SafetyNet privacy policy

This policy explains what personal data Domus Semo Sancus Ltd collects through the SafetyNet platform and the safetynet.ai website, why we hold it, who we share it with, and the rights you have over it.

1. About this policy

1.1 Domus Semo Sancus Ltd (“DSS”, “we”, “us”, “our”) is a Turks & Caicos Islands limited liability company with its registered address at 23 Parade Avenue, P.O. Box 257, Town Centre Building, Providenciales, Turks and Caicos Islands, TKCA 1ZZ. DSS develops and operates SafetyNet, a screening and due diligence platform used by organisations to carry out background checks.

1.2 This policy applies to the safetynet.ai website, to the SafetyNet platform and its API, and to enquiries you send us. It sits alongside our Terms and Conditions, which govern use of the platform itself.

1.3 Terms given a defined meaning in the Terms and Conditions — including Customer, End-User, Data Subject, Applicant Data, Report and Usage Data — carry the same meaning here.

2. Two different roles

2.1 The single most important thing to understand about this policy is that we handle two kinds of personal data in two different capacities, and your rights differ depending on which one applies to you.

2.2 Where we are the controller. For the personal data of the people who deal with us directly — Customer account holders, End-Users, website visitors and people who send us enquiries — we decide why and how that data is processed. Sections 3 to 10 of this policy describe that processing, and you can exercise your rights with us directly.

2.3 Where we are the processor. When a Customer submits Data to be searched and generates a Report, the Customer decides who is screened and why. We process that data on the Customer’s instructions, under the Terms and Conditions. In that relationship the Customer is the controller and we are the processor.

If you have been screened and want to know why, ask for a copy of the Report, or want a record corrected, please contact the organisation that carried out the check. They hold the record of who was searched and on what basis. We can pass a request on to them, but we cannot answer for them, and in most cases we cannot identify you from our records without their help.

3. Personal data we collect

3.1 Account data. Name, business email address, employer, job title, telephone number, login credentials and billing contact details for Customers and their End-Users, together with the details submitted on the Registration Form.

3.2 Data to be searched. The identifying details a Customer submits about a Data Subject — typically name, and where provided, date of birth, nationality, country and similar identifiers — along with any notes, comments and selections an End-User makes within the platform.

3.3 Report data. The information returned by a search, drawn from the sanctions, PEP and watchlist sources the platform screens against and, for enhanced searches, from openly available internet sources.

3.4 Usage data. Records of how the platform is used: log entries, IP address, browser and device information, timestamps, and which features are used. As set out in the Terms and Conditions, Usage Data does not include Applicant Data.

3.5 Website and enquiry data. Anything you send us through a contact or demo request form, and the information your browser provides when you visit safetynet.ai.

3.6 We do not ask website visitors to give us special category data. Screening will, by its nature, surface information that is sensitive in some jurisdictions — for example information relating to criminal allegations or political exposure. Where that happens it is processing carried out for, and on the instructions of, a Customer under section 2.3.

4. Why we process it

4.1 To provide the platform. Creating and maintaining accounts, running searches, producing Reports and providing support. Where you are a Customer this is necessary to perform our contract with you.

4.2 To bill and administer accounts. Invoicing, collecting payment and keeping our own business records.

4.3 To keep the platform secure and used properly. Monitoring for misuse, investigating suspected breaches of the Terms and Conditions, and carrying out the audits those terms provide for. We rely on our legitimate interest in protecting the platform, our Customers and the people whose data is searched.

4.4 To improve the platform. Understanding which features are used and where they fail, using Usage Data. We rely on our legitimate interest in developing the service.

4.5 To meet our own legal obligations. Including responding to lawful requests from authorities and retaining records we are required to keep.

4.6 To send you marketing. Only where you have asked to hear from us. You can withdraw consent at any time using the unsubscribe link in any message, or by contacting us at the address in section 12.

4.7 Where we act as processor under section 2.3, the lawful basis for screening a Data Subject is the Customer’s to determine, document and be able to justify. The Terms and Conditions require the Customer to certify that every search is made for a permissible purpose.

5. Who we share it with

5.1 Service providers. Hosting, infrastructure, communications and support providers who process data on our behalf under written terms that restrict what they may do with it. [DSS to confirm: whether a sub-processor list is published, and where]

5.2 Data source providers. The providers of the sanctions, PEP and watchlist data the platform screens against.

5.3 Professional advisers. Auditors, lawyers, accountants and insurers, where they need the information to advise us.

5.4 Authorities. Where we are required to disclose by law, court order or a lawful request from a regulator or law enforcement agency.

