Privacy Policy
Last updated: 2026-09-21 · Version: v1.0
1. Introduction
AXIS KYC (“the Company”, “we”, “us”, or “our”), based in the United Arab Emirates, is committed to protecting the privacy and security of personal data processed through the AXIS KYC platform (“the Service”). This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. This policy applies to all users of the Service, including administrators, compliance officers, and other authorised personnel within tenant organisations.
2. Data Controller & Processor Roles
The Service operates on a multi-tenant model. Each tenant organisation acts as the data controller for the customer data it uploads and processes through the Service. AXIS KYC acts as the data processor, processing personal data on behalf of and under the instructions of the tenant organisation. For account data (user accounts, login information), AXIS KYC acts as the data controller.
3. Data We Collect
Account Data: When you create an account, we collect your name, email address, organisation name, role, and login credentials. Passwords are stored using industry-standard hashing and are never stored in plain text.
Customer / KYC Data: Tenant organisations upload customer data for compliance purposes. This may include full legal names, dates of birth, nationalities, passport and identity document images, addresses, beneficial ownership information, source of funds documentation, and other information required for KYC and AML compliance. This data is controlled by the tenant organisation.
Screening Data: When customers are screened, the Service processes data against sanctions lists, politically exposed persons (PEP) databases, and adverse media sources. Screening results, match details, and risk scores are stored as part of the compliance record.
Usage & Audit Data: We automatically collect information about how the Service is used, including login timestamps, actions performed, IP addresses, browser type, and device information. This data is used for security, audit trail purposes, and to improve the Service.
4. How We Use Data
We process personal data for the following purposes:
Service Delivery: To provide KYC/AML compliance tools, including identity verification, screening, risk assessment, and certificate generation.
Account Management: To create, maintain, and secure user accounts, manage roles and permissions, and authenticate users.
Compliance & Audit: To maintain audit trails as required by applicable regulations, generate compliance reports, and support regulatory examinations.
Security: To detect, prevent, and respond to security incidents, unauthorised access, and fraudulent activity.
Service Improvement: To analyse usage patterns (in aggregate and anonymised form) to improve the Service’s functionality and performance.
5. Legal Basis for Processing
We process personal data on the following legal bases: performance of a contract (to provide the Service as agreed in the subscription terms), legitimate interests (to maintain security, prevent fraud, and improve the Service), legal obligations (to comply with applicable AML, CTF, and data protection regulations), and consent (where specifically obtained, such as for marketing communications).
6. Data Sharing & Third Parties
We may share personal data with the following categories of recipients:
Screening Providers: Customer data is transmitted to third-party screening providers for sanctions, PEP, and adverse media checks. These providers are bound by data processing agreements and process data solely for screening purposes.
Infrastructure Providers: We use cloud hosting and infrastructure services to operate the platform. These providers process data on our behalf under strict contractual obligations.
Legal & Regulatory Authorities: We may disclose data where required by law, regulation, legal process, or enforceable governmental request.
We do not sell personal data to third parties. We do not use personal data for advertising or marketing profiling.
7. Data Retention
Customer KYC data is retained for the duration required by applicable anti-money laundering regulations, which typically mandate retention for a minimum of five (5) years after the end of the business relationship. Account data is retained for as long as the account is active and for a reasonable period thereafter. Audit logs are retained in accordance with regulatory requirements. Upon termination of a tenant’s subscription, data may be exported within thirty (30) days, after which it is securely deleted in accordance with applicable legal retention requirements.
8. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS) and at rest, access controls and role-based permissions, row-level security ensuring complete tenant data isolation, regular security assessments, secure password hashing, and session management with httpOnly cookies. While we take all reasonable precautions, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
9. Your Rights
For Platform Users (Account Holders): You have the right to access, correct, or update your account information at any time through the platform settings. You may request deletion of your account, subject to applicable legal retention requirements.
For Data Subjects (Customers of Tenant Organisations): If your personal data has been processed through the Service as part of a KYC check, your data rights should be exercised with the tenant organisation that collected your data, as they are the data controller. We will assist tenant organisations in fulfilling data subject requests as required by applicable law.
Depending on your jurisdiction, your rights may include the right to access your data, rectify inaccurate data, request erasure (subject to legal retention obligations), restrict processing, data portability, and the right to object to certain processing activities.
10. International Data Transfers
The Service is hosted in data centres that may be located outside your country of residence. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses, data processing agreements, and compliance with applicable cross-border data transfer regulations. We take steps to ensure that your data receives an adequate level of protection in the jurisdictions in which we process it.
11. Cookies & Tracking
The Service uses essential cookies required for authentication and session management. These cookies are strictly necessary for the operation of the Service and cannot be disabled. We do not use third-party tracking cookies, advertising cookies, or analytics cookies that track individual user behaviour across other websites.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via email or through a notice within the Service at least thirty (30) days before they take effect. We encourage you to review this policy periodically.
13. Contact
For questions, concerns, or requests related to this Privacy Policy or data protection, please contact us at: info@axiskyc.ae
AXIS KYC · info@axiskyc.ae