Data Processing Agreement

This Data Processing Agreement ("DPA") governs the processing of personal data by Searchlook ("Processor") on behalf of our clients ("Controller"). It applies to all personal data processed through the Screening API and Developer Portal.

This agreement is effective upon your use of the Service and complies with GDPR Article 28 and similar data protection regulations.

• Personal Data: Information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data (collection, use, storage, deletion)
• Controller: You (the client) determining purposes and means of processing
• Processor: Searchlook processing data on behalf of the Controller
• Data Subject: The individual whose data is processed
• Sub-processor: Third party engaged by Searchlook for data processing

Subject Matter: Processing of personal identifiers (names, dates of birth, addresses, identification documents, etc.) for KYC screening purposes against sanctions and watchlists.

Duration: For the term of your service agreement. Personal data is retained and processed for periods specified in our Privacy Notice.

Searchlook processes personal data to:

• Perform KYC screening against international sanctions lists and watchlists
• Generate compliance audit trails
• Provide analytics and reporting
• Maintain security and prevent fraud
• Comply with legal and regulatory obligations

The following categories of personal data may be processed:

• Full name and name variations
• Date and place of birth
• Nationality and citizenship
• Identification document numbers (passport, ID card, etc.)
• Address and contact information
• Professional affiliations
• PEP (Politically Exposed Person) indicators

Data subjects typically include:

• Your customers and prospective customers
• Your employees and contractors
• Beneficial owners and authorized signatories
• Counterparties in transactions
• Other parties involved in KYC screening processes

As Controller, you are responsible for:

• Obtaining lawful basis for processing personal data
• Providing privacy notices to data subjects
• Ensuring data subjects consent where required
• Verifying that Searchlook is an appropriate processor
• Responding to data subject rights requests (ARCO/GDPR)
• Notifying Searchlook of any data breaches
• Ensuring compliance with all applicable laws

Searchlook (as Processor) commits to:

• Process data only on documented instructions from Controller
• Ensure persons authorized to process data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Obtain prior written consent before engaging sub-processors
• Assist Controller in responding to data subject rights requests
• Delete or return data upon termination (subject to legal retention periods)
• Make available all information necessary to demonstrate compliance
• Allow audits and inspections by Controller or regulators

Searchlook may engage sub-processors for:

• Cloud infrastructure (AWS)
• Database management (MongoDB, Elasticsearch)
• Logging and monitoring (Sentry, CloudWatch)
• Authentication services (AWS Cognito)
• Payment processing

We will notify you of material changes to our sub-processor list. You may object to new sub-processors by written notice within 30 days.

Personal data may be transferred to and processed in countries outside the EU/EEA, including Mexico and the United States.

For EU data subjects, such transfers are based on:

• Standard Contractual Clauses (SCCs) as approved by the EU Commission
• Binding Corporate Rules (if applicable)
• Adequacy decisions

You may request a copy of our transfer mechanisms.

Searchlook implements security measures including:

• Encryption in transit (TLS 1.3) and at rest
• Access controls and role-based permissions
• Regular security audits and penetration testing
• Incident response procedures
• Employee security training
• Secure key management
• Audit logging and monitoring

Searchlook will assist Controller in responding to data subject rights requests:

• Right to access personal data
• Right to rectification of inaccurate data
• Right to erasure, restriction, and portability, where the GDPR applies
• Right to object to processing
• Rights related to automated decision-making, where the GDPR applies

Under the LFPDPPP the rights are acceso, rectificación, cancelación, and oposición. The data subject files them at the public form, with an official ID. Erasure, restriction, and portability are GDPR rights, not ARCO rights.

Note: Screening audit logs are kept for 10 years under LFPIORPI article 18, the anti-money-laundering record-keeping rule. That statute is not the personal-data law. LFPDPPP article 33, fraction IV, allows refusal of cancellation where a legal duty requires the record to be kept.

In the event of a personal data breach, Searchlook will:

• Notify Controller without undue delay
• Provide details of the breach and affected data
• Explain remedial actions taken
• Cooperate with regulatory investigations

Controller may audit Searchlook's processing activities to verify compliance with this DPA. Searchlook will:

• Grant reasonable access to facilities and personnel
• Provide documentation and evidence of compliance
• Cooperate with third-party auditors
• Provide audit reports upon request

Upon termination or at Controller's request, Searchlook will:

• Delete all personal data not subject to legal retention requirements
• Provide certification of deletion
• Retain screening audit logs for 10 years under LFPIORPI article 18 (anti-money-laundering record-keeping)

This DPA is governed by the laws of Mexico and the EU GDPR (where applicable). Any disputes shall be resolved:

• Through good-faith negotiation
• Via arbitration or mediation if needed
• In the competent courts of Mexico City (for Mexico-based disputes)
• In accordance with GDPR dispute resolution procedures (for EU disputes)

For DPA-related inquiries: