KYC4U Ltd (KYC4U) is the provider of an end-to-end customer due diligence and adhoc compliance services. We act on behalf of our clients (“Clients”) to verify the identities of their customers (“Parties”) for the purposes of aiding our Clients’ compliance with anti-money laundering and countering financing of terrorism laws and regulations (“Applicable Laws“).

This privacy policy (“Policy“) sets out how we collect, use, disclose and protect the Personal Information of:

A. Parties ; and
B. Clients,  

(together, “you” and “your”). 

KYC4U complies with the GDPR, and nothing in this Policy should be interpreted as attempting to limit any of your rights under the relevant Data Privacy Laws.

We may update this Policy from time to time, and any changes will be published directly to our website and will be effective from the date of publication. Please check in occasionally to see what might have changed. This Policy was last updated in August 2023.

How we get the personal information and why we have it

KYC4U undertake Client Due Diligence (CDD), sometimes known as Know Your Client (KYC), Know Your Business (KYB) and Anti-Money Laundering (AML) checks on Parties, for Clients to enable them to comply with the requirements of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

CDD requires the identification and verification of individuals defined as ultimate beneficial owners (UBOs) under the legislation and this is done by obtaining documentary evidence containing the types of personal information listed below.

Most of the personal information we process is provided to us directly by the Party or the Client for one of the following reasons:

For Clients we will receive and use names, telephone numbers and email details for the purpose of communication about progress of the work we undertake.

For Parties identifying and verifying individuals identified as “ultimate beneficial owners” of organisations, where that information cannot be legally obtained from public sources.

We also receive personal information indirectly for the purposes of identifying and verifying individuals from the following sources:

Public registers of organisations, e.g. Companies House and the Charities Commission;

KYC4U will receive information through third parties with whom the Parties have shared their personal information.

We may request you to provide written permission to share your personal information with other professional advisors, to enable efficient completion of CDD checks and as a result reducing your administration in having to provide the information numerous times.

However, we may share your Personal Information to a statutory or regulatory authority, or a law enforcement agency, if required by law.

We will not sell your Personal Information within the meaning of applicable Data Privacy Laws. 

The type of personal information we collect

We currently collect and process the following types of personal information to carry out contractual and legal obligations placed on us:

• Name
• Date of birth
• Residential address
• ID Documents, i.e. passport and driving license
• Financial information
• Telephone number
• Email address

Legal bases for processing information

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

(a) Contractual requirements: We have a contractual obligation to undertake the checks on behalf of our Clients; and

(b) Legitimate Interest: We may process your Personal Information when we believe it furthers our legitimate interest or that of third parties, and such interest is not overridden by your fundamental data protection rights

How we store your personal information

Your information is securely stored using cloud storage within Microsoft Azure servers and using logical controls to minimise the risk of unauthorised access, loss or theft of your information.

We keep your information for a minimum of 5 years and a maximum of 10 years to comply with the retention periods set out in The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

When the required period passed, your information will be digitally deleted from our servers.

Your data protection rights

Under data protection law and based on the lawful basis of the processing that we undertake, you have the following rights:

Right of access – You have the right to ask us for copies of your personal information.

Right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at Parul.thakrar@kyc4u.co.uk if you wish to make a request.

International data transfers

When we share data, it may be transferred to, and processed in, countries other than the country you live in. These countries may have data protection laws that are different to what you’re used to. Rest assured, we have appropriate safeguards in place to ensure that your Personal Information remains protected in accordance with this Policy and all applicable Data Privacy Laws. 

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at parul.thakrar@kyc4u.co.uk.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk