Privacy & Data Protection Policies

    This privacy policy sets out the basis on which any information that we collect from you, or that you provide to us, will be processed by us.

    Privacy & Data Protection Policies

    Trans World Compliance, Inc. (“TWC”) is committed to your privacy and supports the principles of the EU General Data Protection Regulation (“GDPR”).

    A. NOTICE & CHOICE

    Statement

    This Privacy and Data Protection Policies statement describes how TWC collects, uses, shares, and transfers personal data, including personal data received from the European Union, the United Kingdom, and Switzerland. For information about data collected on our websites, please see the “Data We Collect From You” section of this page.

    Jurisdiction

    TWC is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). Where GDPR or other applicable data protection law applies, TWC is also subject to the competent European data protection authorities, and if there is any conflict between this policy and such law, the applicable law shall govern.

    Scope

    TWC’s Privacy and Data Protection Policies apply to its collection, use, and sharing of commercial data (data that TWC processes on behalf of its clients or their partners) and internal data (data that TWC collects for its own internal purposes, such as requests for additional information or applications for employment with TWC).

    TWC’s Data Collection Processes

    TWC creates B2B solutions to help companies comply with US FATCA, CRS, and other international tax obligations. TWC does not have access to our clients’ data and does not see or use any client data without the explicit permission of our clients, and only for the specific purpose of providing application support. Data processed includes:

    • Individual and Entity Account Holder information, including identifiable information such as name, address, date of birth, and phone numbers
    • Tax ID numbers of the aforementioned individuals and entities
    • Financial information concerning accounts held by individuals and entities
    • If a client transmits personally identifiable client information to an employee for the purposes of support, loading, or otherwise, the employee should delete it after use or within 30 days, whichever is sooner.
    • All data transmission must be secured with, at a minimum, password-level encryption.
    • Legally required retention is at least six years (under local law it may be longer).
    • For our cloud solutions, upon written request, TWC will permanently delete all client data from our servers and backups and will provide written confirmation of the same.

    TWC collects personal information for various internal purposes such as sales or HR. This information is collected only with the consent of the individual, is limited to what is necessary for specific business purposes, and will be deleted upon request by the individual.

    TWC End User Data & Privacy Policies

    Both TWC and our clients are responsible for end user privacy. TWC provides end user data and privacy policies for our SaaS solutions, as well as a separate policy for the TWC marketing websites (see “Data We Collect From You”).

    TWC requires that its clients provide the necessary notices and obtain informed consent from their end users for data collection using TWC software solutions.

    TWC will delete any or all client data upon written request from a client within fourteen (14) calendar days of the request.

    TWC Employee & Internal Data & Privacy Policies

    TWC has an employee data and privacy policy. TWC employees are aware of and have been trained on this policy, which is also available on the company’s intranet.

    Your Choices

    Individuals may choose (opt out) whether their personal data is (i) disclosed to a third party, other than a service provider acting as an agent on behalf of TWC, or (ii) used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized. For sensitive personal data, TWC will obtain the individual’s affirmative express consent (opt in) before such disclosure or use.

    Individuals may also unsubscribe from TWC marketing communications at any time by using the “unsubscribe” link included in each email or by contacting us at info@transworldcompliance.com. To exercise any of these choices, please contact our Data Protection Officer (see Section G).

    Classification of Data Types

    Management must establish criteria for determining how data sets and information within the environment should be used, handled, and protected, based on its content and level of sensitivity to the business and TWC’s customers.

    Data Type

    Description

    Examples

    Handling Requirements

    Restricted

    Highly sensitive data that, if compromised, could put the company at severe financial or legal risk. Subject to state, federal, or international privacy regulations.

    Personally Identifiable Information (PII), Credit Card Information, Intellectual Property (IP), Social Security Numbers (SSNs), PHI.

    Mandatory encryption (AES-256) at rest and in transit. Access restricted to a strict “need to know” basis.

    B. ACCOUNTABILITY FOR ONWARD TRANSFERS

    To effectively process data on behalf of our clients to fulfill our clients’ compliance obligations, TWC software must share data with certain tax authorities. In all cases and for each transfer, our clients must explicitly initiate the transfer. With the exception of the aforementioned tax reporting, TWC does not have access to, and does not forward or share, any client data with any other companies for any purpose whatsoever.

    For internal data, TWC may share some data with external providers (for example, employee background checks). All employees will be specifically notified of any sharing of data. TWC will only share data when necessary, and only with firms that adhere to TWC’s data privacy policies. Marketing data collected by TWC may be shared with partners, subject to the choices described in Section A.

    When TWC transfers personal data to a third party acting as an agent on its behalf, TWC requires the agent to provide at least the same level of privacy protection described in this policy. TWC remains responsible and liable for the processing of personal data it transfers to such agents if they process that personal data in a manner inconsistent with this policy, unless TWC proves that it is not responsible for the event giving rise to the damage.

