Privacy Policy
Last updated: July 2026
1. Introduction
BA | Screen ("we", "us", "our"), operated by Aletheia Tech Ltd, provides name and entity screening and compliance intelligence services (sanctions, PEP, adverse media, corporate risk, and monitoring).
This Privacy Policy explains how we collect, use, store, and protect personal data when you use our platform and services.
We are registered in the United Kingdom and committed to data protection under the UK Data Protection Act 2018, the UK GDPR, and the EU General Data Protection Regulation (GDPR).
2. Data We Collect
2.1 Account Data. When you register, we collect your email address, name, and company name, required to create and manage your account.
2.2 Screening Subject Data. Names, dates of birth, countries, company names, identifiers, and any other details you submit to screen an individual or entity. You are the controller of the subject data you submit; we process it on your behalf to run the requested screening.
2.3 Uploaded Documents. Files you upload for corporate risk or due-diligence checks. These are processed for the requested report and handled per Section 5.
2.4 Payment Data. Payment transactions are processed by our payment processors. We do not store full card numbers. We retain transaction records for accounting and legal compliance.
2.5 Usage Data. Pages visited, features used, timestamps, and general interaction patterns, used for service improvement and not shared with third parties.
2.6 Communication Data. Messages sent via support requests and email correspondence related to your account and orders.
3. How We Use Your Data
We use your data to:
• Provide the screening, monitoring, and compliance services you order
• Generate reports and deliver them to your account
• Process payments and manage billing
• Communicate about your orders, account status, and service updates
• Improve our platform, scoring, and user experience
• Comply with legal obligations, including AML/KYC requirements where applicable
• Detect and prevent fraud or misuse of our services
4. Legal Basis for Processing
We process data on the following legal bases:
• Contract performance (Art. 6(1)(b) UK/EU GDPR) — Processing necessary to provide our services.
• Legitimate interest (Art. 6(1)(f)) — Service improvement, security, and fraud prevention.
• Legal obligation (Art. 6(1)(c)) — Compliance with applicable laws, including UK Money Laundering Regulations 2017 and EU AML directives.
• Consent (Art. 6(1)(a)) — Where specifically obtained, such as for optional analytics cookies.
Where you submit personal data about a third party (a screening subject), you confirm you have a lawful basis to do so and to have it processed for screening.
5. Data Storage & Security
Where your data lives. Personal and operational data is stored on infrastructure located in the European Economic Area (EEA).
Account and report data is stored in managed PostgreSQL databases on European cloud infrastructure.
Uploaded documents are stored on Amazon Web Services (AWS) infrastructure in the EEA, encrypted at rest (AES-256), served only through short-lived presigned URLs, with all public bucket access blocked. Documents subject to statutory retention are stored under Object Lock (WORM) for the required period.
Security controls:
• All data in transit is protected by TLS 1.2+ encryption
• Role-based access controls limit data access to authorized personnel
• Audit logging tracks access to sensitive data
• Least-privilege credentials for each service
• Regular security assessments
6. Data Sharing
We do NOT sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary:
• Payment processors — for transaction processing
• Screening data providers (sanctions/watchlist, PEP, corporate registry, and news sources) — to run the checks you request
• Law enforcement — only if legally compelled by valid legal process
We do not share your screening requests, results, or report contents with other customers or third parties.
7. Data Retention
• Account data: Retained while your account is active, plus 5 years after closure (UK MLR 2017 record-keeping requirement)
• Screening reports: Retained for 5 years from generation (UK MLR 2017 / EU AMLD5/6 record-keeping obligations)
• Uploaded files: Processed for the report and deleted within 30 days unless subject to statutory retention
• Usage data: Anonymized after 12 months
• Communication data: Retained for 3 years
8. International Transfers
Where a processor operates outside the UK/EEA, we ensure adequate protection through Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA) or UK Addendum, adequacy decisions where applicable, or other appropriate safeguards required by law.
9. Your Rights
Under the UK GDPR, UK Data Protection Act 2018, and EU GDPR, you have the rights of access, rectification, erasure (subject to legal retention), restriction, data portability, objection, and withdrawal of consent.
To exercise these rights, contact us at privacy@bascreen.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority: https://ico.org.uk
10. Cookies & Local Storage
We use the minimum cookies necessary to operate the platform and, only with your consent, first-party analytics. We do not use advertising, marketing, or cross-site tracking cookies, and we do not integrate third-party trackers such as Google Analytics or Meta Pixel.
• Strictly necessary cookies — authentication (session token), CSRF protection, and your cookie-consent preference. All first-party, HttpOnly/Secure where applicable.
• Analytics (require consent) — an anonymous session identifier used only by our first-party analytics; no data is shared with third parties.
• Marketing cookies: Not used.
11. Contact
For privacy questions or to exercise your rights, contact:
BA | Screen — a service of Aletheia Tech Ltd (registered in England and Wales, company no. 17126805)
128 City Road, London, EC1V 2NX, United Kingdom
Email: privacy@bascreen.com