Data-use statement

This statement says what personal data the Prometiam API keeps about people named in company registers and on lists, where it comes from, who receives it, for how long it is kept, and how a person can object or ask for access, correction or erasure. It supplements the Privacy Policy and the Terms of Service. It is written for the people concerned, for the registers and statistics offices that publish the data, and for supervisory authorities.

1. Who is responsible

Prometiam, based in Barcelona, Spain, is the controller of the personal data described here. Contact: privacy@prometiam.com. Prometiam has not appointed a Data Protection Officer.

2. What the Service is

The Service is an API for businesses, professionals and public bodies. It returns company records from official registers and, for some countries, the people those registers name as officers or owners. Customers receive the data through the API, our MCP server and webhooks. We publish no company or person pages for search engines to index.

3. Why we process it, and where it comes from

Our basis is legitimate interest (Article 6(1)(f) GDPR): the interest of businesses, banks and professionals in verifying who stands behind a counterparty, in meeting anti-money-laundering and due-diligence duties and in preventing fraud. The balancing is in section 2.3 of the Privacy Policy. We do not collect the data from the people concerned. The source is always an official register or list, named in section 4, or a company's own website.

4. Sources by country

The register or authority that publishes each dataset and the credit line, with the licence, that travels with every answer. The full register of sources is at /data/assurance.

5. Fields kept about people

Only fields that the source itself publishes are kept, and only those named here. We keep no postal address of a person, other than the business address that the register publishes for a sole proprietorship (France, Norway), and we take nothing from social networks, data brokers or other private sources.

Outside the company registers:

• Sanctions lists. Individuals listed by the issuing authority: name, aliases, date of birth, nationality, identification numbers and the listing details, as the authority publishes them. Screening is in beta.
• Politically exposed persons. Spain only, in beta: name and public office, from public sources.
• Business contact details. Role-based e-mail addresses and phone numbers that companies publish on their own websites and, occasionally, the work contact details of a named employee where the company publishes them on a public contact or team page.
• Insolvency notices. Corporate notices only, in the markets listed in the documentation; notices that name individuals are filtered before they are served.
• Public procurement. The buyer and the awarded supplier, as the public award notice names them.

6. Who receives it, and on what terms

• Our customers, who are businesses, professionals and public bodies. A customer has an account, accepts the Terms of Service and declares the purposes for which it uses the Service (Terms, section 5.1; the section numbers in this list are those of the Terms). It is a separate controller of what it receives (section 7.3). It may not use the data to decide an individual's eligibility for consumer credit, insurance, employment, housing or a public benefit, to send direct marketing to individuals, to publish it about individuals, to locate or track a person, or to profile an individual outside their role in a business (section 5A). It may not use it to train AI models (section 5.3). It must apply every removal and correction we pass on within 10 working days, keep the data only as long as its purpose needs, check a record older than 12 months before relying on it, delete it when its account ends, and pass the same duties on to its own customers (section 7A). We may ask a customer to show how it uses the Service and suspend its keys if it does not (section 7B).
• Our processors (hosting, e-mail, payment and similar services), who handle the data on our instructions. They are listed with their purpose and location on the sub-processors page.
• Registers and authorities that ask how data from the Service is used: we may tell them which account received which data, when, and for which declared purpose (section 7B.2).

7. How long we keep it

• Register data about people: while the register publishes it. When the register removes it, we remove it at the next update of that register.
• Records of API calls: 12 months.
• Requests from people, and our answers: three years, as proof of compliance.
• Records of acceptance and declared purposes: while the customer's account exists and for five years after it ends.
• Business contact details from websites: re-checked against the company's website at least every 24 months and deleted when they can no longer be confirmed.

8. Your rights, and how to use them

You can ask us for access to the data we hold about you, for its correction or erasure, and you can object to our serving it. Write to privacy@prometiam.com, say which right you use and which company you appear in, and we may ask you to prove who you are. We answer without undue delay and within one month, which can be extended by two months for a complex request, and we charge nothing.

We assess each objection against your particular situation (Article 21(1) GDPR): we stop serving your details unless we can show compelling legitimate grounds that override your interests, rights and freedoms, and an objection by or for a minor or a protected person is always granted. When we erase, correct or suppress details, we tell the customers that received them, who must apply it within 10 working days, and on request we tell you who they are. The register still publishes the data, and a correction to the data itself must be made at the register to last.

9. Complaints

You can complain to the supervisory authority. For Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.