DAlphaPay PRIVACY POLICY

1. WHO WE ARE

DAlpha Company SL Limited ("DAlphaPay", "we", "us" or "our") operates and develops DAlphaPay, a digital payment technology platform intended to support payment initiation, processing, merchant services, payment APIs and related financial technology services.

The entity responsible for a particular processing activity may depend on the product, transaction structure and regulated partner involved. Where a bank, mobile money operator, payment service provider, processor, identity provider or other partner independently determines how it processes your information, that partner's privacy notice may also apply.

2. SCOPE

This Policy applies to personal data collected through DAlphaPay websites, mobile applications, account registration, payment interfaces, APIs, customer support, merchant and agent onboarding, verification processes, communications and related services.

It does not override a specific privacy notice presented for a product where additional or different processing is required. In that situation, the product-specific notice will supplement this Policy.

3. INFORMATION WE MAY COLLECT

Identity information, including name, date of birth, nationality, identification details and photographs or verification information where required.

Contact information, including phone number, email address and address information.

Account information, including username, account identifiers, authentication records and account preferences.

KYC/KYB information, including business registration information, beneficial ownership, authorised representatives and related verification documents.

Transaction information, including transaction references, amounts, currencies, timestamps, recipients, merchants, payment channels and status.

Device and technical information, including device identifiers, operating system, IP address, browser/app information, security events and diagnostic information.

Location information where it is necessary for a specific feature, fraud prevention, security or compliance and is collected in accordance with applicable law and disclosed to you.

Customer-support information, including complaints, correspondence, call records where lawfully recorded, documents and evidence supplied during an investigation.

Risk and compliance information, including fraud indicators, sanctions screening results, transaction-monitoring information and information needed to meet AML/CFT or other legal obligations.

Marketing preferences and responses to communications.

Information supplied by authorised business users about employees, customers, beneficiaries or other individuals where the business is responsible for having an appropriate legal basis to provide it.

4. HOW WE COLLECT INFORMATION

Directly from you when you create an account, complete verification, make a transaction, contact support or use a feature.

Automatically from your device, browser or application when you access our systems.

From banks, mobile money operators, payment providers, switches, merchants, identity-verification providers and other service partners involved in providing or securing a service.

From public, regulatory or legally available sources where permitted.

From fraud, cybersecurity, compliance and risk-management providers where necessary to protect the platform and meet legal obligations.

5. WHY WE USE PERSONAL DATA

To create and administer accounts.

To verify identity, businesses and beneficial owners.

To authenticate transactions and secure accounts.

To process, route, reconcile and support transactions.

To prevent and investigate fraud, cybercrime, money laundering, terrorist financing and other prohibited activity.

To comply with legal, regulatory, court, law-enforcement and payment-network requirements.

To provide customer support and investigate complaints, errors and unauthorised transactions.

To maintain records, audit trails and operational controls.

To improve reliability, security, products and user experience.

To send essential service, security and transaction communications.

To send marketing communications where permitted and according to your preferences.

To establish, exercise or defend legal claims and protect DAlphaPay, customers and partners.

6. LEGAL AND COMPLIANCE BASES

Depending on the activity and the law applicable to it, DAlphaPay may process personal data because it is necessary to provide a service or perform a contract, to comply with a legal or regulatory obligation, to protect security and prevent fraud, to pursue a legitimate operational purpose where lawful, or because you have provided consent where consent is required.

Where processing depends on consent, you may withdraw consent through the available mechanism. Withdrawal does not necessarily affect processing that is required by law, needed to complete a transaction, or otherwise has another lawful basis.

7. KYC, AML/CFT AND REGULATORY PROCESSING

Payment and financial technology services require strong identity and risk controls. DAlphaPay may process identity, transaction, device, business and risk information to perform KYC/KYB, sanctions screening, fraud monitoring, transaction monitoring and AML/CFT controls. Some processing may be required even where you object to optional uses of data.

DAlphaPay may retain or disclose information where required by law or a competent authority, including information relevant to investigations or suspicious activity. We will not disclose protected information merely because a customer requests details about an investigation where disclosure is prohibited or would compromise a control.

8. HOW WE SHARE INFORMATION

With regulated financial institutions and payment partners where needed to provide or settle a transaction.

With mobile network operators, payment processors, switches, card networks and other transaction infrastructure providers where applicable.

With identity, fraud, cybersecurity, cloud, communications, analytics and technology service providers acting on our instructions or under applicable contractual controls.

With merchants, businesses or recipients where necessary to complete or support a transaction and as permitted by the relevant service.

