Privacy Policy
Reuse of personal data from official registers
This Privacy Policy applies to you if you are a private individual mentioned in documents and databases of official company and ultimate beneficial ownership registers.
It explains how we at Topograph process your personal data, in compliance with the European Union General Data Protection Regulation (GDPR).
Who is the data controller for your data?
The data controller in the context of this Privacy Policy is Topograph SAS, a French company registered at the Paris company register under the no. 932884117, with its registered office at 30 boulevard de Sébastopol, 75004 Paris (France).
As the data controller, Topograph is your only contact for any question relating to this policy and the processing of personal data described herein.
You can contact us by email at privacy@topograph.co.
Which personal data is collected about you, for what reason and on which legal ground?
Topograph is a provider of AML/CFT products within the meaning of art. 12.2.(j) of DIRECTIVE (EU) 2024/1640 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Directive (EU) 2019/1937, and amending and repealing Directive (EU) 2015/849.
It develops tools to collect and process information and documents contained in official company and ultimate beneficial ownership registers to assist both obliged entities meet their legal requirements with regards to the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and competent authorities in the course of their mission.
For the aforementioned purpose, we collect and process your personal data that appear in official company and ultimate beneficial ownership registers, namely:
- Information on your identity;
- Information on your relationship with a company, such as if you are a legal representative;
- Information that appears in legal documentation with regard to a company;
- Information related to your status as ultimate beneficial owner.
The personal data processed by Topograph is obtained, either directly or through local authorized partners (such as legal professionals), from official company and ultimate beneficial ownership registers maintained by public authorities or entities entrusted with maintaining such registers.
Topograph’s processing of your personal data is justified in that it is necessary to fulfil Topograph’s legitimate interest in developing and providing its AML/CFT products to obliged entities and competent authorities (article 6.1.f) of GDPR), as provided by art. 12.2.(j) of DIRECTIVE (EU) 2024/1640.
Some of your personal data shall be further processed as a probatory measure for the purpose of proving Topograph’s compliance with applicable laws and regulations. Such further processing is justified in that it is necessary to fulfil Topograph’s legitimate interest to defend itself against a legal claim.
For how long is your data retained by Topograph?
We retain your data for as long as it appears in official company and ultimate beneficial ownership registers and for an additional duration of 5 years as a probatory measure.
Who may access your data? With whom is it shared?
Your personal data shall be shared with or accessed by the following entities:
- Our employees in the context and within the limits of their duties at Topograph;
- Our external IT service providers to the extent necessary to fulfil their mission for Topograph;
- Our local authorized partners (such as legal professionals) who collect information and documents from local official company and ultimate beneficial ownership registers;
- Our clients, which are either obliged entities or competent authorities themselves or service providers to said obliged entities or competent authorities;
- Any entity pertaining to our group;
- Our auditors and financial and legal counsels;
- In case of litigation, all and any parties to the litigation, their counsels, and the personnel of the relevant jurisdictions and authorities.
Some of our service providers or our clients may transfer your data to and/or access it from countries which are not members of the European Union. In such cases, we have ensured that appropriate guarantees are implemented to protect your data throughout and after the transfer. Either:
- our service provider or client is self-certified under the Data Privacy Framework, which is an instrument recognized as adequate by the European Commission to govern EU-US personal data transfers; or
- our service provider or client has implemented binding corporate rules or the standard contractual clauses adopted by the European Commission on June 4th 2021. A copy of the binding corporate rules or implemented contractual clauses will be provided upon request.
What rights do you have to control your data?
You have a certain number of rights determined by applicable laws and regulations. You will find details for each of those rights below.
You may exercise those rights by sending us an email at privacy@topograph.co.
Please make sure you clearly mention the nature of the right you wish to exercise and the reasons which justify your request, as applicable.
Right of access
You have the right to request a copy of all personal data we have that relates to you, in a legible, understandable format, and a copy of this Privacy Policy.
Right of rectification
You have the right to ask us to rectify, complete or update personal data we have that relates to you, in case it appears inaccurate, incomplete or obsolete.
In such case, please make sure you provide us spontaneously, as possible, with all information necessary to proceed with the requested rectification, completion or update.
Right to object
You have a right to object to the processing activities above on grounds relating to your particular situation.
In other words, you may ask Topograph to stop processing your personal data for a given purpose that is based on Topograph’s legitimate interest, by explaining the particular reasons that justify this objection.
It is possible however that we refuse to comply with your request if the processing of your data is still necessary, according to us, for compelling reasons that override the grounds relating to your particular situation (e.g. use of said data as proof in an actual dispute).
If it is grounded and no compelling reason goes against it, your objection will result in us ceasing the respective processing activities, but not necessarily deleting the data; to obtain deletion of your data, you must exercise your right to erasure (see below), which also comes with a series of conditions and limitations.
Right to erasure (right to be forgotten)
You may ask us to delete all or part of the data we have that relates to you, where one at least of the conditions below is met:
- You objected to the processing of your data and you wish that Topograph deletes the relevant data.
- It is not necessary anymore for Topograph to retain the relevant data for the purposes described in this Privacy Policy.
- You consider that Topograph collected and/or processed the data in an unlawful manner.
- Deletion of the data is imposed as a legal obligation.
- The relevant data was collected when you were less than 15 years old.
Please be aware that Topograph may refuse to delete certain data where it is required to retain it for important reasons such as defending Topograph’s interests before a court.
Also, please note that we may choose to anonymize the data instead of deleting it. In this case, we will be able to retain the data in a format that does not allow to identify you anymore (for instance for statistical purposes).
Right to limitation of processing
You may ask us to limit the processing of your data, i.e. to retain it without using it (except for legal obligations). You may especially ask this instead of asking for deletion of that data.
You may exercise this right where one at least of the following conditions is met:
- The concerned data appears inaccurate and you prefer that we stop using it for the time necessary to verify and rectify it as applicable.
- You objected to the processing of your data as explained above, and you wish that we stop using it for the time necessary to verify the grounds for that objection.
- You consider that Topograph collected and/or processed your data in an unlawful manner, but you still prefer that we retain that data instead of deleting it.
- It is not necessary anymore for Topograph to retain the relevant data for the purposes described in this Privacy Policy, but you still wish that we retain that data for you to be able to use it before a court.
In such cases, we will stop using the respective data and will retain it for the appropriate duration.
Right to provide directives regarding your data after your death
You may provide us with directives as to how you want Topograph to proceed with your data after your death.
For instance, you may ask that we delete all of your personal data (except as needed for Topograph to defend its rights before a court) or to transfer it to a recipient of your choice.
You may also designate any person of your choice to control our respect of those “last wishes”. That person does not need to be your heir or your testamentary executor.
You consider that we did not provide a satisfactory answer to your request or that we process your personal data in an unlawful manner?
We invite you to first contact us so that we discuss the issue together and try to find a way to solve it efficiently.
If you wish, you have the right to lodge a complaint with the competent data protection supervisory authority, such as the French Commission Nationale de l’Informatique et des Libertés (CNIL), through its website cnil.fr or by postal mail at CNIL – 3, place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 (France).
This right to lodge a complaint may be exercised at any time and free of charge, except for (as applicable) postal fees and legal counsel fees (if you choose to get assistance from a legal counsel).
Your data, your rights
Get in touch
Topograph is your only contact for any question relating to this policy or to exercise your rights. Email us and we will get back to you.