Data processing agreement
Last updated: November 2026
Business customers who screen personal data of their own customers (for example in bulk screening) act as controllers; AFC Entity Radar processes these names on their behalf. We offer a data processing agreement under Art. 28 GDPR with the following content:
- Subject and duration: screening of names, countries, types and birth years against public lists for the duration of the subscription.
- Nature and purpose: matching in memory; results are returned to the customer. Screened names are not stored and not logged; deep-investigation results are deleted after 24 hours; saved court-record look-ups are deleted after 90 days.
- Instructions, confidentiality, sub-processors (see list), support with data-subject requests and data-protection impact assessments, deletion at the end of the service, audit rights.
- Technical and organisational measures: TLS encryption in transit and HSTS, encryption at rest by our providers, row-level security and least-privilege database access, secrets kept server-side only, rate limits and bot protection, separate test and production environments, no screened names in logs, security headers (CSP), regular automated security tests.
To conclude the agreement, please contact us (topic “Plans, pricing and data licences”).