VISUAL OFAC PRIVACY SHIELD POLICY  

MSR Customs Corporation DBA Visual OFAC (“Visual OFAC”) has adopted this Privacy Shield Policy (“ Policy” ) to establish and maintain an adequate level of Personal Data privacy protection. This Policy applies to the processing of Personal Data that Visual OFAC obtains from Customers located in the European Union and European Economic Arrangement and Switzerland to which Privacy Shield applies.

Visual OFAC complies with the EU-US Privacy Shield Framework and the Swiss – US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland, respectively to the United States. Visual OFAC has certified that it adheres to the Privacy Shield Privacy Principles of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access, recourse, enforcement and liability. If there is any conflict between the policies in this privacy policy and the Privacy Shield Privacy Principles, the Privacy Shield Privacy Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov. Search for MSR Customs Corporation to see our certification.

The Federal Trade Commission (FTC) has jurisdiction over Visual OFAC’s compliance with the Privacy Shield.

All Visual OFAC employees who handle Personal Data from EU and EEA countries and Switzerland are required to comply with the Principles stated in this Policy.

1. Definitions

“Business Data”  means data that is entered or uploaded for processing by Customer in order to carry out International Trade Compliance functions. Depending on the function selected, Business Data may include information about trading partners and other types of business contacts, products or trade transactions.

“Customer”  means a company or other institution who has contracted with Visual OFAC to use the Services.

“Customer/User Information”  means information about Customer or its employees, agents or other persons acting on behalf of Customer who are registered users of the Services or communicate with Visual OFAC in relation to Customer’s use of the Services.

“Customer Personnel”  means employees, agents or other persons acting on behalf of Customer who are registered users of the Services or communicate with Visual OFAC in relation to Customer’s use of the Services.

“Data Subject”  means an identified or identifiable natural living person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Europe”  or “ European”  refers to a country in the European Union or European Economic Arrangement (EEA) that is be covered by the Privacy Shield program.

“Personal Data”  as defined under the EU Regulation 2016/679 per 25 May 2018 (“GDPR”) means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified , directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Sensitive Data”  means Personal Data that discloses a Data Subject’s medical or health condition, race or ethnicity, political, religious or philosophical affiliations or opinions, sexual orientation, or trade union membership.

“Services”  means the SAAS software and related services provided by Visual OFAC.

“Third Party”  means any individual or entity that is neither Visual OFAC nor a Visual OFAC employee, agent, contractor, or representative.

2. Scope

This Policy applies to the processing of Personal Information that Visual OFAC receives in the United States concerning Customer Personnel who reside in the European Union (or EEA) or Switzerland. Visual OFAC provides products and services to businesses only.

This Policy does not cover data from which individual persons cannot be identified or situations in which pseudonyms are used. (The use of pseudonyms involves the replacement of names or other identifiers with substitutes so that identification of individual persons is not possible.)

3. Visual OFAC’s Role as an SAAS Software Service Provider

Visual OFAC provides a hosted SAAS software service that provides customers with a number of Export Compliance functions including but not limited to denied party screening and product classification. Visual OFAC also provides other related offerings to its Customers.

In providing the Service, Visual OFAC receives Business Data submitted for processing by the Service and Customer/User Data required to provide the Services and manage the business relationship between Visual OFAC and the Customer.

In receiving and processing the Business Data, Visual OFAC acts as a Data Processor, receiving, processing and storing any Personal Data it may contain only as directed by Customer.

4. Responsibilities and Management

Visual OFAC has designated the Legal Department to oversee its information security program, including its compliance with the EU – US Privacy Shield and Swiss-US Privacy Shield programs. The Legal Department shall review and approve any material changes to this program as necessary. Any questions, concerns, or comments regarding this Policy also may be directed to .

Visual OFAC will maintain, monitor, test, and upgrade information security policies, practices, and systems to assist in protecting the Personal Data that it collects. Visual OFAC personnel will receive training, as applicable, to effectively implement this Policy.

5. Renewal and Verification

Visual OFAC will renew its EU – US Privacy Shield and Swiss – US Privacy Shield certification annually, unless it subsequently determines that it no longer needs such certifications or if it employs a different adequacy mechanism.

Prior to the re-certification, Visual OFAC will conduct an in-house verification to ensure that its attestations and assertions with regard to its treatment of Customer Contact are accurate and that the company has appropriately implemented these practices.

6. Collection of Personal Data

Business Data:

Visual OFAC is a provider of SAAS software subscription services that help Customers manage International Trade Compliance. In using these Services, Customer Personnel may, on behalf of Customer enter or upload Business Data for processing and storage on the Service. This data may include Personal Information about Customer’s trade partners and other individuals or legal entities. When receiving, processing and storing Business Data, Visual OFAC is acting solely as a Data Processor and performs these actions only as directed by Customer. Business Data regarding individuals and entities that is processed and stored on the Service consists of names and addresses as well as other optional information, as determined by the Customer.

Customer/User Data:

Visual OFAC provides the Services to companies who license the Services on a subscription basis. Visual OFAC collects Customer/User Data when Customer Personnel purchase Service subscriptions on behalf of Customer, set up user accounts, log-in to their account, complete surveys, request information or otherwise communicate with us. For example, Visual OFAC Customer Personnel may seek telephone or email support for the service or to manage their account.

The Customer/User Data that we collect may vary based on the types of interactions that Customer Personnel have with Visual OFAC. As a general matter, Visual OFAC collects the following types of Personal Data from its Customer Personnel: work contact information, including, a contact person’s name, work email address, work mailing address, work telephone number, title, and company name. In order to collect payment for Services, Customer company level credit card and/or bank account information may be collected.

When Customer Personnel use our services online, we will collect their IP address and browser type. We may associate IP address and browser type with a specific Customer.

7. Use of Personal Data

 Business Data:

Business Data entered or uploaded to the Services by Customer Personnel is used only to carry out the functions and processes initiated by Customer Personnel on behalf of Customer. For example, Customer Personnel may initiate screening of trade partners or other individuals for presence on US or international watch lists or process trade transactions such as imports or exports in which such individuals have participated.

Customer/User Data:

Visual OFAC uses Personal Data that it collects directly from its Customer Personnel for the following business purposes, without limitation:

a. maintaining and supporting its products, delivering and providing the requested products/services, and complying with its contractual obligations related thereto (including managing transactions, reporting, invoices, renewals, and other operations related to providing services to a Customer);

b. Informing Customer of additional services that may be available or providing other informational communications;

c. verifying identity (e.g., for online access to accounts);

d. as requested by the Customer Personnel on behalf of Customer;

e. and as otherwise required by law.

8. Disclosures/Onward Transfer of Personal Data

Visual OFAC will not disclose Personal Data to a third party, except as stated below:

Visual OFAC may disclose Personal Data to subcontractors and third-party agents who assist Visual OFAC in providing Services to its customers and prospective customers. Before disclosing Personal Data to a subcontractor or third-party agent, Visual OFAC will obtain assurances from the recipient that it will: (a) use the Personal Data only to assist Visual OFAC in providing the Services; (b) provide at least the same level of protection for Personal Data as required by the Principles; and (c) notify Visual OFAC if the recipient is no longer able to provide the required protections. Upon notice, Visual OFAC will act promptly to stop and remediate unauthorized processing of Personal Date by a recipient. Visual OFAC will remain liable for onward transfers to its subcontractors and third-party agents.

Visual OFAC may also be required to disclose, and may disclose, Personal Data in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements. If such a request involves Business Data being processed for a Customer, to the extent permitted, Visual OFAC will inform Customer before making such disclosure and provide it with a reasonable opportunity to object to such disclosure.

