Privacy policy

Name and contact of the responsible person

Belsignum UG (limited liability)
Zeppelinstraße 73
81669 Munich, Germany

E-mail: helpdesk@pep-screener.com

Contact for data protection questions

If you have any questions about data protection at Belsignum UG, you can contact us by postal mail or e-mail (gdpr@pep-screener.com).

Security and protection of your personal data

We consider it our responsibility to maintain the confidentiality of the personal data you provide to us and to protect it from unauthorized access. Therefore, we apply care and state-of-the-art security standards to ensure maximum protection of your personal data.

As a company under private law, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the regulations of the German Federal Data Protection Act (FDPA). We have taken technical and organizational measures to ensure that the regulations on data protection are observed both by us and by our external service providers.

Lawfulness of processing

The processing of personal data is only lawful if there is a legal basis for the processing. Legal basis for the processing can be according to Article 6 (1) (a)-(f) GDPR in particular:

  • The data subject has given his/her consent to the processing of personal data concerning him/her for one or more specific purposes;
  • the processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the data subject's request;
  • processing is necessary for compliance with a legal obligation to which the controller is subject;
  • the processing is necessary in order to protect the vital interests of the data subject or another natural person;
  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • processing is necessary for the purposes of the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Information about the collection of personal data

In the following, we inform about the collection of personal data when using our website. Personal data are e.g. name, address, e-mail addresses, user behavior.

1. contact 

You have the possibility to contact us via the provided means of communication (e.g. telephone, e-mail, contact form). If you contact us, we store the data provided by you for the purpose of processing and answering your inquiry. The legal basis is Art. 6 (1) (b) and (f) GDPR. Your data will be deleted as soon as your request has been answered and there is no further purpose for storing it. 

2. application - usage, registration and login

Registration is required in order to perform the matching with sanctions lists. As part of the registration process, your organization name and business email address will be collected. In addition, you must assign a password. The legal basis is Art. 6 (1) (b) and (f) GDPR. The login area is protected by the double opt-in procedure. After confirmation in the e-mail, your account will be activated. Within the application, you can voluntarily complete your profile. You can change or remove the information at any time.  

  • Personal data: Salutation/gender, title, first name, last name
  • Information about your organization: name, address, zip code, city, country, state, sales tax number, billing and notification email.

After successful registration, your email (username) and password will be processed at login to verify you.

Within the interface, the following fields exist for data entry: 

  • /person-entities: first name, middle name, last name and gender.
  • /enterprise-entities: name
  • /sanction-entities: only one ID with which a record can be fetched

To improve our API and ensure traceability for our REST API users, we save your queries for 3 months. The data will not be passed on to third parties.

3. collection of personal data when visiting our website

If you only use our website for informational purpose, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 (1) (f) GDPR). The data will be deleted as soon as the purpose for storing the data no longer applies. 

  • IP address
  • Date and time of the request
  • Time zone difference from Greenwich Mean Time (GMT)
  • Content of the request (concrete page)
  • Access status/HTTP status code
  • Data volume transferred in each case
  • Website from which the request comes
  • Browser
  • Operating system and its interface
  • Language and version of the browser software.

4. use of cookies

In addition to the previously mentioned data, cookies are stored on your device when you use our website. Cookies are small text files that are stored on your hard drive associated with the browser you are using and through which certain information flows to the entity that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the Internet offer as a whole more user-friendly and effective.

This website uses the following types of cookies, the scope and functionality of which are explained below:

a) Transient cookies are automatically deleted when you close the browser. These include in particular the session cookies. These store a so-called session ID, with which various requests of your browser can be assigned to the common session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

b) Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. So-called "third party cookies" are cookies that have been set by a third party, consequently not by the actual website you are currently on. We would like to point out that by deactivating cookies you may not be able to use all the functions of this website.

We use cookies to identify you for subsequent visits if you have an account with us. Otherwise, you would have to log in again for each visit. 

The use of our website requires the agreement for those cookies that are absolutely necessary for operation. In addition, you can give us consent to the use of other cookies (e.g. for analysis and marketing purposes). This request is made in each case before the first use of the website and serves as the legal basis for the processing of personal data that is automatically collected by our website (legal basis is Art. 6 (1) (a) GDPR). You can revoke your consent at any time by accessing the Consent Management "Show cookie settings" at the bottom of our website. We inform you directly in our Consent Management about the cookies that can be set by us.

5. use of third parties/data processors

A transfer of your personal data to third parties for purposes other than those listed in this privacy policy does not take place or only after separate information. A commercial sale of your personal data expressly does not take place. 

We will only share your information with third parties if:

  • you have given your express consent to this in accordance with Art. 6 (1) (a) GDPR,
  • the disclosure is necessary in accordance with Art. 6 (1) (f) GDPR for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
  • in the event that a legal obligation exists for the disclosure pursuant to Art. 6 (1) (c) GDPR, as well as
  • this is legally permissible and necessary according to Art. 6 para. 1 p. 1 (b) GDPR for the processing of contractual relationships with you.

To ensure the security of your data, we have concluded data protection contracts with all third parties. With data processors, data processing agreements are concluded in accordance with Art. 28 GDPR. We prefer to select processors within Germany or Europe. If processors are used in third countries, it is checked whether an adequacy decision exists. If this is not the case, the data transfer takes place on the basis of suitable guarantees (e.g. Data Privacy Framework for data transfers to the USA, standard contractual clauses of the EU Commission).

Google Analytics

Processing Company: Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
Privacy policy: https://policies.google.com/privacy?hl
Purpose: This service allows us to measure traffic and engagement on our website and thereby improve the website experience.
Data categories: Cookies, device information, geographic location, browser information, referrer URL, operating system, interaction data, date and time of visit, user behavior, shortened IP address, user ID.
Storage period: The cookies are deleted after two years at the latest.
Country of processing: EU, data transfer to USA cannot be excluded
Legal basis: Art. 6 (a) GDPR

Google Tag Manager

Processing Company: Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
Privacy policy: https://policies.google.com/privacy?hl
Purpose: This is a tag management system. Through Google Tag Manager, tags can be included centrally through a user interface. Tags are small sections of code that can track activity. Script codes from other tools are included via the Google Tag Manager. The Tag Manager allows you to control when a particular tag is triggered.
Data categories: Aggregated tag resolution data
Storage period: The data is deleted as soon as it is no longer required for the purposes of processing.
Country of processing: EU, data transfer to USA cannot be excluded
Legal basis: Art. 6 (f) GDPR

CleverReach

Processing company: CleverReach GmbH & Co. KG, //CRASH Building, Schafjückenweg 2, 26180 Rastede, Germany 
Privacy notice: https://www.cleverreach.com/en-de/privacy-policy/ 
Purpose: Newsletter distribution, email marketing. 
Data categories: E-mail address, surname and first name (if specified) 
Storage period: The data will be deleted upon revocation of consent. 
Country of processing: Germany 
Legal basis: Art. 6 (a) GDPR

Schlund Technologies and mittwald

Processing company: Schlund Technologies GmbH, Johanna-Dachs-Str. 55, 93055 Regensburg; Mittwald CM Service GmbH & Co. KG, Königsberger Strasse 4-6, 32339 Espelkamp
Privacy notice: www.schlundtech.de/datenschutz/, https://www.mittwald.de/datenschutz
Purpose: Hosting of the website, security of the website
Data categories: Log data
Storage period: The data is deleted when the purpose ceases to exist.
Country of processing: Germany
Legal basis: Art. 6 (f) GDPR

AWS and Microsoft

Processing Company: Amazon Web Services EMEAR SARL, Luxembourg, Microsoft Ireland Operations Ltd, Ireland
Privacy notice: aws.amazon.com/privacy/, https://privacy.microsoft.com/en-us/privacystatement
Purpose: Hosting, office application (Microsoft)
Data categories: Master data, contract data
Storage period: The data will be deleted when the purpose ceases to exist/data deletion with deletion request.
Country of processing: Europe
Legal basis: Art. 6 (1) (b) and (f) GDPR

Broadsoft

Processing company: BroadSoft Germany GmbH, Lothringer Straße 56, 50677 Cologne, Germany
Privacy policy: https://www.placetel.com/gb/legal/privacy-policy
Purpose: Cloud telephony, web meetings
Data categories: Business telephone number, business e-mail address, if applicable.
Storage period: The data will be deleted when the purpose ceases to exist/data deletion with deletion request.
Country of processing: Germany
Legal basis: Art. 6 (1) (f) GDPR

weclapp

Processing company: weclapp GmbH, Friedrich-Ebert-Straße 28, 97318 Kitzingen, Germany
Privacy policy: https://www.weclapp.com/en/privacy/
Purpose: ERP and CRM system
Data categories: Master data (customers and suppliers)
Storage period: The data will be deleted when the purpose ceases to exist/data deletion with deletion request.
Country of processing: Germany
Legal basis: Art. 6 (1) (b) and (f) GDPR

6. Newsletter

With your consent, you can subscribe to our newsletter. The newsletter informs you about our current interesting offers. 

For the registration to our newsletter we use the so-called double opt-in procedure. This means that after your registration, we will send you an e-mail to the e-mail address you provided, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store your respective IP addresses used and times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

Mandatory data for sending the newsletter is your business e-mail address. The provision of further, separately marked data is voluntary and will be used to address you personally. After your confirmation, we store your business e-mail address for the purpose of sending the newsletter. The legal basis is Art. 6 (1) (a) GDPR.

You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare the revocation by clicking on the link provided in every newsletter e-mail, by e-mail to helpdesk@pep-screener.com or by sending a message to the contact details given in the imprint.

We would like to point out that we evaluate your user behavior when sending the newsletter. For this evaluation, the emails sent contain so-called web beacons or tracking pixels, which are single-pixel image files that are stored on our website. For the evaluations, we link the data mentioned and the web beacons with your e-mail address and an individual ID. The data is collected exclusively pseudonymously, i.e. the IDs are not linked to your other personal data, a direct personal reference is excluded. You can object to this tracking at any time by clicking on the separate link provided in each e-mail or by informing us via another contact channel. The information is stored for as long as you are subscribed to the newsletter. After unsubscribing, we store the data purely statistically and anonymously.

7. children

Our offer is basically directed at adults. Persons under the age of 18 should not transmit any personal data to us without the consent of their parents or legal guardians.

Rights of the data subject

According to the GDPR, you have various rights with regard to your personal data, which you can assert against us at any time.

  • Information/Access: You may request confirmation as to whether data relating to you is being processed; if so, you may request information on this data and further information on the data processing and a copy of the data, Article 15 GDPR.
  • Correction: You have the right to request without undue delay the rectification of inaccurate personal data and the completion of incomplete personal data, Article 16 GDPR.
  • Data erasure / restriction of processing: You may request that data relating to you be erased without undue delay (Article 17 GDPR) or that processing be restricted (Article 18 GDPR).
  • Data portability: You have the right, under the conditions of Article 20 of the GDPR, to receive the data you have provided and to transfer this data to another controller without hindrance from us.
  • Revocation and objection: You can revoke consent in accordance with Article 7(3) of the GDPR with effect for the future. In addition, you may object to future processing of data relating to you at any time in accordance with Article 21 DSGVO.
  • Complaint and effective judicial remedy: You may lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR. You also have the right to an effective judicial remedy if you consider that your rights under this Regulation have been infringed as a result of the processing of your personal data not in compliance with this Regulation.

Up-to-dateness and change of this privacy policy

Due to the further development of our website or due to changed legal requirements, it may become necessary to change this privacy policy. The current privacy policy can be found on our website. 

Status: August 2023