    C. SECURITY

    TWC uses reasonable and appropriate measures to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction, taking into account any inherent risks and the nature of the personal data involved.

    TWC is a SaaS company that operates within segregated private datacenters as well as the public cloud. Data collected by TWC is co-located in secure locations operated by Amazon Web Services (US, Canada, Brazil), Art Motion (Switzerland), and SALT (Cayman Islands). Additional data center providers may be added in the future.

    D. DATA INTEGRITY & PURPOSE LIMITATION

    The TWC data pledge expressly disclaims ownership of data in favor of the TWC client. Furthermore, it is the TWC client, not TWC, that determines the “purposes and means” of data processing, including data retention and termination. Under EU law, TWC is the “data processor” that processes data on instruction from the client, or “data controller” (the entity that determines the “purposes and means” of the data processing in question).

    E. ACCESS

    Individuals have the right to access the personal data that TWC holds about them, and to correct, amend, or delete that information where it is inaccurate or has been processed in violation of this policy.

    For personal data TWC collects for internal purposes (such as sales and HR), TWC will honor requests to review, correct, or delete that data. To make a request, please contact our Data Protection Officer at info@transworldcompliance.com (see Section G). We will respond within a reasonable time frame.

    For client data, TWC processes data on behalf of its business clients and is not an end user facing company. For any access request or request to be forgotten concerning client data, TWC will refer the individual to the TWC client that has the direct relationship with the individual or entity in question, and will assist that client in responding to the request.

    TWC will not honor any third-party requests for access to client data without explicit written instructions to do so from TWC’s client.

    F. NOTIFICATION

    In the unlikely event of a security breach, within 24 hours of discovery, Trans World Compliance will notify the owners of any affected data and, where applicable by law, relevant data protection authorities.

    G. RECOURSE & ENFORCEMENT

    For questions or complaints, please contact our Data Protection Officer at:

    Data Protection Officer
    Trans World Compliance, Inc.
    1829 Greenplace Terrace
    Rockville, MD 20850
    USA
    Phone: +1 301-825-5137
    Email:     info@transworldcompliance.com

    In instances where other redress possibilities have been exhausted under EU law, or where the complaint has not been resolved by any other means, TWC will provide US and EU end users a binding arbitration option.

    Liability is limited to TWC’s contractual terms or the penalties stated in applicable law (including GDPR), whichever is higher.

    H. DISCLOSURES TO LAW ENFORCEMENT

    TWC may disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Unless expressly prohibited by law or doing so would violate an order, TWC will provide notice to affected clients of any such disclosure.

    I. RETENTION & DATA SECURITY

    TWC does not have direct access to any personally identifiable client data in our cloud or installed applications. Should a client provide access or send data to TWC personnel:

    Cloud installation data retention:

    Any questions about data retention or data security should be forwarded to the Data Protection Officer.

    Data We Collect From You

    Why do we collect Information on the Websites?

    We collect any information you voluntarily provide when you visit the Websites to learn more about TWC and its products, the company, investment opportunities, or for other information. The type of information collected will depend on your request. For example, if you sign up for a TWC newsletter, we will ask for your name and email address. In contrast, if you are considering employment at TWC and submitting a job application, we will collect other details such as your address and phone number.

    What Information does TWC collect on the Websites?

    When you visit the Websites, we automatically collect information about your computer or device, and your use of the Websites, so that we can recognize you as an end user and optimize your experience accordingly. We store this information in log files and may share this data with partners, affiliates, and other vendors, who help us analyze overall activity trends and administer the Websites, track end users activity on the Website for analytics purposes, and gather demographic information about our user base as a whole. We may receive reports based on the use of these technologies from these companies on an individual or aggregated basis.

    Here are the different categories of information that may be collected from your device by the Websites, or by partners, affiliates, and other vendors acting on our behalf:

    • The type of browser you used to access the Websites
    • The times you accessed the Websites
    • The IP address of the device you used to access the Websites
    • The pages on the Websites that you viewed
    • The pages you visited before navigating to the Websites
    • Information about the computer or mobile device you use to access the Websites-hardware model, operating system and version, and mobile network information. TWC uses a variety of technologies to collect this data including cookies, beacons, tags, and scripts
    • Ensuring our Websites remain relevant to your needs and easy to use by providing analytics and other data regarding your use of our Websites as an end user
    • Delivering TWC newsletters, blogs and other content in response to your request
    • Providing confirmations, invoices, technical notices, updates, security alerts, as well as all other support and administrative messages involved in your request or purchase of TWC products and services
    • Alerting you to new products, special offers and promotions that may be offered by TWC and our selected partners
    • Keeping you informed about TWC promotional events
    • Contacting you regarding an open position at TWC for which you had previously applied

    How do we Use Information Collected on the Websites?

    We use the information we collect on the Websites for various purposes based on your request, including but not limited to:

    Third-Party Processors

    Our carefully selected partners and service providers may process personal information about you on our behalf, subject to the protections described in this policy.