Privacy Policy and
Personal Data Processing
update date 16/02/2024
This Privacy Policy and Personal Data Processing, together with the Terms and Conditions of Service, establish the collection, processing, use and storage of personal data by EFY TECHNOLOGIES, S.A. DE C.V. (hereinafter “EFY Finance” or “the Company”), EFY Finance is an online platform that allows its users to deposit and invest in digital assets. Efy Finance adopts this policy for the processing of personal data, which will be informed to all owners of the data collected or that in the future will be obtained in the exercise of commercial activities. In this way, Efy Finance declares that it guarantees the rights of privacy, intimacy, good name, in the processing of personal data, and consequently all its actions will be governed by the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality. All persons who, in the development of different commercial activities, among others, whether permanent or occasional, come to supply Efy Finance. any type of information or personal data, you will be able to know, update and rectify it. Our platform is committed to protecting the privacy of our customers and ensuring that their personal data is kept safe. We collect and process personal data of our customers only for specific, legitimate and explicit purposes, and we never share it with third parties without their prior consent.
1. To whom does this policy apply?
This Privacy and Personal Data Processing Policy applies to all visitors to the efy.finance website, or users of any of the APIs connected to it who share personal information with us. Whether you are a simple visitor to our website or you contact us to provide us with personal information in any way, we will always treat your personal data in accordance with this Privacy and Personal Data Processing Policy.
2. Definitions:
Below we share some of the most important terms we use here and you should know: • PERSONAL DATA: Any information relating to an identified or identifiable natural person (e.g. first and last name, facial image, address, email, identity document, location data, IP address, cookie data, telephone number, etc.). • OWNER: You. The natural person to whom the personal data in question refers. • CONSENT: The free, informed and unequivocal manifestation with which you accept the processing of your personal data for a specific purpose. • PROCESSING: Any operation performed on personal data. For example, collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation, modification, communication, transfer, dissemination or extraction.
3. Data controller.
EFY TECHNOLOGIES, S.A. DE C.V. is a company incorporated in the Republic of El Salvador as a provider of Bitcoin services and intermediation in the purchase, sale and custody of digital assets, and will be responsible for the processing of your personal data. Your privacy is very important to us and we intend that the trust you place in Efy Finance translates into security to operate in our entire ecosystem. Therefore, it is very important that you take into account that, when registering on our platform, you will be providing certain personal information that Efy Finance will process and share with all the companies that participate in the provision of our services and make their operation possible. You must previously accept these conditions to complete your registration and use the platform. If you do not agree, or have any questions about their scope, please do not continue with the registration; we invite you to write to us at support@efy.finance so that we can improve.
4. Authorization for Data Processing by Third Parties.
Sharing Information with Various Entities: In order to provide our services to you effectively and efficiently, EFY Finance will share your personal information with various entities under certain conditions:
• Business Group: Your information may be shared within our business group, which includes companies under the same corporate group operating under privacy and data protection policies similar to ours.
• Service Providers: In the course of our operations, EFY Finance may contract with third parties to provide specialized services, including but not limited to ERP (Enterprise Resource Planning) services, Knowledge of the Customer (KYC) management, and card data processing. These third parties will have access to the personal data necessary to carry out their services and will be subject to the same security and confidentiality obligations as EFY Finance. The use of your personal data by these third parties will be limited to the specific purposes for which they have been contracted.
• Business Partners: We may share your information with allied companies to offer you integrated services, promotions, and user support. We ensure that these business partners comply with applicable regulations regarding the protection of personal data through specific agreements and contractual clauses.
• Linked Users: In the context of facilitating transactions between users of our platform, we may share limited and necessary information with other registered users, always respecting the principles of minimization and necessity of the data shared.
• Competent Authorities: We may disclose your information to competent authorities in response to formal and justified requests in the exercise of their functions, such as tax authorities and control bodies, in compliance with applicable legal obligations. We reserve the right to disclose your information to other users, entities and/or authorities if we consider, in good faith, that your activity on the platform is suspicious or there is a reasonable presumption that your conduct could result in harm to third parties. This measure is adopted in an effort to maintain the security and integrity of our platform and its users. Before sharing your personal information in circumstances other than those mentioned above, we will obtain your prior express consent, unless we are required by law or by a court or administrative order that permits or requires the disclosure of your information without such consent.
