1. Who we are

Aurentis Technologies Limited ("Aurentis", "we", "us", "our") is a company registered in England and Wales. We operate a compliance technology platform at aurentis.co.uk that provides KYC, KYB, sanctions screening, adverse media monitoring and related compliance services to regulated businesses ("the Platform").

We are the data controller for personal data collected through our website and the data processor for personal data processed on behalf of our clients through the Platform.

Contact: hello@aurentis.co.uk

2. Personal data we collect

2.1 Data you provide directly

• Name, job title, company name and work email address when you contact us, book a demo or register an account
• Billing information (processed securely via Stripe; we do not store payment card details)
• Communications you send us via email, contact forms or support channels

2.2 Data collected automatically

• Technical data including IP address, browser type, operating system and referring URL
• Usage data including pages visited, time on site and features used within the Platform
• Cookies and similar tracking technologies (see our Cookie Policy)

2.3 Data processed on behalf of clients (Platform data)

When clients use the Aurentis Platform to screen individuals and entities, they submit personal data relating to their own customers and counterparties ("Subject Data"). We process Subject Data solely as a data processor acting on the documented instructions of our client (the data controller). This is governed by a separate Data Processing Agreement.

3. Legal basis for processing

We rely on the following lawful bases under UK GDPR:

• Contract — processing necessary to perform our contract with you or to take pre-contractual steps at your request
• Legitimate interests — processing necessary for our legitimate interests in operating and improving the Platform, provided those interests are not overridden by your rights
• Legal obligation — processing necessary to comply with our legal obligations, including under the Money Laundering Regulations 2017
• Consent — where we have obtained your specific consent, for example for marketing communications

4. How we use your personal data

• To provide and improve the Aurentis Platform and related services
• To communicate with you about your account, subscription and support requests
• To send you product updates and relevant industry information (with consent, where required)
• To process payments and manage billing
• To comply with legal and regulatory obligations
• To prevent fraud and protect the security of our Platform
• To analyse usage patterns to improve the Platform's functionality and performance

5. Data sharing and third-party processors

We do not sell your personal data. We share data only with:

• Technology sub-processors — cloud infrastructure providers, analytics platforms and security services used to operate the Platform. A full list of sub-processors is available on request.
• Screening data — identity and screening data is processed locally within the Platform. No entity data is transmitted to third-party screening data providers.
• Payment processors — Stripe processes payment card data subject to PCI DSS compliance
• Professional advisers — solicitors, accountants and insurers under confidentiality obligations
• Regulatory authorities — where required by law or court order

Where sub-processors are located outside the UK, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements or equivalent mechanisms.

6. Data retention

We retain personal data for as long as necessary to provide our services and comply with legal obligations. Specific retention periods:

• Account data — retained for the duration of the subscription plus 7 years (to comply with AML record-keeping obligations)
• Compliance screening records — retained for a minimum of 5 years following the end of the business relationship, in accordance with MLR 2017
• Marketing contact data — retained until consent is withdrawn or until 3 years after your last interaction with us
• Technical logs — retained for 90 days

7. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — to receive a copy of the personal data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data in certain circumstances
• Right to restrict processing — to limit how we use your data in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making — we do not make solely automated decisions with legal or significant effects on individuals

To exercise any of these rights, contact us at hello@aurentis.co.uk. We will respond within one calendar month.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration. These include encryption in transit and at rest, access controls, regular security assessments and staff training. Our on-premise deployment option allows clients with strict data residency requirements to host data entirely within their own environment.

9. Cookies

Our website uses strictly necessary cookies to operate the site and, where you consent, analytics cookies to understand how the site is used. You can manage cookie preferences at any time through your browser settings or our cookie consent tool.

10. Complaints

If you have a concern about how we handle your personal data, please contact us first at hello@aurentis.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to this policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by prominent notice on our website. The date of the most recent revision appears at the top of this page.

1. Agreement

These Terms of Service ("Terms") constitute a legally binding agreement between Aurentis Technologies Limited ("Aurentis", "we", "us") and the organisation or individual ("Client", "you") accessing or using the Aurentis compliance platform ("Platform").

By subscribing to the Platform or clicking to accept these Terms, you confirm that you have authority to bind your organisation and that your organisation agrees to these Terms.

