Privacy Policy
Your privacy is important to us. This policy explains how we collect, use, and protect your personal information when you use our AML compliance platform.
Legal Basis
AML Proof, s.r.o. processes personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the cornerstone of European data protection law.
The GDPR was adopted by the European Parliament and the Council of the European Union and is enforced under the supervision of the European Data Protection Board (EDPB) together with the national data protection authorities of each EU Member State.
AML Proof, s.r.o., as the data controller, determines the purposes and means of processing your personal data when you use our platform.
AML Proof, s.r.o. acts as a processor in relation to the personal data of clients of Obliged Entities. You, as the obliged entity, remain the data controller of this data. Our relationship is governed by the Data Processing Agreement (DPA), which is part of our Terms and Conditions.
Legal Obligation
Includes: client identification and due diligence under applicable AML legislation, AML record-keeping, sanctions screening, reporting suspicious transactions to the FIU.
Legitimate Interest
Includes: platform security monitoring, fraud prevention, platform improvement (pseudonymized analytics), commercial communication to existing clients, prevention of platform abuse and protection of trade secrets (risk assessment of registered organisations), measuring opens and clicks in commercial e-mails.
Contractual Necessity
Includes: user account operation, generating compliance reports, access to platform features.
Information We Collect
Personal Information
- • Name and contact details
- • Email address and phone number
- • Job title and organization
- • Professional credentials
- • Account preferences
Usage Data
- • Platform usage patterns
- • Feature interactions
- • Session duration and frequency
- • Device and browser information
- • IP address and location data
Compliance Data
- • AML case information
- • Risk assessment data
- • Training records
- • Audit trail information
- • Regulatory reporting data; e-sign records (signer name and email, IP address, OTP code, consent, audit PDF)
Technical Information
- • Cookies and tracking pixels
- • Log files and error reports
- • Performance metrics
- • Security event logs
- • API usage statistics
How We Use Your Information
Service Provision
- Provide and maintain our AML compliance platform
- Process and manage compliance cases
- Generate reports and analytics
- Facilitate training and certification
Communication
- Send service updates and notifications
- Provide customer support
- Share regulatory updates
- Deliver training materials
Improvement
- Analyze usage patterns and performance
- Develop new features and services
- Enhance security measures
- Optimize user experience
Compliance
- Meet legal and regulatory obligations
- Respond to lawful requests
- Maintain audit trails
- Protect against fraud and abuse
- Assess the risk of platform abuse (organisation suspicion score based on e-mail domains and type of activity)
Data Security & Protection
We implement comprehensive security measures to protect your personal information from unauthorized access, use, or disclosure. File backups. Files uploaded to the platform, in particular copies of identity documents and documents obtained during client identification and due diligence, are backed up to a separate Amazon Web Services storage located in the EU (Stockholm region, Sweden). Backups are encrypted and used solely to restore data after a technical failure or accidental deletion. Platform users have no access to them. When a file is deleted from the platform, whether at the obliged entity's instruction or automatically once the retention period under the AML Act has expired, its backup copy is automatically and irreversibly removed after 90 days. During this period the backup copy is not processed in any way.
Technical Safeguards
- Data transmission encryption (TLS)
- Advanced encryption for data at rest
- Modern authentication (magic link, OAuth 2.0, and optional 2FA via authenticator app)
- Error and security event monitoring
Operational Controls
- Role-based access controls
- Security training programs for employees and persons in a comparable position programs
- Incident response procedures
- Daily encrypted file backups and database history for recovery
Privacy when using AI
- To generate the texts of commercial communications we use the Google Gemini API; no personal data is sent to it.
- For adverse media screening we use Google Gemini 2.5 Flash via Google Vertex AI (Google LLC). The following minimised data is sent to the model: full name of the screened person (required for screening), birth year, country (citizenship / registration), and up to 3 aliases (first in full, remainder as initials). Full date of birth, document numbers, addresses, and contact details are not sent. For automated form completion from a scanned document (Scan to Fill), the document image is sent to Google Vertex AI (gemini-2.5-flash, region europe-west1) — extracted fields include name, date of birth, birth number, address, and document number. On the paid tier, Google does not use API data for product improvement or model training.
Your Privacy Rights
You have important rights regarding your personal information. Contact us to exercise these rights.
Access
Request copies of your personal information
Correction
Update or correct inaccurate information
Deletion
Request deletion of your personal data where legally permissible. Certain AML/CTF compliance records cannot be deleted before the end of mandatory retention periods.
Portability
Export your data in a portable format
Right to Object
Object to processing based on legitimate interest or for direct marketing purposes (Art. 21 GDPR)
Right to Restriction
Request temporary restriction of processing your personal data in cases set out by Art. 18 GDPR
Right to object
You may object at any time to processing based on legitimate interest, including profiling (risk assessment of an organisation), at hello@amlproof.ai. Restricting or blocking an account is always decided by a person, never by automated assessment alone.
Data Retention
We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy and comply with legal obligations.
Account Data
Operational data of the user account (login credentials, settings, preferences) is deleted within 30 days after the account is closed.
Compliance Records
We retain the client data of obliged entities for the term of the Agreement. The retention period under the AML Act is borne by the obliged entity. After the Agreement ends, data can be exported for 90 days, after which we delete the data (Terms and Conditions, Art. 6.6 and 8.8).
Usage Analytics
3 years
Support requests
Support requests – 2 years after resolution. Unresolved requests are deleted 2 years after creation.
