Customers must have a lawful basis before submitting a person for screening. AdverseSearch supports research and review, but it must not make the final decision about a person.
1. Scope and controller
This Privacy Policy applies to AdverseSearch websites, accounts, APIs, the anonymous playground, contact forms, and related support. The service is operated by Mentorsko Ltd., company registration number 207211334 and VAT number BG207211334, with registered office at 1797 Sofia, Mladost district, Musagenitsa residential complex, block 89, entrance 7, apartment 126, Bulgaria.
Mentorsko Ltd. is the controller for account administration, enquiries, service security, abuse prevention, usage records, and its own legal obligations. The role for screening subject data depends on how the service is used, as explained below.
2. Our privacy roles
When a business customer decides why a person is screened and submits the identifiers, that customer normally acts as controller and Mentorsko Ltd. acts as processor on the customer's documented instructions. The customer remains responsible for its lawful basis, notices, rights handling, decision process, and any sector rules that apply.
Mentorsko Ltd. may act as an independent controller for limited operational data needed to authenticate users, secure the service, prevent abuse, enforce limits, maintain audit records, respond to requests, establish legal claims, and meet legal duties.
An order form or separate data processing agreement may add terms for production use. If those terms conflict with this notice, the more specific privacy term governs the relevant processing.
3. Data we process
Screening inputs and results
A screening requires a first and last name. A customer may also submit a middle name, date of birth, country, state, city, gender, phone number, email address, and an internal reference. Results may include public source links, excerpts, dates, identity indicators, event details, confidence, coverage, and limitations.
Account, contact, and usage data
We process account identity and workspace details, sign-in and session records, API key metadata, request and usage counts, role information, contact form details, support correspondence, and limited delivery status data. API key secrets are shown once and are not stored in readable form.
Security and device data
We process IP-derived security signals, device and network fingerprints in protected form, request identifiers, timestamps, browser and request metadata, authentication events, audit events, and security challenge results. Routine logs are designed to exclude raw screening subjects, search phrases, evidence excerpts, credentials, and authentication cookies.
Sources
Data comes from customers and users, their identity provider, public online material selected for review, technical interactions with the service, and communications sent to us. Public availability does not remove the customer's duty to use the information lawfully and fairly.
4. Purposes and legal bases
To create accounts, accept requests, run screenings, return evidence, support deletion, and manage contracted access. We rely on contract necessity or the customer's documented instructions.
To authenticate users, prevent fraud and abuse, enforce limits, investigate incidents, and protect customers. We rely on legitimate interests and, where required, legal obligations.
To answer sales, support, privacy, legal, and security enquiries. We rely on steps requested before a contract, contract necessity, or legitimate interests.
To comply with law, respond to lawful requests, maintain necessary records, and establish or defend legal claims.
Where consent is the proper legal basis, it can be withdrawn for future processing. Withdrawal does not affect processing that was lawful before withdrawal.
5. Sensitive data and criminal offence information
Adverse media can reveal allegations, convictions, political views, health information, or other sensitive facts. Customers must not submit or use this data unless applicable law permits it and suitable safeguards are in place.
Information about criminal convictions and offences is subject to Article 10 GDPR and national law. A customer must identify and document the legal authority for that processing before using AdverseSearch for such information. Access to the service does not create that authority.
AdverseSearch does not make solely automated decisions with legal or similarly significant effects. Outputs are research signals. A qualified human must review the identity evidence, source, context, recency, disputes, acquittals, dismissals, coverage, and applicable law before action is taken.
6. Sharing and international transfers
We disclose data only as needed to operate the service, follow customer instructions, protect rights and security, or comply with law. Recipient categories may include hosting and database providers, search and content retrieval services, document processing services, identity and anti-abuse services, email delivery providers, professional advisers, authorities, and a buyer in a lawful corporate transaction.
Providers are limited by contract and access controls appropriate to their role. Screening data is not sold and is not shared for third-party advertising.
Some providers may process data outside the European Economic Area. Where required, we use an adequacy decision, approved standard contractual clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate.
7. Retention and deletion
- Anonymous playground: access to the result expires after 24 hours. Related subject data and result data become eligible for scheduled deletion at expiry.
- Authenticated screenings: access expires no later than 30 days after creation. Authorized workspace members may delete completed records sooner.
- Pending email delivery: recipient and encrypted payload data expire within 24 hours. Successful or permanently rejected message details are cleared earlier where the delivery state permits.
- Delivery metadata: after recipient and message content are cleared, a limited record of message type, delivery state, attempts, relevant timestamps, and an internal user or screening identifier used to prevent duplicate sends becomes eligible for scheduled deletion after 30 days.
- Sessions: the browser cookie may last up to 30 days, but server access can expire after 12 hours of inactivity or earlier on sign-out or revocation.
- Security and audit records: retained only for a proportionate period needed for security, accountability, disputes, and legal duties. They are designed not to contain the raw screening subject.
Independent scheduled maintenance performs physical cleanup. A short operational delay can occur after an access deadline while the next cleanup cycle completes or a temporary lock clears. Backups, legal holds, and records required by law may follow a separate, limited schedule.
8. Your rights
Depending on the law and our role, you may have rights to information, access, correction, deletion, restriction, portability, objection, and withdrawal of consent. You may also complain to a supervisory authority.
If a customer controls the screening record, we may direct your request to that customer or help it respond. We may ask for proportionate proof of identity and enough context to locate the relevant record. Do not send identity documents, screening subjects, or evidence through the first contact message unless we specifically request them through a secure channel.
Authorized workspace users can delete eligible screenings in the account interface. Cookie choices are described in our Cookie Policy.
9. Security
We use technical and organizational measures designed for the sensitivity of screening data. These include encryption of sensitive stored screening fields, transport protection, role-based access, tenant-scoped controls, short access windows, protected API keys and sessions, audit events, rate limits, security challenges, restricted operational logging, and independent retention maintenance.
No online service can guarantee absolute security. Customers must protect their credentials, limit submitted data to what is needed, configure access carefully, and notify us promptly of a suspected incident.
10. Contact, complaints, and changes
For a privacy request or question, use the AdverseSearch contact form and write “Privacy request” at the start of the message. Do not include screening subject data in the initial form.
You can complain to the Bulgarian Commission for Personal Data Protection or the supervisory authority where you live or work. The Bulgarian authority provides current complaint instructions on its official website.
We may update this policy when the service, law, or our processing changes. Material changes will be highlighted through an appropriate service or account notice. The date at the top shows the latest revision.