Vespia

GDPR overview

GDPR implementation is concrete and documented. The publisher is established in Estonia, so it falls directly under the regulation. The privacy policy is built around GDPR terms, names legitimate interest as the legal basis for processing client contacts, lists the rights of access, rectification, erasure, restriction and objection with a 30-day response window, and names the Estonian Data Protection Inspectorate as the supervisory authority. A Data Processing Agreement concluded under Article 28 is published as Appendix 1 to the terms, with a schedule of technical and organisational measures. Transfers outside the EU are limited to GDPR Chapter V conditions, and Standard Contractual Clauses are cited for the Australian screening provider. Sub-processor changes are notified by email with a seven-day objection window. No Article 27 representative is designated, and none is required.

Who owns the data?

Ownership is split. The customer keeps its Client Data and stays solely responsible for its lawfulness, quality and accuracy; under the Data Processing Agreement the customer is the controller and Vespia the processor acting on instruction. Vespia keeps exclusive intellectual property over the platform itself and grants only a limited, non-exclusive, non-transferable licence for the duration of the contract. Two clauses shift value the other way: any feedback a customer gives becomes Vespia's exclusive property with an irrevocable assignment of rights, and Vespia may use Client Data in aggregated or anonymised form for internal analysis, marketing and product development. Customers can export their data as PDF from the dashboard within one month of termination.

Reuse rights

Verification results are the customer's to use inside its own AML process: PDF reports, machine-readable reports and a full audit trail can be pulled from the dashboard, requested through the API, or asked for by email. No further permission from Vespia is needed for that operational reuse. The limits are legal rather than contractual: the customer must hold an appropriate legal basis for every search it runs, and Vespia disclaims responsibility for the accuracy or completeness of information coming from commercial registers, PEP and sanctions lists and adverse-media databases. The final decision on any verified company or person stays with the customer, and Vespia explicitly declines to advise whether the information obtained is sufficient. After termination, a history extract can be requested, and Vespia may charge for it. Accepting the terms also lets Vespia use the customer's name and logo in its own marketing materials.

Data retention & training

Hosting summary

Hosting runs entirely on Amazon Web Services, described in the Data Processing Agreement as a single strategic infrastructure, storage and database partner, with the statement that data never leaves AWS servers and that customer data may not be stored outside that partner's infrastructure. By default data is stored in the EU unless otherwise agreed, and the privacy policy states that personal data is processed within the European Economic Area as a rule, with any transfer outside it following GDPR requirements. Transfers outside the EU are limited to Chapter V conditions, and Standard Contractual Clauses are cited for the Australian screening provider NameScan. The published technical measures include encryption in transit and at rest, role-based access control, access logging, logical separation of client data and separated test, development and production environments. One point of attribution matters: the ISO 27001, 27017 and 27018 certifications and the SOC and CSA STAR reports listed in the agreement belong to the hosting provider, not to the publisher, which claims no certification of its own.