Privacy Policy

1. Identity and Contact Details of the Data Controller

The data controller responsible for your personal data is:

Data Protection Officer (DPO)

Our designated Data Protection Officer can be contacted at:

If you have any questions about this policy or wish to exercise your data protection rights, please contact the DPO at the email address above, or reach our general support at support@padapesa.com.

2. Categories of Personal Data We Process

We collect and process the following categories of personal data:

• Identity data: full name, date of birth, nationality, government-issued identity document (passport, national ID), selfie / liveness image.
• Contact data: email address, phone number, residential address.
• Financial data: payment card or bank account details used to fund transfers; recipient mobile-money account numbers.
• Transaction data: amount, currency, corridor, timestamp, reference number, purpose of transfer, recipient details.
• Compliance / KYC data: Politically Exposed Person (PEP) status, sanctions-screening results, source-of-funds declarations, risk-rating.
• Device & usage data: IP address, device identifiers, browser type, app version, push-notification token, crash logs.
• AI coaching data: conversations with PadaPesa's AI financial coaching assistant, learning progress, module completions, and AI-generated recommendations.
• Communications: support tickets, emails, in-app messages.

2A. Face Data (Selfie and Liveness Verification)

As part of our legally required identity verification (KYC) process, PadaPesa collects and processes face data in the form of a selfie photograph and a short liveness check. This section explains exactly what we collect and how it is used, shared, stored, retained and deleted.

What face data we collect

• A selfie image of your face, captured with your device camera during identity verification.
• Liveness signals captured during that step (for example, confirming a real, present person via prompts such as a smile or blink) to prevent spoofing.

A real-time, on-device camera guide may help you position your face within an oval while capturing the selfie. Any such on-device face-position processing happens locally on your device in transient memory only; it is not recorded, not stored, and never transmitted to us or any third party, and it is discarded the moment the camera screen closes. The only face data that leaves your device is the selfie image (and its liveness result) submitted for KYC.

How we use face data

• Solely to verify your identity — confirming you are a real, live person and that your face matches your government-issued identity document — as required by anti-money-laundering (AML/KYC) law.
• Face data is never used for advertising, marketing, profiling, tracking, or building any facial-recognition database, and it is not used to train machine-learning models.

Who we share it with

The selfie and liveness data are transmitted to our specialist KYC/identity-verification processor, Sumsub (Sum and Substance Ltd), which performs the document match and liveness analysis on our behalf under a data-processing agreement and EU Standard Contractual Clauses. Face data is not sold and is not shared with any other third party, except where disclosure to a competent regulator or law-enforcement authority is required by law.

Where it is stored

The selfie image is processed by Sumsub (Cyprus / EU, with global sub-processors) and the resulting KYC record and image are stored in our EU-based storage (Microsoft Azure, North Europe). International transfers are protected by EU Standard Contractual Clauses.

How long we retain it

Because face data forms part of our KYC records, we are legally required to retain it for five (5) years after your last transaction or account closure under the EU AML Directive (Art. 40) and Danish AML law. After that period it is securely deleted or anonymised.

Deletion

You may request deletion of your face data at any time by emailing dpo@padapesa.com. We will delete it unless we are legally obliged to retain it for the AML period described above; any data retained solely for that legal obligation is deleted as soon as the obligation expires.

3. Purposes and Legal Basis for Processing

4. Legitimate Interests

Where we rely on Art. 6(1)(f) GDPR (legitimate interests), those interests are:

• Fraud and financial crime prevention: protecting our users and the integrity of the payment system from fraudulent activity.
• Network and information security: ensuring the confidentiality and availability of our systems and data.
• Service improvement: understanding how users interact with our product so we can improve reliability and user experience.

We have conducted a balancing test and concluded that our legitimate interests are not overridden by your interests or fundamental rights. You have the right to object to processing based on legitimate interests (see Section 10).