Business contacts
Business contacts – until unsubscribe, at most 3 years without any response. After unsubscribing we keep only the e-mail address on a suppression list so that we do not contact you again.
Electronic signature — personal data processing
When using the electronic signature feature (E-Sign), the Platform processes personal data of the signatories of the signed documents.
Data processed
- Name and e-mail address of the signatory
- IP address at the time of verification and signing
- Date and time of signing
- Consent to the document content (OTP verification)
- Audit PDF with complete signing history
Legal basis for processing
Legitimate interest of the controller (Article 6(1)(f) GDPR) in ensuring the demonstrability of legal acts, or performance of a contract (Article 6(1)(b) GDPR) concluded with the signatory.
Retention period
Signature data is part of the relevant AML case and is retained in the same way as the case (Terms and Conditions, Art. 6.6 and 8.8).
Data recipients
Signature data (audit PDF) is stored in Vercel Blob cloud storage, data centre FRA1 (Frankfurt, EU). E-mails with signing links and OTP codes are delivered via the Resend platform, which acts as a data processor under a concluded data processing agreement (DPA). A backup of this data is stored in Amazon Web Services S3 (EU – Sweden).
Annex 1: Data Processing Agreement (DPA)
Version effective from 21 November 2026.
1. Subject Matter and Roles
This agreement governs the relationship between the Client as the obliged entity (Controller) and AML Proof, s.r.o. (Processor). The Processor processes personal data for the Controller in order to enable the Controller to fulfil its obligations under the AML Act.
Description of the processing
Subject matter: operation of the AML PROOF platform for the Controller. Duration: for the term of the Agreement and the export period (Art. 6). Nature and purpose: client identification and due diligence, PEP and sanctions screening, risk assessment, ongoing monitoring, electronic signature, record keeping, internal whistleblowing system. Types of data: identification data, copies of documents, birth number, beneficial owner data, information on PEP status and sanctions, transaction data, materials for a suspicious transaction report, signatory data. Categories of data subjects: the Controller's clients, persons acting on behalf of a client, beneficial owners, signatories, whistleblowers.
2. Processor's Obligations
- Process data only on documented instructions from the Controller (including parameters set in the application).
- Ensure that persons authorized to process the data have committed themselves to confidentiality.
- Implement appropriate technical and organizational measures (encryption of data in transit and at rest, secure hosting in the EU, minimisation of personal data transmitted to external processors).
- Assist the Controller in fulfilling their obligation to respond to requests for exercising data subjects' rights.
- Process data only on documented instructions from the Controller, including transfers to third countries.
- Immediately inform the Controller if, in its opinion, an instruction infringes the GDPR.
- Notify the Controller of a personal data breach without undue delay after becoming aware of the breach. Such notification shall contain, at least: (a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned); (b) the details of a contact point where more information concerning the personal data breach can be obtained; (c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects. Where it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
- Assist the Controller in complying with its obligations under Arts. 32 to 36 GDPR.
3. Engagement of Sub-processors
The Controller grants a general authorisation to engage further processors. The current named list of sub-processors (name, purpose, location, data categories) is available on the Personal Data Processing page (amlproof.ai/data_processing). The Processor announces any intended change of sub-processors by publishing the updated list on that page at least 30 days before the change takes effect. Within that period the Controller may raise a reasoned objection at hello@amlproof.ai. It imposes on further processors the same data protection obligations as this agreement and remains fully liable to the Controller for their performance.
4. Security
The Processor adopts technical and organisational measures under Art. 32 GDPR. Personal data is transferred outside the EEA only to those further processors for which this is stated in the list, on the basis of standard contractual clauses (Art. 46(2)(c) GDPR). Data is not passed on for the training of AI models.
5. Audit
The Processor will allow for and contribute to audits or inspections conducted by the Controller to demonstrate compliance with Article 28 of the GDPR.
6. Termination
After the Agreement ends, the Processor enables the Controller to export the data for 90 days (Terms and Conditions, Art. 8.8) and then deletes all personal data. The Controller is responsible for retention of data under the AML Act. Backup copies of files are removed no later than 90 days after deletion.
Processing of Personal Data in the Whistleblowing System
AML PROOF operates an internal reporting system module under the whistleblowing legislation. AML Proof, s.r.o. acts solely as a processor of the technical infrastructure — the controller of the system is the obliged entity (your organisation).
Personal Data Processed
Reports may involve processing of: whistleblower identity (unless submitted anonymously), contact details, report content and attachments, tracking key assigned to each submission. Anonymous submissions do not require any personal data.
Legal Basis
Processing is necessary for compliance with a legal obligation under Art. 6(1)(c) GDPR in conjunction with the whistleblowing legislation.
Retention Period
Personal data related to reports is retained for the period required by the whistleblowing legislation (5 years from receipt of the report), unless a special regulation provides otherwise.
Whistleblower rights under GDPR (access, rectification, erasure) may be exercised with the system controller — the obliged entity. For anonymous submissions, these rights cannot technically be fulfilled as the system does not allow identification of the whistleblower.
Questions About Your Privacy?
If you have questions about this privacy policy or how we handle your personal data, please contact us at hello@amlproof.ai. AML Proof, s.r.o. has not appointed a Data Protection Officer.
If you believe your personal data have been processed unlawfully, you also have the right to lodge a complaint with the Úřad pro ochranu osobních údajů (ÚOOÚ) or with your local supervisory authority within the European Economic Area.