2. The Platform

Aurentis provides a cloud-hosted or on-premise compliance technology platform that includes KYC screening, KYB verification, sanctions monitoring, adverse media screening and related compliance workflow tools. The Platform is provided as a software-as-a-service subscription.

We reserve the right to modify, update or discontinue features of the Platform with reasonable notice. We will not materially reduce functionality during a paid subscription term without providing a proportionate refund or credit.

3. Subscriptions and payment

3.1 Subscription tiers

The Platform is available on Screen (£299/month), Investigate (£599/month) and Govern (from £1,999/month) tiers, as described at aurentis.co.uk/pricing. Each tier includes a jurisdiction allowance as described at aurentis.co.uk/pricing. Additional jurisdictions beyond the tier allowance are available at £99/month each.

3.2 Billing

Subscriptions are billed monthly or annually in advance. Annual subscriptions are discounted equivalent to two months free. Payment is processed via Stripe. All prices are exclusive of VAT unless stated otherwise.

3.3 Late payment

If payment is not received within 14 days of the due date, we may suspend access to the Platform until payment is made. We will provide reasonable notice before suspension.

3.4 Price changes

We will provide at least 60 days notice of any price changes. Price changes will take effect at the next renewal date following the notice period.

4. Acceptable use

You agree to use the Platform only for lawful compliance purposes in connection with regulated activities. You must not:

• Use the Platform to screen individuals or entities without a lawful basis for doing so
• Share login credentials with individuals outside your organisation
• Attempt to reverse-engineer, copy or extract the Platform's source code or data
• Use the Platform in a manner that violates any applicable law, including data protection legislation
• Resell or sublicence access to the Platform without our prior written consent
• Upload malicious code or attempt to compromise the Platform's security

5. Data and confidentiality

Each party agrees to keep the other's confidential information strictly confidential and not to disclose it to any third party without prior written consent, except as required by law or regulatory obligation.

The processing of personal data submitted to the Platform is governed by the Data Processing Agreement, which forms part of the agreement between us. Clients remain the data controller for all personal data relating to their customers that they submit to the Platform.

6. Intellectual property

All intellectual property rights in the Platform, including the software, algorithms, user interface and documentation, remain exclusively with Aurentis. These Terms do not transfer any ownership rights to you.

You retain all ownership rights in the data you submit to the Platform. We are granted a limited licence to process that data solely to provide the Platform services.

7. Warranties and disclaimer

We warrant that the Platform will perform materially in accordance with its documentation during your subscription. We will use commercially reasonable efforts to maintain 99.5% uptime excluding scheduled maintenance.

The Platform is a compliance technology tool and does not constitute legal, regulatory or compliance advice. Aurentis does not warrant that use of the Platform will ensure your compliance with any specific regulatory requirement. Compliance decisions remain the responsibility of your qualified personnel.

Screening results are based on data from third-party providers. We do not warrant the completeness or accuracy of third-party data sources.

8. Limitation of liability

To the maximum extent permitted by law, Aurentis's total liability to you in any 12-month period shall not exceed the total fees paid by you to us in that period.

Neither party shall be liable for indirect, consequential, incidental or special damages, including loss of profits or data, even if advised of the possibility of such damages. This limitation does not apply to liability arising from death or personal injury caused by negligence, fraud, or any liability that cannot be limited by law.

9. Term and termination

These Terms commence on the date you first access the Platform and continue until terminated. Either party may terminate on 30 days written notice at the end of a subscription period.

We may terminate or suspend access immediately if you materially breach these Terms and fail to remedy the breach within 14 days of written notice.

On termination, you may export your data from the Platform for 30 days. After this period, data will be deleted in accordance with our retention policy.

10. Governing law

These Terms are governed by the laws of England and Wales. Any disputes arising under or in connection with these Terms shall be subject to the exclusive jurisdiction of the courts of England and Wales.

11. General

If any provision of these Terms is found to be unenforceable, the remaining provisions will continue in full force. Our failure to enforce any right under these Terms does not constitute a waiver of that right. These Terms, together with the Data Processing Agreement and any Order Form, constitute the entire agreement between us relating to the Platform.

1. Background and scope

This Data Processing Agreement ("DPA") forms part of the agreement between Aurentis Technologies Limited ("Processor", "Aurentis") and the subscribing client ("Controller") and governs the processing of personal data by Aurentis on behalf of the Controller in connection with the Aurentis compliance platform.

