Privacy Notice
V1.0 · EFFECTIVE 28 AUGUST 2026 · 16 SECTIONS
Effective date: 28 August 2026
KYCK Limited ("KYCK", "we", "us", "our") provides counterparty due diligence software. This notice explains how we handle personal data, what rights you have, and how to contact us.
1.Who we are and which laws apply
KYCK provides Know Your Counterparty (KYC) verification, sanctions, politically exposed person (PEP) and adverse media screening, ultimate beneficial ownership discovery, and a timestamped audit trail of the decisions our clients make.
We are registered in Masdar City Free Zone, Abu Dhabi, United Arab Emirates, under company number MC 14173, with our registered office at Smart Station, First Floor, Incubator Building, Masdar City, Abu Dhabi, United Arab Emirates.
Our processing is governed by the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL"), supervised by the UAE Data Office. Where we offer services to, or process the personal data of, individuals in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation and the UK GDPR may also apply. Where they do, we comply with them, and this notice describes the rights they give you.
Production data for the KYCK platform is hosted in data centres located in the European Union. Section 10 explains what that means in practice.
This notice covers our website at thekyck.com and any page linking to it, our marketing and events, and our dealings with clients, prospects, suppliers and job applicants. Section 6 covers, in outline, the data we handle on our clients' behalf. It does not cover third-party websites we link to.
2.The two roles KYCK plays
This is the most important thing to understand about how we handle data, so we have put it first.
As a controller. When you visit our website, request a demo, subscribe to the KYCK Briefing, contact us, apply for a job, or deal with us as a client contact or supplier, we decide why and how your personal data is processed. Sections 3 to 5 and 7 to 16 apply to you.
As a processor. When a client uses the KYCK platform to screen and onboard counterparties, that client decides what is screened, on what basis, and what happens with the result. The client is the controller; we act on their documented instructions. This covers the counterparties themselves and the individuals connected to them: directors, officers, ultimate beneficial owners, and anyone matched during screening.
If you were screened through KYCK by one of our clients, that client is your first point of contact. They hold the relationship and made the decision. Section 6 explains what we can do, and Section 13 explains how to reach us if you cannot identify or reach the client.
Processing in our processor role is governed by our Data Processing Addendum and each client's agreement with us, rather than by this notice.
3.Personal data we collect as a controller
| Category | Examples |
|---|---|
| Identity and contact data | Name, job title, employer, business email, business telephone, business address |
| Account data | Username, authentication credentials, permissions, activity logs in your KYCK account |
| Commercial data | Contract details, billing and payment information, purchase and renewal history |
| Communications data | Emails, contact and demo request forms, support tickets, meeting and call notes |
| Technical data | IP address, device and browser type, operating system, referring URL, pages viewed, session duration |
| Marketing data | KYCK Briefing subscription status, engagement with our emails and content, event registrations, communication preferences |
| Recruitment data | CV, work history, right-to-work information, interview notes, references |
We do not seek sensitive personal data about website visitors, prospects or client contacts, and we ask that you do not send it to us. If it reaches us incidentally, we delete it unless we have a lawful reason to retain it.
4.Where we get it
- Directly from you: forms, demo bookings, email, subscriptions, events and job applications.
- Automatically: cookies and similar technologies on our website. See Section 12.
- From your employer, where you are a named contact under a client or supplier agreement.
- From public and commercial sources: business networking platforms, company registries and business contact data providers: for business development.
- From referrers and partners who introduce you to us.
5.Why we process it, and our lawful basis
The UAE PDPL and the GDPR are structured differently. Under the PDPL, processing requires the data subject's consent unless a specific statutory exception applies. Under the GDPR, consent is one of six equal bases. Where both laws apply to the same activity, we satisfy each. The table sets out both positions.
