Privacy Policy

1.1 Types of Data Collected

• Personal Identification Information: Name, address, email address, phone number, date of birth, gender and government-issued identification numbers.
• Financial Information: Bank account details, transaction records, and payment information.
• Technical Information: IP address, browser type, operating system, device information, and cookies.
• Usage Data: User behaviour, preferences, and interactions with our services.

1.2 Methods of Data Collection

• Direct Interactions: Information provided directly by customers through registration, transactions, or customer support.
• Automated Technologies: Data is collected automatically through website cookies, server logs, and blockchain transactions.
• Third Parties: Information received from third-party service providers, partners, and public sources.

2.1 Purpose of Data Processing

While providing our Services, we may collect Personal Information, namely:

• Service Delivery: To process transactions, manage accounts and provide customer support.
• Legal Compliance: To comply with legal obligations, prevent fraud, and ensure regulatory compliance.
• Marketing: To send promotional materials and updates, subject to user consent.
• Improvement of Services: To analyse usage patterns and improve service offerings.
• Business Transfers: In connection with any merger, sale of company assets, or acquisition.

2.2 Legal Basis for Processing

• Consent: Where the data subject has provided explicit consent.
• Contractual Necessity: Processing necessary for the performance of a contract with the data subject.
• Legal Obligation: Compliance with a legal obligation to which Zabira is subject.
• Legitimate Interests: Processing based on the legitimate interests of Zabira Digital Services Limited, provided the data subject's rights do not override these.

3.1 Data Storage

• Personal data is stored securely on encrypted servers, both locally and in the cloud, ensuring compliance with data protection laws.
• Blockchain transaction data is immutable and publicly accessible, with personal information pseudonymized or anonymized where possible.

3.2 Data Security Measures

• Encryption: Encryption of data both in transit and at rest.
• Access Controls: Restriction of access to personal data to authorised personnel only.
• Regular Audits: Regular security audits and assessments to identify and mitigate potential risks.
• Incident Response: A structured incident response plan to address data breaches or security incidents promptly.

4.1 Retention Periods

While providing our Services, we may collect Personal Information, namely:

• Transactional Data: Retained for a minimum of 7 years to comply with financial regulations.
• Personal Data: Retained as long as necessary for the purposes for which it was collected, or as required by law.
• Marketing Data: Retained until the data subject withdraws consent.
• Inactive Accounts: Personal data from inactive accounts will be deleted after 2 years.

4.2 Data Deletion and Anonymization

• Personal data that is no longer needed is securely deleted or anonymized.
• Blockchain data cannot be deleted, but personal information within it will be pseudonymized.

5.1 Access and Correction

• Data subjects have the right to access their data and request corrections if necessary.

5.2 Data Portability

• Data subjects can request a copy of their data in a structured, commonly used, and machine-readable format.

5.3 Right to Erasure

• Data subjects can request the deletion of their data, subject to legal and contractual obligations.

5.4 Right to Restriction of Processing

• Data subjects can request the restriction of processing of their data under certain circumstances.

5.5 Right to Object

• Data subjects can object to the processing of their data for direct marketing or other purposes based on legitimate interests.

6.1 International Data Transfers

As a global company, personal data may be transferred to and processed in countries other than the country in which the data was originally collected. We ensure that such transfers comply with applicable data protection laws by implementing appropriate safeguards, including:

• Standard Contractual Clauses: Using approved contractual clauses for data transfers.
• Adequacy Decisions: Transferring data to countries recognised by relevant authorities as providing an adequate level of data protection.
• Binding Corporate Rules: Adopting internal policies approved by data protection authorities to safeguard personal data across our group.

6.2 Third-Party Service Providers

• Third-party service providers processing personal data on behalf of Zabira Digital Services Limited are required to comply with data.