5. Recipients and Categories of Recipients

We share your personal data only where necessary with the following categories of recipients:

• KYC / identity-verification providers — to verify your identity and comply with AML obligations.
• Payment processors and partner financial institutions — to execute and settle money transfers.
• Cloud infrastructure providers — to host and operate the Service.
• Push-notification and authentication services — to deliver account and transaction alerts.
• Analytics and monitoring tools — to detect errors and improve performance (data is processed pseudonymously where possible).
• Legal and regulatory authorities — where required by applicable law, court order, or regulatory request (e.g., Finanstilsynet, tax authorities, law enforcement).

6. Transfers to Third Countries

Some of our service providers are established outside the European Economic Area (EEA). We transfer your data to the following named third parties outside the EEA and rely on the transfer mechanisms indicated:

You may request a copy of the applicable SCCs by contacting us at support@padapesa.com.

7. Retention Periods

After expiry, data is securely deleted or anonymised in line with our Record Retention Schedule.

8. Your Rights Under GDPR

You have the following rights with respect to your personal data:

8.1 Right of Access (Art. 15)

You may request a copy of the personal data we hold about you and information about how it is processed.

8.2 Right to Rectification (Art. 16)

You may ask us to correct inaccurate personal data or complete incomplete data without undue delay.

8.3 Right to Erasure / “Right to be Forgotten” (Art. 17)

You may ask us to delete your personal data where there is no longer a lawful basis for processing it. Note that certain data must be retained to comply with legal obligations (e.g., AML record-keeping) even after a deletion request.

8.4 Right to Restriction of Processing (Art. 18)

You may ask us to suspend processing of your data in certain circumstances, for example while you contest the accuracy of the data.

8.5 Right to Data Portability (Art. 20)

Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and to transmit it to another controller.

8.6 Right to Object (Art. 21)

You may object at any time to processing based on our legitimate interests (Art. 6(1)(f)), including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds. You may also object at any time to direct marketing and related profiling.

To exercise any of the above rights, email support@padapesa.com with the subject line “GDPR Data Request”. We will respond within 30 calendar days. We may need to verify your identity before processing your request.

9. Right to Withdraw Consent

Where we process your data on the basis of consent (Art. 6(1)(a) GDPR — e.g., marketing emails), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

To withdraw consent, click “Unsubscribe” in any marketing email or contact us at support@padapesa.com.

10. Right to Lodge a Complaint with a Supervisory Authority

If you believe that our processing of your personal data violates applicable data-protection law, you have the right to lodge a complaint with a supervisory authority. In particular, you may contact:

You may also contact the supervisory authority in your country of habitual residence or place of work.

11. Whether Provision of Personal Data is a Statutory or Contractual Requirement

Provision of certain personal data is a statutory requirement under anti-money-laundering law (the EU 5th AML Directive and Danish AML Act). Without this data (identity documents, proof of address, etc.), we are legally unable to onboard you or process your transfers.

Provision of contact and payment data is a contractual requirement: you must provide it to use our Service. If you choose not to provide it, we will not be able to create your account or execute transfers on your behalf.

Marketing-related data (e.g., email for newsletters) is optional and is based on your consent.

12. Automated Decision-Making and Profiling

We use automated processing in the following areas:

• AML / sanctions screening: automated screening of transactions against international sanctions lists and assignment of customer risk ratings, as required by AML/CFT legal obligations.
• KYC identity verification: automated document verification and liveness checks via our KYC partner Sumsub.
• AI financial coaching: AI-generated financial literacy content and personalised recommendations based on your learning progress and stated goals. This processing does not produce legal or similarly significant effects.
• Fraud detection: automated transaction monitoring to detect unusual patterns indicative of fraud, account takeover, or structuring.

Where automated processing produces decisions that significantly affect you (e.g., account suspension, transfer blocking, KYC rejection), you have the right to request human review, express your point of view, and contest the decision. Please contact dpo@padapesa.com to invoke this right.

13. Cookies and Similar Technologies

Our website uses technically necessary cookies (session management, security). We may also use analytics cookies where you have given consent. You can manage cookie preferences via your browser settings or our cookie-consent tool. Detailed information is set out in our Cookie Policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notification at least 30 days before the changes take effect. The “Last updated” date at the top of this page indicates when this policy was last revised.

15. Contact Us

For any privacy-related queries or to exercise your rights, please contact our data protection point of contact: