How OVARA protects personal data.

Protection throughout the data lifecycle

OVARA applies risk-based technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. These measures support secure collection, processing, storage, access, retention and deletion within the agreed service.

EU, UK and UAE requirements

The OVARA data-protection framework is designed to support obligations arising under Regulation (EU) 2016/679 (EU GDPR), the UK GDPR and Data Protection Act 2018, and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. For customers established in the UAE financial free zones, the applicable framework may also include DIFC Data Protection Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021.

Depending on the service and legal roles, the framework supports data-protection principles, privacy by design and default, documented controller–processor instructions, security of processing, records of processing, data-protection impact assessments, incident assessment and notification support, individual rights and demonstrable accountability. Applicable duties are established for each engagement by reference to the organisation, processing purpose, categories of data, data subjects and jurisdictions involved.

Clear controller and processor roles

The licensed organisation normally decides why applicant, customer and business data is processed and acts as controller. OVARA generally acts as processor, protecting and processing that data on the organisation’s documented instructions under the service agreement and data-processing agreement. The agreed documents confirm the roles for the relevant service.

Security supported by independently audited AWS assurance

OVARA uses Amazon Web Services (AWS) as part of its hosting and security architecture. AWS protects the underlying cloud infrastructure, and OVARA securely configures and operates the services used by the platform. AWS’s in-scope cloud services are covered by independently audited assurance programmes that include ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 and ISO/IEC 27701:2019.

The certification scope applies to the AWS services and regions identified by AWS. OVARA builds on this foundation with organisation and role-based access, least-privilege design, encrypted transport, separation of public and secure environments, monitoring, controlled releases, backups, recovery planning and incident management.

How data-protection responsibilities are allocated

OVARA is responsible for platform security, the service safeguards it operates and the processing commitments assigned to it under the service and data-processing agreements. This includes enforcing platform access controls, protecting data in transit, maintaining controlled environments and supporting monitoring, backup, recovery and incident management.

Each licensed organisation defines the lawful purposes and basis for its KYC, KYB or onboarding activity, provides the relevant privacy information, determines its authorised users and retention requirements, and leads responses to data-subject requests. OVARA supports those duties through the platform and the agreed assistance provisions.

Retention and deletion

Personal data should be retained only for as long as needed for the agreed service, the controller’s documented requirements and applicable legal or regulatory duties. Contractual controls govern return or deletion at the end of the service, subject to lawful retention requirements and protected backup cycles.

International transfers and trusted suppliers

Where personal data is processed across borders, OVARA and the relevant licensed organisation identify the lawful transfer route required for that service. Depending on the circumstances, safeguards may include an adequacy decision or regulation, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, a transfer risk assessment or data-protection test, and appropriate supplementary technical and organisational measures.

Suppliers supporting the service are assessed according to their role and risk and are placed under appropriate data-processing, confidentiality, security, assistance, deletion and audit obligations. Transfer and supplier controls are reviewed when the service, law, processing or risk materially changes.

Individual rights and incident support

People can exercise their data-protection rights through the licensed organisation responsible for their KYC, KYB or onboarding relationship. OVARA supports the organisation in responding where required and maintains procedures to assess, manage and communicate personal-data incidents in line with the agreed roles and applicable requirements.