Privacy Policy - Provenita

Provenita is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal information.

1. Information We Collect

We collect information necessary to provide our payment services, including:

Identity information (name, date of birth, document details) for KYC verification
Contact information (email, phone number, address)
Financial information (bank account details, transaction history)
Device and usage information (IP address, browser type, pages visited)

2. How We Use Your Information

We use collected information to:

Provide and maintain our payment services
Verify your identity and comply with KYC/AML regulations
Process transactions and settlements
Communicate with you about your account and transactions
Prevent fraud and ensure security

3. Data Sharing

We do not sell your personal information. We share data only with:

Banking partners for transaction processing and settlements
Regulatory authorities when required by law
Service providers who assist our operations under strict data protection agreements

4. International Transfers (EU to Angola)

Provenita's core service — sending category-controlled vouchers to a recipient in Angola — requires us to transfer certain personal data (recipient identity details, transaction records) outside the European Economic Area. Angola does not currently benefit from a European Commission adequacy decision.

Where we transfer data to Angola, we rely on the legal basis that the transfer is necessary for the performance of the contract between you and Provenita, at your request (GDPR Article 49(1)(b)) — the transfer exists because you asked us to deliver funds to a named recipient in Angola, and the service cannot function without it. Where we engage service providers or banking partners outside the EEA on an ongoing basis (rather than a one-off, user-requested transfer), we use Standard Contractual Clauses or an equivalent safeguard approved under GDPR Article 46.

5. Data Retention

We keep personal data only as long as necessary for the purpose it was collected, or as required by law:

Identity verification (KYC) and transaction records: retained for 7 years after the end of the business relationship, in line with Dutch anti-money-laundering law (Wwft) and EU AML directive requirements.
Security and audit logs: retained for 1 year for fraud prevention and security investigation purposes.
Account profile data (name, contact details): retained while your account is active, and for a limited period after closure to handle disputes, legal claims, or regulatory requests.
Marketing communication preferences: retained until you withdraw consent or unsubscribe.

After the applicable retention period, data is deleted or irreversibly anonymized, except where a longer period is required by law or an ongoing legal dispute.

6. Data Security

We implement industry-standard security measures including encryption, access controls, and regular security audits to protect your personal information.

7. Your Rights

Under the GDPR and applicable data protection laws, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your data, subject to our legal retention obligations above (e.g. AML/KYC records cannot be deleted before the 7-year period expires)
Export your data in a portable format
Object to or restrict certain processing
Withdraw consent at any time, where processing is based on consent

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with your local supervisory authority if you reside in another EU member state.

8. Contact

For privacy-related questions or to exercise your rights, contact us at [email protected]. For general support, use [email protected].

[Legal entity name, registered office address, and Chamber of Commerce (KVK) number to be added here once Provenita's operating entity is formally incorporated — this page must not claim a legal entity that does not yet exist.]