Privacy policy

In short: no cookies, no advertising or tracking companies. You can use Sanctioni without an account and without telling us who you are. We process only what is needed to run your check and keep the service working.

Who is responsible

xbx gmbh, Heiligholzstrasse 6, 4142 Münchenstein, Switzerland — info@m-ove.ch. This policy follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

What you enter in a check

• Countries, goods and HS code are used to run the route and goods indicators.
• A counterparty name (and type, country, role) is compared with the official sanctions lists on our own server — it is not sent to anyone else. The check is for companies, organisations, banks, vessels and aircraft: Sanctioni does not screen individuals and keeps no entries about individuals from the sanctions lists.
• Checks are stored on our server so we can keep the service correct and prevent abuse. Checks made without an account are deleted automatically after 7 days and are not included in our backups.
• Please do not enter names of individuals. A company name can still contain a person's name (e.g. a sole proprietorship); it is treated like any other input and deleted after 7 days.

Requesting API access

If you request API access on the developers page, we store your work e-mail address, company, the use you describe and the expected volume, with the date — no IP address. We use them only to contact you about API access and to judge demand; nothing is passed on and you receive no newsletter.

Why we may do this (legal basis)

• Running a check you ask for, and recording its reference under the terms: to provide the service you use (GDPR Art. 6(1)(b)).
• An API access request: steps you ask for before a possible contract (GDPR Art. 6(1)(b)).
• Limits per visitor, security logs and statistics: our legitimate interest in a correct, secure and abuse-free service, and yours in screening your business partners (GDPR Art. 6(1)(f)).

Technical data

• To limit abuse of the free service, the number of checks per visitor is counted in memory using the IP address. This counter is not stored and disappears after at most one hour.
• Requests reach the application through a web server (reverse proxy) on the same rented server, which processes IP addresses and request data to deliver the pages.

Statistics without cookies

We count visits with Umami, an open-source statistics tool that runs on our own server. It sets no cookies and stores nothing on your device. To tell visits apart, it forms a pseudonymous identifier from the website, your IP address and browser information, combined with a secret value that changes regularly; the IP address itself is not stored. We see only aggregated figures (pages, referrers, countries, device types). If your browser sends “Do Not Track”, nothing is counted. The statistics stay on our server.

Cookies

Visitors receive no cookies. Only the team sign-in sets one technically necessary session cookie, for the members of our team who use it.

Who else is involved

We use no advertising, tracking or external analytics services, and fonts and all other resources are served from our own domain. Our server is rented from Hetzner Online GmbH in Germany (data centre Falkenstein), a country with an adequate level of data protection under Swiss law. Hetzner provides the hardware and network only; the software on it, including the web server described above, is operated by us. Links to the authorities (e.g. OFAC, EU Council) take you to their websites, where their own privacy policies apply.

How long we keep data

• Anonymous checks: 7 days, never in backups.
• Per-visitor limit counter: in memory only, at most one hour.
• Check reference (a random number shown with your result, the time and the terms version — none of your inputs, no IP address): up to 10 years, as proof that a check was run under the terms.
• API access requests: 12 months, never in backups — earlier on request.
• Backups of the rest of the database (sanctions lists, update pages): 30 days (daily) and 12 months (monthly).

Your rights

You may ask us what data about you we process, and ask for it to be corrected or deleted; you may object to its processing. Write to info@m-ove.ch. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU/EEA, to your data protection authority.

Sanctions data about people

Sanctioni does not process individuals from the sanctions lists: they are discarded when a list is imported, so we neither store, screen against nor publish them. The official list files themselves are not kept. Companies, organisations, vessels and aircraft are named as published in the official lists.