5.5 A buyer or successor. If DSS is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to the protections in this policy.

5.6 We do not sell personal data, and we do not share it with third parties for their own marketing.

6. International transfers

6.1 DSS is established in the Turks and Caicos Islands. The platform operates across multiple jurisdictions and personal data may be stored or processed outside the country you are in. [DSS to confirm: hosting regions, and the countries where support is provided from]

6.2 Where personal data protected by the UK or EU data protection regimes is transferred to a country without an adequacy decision, we put appropriate safeguards in place — ordinarily standard contractual clauses or the UK International Data Transfer Agreement. [DSS to confirm: which transfer mechanism is in use]

7. How long we keep it

7.1 Account data. For as long as the account is open, and afterwards for as long as we need it to meet our legal, tax and accounting obligations. [DSS to confirm: post-closure retention period]

7.2 Data to be searched and Reports. Retention is governed by the Terms and Conditions, which require each Customer to keep Reports for no longer than the maximum period allowed under the applicable data protection regime and to destroy them when they are no longer needed. [DSS to confirm: platform-side retention period for search records and Reports]

7.3 Usage and log data. [DSS to confirm: log retention period]

7.4 Website enquiries. [DSS to confirm: retention period for enquiry and demo-request records]

8. Security

8.1 We maintain technical and organisational measures appropriate to the risk, including access controls, encryption of data in transit, separation of duties and logging of access to the platform.

8.2 Security is shared. Addendum A to the Terms and Conditions sets out the access controls every Customer agrees to operate — protecting credentials, restricting access to personnel who need it, and securing and destroying Reports once they are no longer required. Most risk to Report data arises after it leaves the platform.

8.3 No system can be made perfectly secure, and the Terms and Conditions record that internet communications carry inherent insecurities. If a breach occurs that is likely to result in a risk to people’s rights, we will notify the relevant supervisory authority and, where required, the people affected, without undue delay. Where we act as processor we will notify the Customer so that they can meet their own obligations. [DSS to confirm: breach notification timeframe committed to in customer contracts]

9. Your rights

9.1 Depending on where you are and which data protection regime applies, you may have the right to ask for a copy of the personal data we hold about you, to have inaccurate data corrected, to have data erased, to restrict or object to how it is processed, to receive it in a portable form, and to withdraw consent you have given.

9.2 To exercise any of these rights over data we hold as controller, contact us using the details in section 12. We will ask for enough information to confirm your identity, and will respond within the period the applicable law requires.

9.3 If your request concerns a background check that was carried out on you, please read section 2.3 first. We will forward the request to the Customer concerned and support them in answering it, but the decision is theirs to make.

9.4 You will not be charged for making a request, unless it is manifestly unfounded or excessive.

9.5 If you are unhappy with how we have handled your personal data you can complain to the data protection authority in your country. We would rather hear from you first, so that we have the chance to put it right.

10. Cookies

10.1 The safetynet.ai website uses cookies and similar technologies to keep the site working, remember your preferences and understand how the site is used. [DSS to confirm: cookie inventory — which cookies are set, by whom, what for, and how long they last]

10.2 You can control cookies through your browser settings. Blocking some cookies will affect how parts of the site behave. [DSS to confirm: whether a consent banner is in use, and which categories it covers]

11. Changes to this policy

11.1 We may update this policy as the platform, our practices or the law change. The current version is always published at this address, and the revision dates at the top of the page tell you when it last changed.

11.2 Where a change materially affects how we use personal data we hold about you, we will tell you directly rather than rely on you noticing the update.

12. Contact us

12.1 For any question about this policy, or to exercise a right under section 9, write to us at [DSS to confirm: privacy contact address — a dedicated mailbox is preferable to a general one] or by post to Domus Semo Sancus Ltd, 23 Parade Avenue, P.O. Box 257, Town Centre Building, Providenciales, Turks and Caicos Islands, TKCA 1ZZ. Please mark correspondence for the attention of the Legal Department.

12.2 [DSS to confirm: whether a Data Protection Officer or UK/EU representative has been appointed, and their contact details — this is a requirement in some circumstances]