Terms and Conditions

We are R&R Compliance Consultants Ltd, company number 12070286, registered at 51 Lime Street, London, England, EC3M 7DQ, trading as RR Compliance Associates. Contact us at contact@rrcompliance.com for support, complaints and contractual notices.

“You” means the business identified in the account. RegScreen is provided for business purposes. Anyone creating an account or accepting these terms for a business confirms that they have authority to act on its behalf.

By creating an account, subscribing or using RegScreen after these terms have been clearly presented and made available to you, you accept them on behalf of your business. The agreement begins on that acceptance and is made electronically; no order form, separate signature or countersignature is required. If you do not agree, do not create an account or use the service.

A paid subscription begins when payment succeeds. The plan, price, billing period, included features and limits shown before you subscribe form part of the agreement. Your own standard terms do not apply unless we expressly agree in writing. Section 15 takes precedence on processing personal data on your behalf.

The privacy notice explains our use of personal data. Acceptance of these terms is not consent to optional Analytics, marketing or unrelated processing; those choices are handled separately.

RegScreen provides the following services with shared compliance management and report-recording tools. Availability depends on your plan, supported sources and settings.

1. RegScreener — company register comparison. Compare information you hold about a firm with supported UK registers, including the FCA Register, Companies House and the ICO register. Identify differences and retain supporting evidence. This does not itself constitute sanctions screening of the organisation.
2. Sanctions and AML screening. Screen selected individuals against available sanctions, politically exposed person (PEP) and structured adverse-information datasets. Results identify potential matches and indicators for your anti-money laundering (AML) assessment. This is not documentary identity verification or a comprehensive search of news or the internet.
3. Identity, address and liveness verification. We arrange the selected identity-document, proof-of-address, liveness and face-matching checks through Didit and present selected results and warnings for your review. The checks depend on the product selected. Standalone liveness does not establish a match to an identity document. Section 16 explains this service.
4. Automated reminders. Receive notifications about relevant changes, findings and monitoring issues. Scheduled monitoring can repeat checks at your selected supported frequency, with alerts governed by your settings. You remain responsible for reviewing findings and taking action.

The screening elements can be used independently or together, with reminders supporting ongoing oversight. Shared tools help you organise reports, review findings, record decisions and rationale, retain evidence, track review status and export permitted records.

Results reflect the sources, identifiers, matching criteria and information available at the time of the check. An unavailable or incomplete source is not a clear result. A possible match is not proof of identity, wrongdoing or a legal restriction; a no-match result does not establish that no relevant record or risk exists.

We provide the service with reasonable care and skill. RegScreen supports your procedures; it does not provide legal advice, regulatory approval or a guarantee of compliance. You remain responsible for your due diligence, interpretation of results and decisions.

We grant your authorised users a limited, non-exclusive right to use the service for your lawful business purposes during the applicable access period. Keep account details accurate, assign appropriate permissions, protect credentials and remove access when no longer required. Notify contact@rrcompliance.com promptly of suspected unauthorised access or a material service error.

You are responsible for your users and integrations within your reasonable control, including instructions submitted through them. When acting for another organisation, you must have authority to do so and comply with its lawful instructions and any required data-processing arrangements. These obligations apply to all customers and users.

You must not bypass access controls or usage limits, introduce malware, interfere with the service, unlawfully reverse engineer it, scrape or reconstruct source databases, or use it for unlawful surveillance, harassment or discrimination. Security testing requires advance agreement on scope. Rights that cannot lawfully be restricted remain unaffected.

Reselling, sublicensing and white-labelling RegScreen are prohibited. Do not offer it as your own platform, share credentials with unauthorised parties or remove branding, attribution or rights notices.

You are responsible for the authority, lawful basis, privacy notices and any additional legal conditions needed for the personal data you submit or instruct us to process. This includes special-category and criminal-offence data. Submit only necessary information and respect applicable source restrictions; public availability does not remove data-protection duties.

Check source coverage, timestamps, uncertainty and possible matches. Do not rely on an unreviewed match or score alone to make an adverse decision about a person. Record your decisions and reasons and undertake further checks where appropriate.

Enabling monitoring instructs us to repeat the selected checks and use the applicable credits. Monitoring depends on eligible access, sufficient credits and service/source availability. Checks may be delayed, fail or pause. Alerts depend on your settings, and acceptance by an email provider does not guarantee inbox delivery.

