Privacy Policy & Data Protection Notice

01. Introduction & Legal Framework

This Comprehensive Privacy Policy & Data Protection Notice ("Notice") is issued by KHODSHIMA SUMN ASSIST LTD ("Company", "we", "us", or "our"), a private limited company incorporated in England and Wales under registration number 17435961, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

This Notice is designed to satisfy the transparency requirements stipulated under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR). It governs the collection, processing, retention, and cross-border transfer of personal data associated with our IT engineering services and digital platform.

02. Role of the Parties (Controller vs. Processor)

In the context of delivering technical deliverables to our clients, Khodshima Sumn Assist LTD acts as the Data Controller. We determine the purposes and means of processing your identity, contact, and primary billing data.

However, for the purposes of payment execution, fraud prevention, and regulatory Anti-Money Laundering (AML) compliance, our payment partners (Stripe and Airwallex) act as Independent Data Controllers. When you interact with secure payment links issued for your invoice, your financial data is governed simultaneously by this Notice and the respective global privacy policies of these financial institutions.

03. Categories of Personal Data We Collect

In strict adherence to the principle of Data Minimisation (Article 5(1)(c) UK GDPR), we collect only data that is strictly necessary, proportionate, and legally mandated.

04. Deep Integration: Stripe & Airwallex Payment Processing

To facilitate secure global commerce and comply with international financial regulations, we integrate with Stripe Payments UK, Ltd. / Stripe Payments Europe, Ltd. and Airwallex (UK) Limited. These entities are heavily regulated by the Financial Conduct Authority (FCA) and equivalent global bodies. Processing of your payment data is subject to the following strict conditions:

A. Stripe Integration (Payment Execution & Stripe Radar)

• PCI-DSS Tokenisation: When you enter payment details via our issued payment links, they are securely transmitted directly to Stripe's PCI-DSS Level 1 servers. Our systems only receive a cryptographic token (a string of characters) representing the transaction state.
• Fraud Prevention & Automated Decision-Making (Stripe Radar): Stripe acts as an Independent Data Controller to detect and prevent fraudulent transactions. Stripe Radar utilizes machine learning algorithms that assess behavioral telemetry, including IP address reputation, device fingerprinting, and interaction patterns (e.g., mouse movements and typing speed) to calculate a fraud risk score.
• Identity Verification (Stripe Identity): Where enhanced due diligence is triggered, Stripe may collect government-issued ID documents and biometric data directly from you. Khodshima Sumn Assist LTD does not store or process this biometric data.
• Privacy Policy: For exhaustive details on Stripe's data practices, including cross-border transfers to Stripe, Inc. in the USA under the UK-US Data Bridge, please consult the Stripe Global Privacy Policy.

B. Airwallex Integration (B2B Payments & AML/CTF Compliance)

• FCA Regulatory Obligations: Airwallex (UK) Limited is an authorised Electronic Money Institution. As such, they are legally bound by the UK Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.
• Sanctions Screening & KYC: Airwallex processes identity and transactional data to conduct mandatory screening against OFSI (UK), OFAC (USA), UN, and EU sanctions lists. This processing is based on Legal Obligation (Art. 6(1)(c) UK GDPR).
• Data Sharing with Authorities: In the event of suspicious activity, Airwallex acts as an Independent Controller and possesses the statutory authority to disclose transaction metadata to financial intelligence units, such as the UK National Crime Agency (NCA), without prior notification to the data subject.
• Privacy Policy: Further details regarding Airwallex's data processing can be found in the Airwallex Privacy Policy.

05. Lawful Bases for Processing (UK GDPR Article 6)

Every processing activity undertaken by the Company is strictly anchored to a defined lawful basis under Article 6 of the UK GDPR:

1. Contractual Performance (Art. 6(1)(b)): Processing indispensable for the preparation and fulfillment of our Terms of Service (e.g., delivering custom server hardening scripts, executing audits, issuing quotations).
2. Legal Obligation (Art. 6(1)(c)): Maintaining robust financial and VAT records to comply with the Companies Act 2006 and directives from HM Revenue & Customs (HMRC), as well as facilitating our payment partners' AML and KYC statutory requirements.
3. Legitimate Interests (Art. 6(1)(f)): Safeguarding our digital infrastructure against cyber-attacks, enforcing licensing agreements, preventing chargeback fraud, and conducting internal network analytics. We have conducted Legitimate Interest Assessments (LIAs) to ensure these interests do not override your fundamental rights.
4. Consent (Art. 6(1)(a)): Only utilized where you affirmatively opt-in to receive non-essential marketing or security bulletins, which may be withdrawn dynamically at any time.