9. Sensitive Data

Visual OFAC does not collect Sensitive Data

10. Data Security

Visual OFAC has implemented physical and technical safeguards to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alternation, or destruction. For example, electronically stored Personal Data is stored on a secure network with firewall protection, and access to Visual OFAC’s electronic information systems requires user authentication via password or similar means. Visual OFAC also employs access restrictions, limiting the scope of employees who have access to Personal Data. Further, Visual OFAC uses secure encryption technology to protect certain categories of personal data.

11. Data Integrity and Purpose Limitation

Business Data:

Customer is responsible for a) limiting their collection of Business Data containing Personal Data to that which is necessary to accomplish the purposes disclosed to Data Subjects and compatible purposes; b) ensuring that Personal Data they collect is accurate, complete, current and reliable for its intended uses; c) providing Visual OFAC with instructions for the processing of Personal Data consistent with such purposes. Visual OFAC will process Personal Data only in accordance with the customer’s or prospective customer’s instructions.

In the performance of Services, Visual OFAC will request only information required to perform the applicable Services and will retain such information only for as long as necessary to provide the Services or for compatible purposes, such as to provide additional Services, to comply with legal requirements (such as document retention standards), or to preserve or defend Visual OFAC’s legal rights.

Customer/User Data:

Visual OFAC shall only process Customer/User Data in a way that is compatible with and relevant for the purpose(s) for which it was collected or authorized by the individual. To the extent necessary for those purposes, Visual OFAC shall take reasonable steps to ensure that Personal Information is accurate, complete, current and reliable for its intended use.

12. Access

Business Data:

When Visual OFAC receives Business Data, it does so on Customer’s behalf. Customer is responsible for providing access to, or correction, amendment or deletion of Personal Data contained within Customer’s Business Data to their Data Subjects.

Customer/User Data:

Customer Personnel have the right to know what Personal Data about them has been collected and stored and to ensure that such Personal Data is accurate and relevant for the purposes for which Visual OFAC collected it.

Upon reasonable request and as required by the Privacy Shield principles, Visual OFAC allows Customer Personnel access to their Personal Data, in order to correct or amend such data where inaccurate. Customer Personnel may edit their Personal Data by contacting Visual OFAC by phone or email. To request erasure of Personal Data, Customer Personnel should submit a written request to Visual OFAC.

13. Choice

Business Data:

When Visual OFAC receives and processes Business Data, it does so on Customer’s behalf. Customer is responsible for providing their Data Subjects with the ability to request limitation of the use or disclosure of their Personal Data. Visual OFAC will cooperate with Customers’ instructions regarding Data Subjects’ choices.

Customer/User Data:

When required by the Privacy Shield, Visual OFAC will offer individuals the opportunity to opt out of (1) disclosures of Personal Information to a third party, or (2) our use of Personal Information for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by the individual. Customer may also opt out of any newsletters, product announcements or other informational communications.

14. Enforcement and Dispute Resolution

In compliance with the EU – US Privacy Shield Principles and Swiss – US Privacy Shield Principles, Visual OFAC commits to resolve complaints about your privacy and our collection or use of your personal information. EU, EEA and Swiss individuals with questions or concerns about the use of their Personal Data should contact us at: .

If a Customer’s question or concern cannot be satisfied through this process Visual OFAC has further committed to refer unresolved privacy complaints under EU – US Privacy Shield or Swiss – US Privacy Shield to an independent dispute resolution mechanism operated by the ICDR/AAA.

If you do not receive timely acknowledgement of your complaint, or if your complaint is not satisfactorily addressed by Visual OFAC, EU , EEA and Swiss individuals may bring a complaint before the ICDR/AAA Privacy Shield Program.

Finally, as a last resort and in limited situations, EU, EEA and Swiss individuals may seek redress from the Privacy Shield Panel, a binding arbitration mechanism.

15. Changes to This Policy

Visual OFAC may revise this Policy at any time. If Visual OFAC decides to materially change this Policy, Visual OFAC will post the revised Policy at this location.

Version: 11-26-2018