Keep a responsible person assigned to reviews, check the workspace for findings and service issues, and maintain an appropriate fallback process. You can change supported settings or pause monitoring. A reminder does not transfer responsibility for your compliance obligations to us.

Prices, included credits, features and limits are as indicated on our website and presented before you subscribe. The details applicable to your subscription remain subject to changes notified under section 11.

The free trial provides 10 screening credits once per trial workspace, expiring 30 days after grant. Credits do not replenish when used or expired, and the trial does not automatically become a paid subscription. We make the grant and expiry dates available in your account. Do not create duplicate workspaces to obtain additional trial allowances.

A firm-register check uses 1 credit and combined individual screening uses 6 credits. One firm and two selected individuals therefore use 13 credits. Individuals are screened only when requested; repeat monitoring checks also use credits. Applicable credit costs are shown before you instruct the work.

Monthly credits expire at the end of their billing period unless section 7 provides for carry-forward. Credits are not transferable between customers, have no cash value and cannot be exchanged for money. Unused credits do not themselves create a refund entitlement.

Eligible active paid subscribers may purchase top-ups at £0.15 per whole credit, with a minimum of 2 credits. Top-ups expire 365 days after purchase. Pausing screening, cancellation or non-payment does not pause their expiry.

Checks that fail because of technical issues do not use credits. Credits deducted for a failed check will be restored and unused reservations released. Successfully completed checks within the same request remain chargeable. Where an outcome is uncertain, we will reconcile it before confirming the adjustment.

Report an apparent billing or credit discrepancy to contact@rrcompliance.com with the relevant reference. We will investigate and correct established errors without altering unrelated balances or evidence.

Paid subscriptions renew monthly at the disclosed recurring price unless cancelled before renewal. By subscribing, you authorise recurring charges until cancellation takes effect. Billing dates are shown in your account.

An upgrade requires payment of the new plan's full monthly price, starts a new billing cycle and grants the new allowance once. Eligible unused, unexpired subscription credits carry to the new cycle end. There is no prorated refund of the previous plan under this method. Spent or expired credits are not restored, and top-up expiry dates remain unchanged.

A downgrade takes effect at the next renewal. Existing paid features continue until then. Monitoring at a frequency unsupported by the lower plan pauses until you select a supported frequency. You may cancel or replace a scheduled downgrade before it takes effect.

Cancellation stops renewal at the end of the paid period and does not itself produce a refund. New screening, monitoring and top-up purchases stop when paid access ends, or pause following non-payment. No new paid allowance is granted while the relevant payment remains outstanding.

Saved results, billing history and exports remain available in read-only mode for 30 days from the end of paid access or the missed renewal payment becoming due, as applicable. Cancelling before the paid end does not shorten the paid period.

After those 30 days, automatic access ends. Records are held in restricted retention for a further 11 calendar months, measured from the end of the initial 30-day period. During that fixed window, you may request read-only access and exports from contact@rrcompliance.com. We verify the requester's authority before providing access. A later request does not restart or extend the window.

No separate retention agreement is required. Restricted records are not used for new screening or monitoring. Export records you need before your deadline; the applicable end date is made available in your account or on request. At the end of the window, section 15.7 applies. Earlier lawful deletion instructions may end availability, and deleted records cannot be promised to be recoverable.

Any unexpired purchased credits retain their original expiry and can be used only with eligible account access. Payment recovery relates to the relevant billing period and does not automatically extend credit expiry.

We want you to receive the service you have paid for. If something goes wrong, contact contact@rrcompliance.com with your account and check or invoice reference so we can investigate and put it right. Please do not email identity documents or payment-card details.

If a technical failure prevents correct delivery of a check, we will repeat the affected work without an additional charge or release or restore the corresponding credits, as appropriate. Uncertain outcomes are investigated before adjustment and are not treated as clear results.

If a material service failure cannot be resolved within a reasonable time, we will refund the proportion of the amount paid attributable to the service not supplied. An individual failed check does not automatically entitle you to a refund of an otherwise supplied subscription period. A monetary remedy will be provided where required by law or where restored credits would not reasonably put the matter right.

A correctly completed check remains chargeable whether it returns a match, no match, decline, warning or outcome requiring review. Cancellation, non-use, downgrade, credit expiry or suspension caused by your breach does not itself create a refund entitlement. We do not offer an additional voluntary cooling-off period for this business service.