06. Ephemeral Server Access & Credential Protocol

In the execution of Turnkey Installation engagements, clients provide temporary administrative access to their infrastructure. We govern this access via a strict Clean Handover & Ephemeral Access Protocol:

• Cryptographic Pre-Authentication: Access is established solely via temporary Ed25519 elliptic-curve public SSH keys.
• No Permanent Storage of Secrets: We categorically refuse to request, store, or log plaintext root passwords, database master keys, or SSL private keys on our permanent storage infrastructure.
• Immediate Post-Delivery Revocation: All temporary authentication mechanisms are revoked by the client and securely purged from our staging servers immediately upon delivery of the final executive audit report.

07. International Data Transfers & Safeguards

As a globally operating digital service provider, personal data may be transferred to jurisdictions outside the United Kingdom (UK) and the European Economic Area (EEA). We mandate rigorous safeguards pursuant to Chapter V of the UK GDPR:

• Adequacy Decisions: Transfers to countries formally recognised by the UK Secretary of State or the European Commission as possessing an adequate level of data protection.
• UK-US Data Bridge: Transfers to certified entities in the United States (such as Stripe, Inc.) participating in the UK Extension to the EU-US Data Privacy Framework.
• Standard Contractual Clauses (SCCs) & UK IDTA: Where adequacy decisions do not apply, we mandate the execution of the UK International Data Transfer Agreement (IDTA) or the EU SCCs, augmented by supplementary technical measures (e.g., end-to-end encryption) to shield data from unauthorized foreign governmental access.

08. Statutory Data Retention Schedule

We execute routine data purging protocols. Personal data is retained strictly for the duration necessitated by its original purpose or by overriding statutory laws:

• HMRC & Tax Records: Invoices, payment confirmations, and billing data are retained for 6 years from the end of the financial year in which the transaction occurred (Taxes Management Act 1970).
• AML/KYC Audit Trails: Financial metadata processed by Airwallex or Stripe may be retained by them for up to 5 to 7 years to comply with international anti-money laundering regulations.
• Server Diagnostic Data: Telemetry, IP logs, and server configuration files generated during hardening are retained for a maximum of 60 days (concurrent with the active warranty period), followed by cryptographic shredding.
• General Correspondence: Client inquiries are archived for 24 months post-resolution before deletion.

09. Your Fundamental Rights Under UK GDPR

As a data subject, you are vested with comprehensive, legally enforceable rights. We commit to responding to all verified statutory requests within one calendar month (30 days), free of charge:

• Right of Access (Art. 15): Obtain confirmation of processing and request a comprehensive copy of your personal data (Subject Access Request).
• Right to Rectification (Art. 16): Compel the correction of materially inaccurate or outdated data.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request the definitive deletion of personal data where overriding legal retention mandates (e.g., HMRC tax laws or AML holds) do not apply.
• Right to Restriction of Processing (Art. 18): Temporarily freeze processing during disputes regarding data accuracy or lawful basis.
• Right to Data Portability (Art. 20): Receive your submitted identity and transaction data in a structured, CSV/JSON machine-readable format.
• Right to Object (Art. 21): Object to processing predicated upon Legitimate Interests, including profiling or automated decision-making (e.g., requesting manual review of a Stripe Radar fraud block).

To assert any of these rights, you must submit a formal request accompanied by proof of identity to info@khodshimasumnassistltd.com.

10. Use of Cookies & Tracking Technologies

Our digital infrastructure deploys Strictly Necessary technical session tokens and anti-fraud cookies essential for the secure functioning of the website and payment gateways (including Stripe.js device fingerprinting). We explicitly prohibit the use of third-party behavioural advertising trackers. Detailed enumerations of these technologies are codified in our Cookie Policy.

11. Policy Amendments & Revision History

This Notice may be subject to periodic revision to reflect evolving jurisprudential landscapes, guidelines issued by the Information Commissioners Office (ICO), or technical modifications to our payment processor integrations. Material alterations will be communicated via prominent platform notification or direct email transmission to active clients.