Privacy Policy

This Privacy Policy applies to personal information processed by SanctionsDatabase in connection with:

• Visitors to the SanctionsDatabase website.
• Individuals who submit enquiries, request quotations, or communicate with our team.
• Customers, prospective customers, and their authorised representatives.
• Individuals whose information is included in sanctions, politically exposed persons (PEP), warrants, criminal-entity, or related compliance datasets.
• Individuals who interact with our services, integrations, or business communications.

Different activities may involve different categories of personal information and different legal requirements. Where a separate privacy notice or data-processing agreement applies to a particular activity, that document should be read together with this Policy.

This Policy does not replace any rights or obligations imposed by applicable privacy, data protection, employment, consumer protection, or other laws.

SanctionsDatabase is a data and compliance-information service operated by Prospex Network Private Limited.

For questions about this Privacy Policy or the handling of personal information, you can contact us at enquiry@sanctionsdatabase.com.

Our contact details are:

The Company’s role in relation to personal information may depend on the activity. For example, we may determine the purposes and means of processing information about website visitors and customers. When we compile information from public sources for compliance datasets, our responsibilities depend on the nature of the processing and the applicable law. A Customer using a Dataset for its own screening or compliance decisions may have separate responsibilities for its subsequent use of that information.

The categories of personal information we process depend on how you interact with SanctionsDatabase and the relevant Services.

3.1 Website and technical information

When you visit our Website, technical information may be processed to operate, maintain, secure, and troubleshoot the site. Depending on the website configuration and tools in use, this may include your IP address, browser type, device information, operating system, referring page, pages visited, access timestamps, and diagnostic or security logs.

3.2 Enquiry and business information

If you contact us or request information about our Services, we may process information such as your name, business email address, telephone number, job title, organisation, country, enquiry details, and communications with our team.

3.3 Account and transaction information

Where relevant, we may process Account details, login and authentication records, subscription information, order history, invoices, billing details, payment status, and records needed to administer a purchase or provide customer support.

Payment card or banking details may be handled by a payment provider where one is used. The information processed depends on the payment method and provider.

3.4 Customer communications and support information

We may retain correspondence, support requests, service feedback, records of reported data-quality issues, and information reasonably needed to investigate or resolve a customer enquiry.

3.5 Information in compliance datasets

Depending on the relevant Dataset and available sources, records may contain information about individuals, such as:

• Name and known aliases.
• Publicly available identifying details.
• Nationality or country association, where available.
• Date of birth or age-related details, where published.
• Public office, role, position, or political association relevant to PEP classification.
• Sanctions listing details, issuing authority, designation date, or related identifiers.
• Publicly reported warrant or criminal-entity record details, where included.
• Business affiliations, official positions, ownership relationships, or associated entities, where available.
• Source references and information about the relevant public record.

The actual fields vary by record, jurisdiction, source, and product. Not every Dataset contains all these categories, and we do not guarantee that each record includes every relevant identifier.

Some information may be sensitive or may have significant implications for the individual concerned. We seek to handle such information in accordance with applicable law and the nature of the relevant service.

We may obtain personal information through several channels.

4.1 Directly from you

We may receive information when you complete a form, create an Account, request a quotation, purchase a product, contact our team, submit a support request, or otherwise communicate with us.

4.2 From public and official sources

Compliance datasets may be compiled from publicly accessible or otherwise lawfully accessible sources, including government publications, sanctions authorities, regulatory notices, court records, law-enforcement publications, official registers, and other relevant public records.

The availability, accessibility, and permitted use of information differ between sources and jurisdictions. We consider the nature of the source and the intended purpose of the processing when determining whether information is appropriate for inclusion in a Dataset.

4.3 From business and technical interactions

We may receive information through customer transactions, service usage, technical logs, support interactions, and authorised integrations that are necessary to operate the Services.

4.4 From service providers

Where necessary, service providers may supply or process information on our behalf for functions such as website hosting, communications, payment administration, security, technical support, and business operations.

The specific information obtained depends on the relevant service and the arrangements in place.

