Privacy Notice
What we collect, why, who sees it, how long we keep it, and what you can ask us to do.
Who is responsible
JFK IMPORT-EXPORT LLC, trading as JFKIE LLC, a limited liability company organised in Virginia, United States, since October 2003, operating the CONFIRMA platform. Registered address: [REGISTERED ADDRESS]. Privacy contact: privacy@[DOMAIN].
What we collect
From people who use the platform. Name, business email, the company you act for, your role, and the records of what you did on the platform — sign-ins, approvals, uploads, signatures, and the network details of those sessions.
From companies applying to the programme. Company registration details, tax identification, bank account details in the company name, the identity documents of beneficial owners and directors, and the addresses and telephone numbers recorded at onboarding.
From invoices and accounting records. The commercial content of invoices, delivery records and accounting entries supplied by an operator or a supplier, including the names of the individuals who requisitioned, received or approved the work.
Automatically. A session identifier when signed in, a language preference, and server logs containing a request identifier, a timestamp, and hashed values derived from your address and browser. We use no advertising technology, no third-party analytics, and no tracking across other websites.
Why we use it
To decide whether to purchase a receivable and on what terms; to satisfy anti-money-laundering, sanctions and counterparty due diligence obligations; to detect and prevent fraud; to operate and secure the platform; to produce evidence of signature and consent; and to meet our record-keeping obligations to regulators, auditors and lenders.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.
Who sees it
Our own staff, limited by role. Our professional advisers — lawyers, auditors, accountants. Lenders financing the receivables, on a need-to-know basis. Screening and verification providers used to check sanctions lists and confirm identity. Courts, regulators and law enforcement where legally required.
The operator whose invoice is concerned sees what relates to that invoice. A supplier sees only its own records. Neither sees the other's book.
Where it goes
The platform is hosted and operated in the United States, and records are stored there. If you are outside the United States, your information is transferred there. For counterparties in jurisdictions requiring a transfer mechanism, we contract on standard terms and will provide the applicable contractual clauses on request.
How long we keep it
While the relationship is live, and afterwards for the period required by anti-money-laundering, tax and commercial record-keeping rules — generally not less than seven years from the last transaction. Signature evidence and certificates of completion are retained for the life of the underlying agreement plus the applicable limitation period. Security logs are retained for a shorter period appropriate to their purpose.
Your rights
Wherever you are, you may ask us to: tell you what we hold about you and why; give you a copy; correct anything inaccurate; delete what we no longer need; limit how we use it; and object to a particular use.
Some of these rights are qualified. We cannot delete records we are legally required to keep, and we cannot remove evidence of a signature from an executed agreement. Where we decline, we will say so and explain why.
You will not be treated differently for exercising a right.
To make a request, write to privacy@[DOMAIN]. We verify who you are before acting — usually by confirming control of the account or the email of record — and respond within 45 days, extending once where necessary and telling you if we do.
If you are in California you may use an authorised agent. If you are in the European Economic Area or the United Kingdom you may complain to your supervisory authority.
If you are in the Democratic Republic of the Congo, the rights described above apply to you. The Congolese framework for personal data sits within Law No. 20/017 of 25 November 2020 on telecommunications and information and communication technologies; its practical application is still developing, and we apply the standard set out here in full rather than waiting for it to settle.
Automated decisions
The platform scores each submitted invoice and may refuse to purchase it without a person reviewing it first. That decision concerns the invoice, not you personally, and it does not create or remove any legal right you hold against the operator that owes it. A refusal can be reviewed by a person on request.
Security
Records are encrypted at rest where the platform is configured to do so, and always in transit. Access requires an account, and roles that move money or grant access require a second authentication factor. Documents are never served in a form a browser will execute. Every action is logged against a request identifier.
Changes
We will post any change here and update the date below. Where a change materially affects your rights, we will tell affected counterparties directly.
Effective 19 August 2026.