Privacy Policy
Last updated: October 2026
1. Introduction
Regulancy ("we", "us", "our") respects your privacy and is committed to protecting the personal data of our users, clients and business partners. This Privacy Policy explains in detail how we collect, use, store, share and protect personal data when you visit our website, create an account, or use the Regulancy compliance platform and related services. By using our services you agree to the practices described in this policy. If you do not agree, please do not use our services.
2. Data we collect
We collect several categories of data. Account data: your name, email address, business name and VAT number, as well as credentials and preferences. Dossier data: identity documents, business details, verification results, VIES and sanctions screening outcomes, and any notes or decisions recorded during review. Usage data: pages visited, features used, actions taken and timestamps, which help us improve the service. Technical data: IP address, browser type, device information, operating system and log data, collected automatically for security and diagnostics. We do not sell personal data to third parties.
3. How we use data
We use personal data to provide, operate and maintain the Regulancy platform; to run KYC and KYB verification flows and process identity documents; to perform VIES VAT validation and sanctions and PEP screening; to maintain immutable audit trails and support human sign-off; to communicate with you about your account, dossiers and updates; to provide customer support and training through the Academy; to improve, develop and secure our services; and to comply with legal obligations under the Wwft, AML regulations and other applicable laws.
4. Legal basis for processing
We process personal data on the basis of: (a) the performance of a contract, when processing is necessary to provide our services to you; (b) compliance with legal obligations, where we are required to perform KYC, AML and Wwft checks and retain records; (c) our legitimate interests, such as improving and securing the platform, provided these do not override your rights; and (d) your consent, where you have given it explicitly, for example for optional communications.
5. Data sharing and third parties
We share personal data only where necessary: with subprocessors and service providers (hosting, authentication, email delivery, payment processing) bound by data processing agreements; with verification partners such as Didit for identity verification, under their own privacy terms; with authorities where required by law or regulation; and within your organization according to the roles and permissions you configure. All third parties are required to protect data and use it only for the agreed purposes.
6. International transfers
Our infrastructure is hosted in the European Union. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, so that your data remains protected.
7. Data storage & security
Data is encrypted in transit using TLS and at rest using industry-standard encryption. Access is role-based and all activity is logged. We apply least-privilege principles, regular security reviews and monitoring. We retain data only for as long as necessary to provide the service and to meet legal and regulatory retention obligations, after which it is securely deleted or anonymized.
8. Cookies and similar technologies
We use essential cookies and local storage to keep you signed in, remember your preferences (such as language and theme) and ensure the platform functions correctly. We may also use analytics cookies to understand usage and improve the service. You can control cookies through your browser settings; disabling essential cookies may affect functionality.
9. Your rights
Under applicable data protection law you have the right to access your personal data, rectify inaccurate data, request erasure where legally possible, restrict or object to processing, request data portability, and withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us at hello@regulancy.com. We will respond within the timeframes required by law.
10. Children's data
Our services are intended for businesses and professionals. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, please contact us and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. The "Last updated" date indicates when the policy was last revised.
12. Contact
Questions about this policy or your personal data? Contact us at hello@regulancy.com or via our contact page. We are happy to help.