Duplicate or incorrect charges caused by a payment-processing error will be corrected or refunded without deducting the cost of correcting our error. Adjustments concern the affected payment or service, without duplicate recovery or deductions from unrelated balances. Credit-expiry rules are unchanged unless the correction requires adjustment. Nothing limits rights or remedies that cannot lawfully be excluded.

You retain rights in your submitted information, review decisions and independently created advice. We may use that material only as necessary to provide, secure and support the service, follow lawful instructions and meet legal obligations. We do not acquire ownership of your customer records.

RegScreen and our proprietary know-how remain ours. This includes software, code, interfaces, workflows, methods, configurations, report designs, documentation, branding and improvements. You receive the use rights stated in these terms, not ownership. Do not disclose our confidential know-how or use it to copy or build a competing service. Statutory rights remain unaffected.

Third-party technology and licensed datasets remain subject to their owners' rights. We do not claim ownership of public facts or rights you independently hold under a source licence.

You may use permitted reports and exports for the compliance work covered by your account and share them with authorised recipients, advisers, auditors and regulators, subject to law and source licences. Preserve attribution, dates, qualifications and uncertainty, and secure exported files. Reports must not be resold, publicly republished or used to reconstruct source databases without the necessary rights.

Material additional source-use restrictions will be disclosed before they apply. We will not use your name or logo for publicity without permission.

Each party will protect the other's confidential information, use it only for the agreement and disclose it only to people who need it and are subject to appropriate duties. This does not cover information already lawfully known, independently developed or lawfully public. Legally required disclosure is permitted; where lawful, give notice and limit disclosure to what is necessary.

For customer-directed screening data, we act as processor, or subprocessor where you act for another controller. Section 15 governs that processing. Our privacy notice covers separate controller activities, including account administration, billing, enquiries and our own security/legal records. Actual activities determine each party's legal role. Neither these terms nor your instructions remove duties imposed directly on us.

No particular uptime, support-response time or recovery objective is guaranteed unless expressly agreed in writing. We use reasonable care to operate the service, communicate material disruption and address defects within our responsibility. Source limitations do not excuse our own avoidable failures.

We may make reasonable changes to maintain or improve the service. Price and material contractual changes require at least 30 days' notice and apply prospectively from the stated eligible renewal or, for free accounts, the notified effective date. You may decline by cancelling or stopping use before that date. Continued use after that date, following clear notice of the changes, constitutes acceptance. New charges still require a paid subscription; use of a free account does not authorise payment.

Material reductions to paid functionality also require 30 days' notice and must respect paid entitlements and applicable remedies. Necessary legal or security changes may take effect sooner. Changes do not remove accrued rights or retrospectively alter accepted payments. Section 8 governs refunds.

We may restrict access proportionately where reasonably necessary for security, unlawful use, material breach or non-payment. Where practicable, we will explain the reason and restoration steps; urgent protective action may precede notice. Restrictions do not remove our data-protection obligations.

Either party may terminate for a material breach not remedied within 30 days after written notice, or immediately if it cannot be remedied or continued performance would be unlawful. Rights to terminate following a material service change also apply.

Access and return/deletion of records are governed by sections 7 and 15.7, subject to necessary security restrictions. Payment obligations already incurred, confidentiality, intellectual-property rights, data-protection duties, liability limits and dispute provisions continue where needed after termination.

Nothing limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be limited. Nothing restricts individuals' statutory data-protection rights, regulators' powers or refunds expressly due under section 8.

Subject to that paragraph, we are not liable for loss of profit, revenue, business, anticipated savings, goodwill or business opportunity, or indirect or consequential loss, whether arising in contract, negligence or otherwise, to the extent this exclusion is lawful and reasonable.

Our total aggregate liability arising from this agreement, including negligence and breach of data-protection obligations, is limited to the greater of: (a) the subscription fees you paid or were due to pay for the 12 months immediately before the first event giving rise to liability; and (b) three months of your subscription price at that time. For a free trial or other account without a paid plan, the minimum is three months of the lowest paid plan's monthly price then advertised on our website. The limit applies across all claims and authorised users under this agreement, subject always to the first paragraph and any legal requirement that a limitation be reasonable.

You remain responsible for screening decisions, the lawfulness and accuracy of submitted data, follow-up and continuity arrangements appropriate to your business. We are not responsible for loss to the extent caused by your breach, misuse or failure to take reasonable steps to mitigate it. This does not excuse our own breach or statutory obligations.

You will reimburse reasonable losses and defence costs arising from a third-party claim to the extent caused by your unlawful use of the service, infringement of third-party rights in material you submit, or material breach of your screening-authority obligations. This does not cover loss caused by our own breach or any fine or liability that cannot lawfully be passed on. We will notify you promptly, take reasonable steps to limit the loss and consult you before agreeing any settlement for which we seek reimbursement.

Neither party is responsible for delay caused by events beyond its reasonable control that it could not reasonably avoid, provided it gives notice where practicable, mitigates the effects and resumes performance promptly. This does not excuse accrued payments, lack of reasonable precautions or statutory obligations. Either party may end an affected service after 30 consecutive days of material interruption; section 8 remains applicable.

We send contractual notices to your account email and may also display them in the service. Keep your email address current. Send notices to contact@rrcompliance.com. Formal court documents remain subject to applicable service rules.

Neither party may transfer this agreement without the other's written consent, not unreasonably withheld, except a corporate reorganisation that does not materially reduce protection or service. A failure to enforce a term is not a waiver. If a provision is unenforceable, the remainder continues. No third party has contractual enforcement rights unless expressly stated; statutory rights are unaffected.

These terms and your subscription details form the agreement for RegScreen. It is governed by the law of England and Wales, whose courts have exclusive jurisdiction, subject to rights that cannot lawfully be excluded. The parties will try in good faith to resolve disputes through their contacts before proceedings; this does not prevent urgent relief or regulatory complaints.

This section forms the binding processing terms for personal data we handle on your behalf. No separate data-processing agreement is required. Applicable law includes the UK GDPR and Data Protection Act 2018, as amended, and the EU GDPR where applicable to the processing.

15.1. Processing description

Subject matter

Company register comparison; selected sanctions/AML screening; identity, address, liveness and face-matching checks; reminders, monitoring, assessment records, reports and associated support.

Purpose and operations

Receive submitted details; query sources; compare and present potential matches; arrange hosted verification and transmit request details; receive and retain selected assessments; support review, monitoring, alerts, permitted report downloads, return and deletion. Didit performs document and biometric analysis.

Duration

The service period and instructed read-only/restricted retention under section 7, subject to earlier lawful deletion and section 15.7.

Individuals

Customers, prospects, counterparties, directors, officers, owners and other selected people; authorised users and reviewers where their records are processed on your behalf.

Data

Names, aliases, relevant dates, nationality/country, address details, business links and identifiers, source records, candidate scores, instructions, reviewer notes, decisions and audit references. Identity checks also involve provider-held documents and facial captures, and selected extracted details, outcomes and warnings retained by RegScreen. Original document images, facial recordings and biometric templates are not retained in the assessment database.

Sensitive information

Screening material may include political affiliations, other special-category data, allegations, convictions, offences or related measures. Selected identity checks involve facial biometric processing by Didit. You must establish the applicable lawful basis and additional legal conditions. Processing follows lawful instructions, supplier permissions and safeguards; instructions cannot override legal or source restrictions.

Roles

You are normally controller. If you are a processor for another organisation, you must have authority to appoint us and pass through its instructions. We are processor or subprocessor for this activity; separate controller activities are covered by our privacy notice.

15.2. Standing instructions

Accepting these terms, selecting settings and submitting screening, monitoring or support requests provides your documented instructions for the corresponding processing, including transfers under section 15.5. Routine operations do not require separate instruction forms or approval requests.

We will process personal data only on those instructions unless UK law requires otherwise, or EU or Member State law where the EU GDPR applies. We will inform you beforehand unless the relevant law prohibits this. We will tell you immediately if we consider an instruction unlawful. We do not repurpose customer screening inputs, identity-verification data or review records for advertising, independent datasets or AI model training, and do not authorise our verification providers to do so. Automated matching and verification may be used to deliver the checks you request.

You determine the purposes and lawful basis for your checks, provide the necessary privacy information and meet any additional sensitive-data conditions, including obtaining and being able to demonstrate consent where required. Acceptance of these business terms or continued use does not substitute for an individual’s explicit consent where that is required. We remain responsible for obligations that apply directly to us.

15.3. Confidentiality and security

Personnel processing customer data must be subject to confidentiality duties and appropriate access controls. We will maintain technical and organisational measures meeting Article 32 of the UK GDPR, appropriate to the processing risks, including confidentiality, integrity, availability, recovery and regular assessment of security measures.

15.4. Subprocessors and notification

Acceptance of these terms gives general written authorisation to use subprocessors for the service. Separate approval for each appointment is not required. We make current provider identities, activities, relevant data, processing/access locations and transfer safeguards available before acceptance; updated details are available from contact@rrcompliance.com.

We give at least 30 days' written notice of intended additions or replacements, with relevant details. You may object on reasonable data-protection grounds during that period. We will address an objection before the change takes effect through a suitable alternative or cessation of the affected processing. If there is no objection, we may proceed after the notice period. Sections 7 and 8 govern resulting access and refund treatment.

Subprocessors must be bound by equivalent data-protection obligations, and we remain responsible to you for their performance of those obligations. Providers may support hosting, storage, screening queries, communications and support. A provider acting independently as controller is assessed according to that role.

15.5. UK hosting and international transfers

RegScreen's core application and system operations run on UK-hosted infrastructure. Its primary database of customer screening records, reports and decisions is stored in the UK. Service-provider processing, transfers and authorised access may occur outside the UK as described in this section.

The agreement gives standing instructions for transfers needed to provide, secure and support the service, including in both directions between the UK and the European Economic Area (EEA), which includes the EU. No separate customer approval is needed for each transfer. Section 15.4 continues to govern subprocessor changes.

We rely on applicable adequacy arrangements for UK–EEA transfers while they remain effective and cover the transfer. Other transfers must also meet applicable law. Where adequacy does not apply, we will put a lawful transfer mechanism, required assessment and necessary supplementary safeguards in place before transferring. Country and safeguard information is available from contact@rrcompliance.com.

15.6. Data-protection assistance

We will notify you without undue delay after becoming aware of a personal data breach affecting data processed on your behalf. We will provide available information about its nature, affected data and people, likely effects, response and contact point, with updates as facts become available. You control notifications to individuals and regulators unless law independently requires us to act.

Taking account of the processing and information available, we will assist with individuals' rights, security, breach obligations, impact assessments and necessary regulatory consultation. Requests concerning your data will be referred to you promptly; we respond on your behalf only when instructed or required by law.

We will provide information needed to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections, by you or your appointed auditor. Reasonable notice and confidentiality/security arrangements may protect the service and other customers, but must not obstruct legal rights or regulatory oversight.

15.7. Return, deletion and retained copies

At your choice, we will return or delete data processed on your behalf when that processing ends, and delete copies unless UK law requires retention. The access and restricted-retention periods in section 7 are standing instructions; earlier lawful deletion remains possible. At their end, we will delete the records after providing any return you have instructed before deletion.

Backup copies awaiting erasure will be protected, put beyond ordinary use and deleted as soon as possible through the backup-deletion cycle. Relevant deletion instructions will be reapplied if a backup is restored. Legally required retention is limited to the necessary data and purpose with restricted access. Separate controller records, including billing and legal records, follow our privacy notice.

Where enabled, identity verification includes the document, proof-of-address, liveness or face-matching checks selected when the request is made. These support your assessment; they do not replace sanctions, PEP or adverse-information screening or determine whether you should accept a customer. Review the provider's outcome and reasons and record your own decision separately.

You must be entitled to request the check and meet the controller responsibilities in section 15.2. A person assisting with submission must have appropriate authority; the individual must complete their own liveness step and any required consent. Didit supplies the hosted capture interface and performs document and biometric analysis. RegScreen arranges the request and processes selected assessments and review records on your instructions. Didit's verification privacy notice and end-user terms explain its handling of the interface and data; our identity-verification privacy supplement explains our processing and authorised report downloads. These notices do not remove our obligations under section 15.

Each separately requested check that is delivered and charged for by the supplier is chargeable, including a completed check with a negative outcome. If a requested component is not delivered and the supplier does not charge for it, its reserved credits are released or the corresponding charge refunded. Uncertain outcomes are reconciled before the final adjustment. A new request is a separate check and may incur a further charge; it preserves the individual's previous screening history. Setting a staff review date sends reminders and does not automatically request another identity verification. These charging rules do not limit the remedies in section 8 for incorrect delivery caused by a service failure, including where the supplier has charged us.

Where original provider-report downloads are enabled, the report is transferred through an isolated memory-only service to the authorised user's device without retaining a server copy. You control access to and retention of copies downloaded to your own devices. Availability of original provider evidence depends on the provider's retention and deletion settings; retain the permitted records your organisation requires before those originals are deleted.