What information do we collect We may collect, use, store, and transfer different kinds of personal data, including:

Identity data -
Information provided for onboarding, verification, and due diligence, including information processed through identity verification and compliance service providers.
Contact data -
Physical address, email address, telephone number, and other contact details.
Financial data -
Payment account information, funding and payout details, and other information required to provide services.
Transaction data -
Details about transactions and activity carried out through the Platform, including amounts, currencies, counterparties, recipient details, bank details, and related metadata.
Technical data -
Internet protocol address, browser type and version, time zone setting, location data where permitted, device identifiers, operating system, platform, and other technology information from devices used to access the Platform.
Profile data -
Preferences, feedback, survey responses, and customer support communications.
Usage data -
Information about how customers use the Platform, including features accessed and interaction patterns.
Aggregated data -
Statistical or demographic data derived from personal data that does not directly or indirectly identify a customer.
How do we collect personal data -
We use different methods to collect data, including:
Direct interactions -
When customers complete forms, provide information during onboarding, communicate with us, or submit support requests.
Automated technologies -
When customers interact with the Platform, we may automatically collect technical and usage data using cookies and similar technologies. Please see our Cookie Policy where available.
Third parties -
We may receive personal data from service providers such as analytics providers, identity verification providers, compliance providers, payment service providers, banking partners, card programme partners, custodians, and other infrastructure providers, subject to applicable law.
Do customers have to provide personal data -
We require certain personal data to provide services, to perform onboarding and verification, and to comply with legal and regulatory obligations. If customers do not provide required information, we may not be able to offer certain services.
How do we use personal data -
We will only use personal data where permitted under applicable law. Common purposes include: Account creation and onboarding
To register customers, create a Platform account, and maintain customer records.
Identity verification and compliance -
To verify identity, perform due diligence, prevent fraud, conduct anti money laundering and counter terrorist financing checks, perform sanctions screening, and conduct ongoing monitoring.
Providing services-
To operate the Platform, process transactions, provide customer support, and deliver requested services.
Communications-

To send service related communications such as confirmations, operational notices, security alerts, and important updates.
Improvement and analytics-
To improve the Platform, develop features, troubleshoot, and perform analytics.
Legal and regulatory obligations -

To comply with applicable laws, respond to lawful requests, and enforce our rights.
Marketing-

Where permitted by applicable law, and where required, based on customer preferences or consent. Data accuracy-

It is important that the personal data we hold is accurate and current. Customers should inform Customer Support of changes to their personal details without undue delay.

When do we disclose personal data-
We may share personal data within the Scallop Group and with trusted third party service providers where necessary to provide services and operate the Platform. We take steps to ensure that personal data is processed in accordance with applicable data protection laws.

Personal data may be shared with:

Platform and technology providers-

Hosting providers, cloud services, software and infrastructure providers, analytics providers, and security service providers.
Verification and compliance providers -

Identity verification providers, sanctions screening providers, fraud prevention providers, and related compliance service providers.
Payments and financial partners -

Banks, payment service providers, card issuers or programme partners, processors, and settlement partners.
Professional advisers -

Legal, audit, compliance, and other professional advisers where necessary.
Authorities -
Regulators, supervisory authorities, law enforcement, courts, and government bodies where required by applicable law or where necessary to protect legal rights.
Corporate transactions -

If the Scallop Group engages in a merger, acquisition, reorganisation, financing, or sale of assets, personal data may be shared for due diligence and transaction completion, subject to confidentiality and applicable law.
International transfers -
The Scallop Group may operate and use service providers in multiple jurisdictions. Where personal data is transferred internationally, we take appropriate measuresrequired by applicable law to protect personal data. This may include contractual protections and additional safeguards where required. How long we store personal data -
We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including legal, regulatory, accounting, and reporting requirements. Retention periods depend on the nature of the data and applicable legal obligations. Where required, we may retain data for longer periods to establish, exercise, or defend legal claims, or as required by law