With regulators, courts, law-enforcement bodies, tax authorities or other competent authorities where required or legally permitted.

With professional advisers, auditors, insurers or prospective transaction counterparties where appropriate and subject to confidentiality or legal requirements.

With other parties where you have directed us to share the information or where the law otherwise permits it.

DAlphaPay should not sell personal data to third parties for their independent marketing purposes without a lawful basis and appropriate notice.

9. THIRD-PARTY SERVICE PROVIDERS

Some DAlphaPay services may depend on third-party technology or regulated institutions. Those providers may process personal data necessary for the service. DAlphaPay will seek appropriate contractual, security and confidentiality controls, but customers should also review a partner's privacy notice where it is separately responsible for processing.

10. INTERNATIONAL OR CROSS-BORDER PROCESSING

DAlphaPay may use service providers or payment partners located outside Sierra Leone where necessary to operate the platform or process international transactions. Before enabling cross-border services, DAlphaPay should identify the applicable legal requirements for international data transfers and implement appropriate safeguards, contractual controls and notices.

11. DATA SECURITY

DAlphaPay will maintain reasonable technical and organisational safeguards appropriate to the risks of the data and services it operates. Controls may include encryption, access controls, authentication, logging, monitoring, secure development practices, backups, vulnerability management and incident-response procedures.

No internet or electronic system can be guaranteed completely secure. You must also protect your credentials, device, SIM, email account and authentication information as described in the User Agreement and Customer Protection Policy.

12. DATA BREACHES AND SECURITY INCIDENTS

DAlphaPay will maintain an incident-response process for suspected or confirmed data-security incidents. Where notification to customers, regulators, partners or other persons is required by applicable law or is appropriate to reduce risk, DAlphaPay will make the required notification through an appropriate channel.

A security incident may require temporary account restrictions, password resets, transaction blocks or other protective measures.

13. DATA RETENTION

DAlphaPay will retain personal data for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, regulatory, accounting, dispute, fraud, security and recordkeeping requirements.

For payment-system activities subject to BSL requirements, DAlphaPay's retention programme should support the applicable recordkeeping obligations. BSL's Financial Consumer Protection Guidelines state that covered financial service providers maintain transaction, fraud and service-disruption records for at least 10 years. The precise retention period for each data category should therefore be confirmed against the regulatory status and service model of the relevant DAlphaPay entity and partner.

14. YOUR PRIVACY RIGHTS

Subject to applicable law and regulatory requirements, you may have rights to request access to personal information we hold about you, request correction of inaccurate information, ask about how information is used, object to certain processing, withdraw consent where consent is the basis, or request deletion where deletion is legally available.

These rights are not absolute. DAlphaPay may retain information where required for legal, regulatory, fraud-prevention, dispute, security or recordkeeping purposes. DAlphaPay will establish a practical request process before publication of this Policy.

15. CHILDREN AND MINORS

DAlphaPay services are not intended for persons who are not legally eligible to use the relevant service. DAlphaPay may apply age or legal-capacity checks. Where a product is lawfully made available to a minor through a parent, guardian or another authorised arrangement, the product-specific terms will govern.

16. COOKIES AND SIMILAR TECHNOLOGIES

DAlphaPay may use cookies, local storage, SDKs, logs and similar technologies for authentication, security, preferences, analytics and service operation. Where optional analytics or marketing technologies require consent under applicable law, DAlphaPay will provide an appropriate choice mechanism.

17. MARKETING

DAlphaPay may send product or promotional communications where permitted by law. You may opt out of marketing communications using the available unsubscribe or preference mechanism. Transactional, security and legally required communications are not marketing and may continue after a marketing opt-out.

18. AUTOMATED DECISION-MAKING AND RISK SYSTEMS

DAlphaPay may use automated systems to identify fraud, unusual activity, security threats, sanctions matches or transaction risk. A transaction or account may be delayed, declined or restricted because of these controls. Where applicable law provides rights concerning significant automated decisions, DAlphaPay will implement the required notice, review or escalation process.

19. YOUR RESPONSIBILITIES

Provide accurate and current information.

Do not provide another person's personal information without an appropriate legal basis or authority.

Protect your account credentials and devices.

Report suspected fraud, account compromise or privacy incidents promptly.

Review transaction notifications and account information and report errors promptly.

20. CHANGES TO THIS PRIVACY POLICY

DAlphaPay may update this Policy to reflect changes in law, regulation, technology, partners or services. Material changes will be communicated through an appropriate channel where required. The effective date will appear at the beginning of the updated Policy.