Compliance Screening privacy notice

The controller is Marbell. The full registered legal entity name, registered address, applicable representative, and any data protection officer details are pending confirmation and must be published before live collection begins.

Questions, correction requests, objections, or other privacy requests may be sent to compliance@marbell.com. Marbell will verify the requester’s identity before disclosing or changing sensitive information.

Most information comes from the applicant. Screening and verification information may also come from the sources listed above. Marbell should not collect a data field merely because the form supports it; the field must be necessary for the approved case type.

• Identity and contact details, including names in different scripts, aliases or former names, date and place of birth, registered and actual residential addresses, citizenship, residence permits or tax residency, and passport number, issue date, expiry date, and copy.
• Tax identifiers, employment, and company ownership information, including related individuals, registration numbers, jurisdictions, direct or indirect interests, controlling relationships, and ownership shares.
• Bank-account details, including bank name, country, account or IBAN, SWIFT/BIC, and any applicable local bank code, only where Marbell has documented that they are necessary for verification, payment, or sanctions controls.
• Passport or other identity documents, declarations, explanations, and the name used to attest the submission.
• Account, authentication, organization, security, device, access, audit, document-scan, and case-management records.
• Screening results and supporting records obtained from official sanctions lists, public corporate or government records, Marbell’s bank where an approved bank process applies, or an approved screening service.

Marbell must document the applicable lawful basis for each purpose before live use. If information is required, the form will identify that requirement. Without information necessary for identity and risk checks, Marbell may be unable to assess or start the proposed relationship.

• Verify identity and assess sanctions, ownership or control, fraud, and other compliance risks before and during a business relationship.
• Take requested pre-contract steps and administer a resulting relationship where this processing is necessary.
• Comply with a specific legal obligation only when Marbell has identified and documented the law that applies.
• Protect Marbell and others through proportionate due diligence, security, fraud prevention, audit, and legal-claims controls where Marbell’s documented legitimate-interests assessment supports the processing.
• Use consent only for genuinely optional processing. Acknowledging this notice is not consent to mandatory screening and does not replace another lawful basis.

Marbell may compare names and other identifiers with applicable sanctions lists and related records. Similarity or a possible match is not, by itself, a finding that the applicant is sanctioned.

Potential matches must be reviewed by an authorized person using distinguishing identifiers, ownership or control information where relevant, the source record, and documented reasoning. Marbell will not make an adverse onboarding decision solely by automated processing. Material adverse decisions require escalation and independent approval under the approved screening procedure.

Access is limited according to role and need. Information may be disclosed to authorized Marbell compliance, security, legal, finance, and administration personnel; authentication, hosting, document-scanning, backup, communications, and screening service providers; Marbell’s bank where necessary; professional advisers; and regulators, courts, or authorities where required or permitted by law.

Marbell has selected the hosted OpenSanctions matching API, subject to commercial licensing and privacy approval. The integration sends names, aliases, date and place of birth, citizenship, and residence country for sanctions matching. It does not send passport files, street addresses, tax identifiers, or bank-account details.

Before live use, Marbell must maintain an accurate processor and recipient register, contracts with processors, and access controls. Service providers may process information only on documented instructions and for the approved purpose.

The portal may involve processing outside the applicant’s country. Marbell must publish the confirmed hosting and processor countries before live collection. Where the receiving country is not recognized as providing adequate protection, Marbell must use an applicable safeguard, such as approved contractual clauses, and assess any additional measures required. Transfer details and a copy or description of relevant safeguards may be requested at compliance@marbell.com.

Marbell will keep information only for an approved period that is necessary for the screening purpose, the business relationship, applicable limitation periods, audit and regulatory duties, and legal claims. Different periods may apply to abandoned drafts, unsuccessful applications, accepted relationships, audit logs, screening evidence, and statutory financial records.

The final periods and deletion or anonymization triggers are not yet approved. They must be inserted into this notice and implemented as tested retention jobs before live collection begins. Legal holds may suspend scheduled deletion for the affected records.

Depending on the applicable law, an individual may request access, correction, deletion, restriction, portability, or information about processing; object to processing based on legitimate interests; withdraw consent for optional processing without affecting earlier lawful processing; and ask for human review of a significant automated decision.

Requests may be sent to compliance@marbell.com. Marbell will respond under the applicable time limit and explain any lawful restriction. Individuals may also complain to the competent supervisory authority. The final notice must name the competent authority once the controller and jurisdiction are confirmed.

The portal uses encrypted transport, encrypted sensitive database fields and files, private document storage, malware scanning, least-privilege access, masked values, audit records, and encrypted backups. No security measure eliminates all risk.

Material changes will receive a new policy version and effective date. Where required, Marbell will provide the updated notice before further processing.