Privacy Policy

Last updated: 12 July 2026

WhoWiki (“WhoWiki”, “we”, “us”, or “our”) runs the website at whowiki.org and the compliance and verification tools on it. This policy explains what personal information we collect, why we collect it, how we use and share it, and the choices and rights you have.

We built WhoWiki around clear, transparent tools, and we take the same approach to your data. If anything here is unclear, email us at info@whowiki.org.

Who we are

WhoWiki provides AML, KYC, sanctions, and business-verification tools, along with a glossary, guides, and other reference content, at whowiki.org. For the purposes of data protection law, WhoWiki is the data controller for the personal information handled through this site. For any question or request, contact info@whowiki.org.

Information we collect

Information you give us directly

• Contact and inquiry details. When you fill in a form, request a walkthrough, or email us, we collect your name, email address, company name, and anything you include in your message. Our forms are handled by HubSpot (see “How we share information”).
• Resource downloads and sign-ups. When you download a template, checklist, or other resource, or subscribe to our updates, we collect your email address and any details the form asks for.

What you type into our tools

This is the part people ask about most, so we want to be clear about it.

• Client-side tools. Many of our tools, including the IBAN validator, the SWIFT/BIC structure check, and the calculators and assessments, run entirely in your browser. The names, numbers, or codes you enter are processed on your own device. They are not transmitted to us and are not stored on our servers.
• Password checker. Our password check uses a method called k-anonymity that never sends your full password anywhere. Only a short, partial fingerprint leaves your browser, and your password itself cannot be reconstructed from it.
• Data-backed tools. Some tools, such as sanctions and PEP checks or company and LEI lookups, compare your query against reference data held on our servers or retrieved from an official source. To return a result, the term you enter (for example, a name or company number) is processed by our systems or sent to the relevant data provider. We use what you enter only to run that check and return a result. We do not use it to identify you or build a profile of you.
• A note on the data you screen. If you enter another person’s details into a screening tool, you are responsible for having a lawful basis to do so under the laws that apply to you. Our tools give indicative results and are not a substitute for regulated screening or professional advice. See our Disclaimer.

Information we collect automatically

• Usage and analytics data. Pages you visit, links you click, which tools you use, time on page, the site that referred you, and similar. We use Google Analytics for this.
• Device and connection data. IP address, browser type, operating system, device type, and approximate location derived from your IP.
• Server logs. Our host and our content delivery network keep standard logs, which may include your IP address, request times, and pages requested, for security and reliability.
• Cookies and similar technologies. See our Cookie Policy for detail.

How we use your information, and our legal bases

Under the UK GDPR and the EU GDPR, we rely on one or more of these legal bases:

• To respond to your inquiries and provide what you ask for (performance of a contract, or our legitimate interest in helping you).
• To deliver resources you request and, with your consent, send related updates you can opt out of at any time (consent, and legitimate interest).
• To run, secure, and improve the site and our tools, including analytics (legitimate interest, and consent for non-essential cookies).
• To meet our legal obligations, and to detect and prevent fraud, abuse, and security incidents (legal obligation, and legitimate interest).

Where we rely on legitimate interests, we have weighed those interests against your rights, and you can object to that processing (see “Your rights”). We do not sell your personal information, and we do not make automated decisions that produce legal or similarly significant effects about you.

Cookies

We use cookies and similar technologies to run the site, remember your preferences, and understand how our tools are used. They fall into three groups: essential cookies needed for the site to work, analytics cookies (Google Analytics), and functional cookies that remember your choices. We do not use advertising cookies. Where required, we ask for your consent before setting non-essential cookies, and you can control cookies through your browser at any time. For the full detail, see our Cookie Policy.

How we share information

We do not sell your data. We share it only with service providers who help us run WhoWiki, and only as far as needed. These include:

• HubSpot: forms, contact management, and email.
• Google Analytics: website analytics.
• Hostinger (hosting) and Cloudflare (content delivery and security): to serve and protect the site.
• Our email provider: to send messages you have signed up for.
• Official data sources: when you run a data-backed tool, your query may be sent to the relevant government or open-data source to return a result. See our Data Sources page.

We may also disclose information where the law requires it, to enforce our terms, or to protect the rights, safety, and security of WhoWiki, our users, or others. If our business is ever involved in a merger, acquisition, or sale of assets, information may be transferred as part of that, and we will let you know.

International data transfers

Some of our providers are based outside the UK and the European Economic Area, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards, such as the UK and EU Standard Contractual Clauses or another approved transfer mechanism, so your data stays protected. Contact us if you would like more detail.

How long we keep information

We keep personal data only as long as we need it for the purposes in this policy, or as the law requires. We hold contact and inquiry details for as long as it takes to deal with your request and for a reasonable period afterward. We keep marketing sign-ups until you unsubscribe. Analytics and server logs are retained for a limited period, then deleted or anonymized. You can ask us to delete your details sooner at any time.

Your rights

If you are in the UK or the EEA, you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Ask us to delete your data.
• Restrict or object to how we use it.
• Receive your data in a portable format.
• Withdraw consent at any time, where we rely on it.
• Complain to a supervisory authority. In the UK that is the Information Commissioner’s Office (ico.org.uk). In the EEA it is your local data protection authority.

To use any of these, email info@whowiki.org. We will respond within the time the law allows, normally one month, and we may need to confirm your identity first.

US state privacy rights

If you are a resident of California or another US state with a privacy law, you may have rights to know what personal information we collect, to request access or deletion, and to opt out of the “sale” or “sharing” of personal information as those terms are defined by law. We do not sell personal information. To exercise your rights, contact info@whowiki.org, and we will not discriminate against you for doing so.

Security

We take reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS), access controls, and reputable service providers. No method of transmission or storage is completely secure, so we cannot promise absolute security, but we work to protect your data and to respond quickly if something goes wrong.

Children’s privacy

WhoWiki is a business tool intended for professionals. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us their information, contact us and we will delete it.

Links to other sites

Our site links to third-party sites, including official government and data sources. We are not responsible for their content or their privacy practices. Please read their privacy policies before sharing information with them.

Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top, and for significant changes we will give a more prominent notice. Please check back so you know how we handle your information.

Contact us

For any privacy question or request, contact WhoWiki at info@whowiki.org. You can also read our Terms and Disclaimer.