Legal / Data processing
Data processing agreement.
This is the data processing agreement (verwerkersovereenkomst) between the firm that subscribes to Koheriant Verify (“you”, the controller) and Bureau St. James, LLC, a Wyoming limited liability company (“we”, the processor). It sets out how we process your clients’ personal data for you, as Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) requires.
How this agreement applies
This agreement forms part of our terms of service and takes effect when you subscribe. Where it differs from the terms on a data protection question, this agreement prevails. Words such as personal data, processing, controller, processor, data subject and personal data breach mean what they mean in the GDPR. If your firm needs a signed copy for its own records, write to us and we will sign one in these words.
Subject matter and duration
We process personal data to provide Verify to you. We do so for as long as your subscription runs, and afterwards only for the 30 days in which you can export your data and until it is deleted as section 14 sets out.
Nature and purpose
The purpose is the client due diligence your firm carries out under its anti-money-laundering law, such as the Wwft in the Netherlands and, from 10 July 2027, Regulation (EU) 2024/1624. You decide that purpose and how the data is used for it. The processing we carry out is: hosting the form your client completes; receiving and storing the answers and the documents uploaded; producing a PDF record of the submission; sending your firm’s emails to your clients and staff; where screening is switched on, sending names to the screening provider and recording what it returns; presenting the file to your staff for review and recording their decision; sending reminders; keeping each file for the period you set and then destroying it; and producing exports when you ask for them. We do not use the data for any purpose of our own. We do not sell it, use it for advertising or analytics, or combine it with any other firm’s data.
Whose data
Your clients and prospective clients; where the client is a company, partnership, fund or other entity, its ultimate beneficial owners, directors, authorised signatories, senior managing officials and contact persons; and the members of your own staff whose names appear in the record of who did what in each file.
What data
The data Verify’s form collects and the data your staff add to a file: names, positions, email addresses and telephone numbers of the contact person and the authorised signatory, and the basis of the signatory’s authority; the client’s legal name, trading name, legal form, registration and VAT numbers, registered and operational addresses, country, business sector and website; for each beneficial owner, their name, date of birth, nationality, country of residence, nature of control and ownership percentage; answers on whether the client, a beneficial owner or a family member is a politically exposed person, is subject to sanctions or is under investigation, and any detail given; the transaction (property, city, country, role, service, value and completion date); the purpose of the relationship and the source of funds; the documents your client uploads, such as company register extracts, documents showing authority, ownership charts and stock exchange confirmations; the declaration (place, date, name, position and typed signature); the IP address and browser user agent recorded at submission; the results the screening provider returns; and your staff’s review (risk level, checks performed, outcome, notes, reviewer and date). Verify has no place for copies of passports or identity cards and does not ask for them, and it does not ask for special category data under Article 9. Data relating to criminal offences under Article 10 arises only as the answers on sanctions and investigations your law requires you to ask for.
Your instructions
We process the data only on your documented instructions. Those instructions are the terms, this agreement, and what your staff do in Verify: sending a link, recording a decision, setting a retention period, asking for an export. That includes any transfer of the data outside the European Economic Area. If European Union or Member State law requires us to process the data in any other way, we will tell you before we do, unless that law forbids it. If we think an instruction breaks the GDPR or other data protection law, we will tell you straight away.
Confidentiality
Everyone at Bureau St. James, LLC who can reach your data is bound by a duty of confidentiality, and reaches it only to operate and support Verify. Our support does not read or review your client files.
Security
We take the measures Article 32 requires, and these are the ones built into Verify. The data is stored and processed on Amazon Web Services in Ireland (eu-west-1) and nowhere else. Every record carries its firm, every query is limited to the firm making it, and the database enforces the same separation itself with row-level security, so one firm cannot read or write another’s data. Documents are kept under a separate prefix for each firm. Data is encrypted in transit with TLS 1.2 or 1.3, and at rest: documents under an encryption key used for nothing else and rotated automatically, and the database under a key that stays in the EU region. Each member of your staff signs in with an account of their own, which your firm invites them to, either from Koheriant with a single-use ticket that expires after one minute or with their own password, stored only as a scrypt hash; there are no shared accounts. A client reaches only their own file, through a link carrying 128 bits of randomness, of which we store only a hash. Every change to a filed record is written to an audit log the application cannot alter. Files are destroyed automatically at the end of the retention period, with the audit log’s copies of them. We review these measures as Verify changes and will not reduce the overall level of protection they give.
