Compliance & Standards Overview

01. Introduction & Corporate Identity

This Compliance & Standards Overview ("Overview") provides a comprehensive summary of the regulatory frameworks, industry standards, and internal policies adhered to by KHODSHIMA SUMN ASSIST LTD ("Company", "we", "us", or "our"), a private limited company incorporated in England and Wales under company registration number 17435961, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

As a provider of one-time IT engineering services operating within the United Kingdom, the Company is subject to various statutory and regulatory obligations. This Overview consolidates our compliance posture across data protection, payment processing, security standards, sanctions, and corporate governance. Detailed policies are available via the links in Section 8.

02. Data Protection & Privacy Compliance

The Company processes personal data in strict accordance with:

• UK Data Protection Act 2018: The primary UK legislation supplementing the UK GDPR, establishing the framework for lawful data processing;
• UK General Data Protection Regulation (UK GDPR): All personal data is processed under recognised lawful bases (Art. 6), with full respect for data subject rights (Arts. 15-22), data minimisation (Art. 5(1)(c)), and purpose limitation;
• EU GDPR (Regulation 2016/679): Where applicable to EU-based clients, the Company adheres to EU GDPR requirements including cross-border data transfer safeguards (Chapter V);
• Privacy and Electronic Communications Regulations 2003 (PECR): The Company uses only strictly necessary cookies exempt from consent under PECR Reg. 6(4)(a). No behavioural advertising or third-party analytics cookies are deployed;
• International Data Transfers: Where data is transferred outside the UK/EEA, the Company relies on adequacy decisions or the UK International Data Transfer Agreement (IDTA) / EU Standard Contractual Clauses (SCCs).

Full details are available in our Privacy Policy and Cookie Policy.

03. Payment Processing & PCI-DSS Compliance

The Company does not store, process, or transmit cardholder data directly. All payment transactions are handled by PCI-DSS Level 1 certified payment service providers:

• Stripe Payments Europe Ltd / Stripe Payments UK: PCI-DSS Level 1 Service Provider. Stripe manages the entire card data flow under its own PCI-DSS attestation. The Company receives only transaction reference IDs and payment confirmation tokens — never raw card data;
• Airwallex (UK) Limited: PCI-DSS Level 1 Service Provider, authorised by the Financial Conduct Authority (FCA) under the Electronic Money Regulations 2011 for the issuance of electronic money. Airwallex handles payment processing under its own regulatory perimeter;
• Company Obligations: As a merchant using these providers, the Company operates within the SAQ-A (Self-Assessment Questionnaire A) scope — the lowest PCI-DSS compliance tier — because cardholder data never touches Company systems. All payment links and forms are hosted and tokenised by the payment providers on their own domains.

The Company does not store full debit/credit card numbers, CVVs, or banking credentials in any system. Billing records retained for HMRC compliance contain only transaction references, amounts, currencies, and timestamps.

04. Security Standards & Technical Frameworks

The Company's engineering deliverables are aligned with the following industry-recognised security standards and frameworks:

The Company does not claim formal ISO 27001 certification. Where ISO 27001 alignment is referenced, it indicates that the Company's internal practices follow ISO 27001 control objectives as a guiding framework, not that a certified ISMS audit has been conducted.

05. International Sanctions & AML Compliance

The Company maintains a strict sanctions compliance programme in accordance with:

• UK Office of Financial Sanctions Implementation (OFSI): Screening against the OFSI Consolidated List of Financial Sanctions Targets;
• HM Treasury: Compliance with all UK financial sanctions regulations and reporting obligations;
• United Nations Security Council: Adherence to UN consolidated sanctions lists;
• European Union: Screening against EU restrictive measures (sanctions) lists;
• US Office of Foreign Assets Control (OFAC): Screening against the Specially Designated Nationals (SDN) list for USD-denominated transactions or US nexus;
• Sanctioned Jurisdictions: The Company does not provide services to, process payments from, or deliver products to individuals or entities located in sanctioned jurisdictions, including but not limited to the Russian Federation, Belarus, Iran, North Korea, Syria, Cuba, and occupied territories of Ukraine.

The Company reserves the right to conduct sanctions screening at Order submission and at any point during service delivery. Where a sanctions risk is identified, the Company will refuse or cancel the Order, terminate any active license, and report the transaction to the relevant UK authorities. No refund will be issued in cases of sanctions violations.

Detailed policy: KYC & Anti-Money Laundering (AML) Policy.

06. Corporate Governance & Statutory Compliance

As a company registered in England and Wales, the Company complies with:

• Companies Act 2006: Filing of annual confirmation statements, maintenance of statutory registers, and timely filing of annual accounts with Companies House;
• HM Revenue & Customs (HMRC): Registration for and payment of Corporation Tax, VAT (where applicable), and PAYE (where applicable). Financial and transaction records are retained for 6 years in accordance with the Taxes Management Act 1970;
• Consumer Rights Act 2015: Where services are provided to consumers (as distinct from business-to-business clients), the Company ensures that services are performed with reasonable care and skill, at a reasonable price, and within a reasonable timeframe;
• Electronic Commerce (EC Directive) Regulations 2002: The Company provides clear information about its services, pricing, and contractual terms on its website, and acknowledges orders in accordance with these regulations;
• Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013: Consumers are provided with a 14-day cancellation right, subject to the digital content exemption for immediately downloaded deliverables;
• Modern Slavery Act 2015: The Company maintains a Modern Slavery Act Statement reflecting its commitment to ethical supply chains and zero tolerance for forced labour. See: Modern Slavery Act Statement;
• Supply of Goods and Services Act 1982: Implied terms of reasonable care and skill in service provision are observed.

07. Prohibited Activities & Service Scope Restrictions

The Company provides exclusively non-financial IT engineering services. The following activities are strictly prohibited and will not be engineered, configured, hosted, or facilitated under any circumstances:

• Financial & Regulated Services: Banking infrastructure, payment processing systems, lending platforms, insurance products, investment platforms, or any service requiring FCA authorisation;
• Cryptocurrency: Cryptocurrency exchanges, wallet services, ICO/IDO infrastructure, mining pools, DeFi platforms, or token issuance systems;
• Gambling: Online casinos, sports betting platforms, lottery systems, or any gambling infrastructure;
• Adult Content: Adult entertainment hosting, content distribution networks for adult material, or associated monetisation infrastructure;
• Illegal Activity: Money laundering, terrorism financing, sanctions evasion, distribution of malicious software, or any activity prohibited under English law;
• Infrastructure Abuse: Spam, DDoS attacks, botnet operations, credential stuffing, or unauthorised access to third-party systems.

These prohibitions are enforced through Order screening (Section 5 of our Terms & Conditions), client warranty obligations, and post-purchase monitoring. Violations result in immediate license termination and reporting to UK authorities where applicable.

08. Related Policies & Documents

The following policies and documents form the Company's compliance framework. Each is available as a dedicated page on this website:

09. Continuous Improvement & Policy Updates

Compliance is an ongoing process. The Company is committed to:

• Regular Review: All policies and compliance documents are reviewed at least annually, or sooner if triggered by regulatory changes, payment provider requirements, or operational developments;
• Regulatory Monitoring: The Company monitors updates from the ICO, OFSI, HM Treasury, FCA, and other relevant UK and international regulatory bodies;
• Payment Provider Requirements: The Company maintains alignment with Stripe and Airwallex terms of service, acceptable use policies, and compliance requirements as they evolve;
• Stakeholder Notification: Material changes to compliance documents are published on this website with updated revision dates. Clients with active engagements are notified by email where changes affect their rights or obligations.