Legal / Privacy
Privacy.
Koheriant Verify is provided by Bureau St. James, LLC, a Wyoming limited liability company, registered at 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801, United States; the rest of our details are on the company information page. This notice covers Verify, koheriant.com and the Koheriant workspace at app.koheriant.com through which Verify is bought. It says what we do with personal data, and in which role. For almost everything in a client’s file we are not the one deciding: the firm is.
If you filled in a firm's form
The firm that sent you the link is the controller of your data, and we process it only on that firm’s instructions under a written data processing agreement. We do not use it for anything of our own. The firm’s own privacy notice, which says why it is asking and on what legal basis, is linked from the form. To exercise your rights (access, correction, deletion, objection, restriction, portability), contact the firm; if you write to us instead, we pass your request on to them and tell you we have.
Where your file is kept, and for how long
In the European Union: on Amazon Web Services in Ireland, and nowhere else. Emails about your file are sent through a provider in the European Union: Scaleway in Paris or Amazon’s email service in Ireland. Where the firm has switched on sanctions and politically-exposed-person screening, the name being checked goes to a provider in Germany, with your date of birth and nationality where you gave them, and nothing else about you does: no document, address or contact detail. Verify does not collect copies of passports or identity cards, and does not ask for special-category data. Your file is destroyed at the end of the period the firm’s law requires it to be kept (five years after the end of the relationship under the Dutch Wwft, for example), and the destruction removes the documents and the records, and the copies behind them age out within a month. A form you started and never finished is deleted thirty days after its link expires.
Nothing here is decided by a machine
Verify makes no automated decision about anybody and does no profiling. When a name is checked against sanctions and politically-exposed-person data, what comes back is a list of possible matches from a third-party provider, and a person at the firm decides what it means. Verify records that they decided, and when. It never produces a verdict of its own. The check we run on a firm that signs up, below, works the same way: a possible match, or a check that could not run, holds the workspace until a person here has looked at it, and the decision is that person’s, not the screen’s.
If you work at a firm that uses Verify
We are the controller for this part. We receive your name and email from your Koheriant workspace when you open Verify, and use them to sign you in and to record who did what in each file. The legal basis is our legitimate interest in running the service securely and in keeping an audit trail your firm is required to have. A cookie keeps you signed in for the session and is used for nothing else. We keep your account while your firm subscribes; the audit entries belong to the client file and are destroyed with it.
If you sign your firm up
We are the controller for this part. To open a Koheriant workspace for Verify we ask for your name, your email address and a password, which we store only as a hash, and for your firm’s registered name, its country of registration and registration number (the KvK number in the Netherlands), its VAT number if it has one, and the name of the person accepting the terms for the firm. We use them to open and run the workspace, to bill the firm, and to record who accepted the terms and the data processing agreement, and when. The legal basis is the performance of our contract with the firm. Before the workspace can be paid for, the firm’s registered name and country and the signatory’s name are checked against sanctions and politically-exposed-person data by the provider Verify uses, OpenSanctions in Germany; nothing else about you is sent to it. The legal basis is our legitimate interest in not providing a service to a sanctioned person or company. The answer is kept with the workspace record. These records are held in the United States, as the section on leaving the EEA says, for as long as the firm has a workspace. When the subscription ends, the firm’s records are deleted with the workspace after the 30 days in which it can export its data. Your own sign-in stays, because a person can belong to more than one firm; write to us and we will close it.
Billing
Your firm’s subscription is billed through Stripe, which receives the firm’s billing contact and payment details. The legal basis is the performance of our contract with the firm. Stripe never receives your clients’ data, and neither do we see card numbers.
Leaving the EEA
Your clients’ data is stored and processed in the European Union and stays there. We are a company in the United States, so the people who run and support the service reach it from outside the EEA when they need to, and your firm’s own account records, including what it gave when it signed up, are held by Koheriant in the United States until its EU region is live. Those transfers are governed by the data processing agreement we sign with your firm, which sets out the safeguards and the limits on what we may access. We do not move client files out of the EU.
Who else touches the data
Amazon Web Services, for hosting and for email; Scaleway, for the email that notifies your clients; Stripe, for billing; and OpenSanctions, the sanctions and politically-exposed-person provider a screen is sent to. The current list, what each one handles and where, is in the sub-processor schedule in our data processing agreement, and your firm is told at least thirty days before it changes.
Cookies, storage and this website
We use no analytics and no advertising or tracking cookies, on this site, on koheriant.com or in the workspace. The typefaces are served from our own servers, so your browser does not contact Google to display a page. What we do store in your browser is listed below; each item is there only to do something you asked for, such as staying signed in or keeping a form you have started, which is why we do not ask for consent to it. Maps in the workspace are drawn by Mapbox, in the United States: when a page with a map opens, your browser fetches the map from Mapbox, which receives your IP address and browser details and keeps the identifier listed below. Payment happens on Stripe’s own checkout page, which sets its own cookies under Stripe’s privacy notice. If you write to us, we use your message and address to reply, on the basis of our legitimate interest in answering you, and we keep it no longer than dealing with what you wrote about requires.
| Name | Where | What it does | How long |
|---|---|---|---|
| verify_staff | Cookie, verify.koheriant.com | Keeps a member of a firm’s staff signed in to Verify. | 12 hours, or until you sign out |
| verify_console | Cookie, verify.koheriant.com | Keeps our own team signed in to Verify’s console. | 8 hours, or until sign-out |
| cdd_draft_v1 | Local storage, verify.koheriant.com | Saves the answers to a form you have started on this device, so they are not lost if the page closes. Uploaded files are never saved. Removed when you submit. | Until you submit or clear it |
| cdd_confirmation | Session storage, verify.koheriant.com | Carries your submission’s reference to the confirmation page. | Until the tab closes |
| cdd-cookie-consent | Local storage, verify.koheriant.com | Remembers that you closed the cookie notice on a firm’s form. | Until you clear it |
| koheriant.verify.theme, koheriant.verify.staff-theme | Local storage, verify.koheriant.com | Remembers light or dark, if you chose one. | Until you clear it |
| koh_session | Cookie, koheriant.com and its subdomains | Keeps you signed in to your workspace. | 30 days, or until you sign out |
| koh_workspace | Cookie, app.koheriant.com | Remembers which workspace you were in, if you belong to more than one. | 1 year |
| koheriant.theme, koheriant.nav, koh-tour-* | Local storage, app.koheriant.com | Remembers light or dark, a collapsed menu, and which guided tours you have seen. | Until you clear it |
| mapbox.eventData | Local storage, app.koheriant.com, set by Mapbox | An identifier Mapbox uses to count map loads. Only on workspace pages with a map; Mapbox’s performance reporting is switched off. | Until you clear it |
Your rights, and who to complain to
Where we are the controller you may ask for access to, correction or deletion of your personal data, object to its use, ask us to restrict it, or ask for a copy of it. Where we are a firm’s processor those requests go to the firm, and we help the firm answer them. No data protection officer is appointed; write to us and it reaches the person responsible. You may also complain to a data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.