Sub-processors
You give us general written authorisation to engage the sub-processors listed below. We will tell you by email at least 30 days before we add or replace one. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may end your subscription before the change takes effect. Each sub-processor is bound by a written contract with data protection obligations that give the same protection as this agreement, and we remain responsible to you for what they do. One email service carries your firm’s email at a time; both are listed because either can be the one in use.
| Sub-processor | What it does | Data it handles | Where |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting: application servers, database, document storage, encryption keys and logs. Amazon SES may also send your firm’s emails. | All the data in Verify, encrypted at rest. For email, the recipient, the message and its attachments. | Ireland (eu-west-1) |
| Scaleway SAS | Sending your firm’s emails to your clients and staff. | The recipient, the message and its attachments, such as the PDF record on a submission notice. | Paris, France |
| OpenSanctions Datenbanken GmbH | Sanctions and politically exposed person screening, where screening is switched on. | Names sent for matching: a person’s name and, where given, date of birth and nationality; a company’s name and country. No documents, addresses, contact details or source of funds. | Germany; hosted in the EU (Frankfurt) |
| Stripe, Inc. | Billing your firm for its subscription. | Your firm’s billing contact and payment details only. Never your clients’ data. For this we are the controller, not your processor; it is listed so the whole list is in one place. | United States |
Transfers outside the EEA
Your clients’ data is stored and processed in the European Union and we do not move client files out of it. We are established in the United States, and our people reach the production environment from there to operate and support Verify. That remote access is a transfer, wherever the data is stored. For it, you and we agree the standard contractual clauses adopted by the European Commission on 4 June 2021 (Implementing Decision (EU) 2021/914), Module Two (controller to processor), with you as data exporter and us as data importer. They are incorporated into this agreement by reference, with these choices: the optional clause 7 is not used; under clause 9, option 2 applies, with the 30 days’ notice in section 9 above; the optional wording in clause 11 is not used; the supervisory authority under clause 13 is the one for the Member State where your firm is established; and under clauses 17 and 18 the clauses are governed by the law, and disputes go to the courts, of that Member State. Annex I is completed by sections 1 to 5 of this agreement, Annex II by section 8, and Annex III by the list in section 9. Where the clauses and this agreement conflict, the clauses prevail.
Your clients' rights
Verify lets you answer your clients’ requests yourself: you can export everything held about a client, correct a record, and the file is destroyed at the end of its retention period. If a data subject writes to us instead of to you, we pass the request to you without undue delay, tell them we have, and do not answer it ourselves. Where you need more from us to answer a request, we will help, as far as the nature of the processing allows.
Helping you meet your own obligations
We will help you meet your obligations under Articles 32 to 36 of the GDPR: security, notifying a breach to your supervisory authority and to your clients, data protection impact assessments, and prior consultation with your supervisory authority. We do that by giving you the information we hold about how Verify processes the data, including this agreement and the measures in section 8.
Personal data breaches
If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and we aim to do so within 24 hours. We write to your firm’s administrator. We will tell you what happened, the categories and approximate number of people and records concerned, the likely consequences, what we have done and propose to do about it, and who to contact; where we do not yet know everything, we will tell you what we know and send the rest as we learn it. Deciding whether to notify your supervisory authority or your clients is yours, and we do not notify them on your behalf unless you ask us to or the law requires it.
At the end
When your subscription ends you can export your data for 30 days, which is how we return it to you. After that we delete it, unless European Union or Member State law requires us to keep it. Our backups age out on their own: database backups are kept for 14 days and earlier versions of documents for 30, so nothing deleted on a given day exists anywhere 31 days later. On request we will confirm the deletion in writing. Your law may require you to keep your due diligence records for longer than your subscription (five years under Article 77 of Regulation (EU) 2024/1624, and under Article 33 of the Wwft); keeping them is your responsibility, so export them before access ends.
Audits and information
We will make available to you the information you need to show that we meet Article 28, including this agreement, our record of processing and a description of our security measures. We will allow audits, including inspections, by you or by an auditor you appoint who is bound by confidentiality. You give us at least 30 days’ written notice; an audit takes place in business hours, avoids disrupting the service and other firms’ data, and happens no more than once in any twelve months, unless it follows a personal data breach or your supervisory authority asks for it. Each of us bears its own costs.
Our representative in the EU
We are established outside the European Union, so Article 27 of the GDPR requires us to appoint a representative within it. Their name and address are published in our privacy notice when the appointment takes effect, and we will tell you when it does.
Liability and changes
The limit of liability in the terms applies to this agreement as far as the law allows. Nothing in it limits your clients’ rights under the GDPR or either party’s liability under the standard contractual clauses. If we change this agreement, we will email you before the change takes effect, and at least 30 days before any change to the sub-processors. If you do not accept a change, you can end your subscription before it takes effect.