1. Introduction

This Privacy Policy explains how KYCProtect, operated by Novalis Solutions AB, registration number 559562-1912, with its registered office in Stockholm, Sweden ("KYCProtect", "we", "us", or "our"), collects, uses, stores, and protects personal data.

KYCProtect is a cloud-based compliance platform designed to support Anti-Money Laundering (AML) and Know Your Customer (KYC) processes for businesses operating in the art and luxury market and other regulated sectors.

We are committed to protecting personal data and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

2. Who This Policy Applies To

This Privacy Policy applies to:

visitors to the KYCProtect website at https://kycprotect.com/;
users of the KYCProtect platform;
representatives, employees, and authorised users of our business customers; and
individuals whose personal data is processed through the Services for AML and KYC purposes.

3. Roles and Responsibilities (Controller and Processor)

Depending on the context:

KYCProtect acts as a data controller for personal data relating to website visitors, prospective customers, and account administration.
KYCProtect acts as a data processor when processing personal data on behalf of its customers in connection with AML and KYC activities carried out through the Services.

Our customers are the data controllers for personal data processed through the Services for their own compliance purposes.

The specific terms governing our role as a data processor are set out in our Data Processing Agreement.

4. How We Collect Personal Data

We collect personal data through the following methods:

Direct interactions: data provided directly by our clients or their customers, including information entered into the platform and uploaded CDD documentation;
Automated technologies: technical data collected through website cookies on https://kycprotect.com/, as well as security logs, audit logs, and analytics generated through use of the Services; and
Third parties: data received from third-party service providers such as identity verification providers, screening partners, and payment processors.

5. Categories of Personal Data We Process

The categories of personal data processed through the Services may include:

identification data such as name, date of birth, nationality, and gender;
government-issued photo identification documents;
proof of address documentation;
contact details such as email address, telephone number, and business address;
financial and billing information;
AML screening data, including politically exposed person (PEP) status and beneficial ownership (UBO) details;
technical data such as IP address, device identifiers, and system logs.

Some processing may involve special categories of personal data, for example biometric data contained in identity documents or political exposure information inferred through PEP screening, where required for AML and KYC purposes.

6. Purposes of Processing and Lawful Bases

The following outlines how and why personal data is processed, and the applicable lawful bases under the GDPR:

AML customer due diligence (CDD) and KYC checks: identification documents, proofs of address, date of birth, PEP status, and UBO data are processed to comply with applicable AML laws (legal obligation);
Identity verification via third-party partners: identity document images, metadata, and verification results are processed to meet AML requirements (legal obligation);
Platform account creation and access management: name, email address, login credentials, user role, and access logs are processed to provide the Services (performance of a contract) and to maintain platform security (legitimate interests);
Billing and payments: contact details, subscription data, and payment records are processed to administer subscriptions and meet accounting and tax requirements (performance of a contract and legal obligation);
Customer support and service communications: contact details and support interactions are processed to ensure continuity of service (performance of a contract and legitimate interests);
Security monitoring and fraud prevention: technical logs and IP addresses are processed to protect the integrity and security of the Services (legitimate interests);
Analytics and service improvement: usage data and error reports are processed to improve platform performance and functionality (legitimate interests);
Regulatory or law enforcement requests: relevant personal data may be processed or disclosed where required to comply with applicable laws (legal obligation);
Marketing to business contacts: business contact details may be processed to promote our Services (legitimate interests or consent, where required by law).

7. Use of Third-Party Service Providers

KYCProtect uses carefully selected third-party service providers to deliver essential parts of the Services. These include:

Identity Verification Providers: To perform document authenticity and biometric checks;
Screening Providers: To check sanctions lists, politically exposed persons (PEPs), and adverse media;
Infrastructure Providers: For secure cloud hosting and database management.

All third-party providers are subject to due diligence and are contractually required to process personal data only in accordance with our instructions and applicable data protection laws. We select partners who demonstrate clear commitments to data security and privacy by design.

8. Cookies and Similar Technologies

Cookies are used only on https://kycprotect.com/, our marketing and information website. Cookies on this website support site functionality, analytics, and marketing activities where consent has been provided. You can manage cookies through your browser settings or via the cookie consent tool on our website.

No cookies are used within the KYCProtect compliance platform. The platform uses only strictly necessary technical session identifiers, such as authentication tokens, to enable secure login and operation. These identifiers are essential to the functioning of the Services and are not used for marketing, analytics, or tracking.

9. Accuracy of Personal Data

It is important that the personal data we process is accurate and up to date. Our customers and their users are responsible for ensuring that information provided through the Services is correct and for notifying us of any changes.

10. Data Retention and Lifecycle Management

KYCProtect applies a structured data lifecycle management approach, balancing legal retention obligations with data minimisation principles.

