Privacy Policy

Effective date: 28 October 2026

1. Who we are

KeyWho is provided by DST DWC-LLC, trading as KeyWho, Dubai, United Arab Emirates (“we”, “us”). This policy explains how we handle personal data when you visit keywho.com, use the KeyWho service, or upload documents through a KeyWho link.

2. Our two roles

Our customers' verification cases. When a customer asks KeyWho to verify a company, the documents and the personal data in them (for example the names, ID or passport details of directors, shareholders or signatories) are processed on the customer's behalf. For this data the customer decides why it is processed, and we act as its processor. If your details were submitted in a verification, the customer who requested it is your first point of contact; we will help them respond to you.
Our own accounts, billing and website. For the data of people who sign in to KeyWho, buy from us or contact us, we decide how it is used and are responsible for it.

3. What we collect

Account data — name, business email address, organisation, role, sign-in and two-step verification details, language preference.
Verification data — the documents uploaded for a case, what is read from them, screening and register results, the outcome, the report and the certificate.
Counterparty upload data — when someone uploads through a KeyWho link: the documents, the email address the link was sent to, and the times the link was opened and used.
Billing data — purchase history, plan and invoices. Card payments are handled by our payment provider; we do not receive or store full card numbers.
Technical data — IP address, browser information and logs of actions in the service, used for security and to operate the service.
Correspondence — messages you send us and our replies.

4. How we use it

To provide the service: run verifications, produce reports and certificates, and send the emails the service needs (for example upload requests, sign-in codes and outcome notifications) — on the basis of our contract with the customer.
To bill for the service and keep accounting records — to perform the contract and meet legal obligations.
To keep the service secure, prevent misuse, and keep a tamper-evident audit trail — in our and our customers' legitimate interests.
To answer your questions and give support.
To comply with the law and respond to lawful requests from authorities.

We do not sell personal data, and we do not use verification data for advertising.

5. Automated processing

Documents are read with OCR and AI, and outcomes are proposed automatically from configurable rules and a transparent score. Each outcome is accompanied by the reasons for it. The outcome is information for our customer, who decides whether and how to do business; a customer can review a case, ask for it to be run again and contact us about it.

We share personal data only as needed to run the service, with service providers bound by confidentiality and data-protection obligations. They include providers of: cloud hosting and storage; AI and document-reading services; sign-in; email delivery; payment processing; and sanctions and PEP data and public-register lookups (which receive the names or identifiers being checked). A current list of these providers is available on request at admin@keywho.com.

We may also disclose data where the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.

7. Where it is stored

Verification documents and service data are stored encrypted in the European Union, in Amazon Web Services' Stockholm region. Some service providers — for example for sign-in, payments or email delivery — may process limited personal data in other countries. Where data is transferred outside the country where it was collected, we use the safeguards required by applicable law, such as standard contractual clauses.

8. How long we keep it

Verification cases are kept for the retention period set for the customer's account — seven years unless the customer chooses otherwise — and are then erased automatically. A customer can erase a case earlier.
Account data is kept while the account is active and for a reasonable period afterwards.
Billing records are kept for as long as accounting and tax laws require.
The audit trail records that a case existed and was erased, without the erased personal data.

9. Security

We protect data with encryption in transit and at rest, access restricted to those who need it, two-step verification for sign-in to administrative accounts, and an audit trail of actions in the service. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

10. Your rights

Depending on where you are, data protection laws — such as the UAE Personal Data Protection Law and, where it applies, the EU General Data Protection Regulation — may give you the right to access, correct, erase or export your personal data, to object to or restrict its processing, and to withdraw consent where processing is based on consent. To use these rights, email admin@keywho.com. We may need to confirm your identity. If your data was submitted in a customer's verification case, we will pass your request to that customer. You may also complain to your data protection authority.

11. Cookies

This website does not use advertising or analytics cookies. The KeyWho app uses only the cookies and browser storage needed to sign you in and keep your session secure.

12. Changes

We may update this policy. The current version is always on this page with its effective date; for material changes we will tell account holders by email.

13. Contact

DST DWC-LLC, Dubai, United Arab Emirates. Email: admin@keywho.com.