PRIVACY POLICY

Definitions

“Applicable privacy law” means the law applicable to the particular processing, including the GDPR and relevant EU/EEA national rules, California privacy legislation where its scope is met, and applicable Wyoming law. Incorporation in Wyoming does not displace mandatory rights arising elsewhere. [1, 9, 12]

“GDPR” means Regulation (EU) 2016/679, as applicable in the EU/EEA. It can apply to a business outside the EU/EEA when the relevant processing concerns offering goods or services to people there or monitoring their behaviour there. EU/EEA hosting alone does not establish or exclude territorial scope. [1]

“Personal data” or “personal information” means information about an identified or identifiable individual. A wallet address, transaction identifier, IP address or device identifier can be personal data when linked or reasonably linkable to an individual.

“Data subject” or “individual” means the person to whom personal data relates. California terminology and the scope of statutory definitions apply where California law governs.

“Employee” includes a member of staff or individual contractor authorised to handle personal data for Paysolo. Applicants, business representatives, directors and beneficial owners may also be data subjects.

“Processing” includes collecting, recording, consulting, analysing, transmitting, restricting, storing or deleting personal data.

“Controller” means a person or organisation determining why and how personal data is processed. A provider’s role depends on the actual processing, rather than the label in its contract. [4]

“Processor” means a person or organisation processing personal data for a controller under documented instructions. California “service provider” and “contractor” requirements are assessed separately; these labels are not automatically interchangeable. [4, 9]

“Personal data breach” means a security failure affecting the confidentiality, integrity or availability of personal data. “CCPA” means the California Consumer Privacy Act, as amended by the California Privacy Rights Act. “Sensitive information” has the meaning given by the applicable law, which may include identity-document details, account credentials, health information or identifying biometrics. [7, 9]

Organisation and Roles in the Processing of Personal Data

The Company operates online through paysolo.io. Its principal and mailing address is the Wyoming address stated above. Privacy requests may be submitted by email or by post to PAYSOLO LLC, Attention: Privacy, at that address. The privacy provisions in this Policy do not establish eligibility for financial services in any jurisdiction.

Paysolo determines the purposes and means of its own account administration, support, platform security, business and employment processing. A provider is separately responsible for processing it undertakes for its own legal and operational purposes. We identify the relevant provider and make its privacy notice available in the applicable onboarding or service flow. [4]

Where Paysolo acts as a processor, the relevant controller’s lawful instructions and the processing agreement govern that activity. We assist with rights requests and incidents within our role. Individuals may contact us to identify the responsible controller and to route a request appropriately. [4]

Purpose of the Policy

The purpose of this Policy is to make the Company’s data handling understandable and to set requirements for its staff and providers. Each processing activity must have a defined purpose, an appropriate legal basis and safeguards proportionate to its risk. A description of a category below does not authorise collecting every item in that category from every person. [2, 3]

Types of Personal Data Processed by Paysolo

a. Categories of information according to the relevant relationship

• Recruitment information, such as CVs, work history, education, qualifications and application correspondence, where a person applies to work with Paysolo;

• Internet or electronic network activity, including IP addresses, browser and device details, access times, security logs and cookie preferences; cookie purposes and controls are explained in the separate Cookie Policy;

• Identifiers and contact details, including name, residential or business address, email, telephone number, account identifiers, date of birth and nationality where needed;

• Records of notices, consents, contractual acceptance, electronic signatures and communications with support;

• Commercial and transaction information, such as service requests, currency or asset type, amount, date, status, provider references and transaction-related correspondence;

• External wallet addresses, public transaction hashes, network information and relevant transaction-screening results; these records do not give Paysolo custody of assets or private keys;

• Professional and business information, including the role, authority and contact details of representatives and information about directors and beneficial owners;

• Verification and compliance information, where lawfully required, including identity documents, address evidence, corporate records, ownership information and source-of-funds or source-of-wealth evidence;

• Verification outcomes, sanctions or fraud alerts and risk assessments received from a provider, limited to what Paysolo needs for its own disclosed functions;

• Employment, contractor, payroll and tax records where relevant to the Company’s workforce and administration;

• Health, disability, family or dependent information only where a specific employment, benefit or legal requirement makes it necessary, with a separate notice and the additional safeguards required by law;

• Bank-account or payment-reference information needed for a requested provider service, business payment or payroll, without Paysolo holding client fiat funds; and

• Images, document photographs or biometric verification results where a provider lawfully uses them for identity verification. Any processing of identifying biometrics or other specially protected data requires the applicable additional legal condition; it is not authorised merely by accepting this Policy. Paysolo does not request private keys, seed phrases or recovery phrases.