We may process personal information for the following purposes, where permitted by applicable law:

• To operate, maintain, and secure the Website and Services.
• To respond to enquiries and provide quotations, product information, and customer support.
• To create and administer Accounts and manage subscriptions or purchases.
• To prepare, maintain, organise, and provide compliance-related datasets.
• To identify and describe relevant public records and make them searchable.
• To investigate reported data-quality issues and assess requests for correction or other action.
• To process payments, maintain business records, and manage contractual obligations.
• To prevent fraud, abuse, unauthorised access, and misuse of the Services.
• To maintain technical performance, diagnose errors, and improve service functionality.
• To comply with legal obligations and respond to lawful requests from competent authorities.
• To establish, exercise, or defend legal claims.
• To communicate material service changes, security notices, and information relevant to an existing customer relationship.
• To send marketing communications where permitted by law and subject to applicable preferences or consent requirements.

We seek to limit processing to purposes that are relevant to the activity and the information involved.

The legal grounds available to us depend on the type of information, the purpose of processing, the applicable jurisdiction, and the law in force at the relevant time.

Where required by applicable law, we may rely on one or more recognised legal grounds, including:

• Consent: Where processing requires consent, we will seek it through an appropriate process. Where applicable, consent may be withdrawn, subject to legal limitations and the consequences explained at the time.
• Contractual necessity: Processing may be necessary to respond to a request made before entering into a contract, provide purchased Services, administer an Account, or fulfil contractual obligations.
• Legal obligations: We may process information where necessary to comply with applicable laws, regulatory requirements, court orders, or lawful requests from competent authorities.
• Legitimate interests or other permitted grounds: Where recognised by applicable law, processing may be necessary for legitimate business purposes, such as maintaining security, preventing misuse, administering the Services, or compiling relevant public-record information for compliance-related purposes. Any such ground is subject to applicable legal requirements and safeguards.

The legal grounds available in one jurisdiction may not be available in another. Where a law prescribes a different legal basis or imposes additional conditions, we will follow the requirements applicable to the processing.

SanctionsDatabase may compile and organise information concerning individuals identified in relevant public records. This may include sanctions designations, PEP status, warrants, criminal-entity records, official positions, aliases, identifiers, and associated public information.

The purpose of such processing is to make relevant records available for lawful compliance research, due diligence, screening, risk assessment, and related business activities.

Inclusion in a Dataset is not, by itself, a finding of criminal conduct, wrongdoing, or current legal restriction. A PEP classification does not establish that an individual has engaged in misconduct. The legal status and significance of a record depend on the underlying source, applicable law, and relevant circumstances.

We may standardise names, organise fields, associate identifiers, identify potential duplicates, or categorise records to support search and review. These processes may involve errors or incomplete matches, particularly where names are common or source identifiers are limited.

Customers must assess whether a record relates to the person or entity they are reviewing and must undertake any further verification required for their own purposes.

We take reasonable steps to maintain useful information in our Services. However, information originating from external sources may be incomplete, inaccurate, delayed, amended, or removed.

If you believe that a record in a SanctionsDatabase Dataset is inaccurate, outdated, incomplete, incorrectly attributed, or otherwise requires review, you may contact enquiry@sanctionsdatabase.com.

To help us assess the request, please provide, where reasonably available:

• The name and identifying details of the individual or entity concerned.
• The relevant Dataset or record reference.
• A description of the suspected error or concern.
• A link to the relevant official source or other supporting documentation.
• Your relationship to the information and any additional details needed to assess the request.

We may ask for reasonable additional information to confirm the record concerned, understand the requested change, or prevent unauthorised disclosure of personal information.

We will review requests in accordance with applicable law and the information available to us. Where appropriate, we may correct or update a record, add relevant context, restrict processing while a matter is assessed, or take another action permitted or required by law.

We may need to retain certain historical or audit information where lawful and necessary. We may also be unable to make a requested change where the information accurately reflects an official record or where retention or disclosure is required by law. In such cases, we will consider what response or other action is appropriate under applicable law.

