GDPR/Privacy Shield Policies

Last update: February 22, 2018

Trans World Compliance ("TWC") is committed to your privacy and support the EU's General Data Protection Regulation ("GDPR") and the EU-U.S. Privacy Shield Framework ("Privacy Shield").

A. NOTICE & CHOICE

Affirmative Statement of Participation in the EU-US Privacy Shield Framework

This Statement complies with the Privacy Shield as set forth by the U.S. Department of Commerce and GDPR as set forth by the European Union regarding the collection, use, and sharing of personal information. This Privacy and Data Protection Policies statement describes how TWC collects, uses, and transfers data. Please also refer to TWC's web privacy policies available here and a list of Privacy Shield participants here.

Jurisdiction

TWC certifies that it adheres to the Privacy Shield and GDPR Principles. TWC states that if there is any conflict between the terms of any TWC privacy policy and Privacy Shield or GDPR Principles, the Privacy Shield and GDPR Principles shall govern. TWC is also subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) and the European National Data Protection Authorities.

Scope

TWC's Privacy and Data Protection Policies applies to its collection, use, and sharing of commercial data (data that TWC processes on behalf of its clients or their partners) and internal data (data that TWC collects for TWC internal purposes such as requests for additional information or to apply for employment with TWC).

TWC's Data Collection Processes

TWC creates B2B solutions to help companies comply with US FATCA, CRS, and other international tax obligations. TWC does not have access to our client's data and does not see or use any client data without the explicit permission of our clients and only for the specific reason of providing application support. Data processed includes:

• Individual and Entity Account Holder information including identifiable information such as name, address, data of birth, and phone numbers
• Tax ID numbers of the aforementioned individuals and entities
• Financial information concerning Accounts held by individuals and entities

TWC collects personal information for various internal purposes such as sales or HR. This information is collected only with the consent the owner, includes only necessary for specific business purposes, and will be deleted upon request by an owner.

TWC End User Data & Privacy Policies

Both TWC and our clients are responsible for end user privacy. TWC provides end user data and privacy policies for our SaaS solutions, as well as a separate policy for the TWC marketing websites (see next section).

TWC requires that its clients provide the necessary notices and obtain informed consents from their end users for data collection using TWC software solutions.

TWC will delete any or all client data upon request from a client. Requests must be in writing and will be deleted within fourteen (14) calendar days of a request.

TWC Employee & Internal Data & Privacy Policies

TWC has an employee data and privacy policy. TWC employees are aware of and have been trained on this policy, which is also available on the company’s intranet.

TWC website privacy policy is available on our marketing websites and detail the data collected and intended use of such data.

B. ACCOUNTABILITY FOR ONWARD TRANSFERS

To effectively process data on behalf of our clients to fulfill our client's compliance obligations, TWC software must share data with certain tax authorities. In all cases and for each transfer, our clients must explicitly initiate the transfer. With the exception of the aforementioned tax reporting, TWC does not have access and does not forward or share any client data to any other companies for any purpose whatsoever.

For internal data, TWC may share some data with external providers (for example, employee background checks). All employees will be specifically notified of any sharing of data, TWC will only share data when necessary, and only with firms that adhere to TWC's data privacy policies. Marketing data collected by TWC may be shared with partners.

C. SECURITY

TWC uses reasonable and appropriate measures to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction, taking into account any inherent risks and the nature of the personal data involved.

TWC is a SaaS company that operates within segregated private datacenters as well as the public cloud. Data collected by TWC is co-located in secure locations operated by Amazon (AWS) and SALT in the Cayman Islands. Additional data center providers may be added in the future.

D. DATA INTEGRITY & PURPOSE LIMITATION

The TWC data pledge expressly disclaims ownership of data in favor of the TWC client. Furthermore, it is the TWC client, not TWC, that determines the "purposes and means" of data processing, include data retention and termination. Under EU law, TWC is the "data processor" that processes data on instruction from the client or data controller (the entity that determines the "purposes and means" of the data processing in question).

E. ACCESS

TWC processes data on behalf of its business clients and is not an end user facing company. For any access request or request to be forgotten, TWC would refer the end user to the TWC client’s that has the direct relationship with the individual or entity in question.

TWC does collect certain personal data for internal purposes such as sales and HR. TWC will honor any requests to review data and/or any requests to be forgotten (have personal data deleted).

F. NOTIFICATION

In the unlikely event of a security breach, within 72 hours of discovery, Trans World Compliance will notify the owners of any affected data and, where applicable by law, relevant Data Protection Authorities.

G. RECOURSE & ENFORCEMENT

For questions or complaints please contact our Data Protection Officer at:

Data Protection Officer
Trans World Compliance, Inc.
1829 Greenplace Terrace
Rockville, MD 20850 USA
Phone: 301-825-5137
Email: info@transworldcompliance.com

In instances where other redress possibilities have been exhausted under EU law, or where the complaint has not been resolved by any other means, TWC will provide US and EU end users a binding arbitration option.

Liability is limited to TWC's contractual terms or penalties stated in law (GDPR or Privacy Shield or other relevant law), whichever is higher.

H. DISCLOSURES TO LAW ENFORCEMENT

TWC may disclose data in response to lawful requests by public authorities, and to meet national security or law enforcement requirements.