Privacy Policy

1. Who we are

This Privacy Policy explains how TokenPe ("we", "us"), [US ADDRESS], collects and uses personal data when you visit tokenpe.com, apply for or use our services, or contact us. For the purposes of the EU and UK General Data Protection Regulation (GDPR), TokenPe is the controller of the personal data described here. Contact: [email protected].

2. Who this policy covers

• Visitors to our website.
• People who contact us or join a waitlist.
• Directors, beneficial owners, authorised users and employees of merchants that apply for or use our services.
• Customers of our merchants, to the extent we process their data when processing payments or payouts.

Our merchants are responsible for their own privacy notices to their customers.

3. Personal data we collect

• Identity data: name, date of birth, nationality, government ID details and images, photographs or selfies for verification.
• Contact data: email address, phone number, postal address.
• Business data: job title, role, ownership percentage, company details and licences.
• Verification and compliance data: results of identity checks, sanctions, politically exposed person (PEP) and adverse media screening, source of funds and source of wealth information, and risk ratings.
• Financial and transaction data: wallet addresses, transaction hashes, amounts, bank account details for payouts, payout recipient details and transaction history.
• Blockchain analytics data: risk scores and information about wallet addresses and transactions, provided by blockchain analytics providers.
• Technical data: IP address, device and browser type, log data, approximate location derived from IP address, and API usage logs.
• Usage data: pages visited and actions taken on our website and dashboard (analytics cookies only with your consent).
• Communications: messages, emails, support tickets and call notes.

We do not intentionally collect personal data from children under 18.

4. Where we get personal data

• From you, when you apply, use the services or contact us.
• From the merchant you work for or own.
• From identity verification, sanctions screening and blockchain analytics providers.
• From public sources such as company registers and public blockchains.
• From banks and payout partners, including our Mastercard partnership, when processing payouts.

5. How we use personal data and our legal bases

We do not use personal data for decisions that produce legal effects based solely on automated processing without human review. Our screening tools flag risks, and our compliance team reviews flags before a final decision.

6. Who we share personal data with

• Service providers that help us run the business: hosting, identity verification, sanctions screening, blockchain analytics, customer support, email and analytics providers.
• Banks, custodians and payout partners, including our Mastercard partnership, to process payouts.
• Regulators, law enforcement, courts and government authorities, including FinCEN, where required by law.
• Professional advisers such as auditors and lawyers.
• A buyer or successor in a merger, acquisition or sale of assets, subject to this policy.
• Others with your consent.

Information recorded on public blockchains is visible to anyone and cannot be deleted by us.

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising.

7. International transfers

We are based in the United States and process data there and in other countries where our providers operate. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use safeguards approved by law, such as the European Commission's Standard Contractual Clauses and the UK addendum, or rely on an adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified.

8. How long we keep personal data

• Verification (KYB/KYC) records and transaction records: at least five years after the account closes or the transaction occurs, as required by the Bank Secrecy Act, and longer where required by law or a legal hold.
• Suspicious activity report records and supporting documents: five years from the date of filing.
• Account and contract records: for the life of the account and up to seven years after it closes, for legal and tax purposes.
• Contact form and waitlist data: up to 24 months after our last contact, unless you become a merchant.
• Analytics data: up to 14 months.
• Security logs: up to 12 months, unless needed for an investigation.

9. Security

We use technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, two-factor authentication for staff and regular security reviews. No system is completely secure. If a breach affects your personal data, we will notify you and regulators where the law requires.

10. Cookies

We use strictly necessary cookies and, with your consent, analytics cookies. See our Cookie Policy for details and to change your choices.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• receive a copy of your data in a portable format;
• object to or restrict our processing;
• withdraw consent at any time, without affecting earlier processing;
• opt out of marketing;
• complain to a data protection authority.

Some rights are limited by law. For example, we must keep verification and transaction records for the periods required by the Bank Secrecy Act even if you ask us to delete them, and we may not be able to tell you about some compliance activities.

12. California residents (CCPA/CPRA)

This section applies to California residents and supplements this policy.

• Categories collected in the last 12 months: identifiers; personal information described in Cal. Civ. Code § 1798.80(e); commercial information; internet or other electronic network activity; geolocation data (approximate, from IP address); audio, electronic or similar information (call and support records); professional or employment-related information; and sensitive personal information (government ID numbers, account details for payouts).
• Sources, purposes and recipients: as described in sections 4, 5 and 6.
• Retention: as described in section 8.
• Sale and sharing: we do not sell or share personal information as those terms are defined in the CCPA, including information about consumers under 16.
• Sensitive personal information: we use it only for purposes permitted by the CCPA, such as verifying identity, providing the services, security and legal compliance. We do not use it to infer characteristics.
• Your rights: to know and access, delete, correct, and limit the use of sensitive personal information (where applicable), and not to be discriminated against for exercising your rights.
• How to exercise rights: email [email protected]. We will verify your identity by matching information you provide with information we hold. You may use an authorised agent, who must provide signed permission from you.
• Some personal information we collect is covered by the Gramm-Leach-Bliley Act and is exempt from parts of the CCPA. We will tell you if this applies to your request.

13. EU, EEA and UK residents (GDPR)

• Our legal bases are listed in section 5.
• You may complain to the data protection authority where you live or work, or where an alleged infringement occurred.
• Where required, we will appoint a representative in the EU or UK and list their details on this page.

14. Responding to requests

We respond to verified requests within the time required by law: 45 days under the CCPA and one month under the GDPR, which may be extended where the law allows.

15. Changes

We may update this policy. We will post the new version on this page with a new effective date and notify merchants of material changes by email.

16. Contact

Email [email protected] or write to TokenPe, [US ADDRESS], Attention: Privacy.