A request to correct a record in SanctionsDatabase does not itself amend the originating authority’s record. Where the concern relates to the original official record, the relevant authority may need to be contacted separately.

We do not treat personal information as available for unrestricted disclosure. We may disclose information where it is necessary for a stated purpose, permitted by applicable law, or otherwise authorised.

Depending on the circumstances, information may be disclosed to:

• Service providers: Organisations that support website hosting, data storage, communications, security, payment processing, customer support, and other business operations. They may process information on our behalf under applicable contractual or legal requirements.
• Customers and authorised users: Information contained in a purchased Dataset may be provided to the Customer and its authorised users within the scope of the applicable licence and product.
• Professional advisers: Lawyers, accountants, auditors, insurers, and other professional advisers where reasonably necessary for business, legal, financial, or compliance purposes.
• Authorities and legal recipients: Courts, regulators, law-enforcement bodies, government authorities, or other recipients where disclosure is required or permitted by law, or is reasonably necessary to protect legal rights or address security concerns.
• Business transaction participants: Relevant parties and advisers in connection with a proposed or completed merger, acquisition, restructuring, financing, or transfer of business assets, subject to appropriate confidentiality and legal safeguards.
• Other recipients with authorisation: Other parties where you have requested or authorised a disclosure, or where a valid legal basis permits it.

The recipients and information involved will depend on the purpose and circumstances. We do not represent that every category of recipient is involved in every processing activity.

SanctionsDatabase operates from India and may use service providers or technical infrastructure located in other jurisdictions. Information may therefore be processed or accessed outside the country where it was collected, subject to applicable law and the arrangements governing the relevant service.

Where a cross-border transfer is subject to legal restrictions, we will take the steps required by the applicable law before making the transfer.

Depending on the circumstances, safeguards may include contractual requirements, access restrictions, security measures, or other transfer mechanisms recognised by applicable law.

The laws governing personal information may differ between jurisdictions. Individuals may have different rights depending on their location, the nature of the information, and the applicable legal framework.

We retain personal information for as long as reasonably necessary for the purpose for which it was collected or processed, subject to applicable legal requirements.

Retention periods may depend on the type of information, the nature of the relationship, the applicable Order, security requirements, recordkeeping obligations, dispute risks, and legal or regulatory requirements.

For example:

• Enquiry and customer communications may be retained for a period needed to respond to requests, administer the relationship, and maintain appropriate business records.
• Account, transaction, and invoice information may be retained for contract administration, accounting, tax, legal, and dispute-related purposes.
• Technical and security logs may be retained for a period appropriate to operational security, troubleshooting, and incident investigation.
• Compliance dataset records may be retained or updated according to the purpose of the Dataset, the status of the underlying source, legitimate recordkeeping needs, and applicable legal requirements.

We may delete, anonymise, restrict, or otherwise dispose of personal information when it is no longer required, subject to lawful retention obligations and technical limitations.

We do not promise a single fixed retention period for all categories of information because the relevant needs and legal requirements differ.

We seek to apply reasonable technical, organisational, and administrative safeguards designed to protect personal information against unauthorised access, disclosure, alteration, loss, or misuse.

Safeguards may include access controls, authentication measures, restricted permissions, secure transmission or storage practices where appropriate, system monitoring, backup procedures, staff responsibilities, and processes for responding to security incidents.

The specific measures used may vary according to the system, service, type of information, and risk involved.

No website, database, communication channel, or electronic storage system can be guaranteed to be completely secure. We therefore cannot promise that unauthorised access or data loss will never occur.

Customers are responsible for protecting their own Accounts, API credentials, devices, systems, and copies of Data received from the Services.

If we become aware of a personal data incident that triggers a notification obligation under applicable law, we will take the steps required by that law.

The Website may use cookies or similar technologies to support essential functionality, maintain preferences, improve security, understand website performance, or support other website features.

The technologies used, and the information they collect, depend on the Website’s configuration and the tools enabled at the relevant time. We do not claim that every category of cookie or tracking technology is used on every visit.