| Purpose | Data used | PDPL basis | GDPR basis |
|---|---|---|---|
| Providing, supporting and securing the KYCK platform | Identity and contact, account, technical | Necessary to perform a contract to which the data subject is a party, or to take steps at their request | Contract |
| Administering contracts, invoicing and collecting payment | Identity and contact, commercial | Contract necessity; compliance with a legal obligation | Contract; legal obligation |
| Responding to enquiries, demo requests and support tickets | Identity and contact, communications | Steps taken at the data subject's request with a view to a contract; otherwise consent | Legitimate interests in responding to people who contact us |
| Business development, marketing and the KYCK Briefing | Identity and contact, marketing, technical | Consent | Consent where required; otherwise legitimate interests |
| Understanding and improving website use | Technical, marketing | Consent | Consent |
| Detecting and preventing fraud, misuse and security incidents | Account, technical, communications | Compliance with a legal obligation; protection of the public interest | Legitimate interests; legal obligation |
| Meeting our legal, regulatory, accounting and tax obligations | Identity and contact, commercial, communications | Compliance with a legal obligation | Legal obligation |
| Screening our own clients, suppliers and their representatives against sanctions lists before and during a business relationship | Identity and contact, commercial | Compliance with a legal obligation | Legal obligation |
| Establishing, exercising or defending legal claims | Any relevant data | Necessary to initiate or defend claims or legal proceedings | Legitimate interests; legal obligation |
| Recruitment | Recruitment data | Obligations and rights in the field of employment; steps prior to a contract | Legitimate interests; steps prior to a contract; legal obligation |
Where we rely on consent, you can withdraw it at any time, and withdrawal does not affect processing already carried out. Where we rely on legitimate interests under the GDPR, we have assessed that those interests are not overridden by your rights, and you can ask us for that assessment.
6.Data processed through the platform on behalf of clients
This section is for individuals whose data reaches us because one of our clients screened them, or screened a company they are connected to. We are a processor for this data. The client that ran the screening is the controller.
What is processed. Name, date of birth, nationality, country of residence, role or position, shareholding or ownership percentage, identification and registration numbers, and documents uploaded by the client or the counterparty. This is matched against sanctions designations, watchlists, PEP and relative-or-close-associate records, and adverse media reporting.
Where the screening data comes from. Matching runs against data supplied by third-party providers and public sources, including OpenSanctions, LSEG Data & Analytics, PurpleTRAC and AdverseMe, together with sanctions lists published by authorities including OFAC, HM Treasury, the EU, the UN Security Council, DFAT, SECO, OSFI and MAS, and corporate registry data. We do not compile these datasets and cannot amend a source record. Corrections must be raised with the body that published the record.
The basis for screening you. Screening is carried out because our client is required to do it. Regulated firms must identify and verify the parties they do business with, and must check them against sanctions designations, under anti-money laundering, counter-terrorist financing and sanctions law. That legal obligation, not your consent, is what permits the processing. You were not asked to agree to it and you cannot withdraw agreement to it, because consent is not the basis on which it happens. The obligation belongs to the client that ran the check; we carry out the processing on their instructions.
Sensitive and criminal offence data. PEP screening involves data that may reveal an individual's political exposure. Adverse media screening involves data relating to alleged or actual criminal offences and proceedings. We process this only on our clients' documented instructions, so that they can meet their own anti-money laundering, counter-terrorist financing and sanctions obligations, and we apply access controls, logging and confidentiality measures appropriate to its sensitivity.
A match is not a finding. A screening result records that a name resembles a record in a source dataset. It is not a statement by KYCK that an individual is sanctioned, is a PEP, or has done anything wrong. Match scores are produced by a deterministic, explainable algorithm and are reviewed by the client.
If you were screened. Contact the organisation that screened you. If you cannot identify or reach them, write to us at info@thekyck.com. We will pass your request to the relevant client and support them in responding, and we will tell you what we are able to tell you without breaching our obligations to them.
7.Who we share personal data with
- Service providers and sub-processors: see Section 9.
- Data and screening providers: see Section 6.
- Professional advisers: lawyers, auditors, accountants and insurers, bound by confidentiality.
- Authorities: where we are legally compelled, or where disclosure is necessary to establish or defend legal claims.
- Acquirers: in connection with any actual or proposed merger, acquisition, financing or sale of assets, subject to confidentiality and to the requirements of applicable data protection law.
We do not sell personal data, and we do not share it with advertising networks for cross-context behavioural advertising.
8.Automated processing and AI
Our platform automates name matching against screening datasets and scores the strength of each match. Matching uses a deterministic algorithm that produces a reproducible, explainable score built from named features: strong identifiers such as dates of birth and registration numbers carry more weight than weak aliases or common name fragments. Match thresholds are configured by each client to reflect their own risk appetite.
Decisions are made by our clients, not by KYCK. Approving, rejecting, blocking or escalating a counterparty is a human decision taken by the client, recorded in the audit trail with the reviewer's identity and a timestamp.
