2.1. For All Users (Personal & Business)

Identity Data (Necessary for KYC/AML compliance and contract performance)

For Personal Users: Name, Address, Date of Birth, Government ID, Selfie.

For Business Users: This extends to data of representatives, Beneficial Owners, and Authorized Users as required.

Financial Data (Necessary for the performance of our contract with you (to process your ramp transactions))

• Bank Account Number / IBAN (for Off-Ramp payouts).

• Credit/Debit Card partial numbers (for On-Ramp purchases).

• Wallet Addresses and Transaction Hashes.

Transactional Data (Necessary for the performance of our contract (to settle transactions and maintain your balance) and for our legitimate interests in preventing fraud and ensuring network security)

Merchant Name, Location, Amount, and Currency for every card transaction.

2.2. Specific to Business Users & Their Accounts:

Business Entity Data (Necessary for KYB/AML and contract performance with the entity)

Company registration number, legal name, registered address, Tax ID. Constitutional documents, proof of good standing.

Authorized User Management Data (Processed on instructions of the Business User)

Names, email addresses, and roles of Authorized Users designated by the Business User.

Note: We use this data to calculate your remaining crypto balance and detect fraud.

4.1. We retain personal data only for as long as necessary to fulfill the purposes we collected it for, including for satisfying any legal, accounting, or reporting requirements. Upon expiry of the applicable retention period, we will securely delete or anonymize your personal data in a manner consistent with our data retention schedule.

4.2. KYC/Identity Records: For Personal Users: Retained for 5 years after the closure of your Account or the last transaction, as required by anti-money laundering regulations. For Business Users: We retain the company's KYB (Know Your Business) documentation, including identification data of Beneficial Owners (UBOs), controlling persons, and authorized representatives (Business Users), for 5 years after the closure of the Business Account or the last transaction. This period may be extended if required by specific regulations in the jurisdiction of the corporate entity.

4.3. Transaction Records: Retained for 7 years after account closure for financial auditing, tax, and compliance purposes (standard financial regulation). This applies uniformly to transactions conducted through both Personal and Business Accounts.

4.4. Business Account Metadata: Non-transactional data related to Business Account administration (e.g., corporate registration documents, list of Authorized Users and their assigned permissions, internal approval logs) is retained for 5 years after account closure to comply with potential regulatory inquiries and for internal audit purposes.

4.5. Authorized User Data: Personal data of Authorized Users (name, contact details) provided by the Business User is retained for the duration of their active association with the Business Account plus 2 years after disassociation or account closure, whichever is later, unless a longer period is required for compliance with Applicable Law.

4.6. Card Data: Stored securely in compliance with PCI-DSS standards and retained as required by Card Network rules (typically for dispute resolution periods, which can be up to 13 months for standard disputes or longer for specific investigations).

6.2. How to Exercise Your Rights (Distinct Paths)

For Personal Account Holders (Individual Consumers): If you hold a Personal Account with us, you are the direct data subject. You may exercise your rights directly against Rekashpay by submitting a verifiable request through the designated channels in our App or by contacting our Data Protection Officer at the details provided at the end of this Policy. We will respond to your request in accordance with Applicable Law.

For Individuals Associated with a Business Account: If your personal data is processed in connection with a Rekashpay Business Account (e.g., as an administrator, Beneficial Owner, or Authorized User), please note the following important distinction:

Primary Relationship: In this context, Rekashpay primarily processes your personal data on behalf of and under the instructions of the Business User (your employer or the entity you represent). For such data, the Business User is the data controller, and Rekashpay acts as a data processor or service provider.

Initial Point of Contact: Therefore, you should first direct your privacy requests (e.g., to access, correct, or delete the data provided to us by your organization) to the administrator of the relevant Business Account. We are contractually obligated to assist the Business User in fulfilling such requests.

Direct Requests to Rekashpay: You may also contact us directly. However, if we determine that your request relates to data we process as a processor for a Business User, we will typically forward your request to that Business User for action, unless prohibited by law. We will notify you of this action.

For All Individuals: Regardless of your account type, you always have the right to lodge a complaint with a competent supervisory authority in your country of residence.