Where applicable law requires consent for non-essential cookies or similar technologies, we will seek consent through an appropriate mechanism. Depending on your browser or device, you may also be able to manage or block certain cookies through its settings. Blocking some cookies may affect website functionality.

If a cookie notice or preference tool is provided on the Website, it may contain further information about the technologies in use and the available choices.

We may use business contact information to respond to enquiries, provide requested information, administer customer relationships, and send service-related communications.

Where permitted by applicable law, we may also send relevant business or marketing communications about SanctionsDatabase products and services.

Where consent is required, we will obtain it before sending the relevant marketing communications. Where an opt-out right applies, you may use the unsubscribe mechanism provided in the message or contact enquiry@sanctionsdatabase.com to request that marketing communications stop.

Opting out of marketing will not necessarily prevent operational or transactional communications that are necessary to administer a purchase, maintain security, respond to a request, or fulfil a legal obligation.

We may maintain a limited record of a preference or opt-out request so that we can respect it in future communications.

Depending on applicable law, your rights may include the right to request access to personal information, seek correction or updating, request erasure, withdraw consent where processing is based on consent, raise an objection, request information about processing, or exercise other statutory rights.

These rights are not identical in every jurisdiction. Some rights may be subject to exceptions, verification requirements, legal retention duties, third-party rights, or other limitations permitted by law.

To submit a privacy request, email enquiry@sanctionsdatabase.com with the subject line “Privacy Request”. Please describe the information or processing activity concerned and the action you are requesting.

We may ask for additional information reasonably necessary to verify your identity or authority to act on behalf of another person. We will use verification information for the purpose of assessing and responding to the request, subject to applicable law.

We will respond within the period required by applicable law. If a request cannot be fulfilled in full, we will explain the position where required or permitted by law.

If you are dissatisfied with our response, you may have the right to raise a complaint with a competent data protection authority or pursue another remedy available under applicable law.

The Website and Services are intended for business and professional use and are not directed at children.

We do not knowingly seek to collect personal information directly from children through website enquiry or account-registration processes. If you believe that a child has provided personal information to us in a context where it should not have been collected, please contact enquiry@sanctionsdatabase.com so that we can assess the matter and take appropriate action in accordance with applicable law.

The treatment of information concerning children, including information appearing in public records or compliance-related datasets, will depend on the source, the purpose of processing, and the legal requirements that apply.

The Website or Services may contain links to third-party websites, official records, external resources, or services operated by other organisations.

Those third parties may have their own privacy notices, security practices, and terms of use. SanctionsDatabase does not control the privacy practices of external websites merely because a link is provided.

When you leave our Website or use a third-party service, you should review the relevant provider’s privacy information and terms before submitting personal information.

A link to an external source does not necessarily indicate endorsement of that source or confirmation that all information displayed there is current.

Some Services may organise, categorise, compare, or match records using technical processes. Depending on the product, these processes may help identify potential name matches, associated identifiers, or records requiring further review.

A potential match is an indication that information may be relevant for investigation. It does not necessarily establish that two records relate to the same person or entity.

SanctionsDatabase does not represent that the inclusion of a record or a technical match automatically constitutes a legal determination about an individual. Customers remain responsible for assessing results, verifying identity, considering relevant context, and determining appropriate next steps.

Where applicable law gives an individual rights relating to automated decision-making or profiling, those rights will depend on the nature of the processing and the law applicable to the particular activity.

Customers using the Services in their own decision-making processes must independently assess whether their use complies with applicable privacy, data protection, equality, consumer protection, and other legal requirements.

We may update this Privacy Policy to reflect changes in our Services, data-handling practices, business operations, or applicable law.

The updated version will be published on the Website with a revised “Last updated” date. Where applicable law requires additional notice or another process for a material change, we will follow the relevant requirement.

You should review this Policy periodically to understand how personal information is handled. Continued use of the Website or Services after an updated Policy is published does not override any consent or notice requirement imposed by applicable law.

For questions about this Privacy Policy, requests concerning personal information, or concerns about how information is handled, contact: