Privacy Policy (EU GDPR)

Who We Are (Controller)

Data We Collect

We collect and process the following categories (as applicable to your use):

• Identification & KYC: name, date of birth, address, ID documents, selfies/biometrics (where legally permitted).
• Contact: email, phone, mailing address.
• Account & Usage: login data, device info, analytics events, preferences, support interactions.
• Financial/Transaction: IBAN/virtual accounts, payment/transfer details, currencies, balances (where services apply).
• Compliance: AML/CTF screening data, sanctions/PEP results, audit logs.
• Cookies/Tracking: see Cookies below.

Purposes & Legal Bases

We process personal data under one or more of the following GDPR legal bases (Art. 6):

• Contract (Art. 6(1)(b)): to provide and operate accounts, payments, and requested services.
• Legal obligation (Art. 6(1)(c)): AML/CTF checks, tax, accounting, regulatory reporting.
• Legitimate interests (Art. 6(1)(f)): service security, fraud prevention, service improvement; we balance against your rights.
• Consent (Art. 6(1)(a)): marketing communications, certain cookies, and optional features; you may withdraw consent at any time.

Sharing & Processors

We share data only when necessary:

• Service providers (processors): cloud hosting, analytics, KYC/AML, payment partners, support tools—bound by DPAs.
• Financial partners: banks, EMIs/PIs, card issuers and networks to execute transactions.
• Authorities & auditors: where legally required.
• Corporate events: in case of merger, acquisition, or restructuring (with safeguards).

International Transfers

Where data is transferred outside the EEA/UK, we use appropriate safeguards such as the EU Standard Contractual Clauses (SCCs), and conduct transfer impact assessments as required.

Data Retention

We retain data only as long as necessary for the purposes described or to meet legal obligations (e.g., AML retention periods). When no longer required, data is securely deleted or anonymised.

Your GDPR Rights

• Access, rectification, erasure, restriction, portability, and objection (Arts. 15–21 GDPR).
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with a supervisory authority (see below).

To exercise rights, contact privacy@monvera.finance. We may need to verify your identity.

Cookies & Similar Technologies

We use strictly necessary cookies for core functionality. With your consent, we may use analytics/marketing cookies. You can manage preferences in our cookie banner or your browser settings. See our Cookie Policy (if published) for details.

Security

We implement technical and organisational measures including encryption in transit, access controls, logging, and regular reviews. No method of transmission or storage is 100% secure.

Children

Our services are not directed to individuals under 18. We do not knowingly collect data from children. If you believe a minor has provided data, contact us to delete it.

Contact & DPO

Supervisory Authority

You can lodge a complaint with your local authority or our lead authority (if designated). Example: [Country] Data Protection Authority – website: [URL].

Changes to this Notice

We may update this policy to reflect legal, technical, or business changes. We will indicate the “Last updated” date and, where appropriate, notify you.