This DPA is required by Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Roles and responsibilities

The Controller is the data controller for all personal data relating to its customers, counterparties and other individuals that it submits to the Platform for screening and compliance purposes ("Subject Data").

Aurentis is the data processor and processes Subject Data solely on the Controller's documented instructions and for no other purpose.

3. Details of processing

3.1 Categories of data subjects

• Individual clients and prospective clients of the Controller
• Beneficial owners, directors and officers of corporate clients
• Counterparties and their representatives
• Politically exposed persons identified through screening

3.2 Categories of personal data

• Identity data: full name, date of birth, nationality, national identification number
• Contact data: address, email, telephone number
• Document data: passport, driving licence and identity document images and data
• Biometric data: facial images and liveness detection data (where biometric verification is used)
• Corporate data: company registration numbers, directorship and ownership information
• Risk data: sanctions match results, adverse media findings, PEP status

3.3 Special category data

The processing may involve special category data including biometric data (for identity verification purposes) and data relating to criminal convictions and offences (through sanctions and adverse media screening). Such processing is carried out only to the extent authorised by the Controller and in accordance with applicable legal bases.

3.4 Purpose and duration

Personal data is processed for the purpose of providing KYC/KYB screening, sanctions monitoring, adverse media screening and related compliance workflow services. Processing continues for the duration of the subscription and for such period thereafter as required to comply with applicable record-keeping obligations.

4. Processor obligations

Aurentis agrees to:

• Process Subject Data only on the Controller's documented instructions, unless required to do so by applicable law
• Ensure that persons authorised to process Subject Data are bound by appropriate confidentiality obligations
• Implement and maintain appropriate technical and organisational security measures in accordance with Article 32 UK GDPR
• Not engage sub-processors without prior written authorisation from the Controller, subject to the sub-processor provisions below
• Assist the Controller in responding to requests from data subjects exercising their rights under UK GDPR
• Assist the Controller in ensuring compliance with Articles 32–36 UK GDPR (security, breach notification, DPIA)
• Delete or return all Subject Data on termination of the agreement, as directed by the Controller
• Make available all information necessary to demonstrate compliance with this DPA and cooperate with audits conducted by the Controller or its appointed auditor

5. Sub-processors

The Controller grants Aurentis general written authorisation to engage the following categories of sub-processors to assist in providing the Platform:

• Cloud infrastructure and hosting providers
• Authentication and identity providers (SaaS mode only)
• Payment processing providers (Stripe)
• Security monitoring and logging providers

A current list of sub-processors is available at aurentis.co.uk/sub-processors and will be updated with at least 14 days prior notice of any changes. The Controller may object to new sub-processors within this notice period.

Aurentis will impose data protection obligations on sub-processors equivalent to those in this DPA and remains liable to the Controller for the performance of sub-processors' obligations.

6. International transfers

Where personal data is transferred to countries outside the UK, Aurentis will ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V. This includes UK International Data Transfer Agreements (IDTAs) or the UK Addendum to the EU Standard Contractual Clauses where applicable.

Controllers with strict data residency requirements may elect to deploy Aurentis on-premise, in which case Subject Data is processed entirely within the Controller's own infrastructure and is not transferred to Aurentis systems.

7. Security measures

Aurentis implements the following technical and organisational measures to protect Subject Data:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 or equivalent
• Role-based access controls with principle of least privilege
• Multi-factor authentication for all administrative access
• Regular penetration testing and vulnerability assessments
• Audit logging of all access to and processing of Subject Data
• Business continuity and disaster recovery procedures
• Staff training on data protection and information security

8. Data breaches

In the event of a personal data breach involving Subject Data, Aurentis will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include, to the extent available: a description of the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences of the breach, and the measures taken or proposed to address the breach.

9. Audit rights

Aurentis will make available all information necessary to demonstrate compliance with this DPA and will cooperate with reasonable audits or inspections conducted by the Controller or an appointed independent auditor, subject to reasonable notice, confidentiality obligations and frequency limitations (no more than once per year unless there is a specific reason to suspect non-compliance).

10. Governing law

This DPA is governed by the laws of England and Wales and is subject to the exclusive jurisdiction of the courts of England and Wales.

11. Contact

For data protection queries: hello@aurentis.co.uk

For data subject requests: hello@aurentis.co.uk