This Privacy Policy describes how Label Technologies Group of entities ("Label", "we", "us", or "our") collects, uses, and protects personal information in connection with our regulatory reporting platform, accessible at https://fatcacrs.labeltech.io.
Our platform is a business-to-business (B2B) service that enables financial institutions, service providers, and other regulated entities ("Customers") to fulfil their FATCA and CRS regulatory reporting obligations.
This policy is effective as of 20 December 2022.
Last updated: 8 January 2026
We handle two distinct categories of personal data, each with different purposes and legal bases:
When authorised personnel from our Customers access the platform, we collect minimal personal data required to provide secure access to our services:
We do not request or collect any additional personal information from platform users beyond what is provided by the authentication process.
In the course of providing our regulatory reporting services, Customers upload data concerning their own clients, account holders, and beneficial owners ("Data Subjects"). This data typically includes personal information required for FATCA and CRS compliance.
This data is submitted by authorised Customer personnel and processed by us strictly in accordance with Customer instructions and applicable Data Processing Agreements (DPAs). We do not determine the purposes or means of processing this data—the Customer does.
The General Data Protection Regulation (GDPR) distinguishes between Data Controllers (who determine the purposes and means of processing) and Data Processors (who process data on behalf of Controllers).
When acting as a Processor, we do not use Customer-Submitted Data for any purpose other than providing the regulatory reporting services requested by the Customer. We do not analyse, profile, sell, or otherwise exploit this data for our own purposes under any circumstances.
We use platform user data solely for the following purposes:
We process Customer-Submitted Data strictly for the purpose of providing regulatory reporting services as instructed by the Customer. This includes:
We adhere to the principle of data minimisation. We do not collect, request, or retain any personal data beyond what is strictly necessary to provide our services:
When you access our platform, our servers automatically log standard technical data provided by your web browser, including:
This data is used for security monitoring, troubleshooting, and maintaining platform integrity. It is retained for a limited period and is not combined with other data sources for profiling purposes.
If you encounter errors while using the platform, we may automatically collect technical data about the error and the circumstances surrounding its occurrence. This data is used solely for diagnosing and resolving technical issues.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
While we employ industry-standard security practices, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents.
We retain platform user data for as long as the user's account remains active or as necessary to provide services to the Customer. If a user's access is revoked or the Customer relationship ends, we will delete or anonymise user data within a reasonable period, unless retention is required for legal or compliance purposes.
Retention of Customer-Submitted Data is governed by our agreements with each Customer and applicable regulatory requirements. Customers may instruct us to delete their data in accordance with their data retention policies, subject to any legal retention obligations.
We may disclose personal data to:
We do not sell personal data to third parties. We do not share Customer-Submitted Data with any third party except as instructed by the Customer or required by law.
We use the following third-party services:
These providers are bound by contractual obligations to process data only as instructed and to maintain appropriate security measures.
If you are a platform user (authorised personnel), you have the following rights regarding your personal data:
To exercise these rights, please contact us using the details below. We will respond within the timeframes required by applicable law.
If you are a Data Subject whose personal data has been submitted by a Customer for regulatory reporting, please direct any requests regarding access, rectification, erasure, or other rights to the relevant Customer (the Data Controller). As a Data Processor, we will assist the Customer in responding to such requests in accordance with our contractual obligations.
Our platform uses cookies strictly for functional purposes, such as maintaining your authenticated session. We do not use cookies for advertising, tracking, or profiling purposes.
Please refer to our Cookie Policy for more information.
In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity. Any such transfer will be subject to this Privacy Policy, and we will notify affected parties as required by law.
We may update this Privacy Policy to reflect changes in our practices or legal requirements. If we make significant changes, we will notify Customers through appropriate channels. The "Last updated" date at the top indicates when the policy was last revised.
For questions about this Privacy Policy or to exercise your data protection rights, please contact:
Label Technologies Group of entities
Email: contact@labeltech.io
If you believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection authority.