Sanctions Screen API: Privacy Notice (GDPR)
Last updated: 2026-10-16

1. Data controller
Price Møbelsnedkeri ApS, CVR 34223858, Spangkærvej 1, 4671 Strøby, Denmark. Contact: pp@pricemøbelsnedkeri.dk

2. What we process
- Screening requests: the name, and optionally the date of birth, country and subject type, that a customer submits to be screened. A name and date of birth of a natural person are personal data.
- Sanctions list data: names, aliases, dates of birth, nationalities and other identifiers published by official public authorities (US Treasury OFAC, the European Commission, the UK Foreign, Commonwealth & Development Office). We download these lists from the official sources and do not enrich them.
- Payment data: x402 payments are blockchain transactions; the paying wallet address and transaction hash are public on the Base blockchain and processed by the payment facilitator.
- Technical data: IP address and request metadata in short-lived operational logs kept by our hosting provider for security and abuse prevention.

3. How long we keep it
Screening inputs are processed transiently, in memory, only to compute the result, and are not stored in any database. Our application does not log submitted names or dates of birth. Minimal operational logs (timestamps, status codes, technical metadata) are kept only as long as needed for operation and security, normally no longer than 30 days. Tip: send queries with POST (JSON body) rather than GET so names do not appear in URLs.

4. Purposes and legal basis
We process screening data to provide the screening service requested by our customers, who use it to meet their own legal obligations (sanctions and anti-money-laundering compliance). Legal basis: legitimate interests (GDPR Art. 6(1)(f)), namely our and our customers' interest in preventing dealings with sanctioned persons and in supporting customers' legal obligations (Art. 6(1)(c) applies on the customer's side). Data concerning criminal offences is not processed beyond what official sanctions lists publicly contain. For screening requests, the customer is the controller of the data it submits; we process it to deliver the result.

5. Recipients
Our hosting provider (Railway) and the payment facilitator (Coinbase Developer Platform) act as service providers. Hosting may involve transfers outside the EEA, protected by the providers' Standard Contractual Clauses. We never sell personal data or use it for marketing or profiling.

6. Your rights
You have the right to access, rectification, erasure, restriction, objection and data portability, subject to the conditions in the GDPR. Because we do not store screening inputs, we usually hold no data about a screened person beyond the public official lists; corrections to listings must be requested from the issuing authority. Contact pp@pricemøbelsnedkeri.dk to exercise your rights.

7. Complaints
You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, dt@datatilsynet.dk, or to the supervisory authority where you live.