Data Processing Agreement
Last updated: June 30, 2026 · GDPR Article 28 compliant
1. Definitions
In this DPA, "Controller" means the organization using Count Comply; "Processor" means Count Comply Inc.; "Data Subject" means the individual whose personal data is screened; "Personal Data" has the meaning given in GDPR Article 4.
2. Nature and Purpose of Processing
Count Comply processes personal data (names, dates of birth, nationalities, ID numbers) solely for the purpose of performing AML sanctions screening and KYC identity verification as instructed by the Controller. We act as a Processor and do not determine purposes or means of processing independently.
3. Controller Obligations
The Controller warrants that it has a lawful basis for processing personal data submitted to Count Comply, that data subjects have been notified where required, and that all applicable AML and data protection laws have been complied with prior to submitting data.
4. Processor Obligations
Count Comply will: process data only on documented instructions from the Controller; ensure confidentiality obligations are in place for authorized personnel; implement appropriate technical and organizational measures; assist the Controller in meeting data subject rights requests; delete or return all personal data upon request.
5. Sub-processors
Count Comply uses approved sub-processors including cloud infrastructure providers (AWS), identity verification partners, and analytics services. A current list of sub-processors is available at countcomply.com/sub-processors. We will provide 30 days' notice of any changes.
6. Data Retention
AML screening records are retained for 5 years from the date of screening to meet typical regulatory requirements. Controllers may request earlier deletion where retention is not legally mandated. Retention periods can be configured per jurisdiction in Enterprise plans.
7. Data Transfers
Data may be processed in the EU/EEA, UK, or Ghana. International transfers are governed by appropriate safeguards including EU Standard Contractual Clauses, UK International Data Transfer Agreements, or adequacy decisions as applicable.