Customer due diligence and KYC-related personal data is retained in accordance with applicable AML legislation, typically for five (5) years following the end of an occasional transaction or business relationship. Where specific regulatory requirements mandate a different retention period, those requirements take precedence.

During an active subscription, such data is stored securely on behalf of our customers in accordance with the security measures described in this Policy. Upon termination of a subscription, data will be made available to the customer for retrieval within a reasonable period, after which it will be securely deleted from our systems, subject to any applicable legal retention obligations.

Data that is no longer necessary for the purposes for which it was collected is deleted or anonymised in a controlled and secure manner. Audit logs and security-related metadata may be retained separately and for a shorter period, limited to what is required for compliance and legitimate security purposes.

11. International Data Transfers

Personal data may be transferred to, or processed in, countries outside the European Union or European Economic Area where required for the provision of the Services.

Where such transfers occur, KYCProtect ensures appropriate safeguards are in place, such as the use of EU Standard Contractual Clauses or other lawful transfer mechanisms.

12. Data Sharing and Sub-Processors

We use trusted third-party service providers (sub-processors) to support the Services, including:

Cloud hosting and infrastructure partners;
Payment and billing processors;
Specialist identity verification and AML screening partners;
Customer support and secure communication tools.

These service providers are subject to strict contractual obligations to protect your data. Our current list of sub-processors and data processing terms are detailed in our Data Processing Agreement.

13. Data Security

KYCProtect is engineered with a robust, multi-layered security architecture designed to safeguard personal data throughout its lifecycle — from collection and processing through to secure deletion. Our infrastructure is designed in accordance with the principles of privacy by design and by default, and we continuously monitor advances in privacy-enhancing technologies and regulatory expectations to evolve our practices accordingly. Key measures include:

Encryption in transit and at rest: all data exchanged with or stored within the platform is protected using strong, industry-standard cryptographic protocols, ensuring confidentiality and integrity at every stage;
Multi-tenant data isolation via Row-Level Security (RLS): database-level Row-Level Security policies enforce strict logical segregation between customer accounts, ensuring that each organisation's data is accessible only to authorised users within their own team — regardless of the underlying shared infrastructure;
Role-based access controls: granular permission systems restrict access to personal data based on the user's assigned role, enforced at both application and infrastructure layers, minimising the risk of unauthorised internal access;
Secure document handling: identity documents and other sensitive files uploaded to the platform are stored in secure, private object storage. Access is provided exclusively through time-limited, cryptographically signed URLs, preventing direct or persistent public access to stored files;
Secure processing of verified attributes: our compliance workflows are designed to prioritise the validation of necessary identity attributes while minimising the exposure and retention of raw personal data where operationally feasible, enhancing privacy protection throughout the verification process;
Dynamic data minimisation and purpose-limited retention: the platform is designed to collect and retain only the personal data necessary for each specific compliance purpose. Data that is no longer required is subject to secure deletion or anonymisation in a controlled manner, consistent with applicable legal obligations;
Audit logging and monitoring: all material actions within the platform are recorded in immutable audit logs, enabling full traceability of data access and modifications for compliance and incident response purposes; and
Trusted third-party verification partners: Where identity verification or screening services are provided through integrated partners, we select providers who demonstrate high standards of data security and may employ advanced privacy-enhancing technologies to validate identity attributes without unnecessary data exposure.

KYCProtect is committed to maintaining and continuously improving its security posture in response to evolving threats and regulatory developments. While no system can guarantee absolute security, we take a proactive approach to risk management and incident response. Further details regarding our security practices are available upon reasonable request.

14. Individual Rights

Where applicable under GDPR, individuals have the right to:

access their personal data;
request rectification or erasure;
restrict or object to processing;
request data portability;
withdraw consent (where processing is based on consent);
lodge a complaint with a supervisory authority.

Requests relating to personal data processed through the Services should generally be directed to the relevant customer acting as data controller.

15. Changes to This Privacy Policy

15.1. KYCProtect reserves the right to update this Privacy Policy from time to time to reflect changes in the Services, applicable law, or regulatory requirements.

15.2. We will notify you of any material changes by posting the updated Privacy Policy on our website or via email at least thirty (30) days before the changes take effect.

15.3. Your continued use of the Services after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree to the changes, your sole remedy is to terminate your use of the Services prior to the effective date.

15.4. The current version of this Privacy Policy will always be available on our website at https://kycprotect.com/ and within the platform.

16. Contact Information

If you have questions about this Privacy Policy or our data protection practices, please contact:

Email: info@kycprotect.com
Website: https://kycprotect.com/

End of Privacy Policy

Privacy Policy