Privacy Policy

Last updated: 13.10.2026

1. Introduction

The protection of your personal data is important to us. This privacy policy informs you about the processing of personal data when using the website scp.one, the web application and the REST API of the Sanctions Compliance Platform.

2. Data Controller

Alexander Bergmann

Quellenstraße 7a

70376 Stuttgart

E-Mail: alexander.bergmann@scp.one

3. Hosting and Server Log Files

The platform runs on servers operated by us at Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany (server location: data centre in the European Union). All databases of the platform run on these servers. The hosting provider acts as our processor. It creates a daily backup of the entire server, which is kept for up to 10 days; deleted data may still be contained in the backups until this period expires.

When the website and the platform are accessed, our web server automatically stores the following data in log files:

  • IP address
  • Date and time of access
  • Requested address including parameters and HTTP method
  • Status code and amount of data transferred
  • Referrer URL
  • Browser identifier (user agent)

The purpose is to deliver the content, to ensure stability and security and to detect and prevent misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and uninterrupted operation. Retention period: 14 days; the logs are then deleted automatically.

4. Registration, Login and User Account

Registration and login are handled by the Auth0 service of Okta, Inc., USA, which acts as our processor. Auth0 processes your login data (email address and password, or login via a third-party provider) as well as your IP address and device information at login. We receive your Auth0 identifier, email address and name from Auth0 and store them in your user account together with your language setting, your plan and quota data and your notification settings.

The purpose is to manage your user account and to perform the contract; the legal basis is Art. 6(1)(b) GDPR. Data may be transferred to the USA (see section 13). Auth0 privacy information: https://auth0.com/privacy. The data is stored until your account is deleted (see section 14).

5. Record of Acceptance of the Terms and the Privacy Policy

When you accept the Terms of Service and acknowledge the privacy policy, we store in your account the version of the Terms and the privacy policy, the time of your acceptance of the Terms and the time you acknowledged the privacy policy. No IP address is stored in this process.

The purpose is to prove the effective incorporation of the Terms and to determine which version applies to you. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR; our legitimate interest lies in proving the content of the contract and in defending against claims. The data is stored for the duration of the contractual relationship. After your account is deleted, the version and timestamps remain in the pseudonymised account record without name, email address and login identifier until the end of the third calendar year after the account deletion (regular limitation period, Sections 195, 199 German Civil Code, BGB) and are deleted afterwards.

6. Use of the Platform and the API

When you use the platform, we process:

  • Search requests (search text, search type, filters, summary of matches and time) as search history
  • The list of entities you monitor, with the times of the last check and the last notification
  • Your API token (stored only as a hash value) with the time of creation and of last use
  • Your plan, your quota and your usage

The purpose is to provide the functions of the platform, including search history, monitoring and quota accounting; the legal basis is Art. 6(1)(b) GDPR. The data is stored until your account is deleted. You can export it at any time in the account settings.

7. Third-Party Data in Search Requests and Sanctions List Data

If you enter names or other details of third parties, we process them on your behalf (Art. 28 GDPR); in this respect, the user is the controller. Data subjects should address their requests to the respective user. Search texts are also stored in technical logs for error analysis (for the retention period, see section 3).

We are the controller for the sanctions list data (names, aliases, dates of birth, nationalities, addresses, identification numbers and reasons for listing of listed persons). It originates from publicly accessible official sanctions lists (including those of the USA, the European Union, the United Nations, the United Kingdom, Switzerland, Canada, Australia, Japan and Israel). The purpose is to provide a screening service that supports our users in fulfilling their legal obligations; the legal basis is Art. 6(1)(f) GDPR.

The data is updated each time the sources are retrieved (usually daily). Lifted listings remain stored and marked as inactive so that the sanctions status remains traceable. The data subject rights under section 15 also apply to this data.

8. Payment Processing (Stripe)

You pay for paid plans via Stripe Checkout. To set up the customer account, we transmit your name and email address to Stripe. Stripe (for customers in the EEA: Stripe Payments Europe, Ltd., Ireland) processes your payment data (e.g. card details), your name, your email address and billing data in accordance with the terms of Stripe as an independent controller or as a processor. We do not receive any card details; we store the Stripe customer and subscription ID, the plan and the end of the term. Stripe privacy information: https://stripe.com/privacy.

