Client Due Diligence — Wwft & Sanctions ComplianceLegal / Privacy
Privacy.
This notice explains how The McDevitt Company processes personal data collected through this Client Due Diligence (CDD) form, in accordance with the EU General Data Protection Regulation (GDPR) and the Dutch Wwft.
Who we are
The McDevitt Company ("McDevitt", "we", "us") is the data controller for the personal data collected through this form. For any privacy request, contact privacy@mcdevitt.com.
What we collect
We collect the information you enter into this form: client and contact details; the identity, date of birth, nationality and residence of ultimate beneficial owners (UBOs); politically-exposed-person and sanctions declarations; source-of-funds information; and the supporting documents you upload, including company extracts and copies of identity documents.
Lawful basis
We process this data to comply with a legal obligation (Article 6(1)(c) GDPR) — namely the client due diligence duties imposed on us by the Dutch Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft). Because processing is required by law, we do not rely on your consent as the lawful basis, and you cannot withdraw it while the legal obligation applies.
How we use it
The data is used solely to identify and verify clients, screen for sanctions and politically exposed persons, assess money-laundering risk, and maintain the CDD record required by law. We do not sell personal data, and we do not use it for marketing or profiling.
Storage and recipients
On submission, the completed form and your uploaded documents are delivered by email to McDevitt's compliance team and stored as the CDD record in a private, access-controlled database and file store hosted by Supabase in the European Union (Frankfurt, Germany). Access is restricted to McDevitt's compliance officer, and every access and change is logged. We use Resend to deliver the notification email. Processing takes place within the EU. We do not transfer this data to third parties except our EU-based processors acting on our instructions, or where required to meet a legal or regulatory obligation.
Retention
Under Article 33 Wwft, CDD records must be retained for at least five years after the end of the business relationship or the completion of the transaction. We keep the data for that statutory period and delete it thereafter unless a longer retention period is required by law.
Your rights
You have the right to access your personal data and to have inaccurate data corrected. You may object to processing or request erasure, but these rights are limited where we are legally required to keep the data: the Wwft retention obligation overrides erasure requests for the statutory period. EU residents may lodge a complaint with the Dutch supervisory authority (Autoriteit Persoonsgegevens).
Cookies
This site uses only essential cookies necessary for the form to function. It uses no analytics, advertising, or third-party tracking cookies. Your cookie choice can be changed at any time via the cookie settings link in the footer.
Contact
To exercise your rights or ask a question about this notice, write to privacy@mcdevitt.com.