Privacy Policy

JRC RegRisk is a Paris-based RegTech business with a presence in France and Sierra Leone / West Africa, combining European regulatory and technology expertise with African and local market intelligence. We develop RegTech solutions for financial institutions and regulated businesses, bridging global compliance standards with the realities of evolving markets.

For the purposes of this Privacy Policy, the data controller is Janneh RegRisk Consulting Limited, trading as JRC RegRisk, a Private Company Limited by Liability incorporated in Sierra Leone (Company No. SL230125JANNE24090), with registered office at 1 Barrie Drive, New York, Freetown, Sierra Leone (“JRC RegRisk”, “we”, “us” or “our”).

This Privacy Policy explains how we process personal data in connection with the JRC RegRisk corporate website, newsletter, contact and demo requests, events, business-development activities and other interactions that link to this Policy.

This Policy governs the public corporate website and related business communications. It does not replace the privacy, confidentiality or data-processing terms applicable to a customer's use of IdentityProof, screening, training, Market Intelligence, Sandbox/evaluation environments, APIs, pilots or other JRC RegRisk products and professional services.

Where JRC RegRisk processes personal data on a customer's documented instructions, JRC RegRisk may act as a processor/service provider and the customer remains responsible for its own lawful basis, notices, instructions and compliance obligations, subject to the applicable contract and data processing agreement. Where JRC RegRisk determines its own purposes for a processing activity, it may act as controller for that activity.

• Business contact information, such as name, professional email address, telephone number, job title, employer/organisation, country and professional interests.
• Information submitted through contact, demo, partnership, event, newsletter or other website forms.
• Communications and correspondence with JRC RegRisk, including requests, feedback and support-related messages.
• Newsletter information, including subscriber email address, subscription status, unsubscribe/suppression status and distribution records.
• Technical and security information, including IP address, browser/device information, timestamps, server logs, authentication events and similar security data.
• Cookie, consent and preference information where cookies or similar technologies are used.
• Relevant professional contact information obtained from referrals, business networks or legitimate public/professional sources where lawful.

Do not submit government identity documents, biometric data, financial account information, special-category data or other sensitive personal data through public website forms unless JRC RegRisk has expressly requested it through an approved secure channel.

• To respond to enquiries, demo requests, partnership discussions and requests for information — steps taken at your request and/or our legitimate interests in managing business enquiries.
• To operate, secure, troubleshoot and improve the website and administrative environment — our legitimate interests in service integrity, cybersecurity, fraud prevention and business operations, and legal obligations where applicable.
• To manage customer, prospect and institutional relationships — our legitimate interests in relevant professional B2B engagement, or consent where required.
• To send the JRC RegRisk Intelligence Brief and other relevant communications — consent where required, or another lawful basis permitted for professional B2B communications, always subject to an easy opt-out.
• To comply with law, regulatory requests, audits, security investigations and legal claims — legal obligation and/or legitimate interests in protecting our rights and systems.
• To use non-essential analytics, advertising or similar tracking — consent where required by applicable privacy/ePrivacy law.

Where we rely on legitimate interests, we assess the necessity and proportionality of the processing and the reasonable expectations, interests and rights of the individuals concerned.

JRC RegRisk may send relevant professional communications to business contacts where permitted by applicable law and where the subject matter is connected to the recipient's professional role. Marketing and newsletter messages will identify JRC RegRisk and provide a simple way to unsubscribe or object. We may retain limited suppression information after an opt-out so that we can continue to respect that choice.

Cookies and similar technologies are used only as described in our Cookie Policy. Strictly necessary technologies may operate without consent where legally permitted. Non-essential technologies are subject to applicable consent requirements. If individual email-open tracking pixels or comparable technologies are enabled, JRC RegRisk will apply the transparency, consent and/or objection requirements applicable to that use.

Personal data may be disclosed, where reasonably necessary, to:

• authorised JRC RegRisk personnel and contractors who require access for their role;
• cloud, hosting/infrastructure, database/authentication, cybersecurity, email-delivery, communications and other technology providers under appropriate contractual arrangements;
• Cloudflare for website delivery, network security and the configured website hosting service; the managed cloud platform for application data, authentication and storage; Resend for newsletter confirmation and other requested email delivery. These services process relevant technical, account, contact or email data to provide their respective functions;
• professional advisers, auditors, insurers, banks or legitimate transaction counterparties where necessary and lawful;
• courts, regulators, law-enforcement bodies or other competent authorities where required by law or necessary to protect legal rights;
• a legitimate successor or acquirer in connection with a financing, reorganisation, merger, sale or transfer, subject to appropriate safeguards.

JRC RegRisk does not sell personal data for monetary consideration.

Provider integrations have been identified from the website configuration. The contracting legal entities, executed data-processing agreements, selected hosting/database regions, provider processing locations and subprocessors are subject to verification by JRC RegRisk. No particular storage country or signed contractual safeguard is represented as confirmed by this Policy.

JRC RegRisk operates internationally and may use service providers located in different countries. Where personal data protected by EU/EEA law is transferred to a country not recognised as providing an adequate level of protection, we will use an appropriate transfer mechanism where required, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful mechanism, together with supplementary safeguards where appropriate.

Provider processing may involve access or transfers outside the EEA. The actual locations and transfer mechanisms applying to our accounts are being verified; we do not assert a particular adequacy certification, executed Standard Contractual Clauses or EEA-only processing without that verification. Contact info@jrcregrisk.com for current information about your data and applicable safeguards.

We retain personal data only for as long as reasonably necessary for the relevant purpose, taking account of legal, contractual, security and evidential requirements. Business-development records are periodically reviewed and are normally deleted or anonymised when no longer reasonably required. Newsletter information is retained while the subscription is active; limited suppression information may be retained longer to honour opt-outs. Security logs are retained for a proportionate period and may be preserved longer where an incident, investigation or legal obligation requires it.

We use administrative, organisational and technical safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No internet transmission, software platform or electronic storage system can be guaranteed to be completely secure.

Depending on the law applicable to you, you may have rights to obtain information about processing, access personal data, correct inaccurate data, request deletion or restriction, object to certain processing, receive certain data in a portable format, withdraw consent and lodge a complaint with a competent supervisory authority. Withdrawal of consent does not affect processing lawfully carried out before withdrawal.

Individuals in the EU/EEA may complain to the competent supervisory authority in their country. In France, the supervisory authority is the Commission nationale de l'informatique et des libertés (CNIL).

Where a U.S. state privacy law applies to JRC RegRisk and grants an individual additional rights, JRC RegRisk will honour those rights as required. Depending on the law, these may include rights of access/knowledge, correction, deletion, portability and rights relating to certain sales, sharing or targeted advertising. JRC RegRisk does not sell personal information for monetary consideration.

The corporate website is intended for business, institutional and professional audiences and is not directed to children. We do not knowingly seek to collect children's personal data through the public corporate website.

The public corporate website does not make decisions producing legal or similarly significant effects about visitors solely by automated means. Automated processing within contracted JRC RegRisk products, where applicable, is governed by the relevant product documentation, customer instructions and contractual/privacy arrangements.

Privacy enquiries and rights requests may be sent to info@jrcregrisk.com. We may request reasonable information to verify identity before acting on a request and will respond within the period required by applicable law.

We may update this Privacy Policy to reflect changes in our business, technology, services or legal obligations. The current version will be posted on the website with an updated date. Where required by law, additional notice will be provided for material changes.