The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (retention obligations under tax and commercial law). Data may be transferred to the USA (see section 13).

9. Email Notifications

We send you contract-related emails: notices about the expiry of and payments for your subscription, about plan changes, monitoring notifications and confirmations of account deletion, data export and withdrawal. The emails are sent via Proton AG (Proton Mail), Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, as our processor.

The legal basis is Art. 6(1)(b) GDPR. You can deactivate subscription reminders and monitoring notifications in the settings. We do not currently send any advertising emails.

10. Protection Against Attacks (Aikido)

To protect the platform, we use an application firewall from Aikido Security. In the case of suspicious requests, technical request data, in particular IP address, requested address, user agent and characteristics of the detected attack, is transmitted to Aikido Security. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the security of the platform.

11. Cookies and Similar Technologies

We use the following technically necessary cookies:

  • __session – login session (Auth0), encrypted; ends after 3 days at the latest or after 1 day of inactivity
  • __txn_* – short-lived cookies during the login process
  • NEXT_LOCALE – language setting, 1 year
  • cc_cookie – stores your cookie choice, 182 days

The legal basis for storing and reading these cookies is Section 25(2) No. 2 TDDDG, and for further processing Art. 6(1)(b) or (f) GDPR. We only set cookies for web analytics with your consent (section 12).

12. Web Analytics (Google Analytics 4)

Only if you consent in the cookie banner do we use Google Analytics 4 from Google Ireland Limited, Ireland. Usage data (e.g. pages visited, time spent, device and browser information and approximate location data) is processed and the cookies _ga and _ga_DX7H8FDHYD are set with a lifetime of up to 2 years.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future via "Cookie settings" in the page footer. Data may be transferred to Google LLC, USA; this is based on the EU-US Data Privacy Framework.

Retention period of the analytics data at Google: event data is deleted after 2 months, user-level data after 14 months.

13. Recipients and Transfers to Third Countries

Recipients of your data are, where necessary, exclusively the service providers named in this privacy policy:

  • Hosting: Contabo GmbH (Germany)
  • Auth0 / Okta, Inc. (login) – privacy information: https://auth0.com/privacy
  • Stripe (payment processing) – privacy information: https://stripe.com/privacy
  • Google (web analytics, only with consent) – privacy information: https://policies.google.com/privacy
  • Aikido Security (protection against attacks)
  • Email delivery: Proton AG (Switzerland)

Transfers to the USA (Okta, Stripe, Google) are based on the adequacy decision of the European Commission on the EU-US Data Privacy Framework or on EU standard contractual clauses. For Switzerland (Proton), there is an adequacy decision of the European Commission (Art. 45 GDPR).

14. Retention and Deletion

We delete or anonymise personal data as soon as the purpose of storage no longer applies and no statutory retention obligation prevents this. If you delete your account in the account settings, the following happens immediately:

  • Name, email address and login identifier are removed from your account, and the API token is deleted.
  • In the search history, the search text is replaced by "[DELETED]" and the link to your account is removed.
  • Monitored entities are marked as deleted and are no longer checked.
  • Plan data, the Stripe customer ID and acceptance data remain in the pseudonymised account record (see section 5).
  • Your login account at Auth0 is not deleted automatically. We delete it without undue delay, at the latest within one month after the account deletion. If you request it by email to alexander.bergmann@scp.one, we delete it immediately.

Invoices and payment records are retained by Stripe or by us in accordance with the statutory retention periods (in particular Section 147 German Fiscal Code, AO).

15. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7(3) GDPR)
  • Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. with the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany

You can export your data and delete your account at any time in the account settings. For all other requests, an email to alexander.bergmann@scp.one is sufficient.

Right to object under Art. 21 GDPR: Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation.

16. Obligation to Provide Data and Automated Decision-Making

The account data is required to conclude the contract; without it, the platform cannot be used. No automated decision-making within the meaning of Art. 22 GDPR takes place with regard to you. Match scores are indications; the user decides how to assess them.

17. Changes to this Privacy Policy

We update this privacy policy when the data processing or the legal situation changes. The current version is always available on our website. In the event of material changes, we will inform you and ask you to acknowledge the policy again at your next login.