b. Categories of individuals and sources of information

• Users and prospective users of the platform, together with business representatives, directors and beneficial owners;

• Staff dependants and emergency contacts, only where relevant to legitimate workforce administration;

• Employees, job applicants, contractors, suppliers and other business contacts;

• Persons whose data is supplied by a user, provider, authorised representative, professional adviser or competent authority, where disclosure and receipt are lawful; and

• Website visitors and people contacting support. Information may come directly from the person, from platform interactions, from the third-party provider or from lawful public registers and screening sources. We do not treat public availability as unrestricted permission to use personal data.

The service is intended for individuals aged 18 or over. Children should not submit onboarding information. If a child’s information has been supplied in error, contact us so that we can assess its removal and any limited legal preservation requirement. Necessary staff-dependent information is handled separately.

Processing of KYC KYB AML and Transaction Data

KYC/KYB and AML/CFT functions may be undertaken by the third-party provider. Verification documents may be collected directly through its onboarding process. Paysolo accesses or receives such information only to the extent necessary for its agreed, lawful role, which may include assisting onboarding, communicating a verification status, preventing fraud or responding to a specific lawful request. A provider’s statutory obligations are not automatically obligations of Paysolo.

Provider contracts must identify controller and processor roles, permitted purposes, confidentiality, security, incident cooperation, relevant international transfers and retention responsibilities. Where the provider acts as a processor, the contract must meet applicable processor requirements; where it acts as an independent controller, it must provide its own lawful basis and privacy information. [4, 8]

Paysolo remains accountable for its own processing and for the providers it engages as processors. It must not retain a duplicate full verification file simply because another controller is required to keep one. Required information, the consequences of not providing it and any provider decision affecting service access must be explained in the relevant onboarding flow. The retention requirements for relevant records appear in Chapter VI.

Principles of Security and Protection of Personal Data

The following principles govern the Company’s processing and apply alongside the specific requirements of each applicable law. [2]

a. Lawfulness fairness and transparency

For each activity, Paysolo records its purpose and legal basis. Where the GDPR applies, contract necessity may support account administration and requested support; legitimate interests may support proportionate security, fraud prevention and legal claims; consent may support optional marketing or other optional uses; and an applicable EU or Member State legal duty may support processing required by that duty. A US obligation or a provider contract does not, by itself, establish a GDPR Article 6(1)(c) basis. [3]

Where legitimate interests are used, Paysolo assesses necessity and balances the purpose against individuals’ rights and reasonable expectations. Consent must be a real choice and may be withdrawn through an equally accessible route. Special-category data requires an Article 9 condition as well as an Article 6 basis; criminal-offence information requires the safeguards in Article 10. [3]

b. Purpose limitation

Use is limited to the purposes disclosed to the individual: operating and supporting the interface; facilitating a requested provider interaction; protecting accounts and detecting misuse; handling complaints and legal claims; meeting duties actually applicable to Paysolo; administering business and workforce relationships; and sending optional communications where permitted.

Privacy information must be supplied at collection or within the applicable period for information obtained elsewhere. A materially new use requires a fresh assessment and any notice or consent the law requires. Commercial convenience does not justify keeping or repurposing a complete customer file. [2, 5]

c. Data minimisation

Staff must use the least data reasonably needed for the specific task. Where a provider’s confirmation or a limited record is sufficient, Paysolo should not obtain the underlying full identity or financial file. Requests for additional evidence must explain their purpose and use an appropriate secure channel.

d. Accuracy

Personal data must be kept sufficiently accurate for its use. We provide a route to correct information and, where necessary, communicate corrections to relevant recipients. A disputed risk alert must be assessed in context; an alert is not proof of wrongdoing.

e. Storage limitation

Personal data must be erased or irreversibly anonymised when its documented purpose and lawful retention period end. Relevant transaction and compliance records follow Chapter VI’s five-year baseline and, where justified and lawful, an investigation extension of up to two years. This does not impose a five- or seven-year period on all website, cookie, marketing or staff data. [2]

f. Integrity and confidentiality

Access, transfer and disposal must protect personal data against misuse, unauthorised access and accidental loss. Controls are selected for the sensitivity of the information and the risks to individuals. Security arrangements are reviewed when systems, providers or risks change. [6]

g. Accountability

Management oversees this Policy, assigns responsibilities and maintains evidence of compliance. The Company must assess whether an EU/EEA representative, a data protection officer, impact assessments, prior consultation, California risk assessments or cybersecurity audits are required for its actual processing, and meet any applicable conditions and deadlines. Appointment and contact information must be published where required. [1, 10]

All staff and contractors handling personal data must follow this Policy, confidentiality obligations and authorised procedures. Suspected misuse, excessive collection, inappropriate disclosure or a security incident must be reported promptly to the responsible manager. Accountability or disciplinary action is governed by applicable law and contract.

Management remains responsible for providing resources, allocating tasks and addressing compliance issues. Delegating tasks does not remove the Company’s obligations.

Management Responsibilities

Management approves data-handling procedures, staff training, provider assessments, access rights and retention arrangements. It must ensure that product changes are assessed for privacy impacts before release, that support staff can recognise rights requests, and that incidents and legal holds reach the appropriate decision-maker promptly.

Privacy Coordination and Independence

• Assign a person or function to coordinate privacy enquiries and maintain clear reporting lines;

• Obtain appropriate advice where a processing purpose, disclosure, retention decision or legal request is uncertain;

• Provide sufficient resources, training and access to relevant information;

• Assess whether a statutory data protection officer is required and appoint a suitably qualified person where necessary;

• Where a GDPR data protection officer is appointed, protect the independence required by Articles 38 and 39 and avoid conflicting duties;

• Require confidentiality and limit access to the information needed for each assigned task; and

• Escalate unresolved risks to management and document remedial decisions. A manager is not automatically the Company’s statutory data protection officer.

Operational Tasks

• Maintain the processing inventory, provider roles, notices and retention schedule;

• Receive, verify where appropriate, route and answer privacy requests through contact@paysolo.io;

• Train staff in confidentiality, phishing awareness, secure evidence handling and rights requests;

• Assess high-risk changes, international transfers and any legally required impact assessments;

• Coordinate incident response and lawful communications with the competent authority for the affected processing; and

• Review the necessity of sensitive-data access, investigation holds and retention extensions, recording the reason and review date for each decision.

Information Security Measures

The Company’s security procedures must address the risks of its actual systems and data. Measures include, as appropriate to those risks: [6]

• multi-factor authentication and controlled account administration;

• password controls, encryption in transit and at rest where appropriate, and secure configuration;

• access limited by role, confidentiality duties and timely removal of unnecessary permissions;

• backups, restoration checks, security monitoring, patching and response procedures; and

• written provider terms governing permitted access, safeguards, breach cooperation and deletion. Staff must not request wallet secrets or send verification files through unsuitable channels.

Data Hosting and International Transfers

Company-controlled primary hosting and backups of customer personal data must be located in EU data centres. This hosting requirement does not mean that every third-party provider processes exclusively in the EU, or that lawful access from another country cannot occur. Each provider’s notice and contractual role must be considered separately.

Before personal data subject to the GDPR is made available to a separate recipient outside the EEA, Paysolo must identify a valid Chapter V mechanism. This may be a current adequacy decision covering the recipient or appropriate safeguards such as the European Commission’s standard contractual clauses, together with any necessary transfer assessment and supplementary measures. [8]

A hosting location alone does not resolve international-transfer requirements. Individuals may request information about the relevant destination and safeguards, including an accessible copy where applicable. Transfers and remote access must remain limited to authorised purposes and necessary data. Routine transfers must not be justified by a general consent clause in this Policy. [8]

Authorised Recipients and Legal Requests

Depending on the relevant service and purpose, necessary personal data may be disclosed to the following recipients. The Company must record who receives data and in what capacity:

• the third-party financial-service or verification provider for the user’s requested service, lawful screening and related support;

• contracted hosting, security, communications, support and business-administration providers, subject to appropriate confidentiality and use restrictions;

• professional advisers, auditors, insurers or competent authorities where necessary and lawfully justified for a specific duty, investigation or legal claim;

• processors under written terms meeting the requirements of Article 28 of the GDPR where applicable, including controls over subprocessors; [4]

• another controller under a lawful disclosure or, where actual joint controllership exists, an arrangement allocating responsibilities; and

• a competent law-enforcement, regulatory or judicial authority in response to a valid and proportionate request. Paysolo checks authority, scope and applicable restrictions, discloses only the necessary records, and gives notice to the individual unless prohibited or lawfully restricted.

A foreign court or administrative request does not by itself remove GDPR transfer restrictions. Any disclosure must meet the applicable processing and transfer requirements. Staff must preserve relevant records under a valid legal hold, while limiting access and avoiding unnecessary disclosure of unrelated persons’ information.

Paysolo maintains an electronic record of processing activities where Article 30 of the GDPR requires it, and an operational inventory supporting this Policy. Records identify purposes, categories of data and individuals, recipients, provider roles, relevant transfers, retention criteria and security arrangements. Management reviews these records when processing changes. Decisions concerning notices, assessments, requests, incidents and investigation holds must also be documented.

Minimum Five Year Retention

Records needed to trace and substantiate transactions, including relevant transaction references, external wallet addresses, dates, amounts, provider communications and associated verification or compliance evidence lawfully held by Paysolo, must be retained for a minimum of five (5) years where a binding recordkeeping duty applies or a documented assessment establishes that this period is necessary and lawful for the Company’s disclosed purposes.

The period runs from the relevant transaction, creation of the record or termination of the relationship, according to the rule applicable to that record. The retention schedule must identify the correct trigger. Where a relationship-based rule applies, transaction or verification records required for that relationship are kept for five years after it ends; a transaction-specific rule is measured from its own prescribed date.

For example, 31 CFR 1010.430(d) generally requires records covered by US Bank Secrecy Act regulations to be kept for five years. Article 40 of Directive (EU) 2015/849 provides a five-year framework for relevant records of obliged entities, subject to applicable national implementation. These rules apply to the entities and records within their scope. They do not make every software platform an obliged financial institution. [13, 14]

Investigation Extension of Up to Two Additional Years

Where an ongoing investigation requires preservation, the relevant records must be placed under a documented hold and may be retained for up to two (2) additional years after the five-year baseline, giving a total of up to seven (7) years. An extension is used only to the extent lawfully required or necessary for a specific regulatory, law-enforcement, fraud or AML/CFT investigation, dispute or legal proceeding.

The responsible manager must record the matter, legal basis, affected records, start date, expected end date, access restrictions and review arrangements. Only records relevant to the matter are retained under the extension. The extension is not automatic, and the two-year period must not be used where a shorter period is sufficient or applicable law does not permit continued retention.

When the hold ends, records whose other lawful retention periods have expired must be securely deleted or irreversibly anonymised. Retention beyond seven years requires a separate, specific legal duty or binding preservation requirement and a documented review. Any shorter mandatory limit or prohibition must also be respected. The five-plus-two structure is the Company’s qualified retention policy, rather than a universal requirement imposed by EU, California or Wyoming privacy law. [2, 9, 13, 14]

Other Records and Secure Disposal

• Account and support information is retained while needed to provide the interface, resolve the request and address a justified complaint or claim; unrelated data is removed sooner.

• Security logs and website data follow a purpose-specific period based on the risk and the useful investigation window; routine browsing and cookie records do not automatically receive five- or seven-year retention.

• Optional marketing data is removed or restricted after withdrawal or objection, except a minimal suppression record needed to respect that choice.

• Workforce and accounting records follow the requirements applicable to that record and relationship. Unsuccessful applicant data is kept only for a justified recruitment or claims period.

• Where CCPA regulations apply, consumer-request and response records are retained for at least 24 months and used only for the permitted compliance purposes. This is separate from the investigation extension. [10]

A deletion request is assessed record by record. We explain any applicable exception unless disclosure is prohibited, restrict retained information to its lawful purpose and delete information outside that exception. A provider determines its own retention obligations as an independent controller; Paysolo’s account closure does not instruct it to destroy legally required records. Backups remain protected and age out through controlled deletion; restoration must not reintroduce data scheduled for erasure.

Requests and Available Rights

Where the GDPR applies, individuals may ask to see their personal data and obtain a copy, correct inaccuracies, seek erasure, limit processing, object to qualifying processing, or receive qualifying data in a portable form. Consent can be withdrawn for future processing. Direct-marketing objections must be respected. Rights are subject to the conditions of the relevant law. [5]

Send requests to contact@paysolo.io or to the Company’s postal address, marked "Privacy". State the right and information concerned. We may seek proportionate identity or authority evidence where needed, without demanding unnecessary documents. Requests concerning a provider’s separate processing are routed to that controller.

We normally act within one month. For a complex request or a number of requests, the GDPR permits an extension of up to two further months, with reasons given within the first month. Requests are normally free. A refusal or lawful fee must be explained together with available complaint and judicial remedies. [5]

Automated Assessments and Complaints

Verification or security tools may generate alerts or risk indicators. Before any processing that falls within GDPR Article 22 is used, the responsible controller must identify a permitted basis, give the required information about the decision and its consequences, and provide the applicable safeguards. These may include an opportunity for human intervention, to express a view and to challenge the decision. A provider remains responsible for decisions it makes as an independent controller. [5]

Individuals may complain to the competent data protection authority, including in the Member State of their habitual residence, place of work or alleged infringement, and may seek an applicable judicial remedy. Contacting Paysolo first is optional and does not remove those rights. [5]

Scope and Transparency

This Chapter applies to California personal information where the relevant California law covers the Company and the processing. CCPA obligations depend on statutory scope, thresholds and exceptions; a Wyoming registration does not itself establish CCPA coverage. Any financial-information exemption must be assessed for the specific data and does not automatically exempt the entire software business. [9]

The categories, sources, purposes and recipient types in Chapters II and IV describe the information handled within the relevant relationship. Retention is governed by Chapter VI. At or before collection, notices must identify the actual categories and purposes, sensitive-information handling and retention periods or criteria. Where required, the published notice must also accurately report the preceding 12 months’ collection and disclosures. It must be updated at least every 12 months. [9, 10]

California Consumer Choices

Where the CCPA applies, consumers can seek access to information about collection and disclosure, request correction or deletion, opt out of sale or qualifying advertising sharing, and limit qualifying uses of sensitive information. They are protected against unlawful discrimination or retaliation for exercising rights. A qualifying authorised agent may submit a request. [9, 11]

Sale of personal information and disclosure for cross-context behavioural advertising are prohibited under this Policy. Sensitive information may be used only as reasonably necessary for the requested service, account security, lawful verification, fraud prevention and other uses permitted by applicable law. A change outside these limits requires a lawful assessment and the notices, controls and choices required before the change takes effect.

Where an opt-out or limitation right applies, Paysolo must honour it and a qualifying Global Privacy Control signal. A consumer does not need an account or identity verification merely to opt out of sale or sharing. Requests for access, correction or deletion may require proportionate verification. Data used to verify a request must not be repurposed for marketing. [10, 11]

How to Submit a California Request

Email contact@paysolo.io with the subject "California Privacy Request", or write to the Company’s Wyoming address, Attention: Privacy. State the request and a means of replying. An authorised agent should provide evidence of authority; identity checks must follow the applicable rules. Additional submission methods must be supplied if the Company’s operations make them legally required. [9, 11]

For covered access, correction or deletion requests, receipt is confirmed within 10 business days and a substantive response is ordinarily provided within 45 calendar days. A further 45 calendar days may be used where reasonably necessary, with notice within the first period. Applicable opt-out and sensitive-information limitation requests must be acted on as soon as feasible and within the relevant regulatory deadline, ordinarily no later than 15 business days. [10, 11]

Online Tracking and California Breach Notices

The Cookie Policy explains the technologies in use and available controls. A browser’s legacy Do Not Track setting is not treated as consent to optional processing. Its technical treatment and whether third parties collect information across websites must be disclosed accurately in the online notice. Qualifying Global Privacy Control signals are handled under the applicable opt-out rules. Optional tracking must not be activated contrary to a valid refusal. [10, 15]

Where California breach-notification law applies, Paysolo must assess the incident, notify affected residents within the applicable statutory period and meet the required content and reporting rules. A sample notice must be submitted to the California Attorney General when the law requires it, including the applicable threshold for notices to more than 500 California residents. [16]

Consumers may raise a privacy concern with the California Privacy Protection Agency at cppa.ca.gov or the California Attorney General at oag.ca.gov/privacy/ccpa. Those routes do not restrict any remedy available under applicable law. [11]

Protection of Personal Identifying Information

Paysolo must protect information within the scope of applicable Wyoming law, including W.S. 40-12-501 and 40-12-502. The statutory definitions and duties apply to the affected data and circumstances. These provisions do not create an automatic five-plus-two-year retention requirement or displace mandatory EU/EEA or California rights. [12]

When a covered breach is identified, the Company must promptly investigate in good faith whether Wyoming residents’ identifying information has been or is likely to be misused. Where the statutory trigger is met, affected residents must receive clear notice as soon as possible and without unreasonable delay, subject to the law’s permitted investigation and restoration considerations. A law-enforcement delay must meet the statutory written-determination requirement. [12]

Required notice must use a permitted delivery method and contain the statutory incident, information, contact and protective-action details. A provider maintaining covered data for another business must give that business notice as soon as practicable after the relevant determination. The parties must coordinate the resident notice without allowing their contractual arrangements to defeat the statutory duty. [12]