Processor Data Protection Policy

GSS Processor Data Protection Policy

Dated 6 May 2026

This document explains how GSS processes Personal Data on behalf of our customers (typically Financial Institutions – whom we refer to as GSS Users) when providing the GSS Screening Services to GSS Users.

GSS Purposes

GSS may process the Personal Data of individuals collected by GSS for the provision of the GSS Screening Services and products (GSS Purposes). Our Privacy Notice, describes when GSS processes Personal Data for our own purposes, and, in such case, GSS will be determined a Data Controller (for that specific purpose). In such circumstances, GSS only processes Personal Data based on a valid lawful basis and as set out in our Privacy Notice.

Where GSS acts as a data Processor

Outside of GSS Purposes, GSS only processes Personal Data as a Data Processor; that is, on the instructions of GSS Users who are the Data Controllers of the Personal Data. We do not determine the purposes or means of the processing.

GSS Users are required to process certain Personal Data about individuals (Data Subjects), to, amongst other things, meet their legal obligations in combatting fraud, money-laundering, bribery and corruption and the avoidance of sanctions.

How GSS Users process Personal Data and with whom they share that data, will be set out in their respective Privacy Notices. We would encourage Data Subjects to review the Privacy Notices with the institution with whom they have a banking relationship. If Data Subjects wish to exercise any of their rights under Data Protection Laws^[1] or any other applicable local data protection laws, including, but not limited to what Personal Data they hold about them, they will need to contact the relevant GSS User directly.

GSS will also receive Personal Data directly from GSS Users in relation to its customers (in the form of lists) and specifically, sanctioned individuals, message data (payment and transaction) (which may include personal data) for the purpose of assisting GSS Users with Screening Services, to meet their legal obligations under applicable laws, such as anti money laundering.

Examples of source(s) of Personal Data

Personal Data processed by GSS (either for GSS Screening Services and/or GSS Purposes) includes Personal Data, it obtains directly from GSS Users, third party commercial partners and via publicly available sources.

Source: (Publicly Available)	Examples of Personal Data GSS may receive	Link to Website
EU	Please visit official website	Consolidated list of persons, groups and entities subject to EU financial sanctions – Data Europa EU
US Fed Register		Federal Register: Notice of OFAC Sanctions Actions
US OFAC	Please visit official website	Home \| Office of Foreign Assets Control (treasury.gov)
UN	Please visit official website	United Nations Security Council Consolidated List \| United Nations Security Council
UK/OFSI	Please visit official website	OFSI Consolidated List Search (hmtreasury.gov.uk)
Factiva t/a Dow Jones (third party commercial provider)	See Dow Jones Privacy Notice: Privacy Notice – Dow Jones	www.dowjones.com
Financial Institutions (GSS Users)	Financial Institution specific Privacy Notices available via their official websites	N-A

GSS Users must ensure that prior to passing any Personal Data to GSS, they do so in accordance with all applicable data protection laws and regulations, including, but not limited to, where applicable, providing notice to the individual about GSS Screening Services and, where required, obtaining appropriate consent.

GSS Users’ Responsibilities

Compliance with applicable data protection laws

When providing Personal Data to GSS, GSS Users must comply with all applicable data protection laws and must collect such Personal Data for the relevant purposes in compliance with any local applicable data protection laws. In doing so and where relevant, GSS Users must ensure that they meet their own obligations regarding the Processing of Personal Data, in particular (but not limited to):

accountability and transparency;
data accuracy and lawfulness of the Processing;
providing notice to individuals regarding the data Processing (including any profiling or automated decision-making);
the handling of individuals’ requests to exercise their rights of access, rectification, restriction, erasure, data portability, objection, consent withdrawal, and their rights relating to automated individual decision-making; and
record keeping obligations, performing data protection impact assessments including any assessment relating to international data transfers.

GSS Responsibilities as Data Processor

Where GSS acts as a Data Processor, GSS shall:

only process such Personal Data on the written instructions of the GSS Users and in accordance with agreements between GSS and GSS Users.
inform GSS Users if it cannot comply with their instructions, to the extent required under applicable data protection law(s)
not retrieve, use, or disclose message data (which may contain Personal Data) except as agreed between GSS and GSS Users and/or for GSS Purposes. Specifically, GSS does not Process Personal Data contained in message data for purposes falling outside GSS User instructions.

As a Data Processor, we rely on the Data Controller to establish the lawful basis for processing personal data under applicable data protection laws.

Confidentiality, integrity, and security

Our information security framework is governed by an information security policy, supported by technical and organisational security measures which are formally documented.

GSS will secure all Personal Data with appropriate technical, physical, and organisational security measures to protect such data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, and against other anticipated threats or hazards and relevant unlawful forms of Processing.

GSS corporate security policy and standards are based on principles of ISO 27001 standard series. GSS undertakes regular reviews of its security measures.

Personal Data breach notification

GSS will notify GSS Users of any security incidents that lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data without undue delay after becoming aware of the Personal Data breach.

GSS will use commercially reasonable efforts to assist GSS Users to facilitate their compliance with relevant obligations under Data Protection Law(s) and regulations, including their obligations to notify Personal Data breaches to the individuals concerned.

Limited retention periods and deletion procedures

Personal Data is deleted by GSS from its systems according to GSS’ data retention and deletion procedures and /or as agreed with GSS Users.

Assisting GSS Users

Facilitating the exercise of individuals’ rights

In accordance with Data Protection Laws, individuals have certain rights regarding their Personal In accordance with Data Protection Laws, individuals have the right to:

Access their personal data;
Rectify inaccurate data;
Request that their data is erased;
Restrict the processing of their data;
Transfer their data to another provider;
Object to the processing of their data.

GSS Users are responsible for handling requests from individuals to exercise their rights. If an individual sends a request to GSS to exercise these rights to his/her Personal Data, GSS will advise that individual to direct its request to the GSS User that originally collected the individual’s data (for instance the individual’s bank). GSS will provide the GSS Users with the necessary assistance in handling such requests.

Data Protection Officer

Any questions about GSS responsibilities regarding the Processing and protection of Personal Data should be directed to GSS, for the attention of the Data Protection Officer, 1-3 Fredericks Place, London, EC2R 8AE or by e-mail to privacy@gss-rose.com. The GSS DPO is authorised to carry out internal supervision as may be deemed necessary in connection with GSS responsibilities under this GSS Personal Data Protection Policy.

Confidentiality

GSS ensures that its employees (and sub-Processors) are bound by confidentiality obligations with regards to the Processing of list and message data and are properly instructed and required to comply with GSS obligations under this policy and any other supporting GSS policy in existence from time to time.

Subcontracting

GSS will notify GSS Users of any subcontracting of the processing of Personal Data by third parties or in other locations. Where appliable, GSS will enter into contractual arrangements and ensure appropriate safeguards and protections are in place with its sub-Processors in accordance with the requirements set out in Data Protection Laws.

Data Transfers

GSS may, as Data Processor, transfer Personal Data outside the UK and/or EU/EEA. When we transfer Personal Data to other countries, we will put in place appropriate safeguards and protections (such as standard contractual clauses) and, where necessary, supplemental measures, that align to Data Protection Laws. We may transfer Personal Data to countries that have been formally deemed adequate under Data Protection Laws, without putting in place additional safeguards and protections.

We may update this policy from time to time. Any changes will be published on this page with an updated revision date.

[1] Means EU & UK GDPR