Human review. If you are subject to a decision involving automated processing through our platform, you may ask that a person review it. Requests are routed to the client controller responsible for the decision, and we support them in carrying out that review. Contact us at info@thekyck.com if you cannot reach them.
We do not use personal data processed through the platform to train machine learning models.
9.Sub-processors and service providers
The providers below support KYCK's own operations as a controller: our website, marketing, sales and corporate systems.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Microsoft Azure | Platform and website hosting | Account, technical | West Europe (Netherlands), EU |
| Microsoft 365 | Business email, calendar, document storage, support correspondence and the KYCK Briefing | Contact details, correspondence, marketing preferences | Microsoft global cloud |
| KYCK HQ (our own system, operated by KYCK) | Client and prospect relationship management | Identity and contact, commercial | Microsoft Azure, West Europe (Netherlands), EU |
A separate sub-processor list applies to the platform service we provide to clients as a processor. It is maintained under each client's agreement and provided to clients directly, together with notice of changes.
We update this page when a provider listed above is added or replaced, and revise the effective date.
10.Where your data is held, and international transfers
Hosting. Production data for the KYCK platform is stored in data centres located in the European Union, in West Europe (Netherlands), operated by Microsoft Azure.
Access from outside the EU. KYCK is based in Abu Dhabi. Our personnel access data hosted in the EU in order to operate, support, administer and secure the service. That access is a transfer of personal data outside the European Economic Area. The United Arab Emirates is not the subject of a European Commission adequacy decision, so we rely on Standard Contractual Clauses, supported by a transfer risk assessment and by supplementary technical and organisational measures including role-based access control, multi-factor authentication, encryption in transit and at rest, and access logging. Where UK data is involved, we additionally apply the UK International Data Transfer Addendum.
We set this out directly because hosting in the EU and never leaving the EU are different things, and only the first describes our service.
Transfers out of the UAE. Transfers of personal data outside the UAE are made in accordance with Articles 22 and 23 of the PDPL: to countries with an adequate level of protection as determined by the UAE Data Office, or, in the absence of such a determination, under a contract binding the recipient to protections equivalent to those required by the PDPL, or on another basis permitted by that law.
You can ask us for details of the safeguards applying to any specific transfer.
11.How long we keep it
We keep personal data only as long as we need it.
| Data | Retention |
|---|---|
| Client contract and account records | 6 years after the end of the relationship |
| Billing and accounting records | 5 years, as required by UAE tax law |
| Marketing contacts and subscribers | 24 months after last engagement, or until you unsubscribe |
| Website analytics | 26 months |
| Support correspondence | 3 years |
| Unsuccessful job applications | 12 months |
Data processed on behalf of clients is retained according to that client's instructions and their agreement with us, and is deleted or returned at the end of the engagement.
12.Cookies
We use cookies and similar technologies. Non-essential cookies are set only with your consent, which you can change at any time using the cookie settings link on any page. Full details, including the specific cookies we use, are in our Cookie Policy.
We do not currently respond to browser "Do Not Track" signals.
13.Your rights
Subject to the law that applies to you, you may have the right to:
- ask what personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict processing, or ask us to stop processing your data;
- receive data you gave us in a machine-readable, portable format;
- object to processing carried out by automated means, and ask that a person review a decision made that way;
- object to direct marketing at any time; and
- withdraw consent where we rely on it.
These rights are not absolute. They may be limited where the law requires us to retain data, or where meeting the request would affect another person's rights.
How to exercise them. Email info@thekyck.com. We may need to verify your identity before we act. We aim to respond within 30 days, and we will tell you if we need longer.
Requests about platform screening data: see Section 6.
Complaints. Please raise any concern with us first. You may also complain to the UAE Data Office. If you are in the European Economic Area or the United Kingdom, you may instead complain to the supervisory authority in the country where you live or work.
14.Marketing preferences
Every marketing email carries an unsubscribe link, and you can also email info@thekyck.com. We act on opt-out requests without condition. We may still send you service and transactional messages about an account or contract you hold with us.
15.Contact us
KYCK Limited
Smart Station, First Floor, Incubator Building, Masdar City Free Zone, Abu Dhabi, United Arab Emirates
Privacy and general enquiries: info@thekyck.com
16.Changes to this notice
We update this notice when our practices, our services or the law change. The current version always appears on this page with its effective date. Where a change materially affects how we use your personal data, we will take reasonable steps to tell you.