5. Geographic Database Management
In order to comply with local regulations and provide a personalized service, EFY Finance reserves the right to maintain separate databases to manage user information: one for users in El Salvador, another for users in Panama, and a third for users from the rest of the world, provided that their jurisdictions are not restricted. Each database will be subject to the laws and regulations applicable in the corresponding jurisdiction, guaranteeing the proper and secure treatment of your personal data.
6. Data collected
During the use of our Website, Platform or APIs, we may process the following information and personal data of users:
a. Personal Information resulting from the creation of an Account, which includes:
• Email Address;
• Login Details (Username and Password);
• Security Data (2FA).
b. Informações pessoais que exigem para verificar sua identidade e cumprir o “KYC” e os regulamentos anti-lavado de dinheiro.
Para o registro de uma conta pessoal, será necessário comprovar as seguintes informações:
• Nome completo;
• Direção de residência;
• Uma cópia/Imagem do seu Pasaporte y/o; no caso de você residir na República do Panamá ou em El Salvador, também será necessário o documento de identidade do seu país de origem;
• Una Prueba de Residencia (Ej. recibo de serviços públicos).
Para registrar uma conta com o nome de uma entidade (Conta Corporativa), serão necessárias as seguintes informações pessoais para verificar sua conta:
• Seu nome completo;
• O nome estatutário e, nesse caso, os nomes comerciais diferentes da entidade;
• A direção da empresa registrada na Câmara de Comércio;
• Um documento válido de constituição da empresa (da Câmara de Comércio e/ou da Comissão de Serviços Financeiros);
• URL do site governamental que contém os dados de sua empresa e que verifica a autenticidade do registro;
• Escritura de constituição e estatutos (que contém a estrutura e as normas da empresa);
• Fontes de financiamento;
• Registro de accionistas/sócios/sócios (lista completa de nomes, direções e número de ações de cada accionista real);
• Gráfico da estrutura de propriedade no que representa as porcentagens de cada acionista, o(s) beneficiário(s) final(es) e os países de residência/incorporação;
• Lista de nomes completos e percentagens de propriedade dos accionistas que representam os 25% ou mais das acções da empresa;
• Documento de identidade e verificação recente do domicílio de todos os acionistas que representam os 25% ou mais das ações da empresa;
• Lista com os nomes completos, data de nascimento e direção de todos os diretórios;
• Passaporte, Licença de Condução ou ID do país de origem e teste recente da direção de residência de todos os diretores;
• Lista de pessoas autorizadas a operar na Plataforma; • Passaporte, Licença de Condução ou ID do país de origem e uma verificação recente da direção residencial de todas as pessoas que operam na plataforma EFY Finance.
c. In order to facilitate your use of Products on our Platform, we will require the following information:
• The wallet address from or to which incoming/outgoing deposits and/or withdrawals of digital assets are made;
• The deposits, investments, returns and balances of your account.
d. Information relating to the communication between you and us:
• Name;
• Email address; and
• Details of your request and/or complaint and other information you provide to us in the course of the communication session.
e. Information you provide to us for sending cards and other products: Name;
Email address;
Physical address of residence.
f. Information that you provide to us when you visit our Website and use our Platform:
• Login records;
• IP address;
• Information about your device, browser, operating system and network system;
• Viewing time and online behavior on the Platform.
• The personal data we collect includes contact information, such as name, address, telephone number and email, as well as financial information, such as bank account numbers and transaction data.
• Contracting data: products and services contracted, ownership status, information on investments made and their evolution.
• Basic financial data: current and historical balances of your products and services, and movements of your accounts, including the type of transaction, the parties, the amount and the concept.
g. Data obtained from data analysis:
• Data obtained from the execution of statistical models: we apply various statistical models to our customers' data to fight fraud, deduce consumer habits or preferences, comply with our regulatory obligations and manage our products and services.
• Risk assessment data: in order to provide you with some of our products, we will previously deduce your payment capacity, applying statistical models that are calculated on your data.
h. Data obtained from publicly accessible or external sources:
• Data obtained from credit information systems: result of consulting the most recognised systems on the market, which provide information on debts, financial solvency and credit (debtor, creditor and debt).
• Data obtained from public bodies: result of consulting publicly accessible systems, which provide information on debts.
• Data relating to international sanctions: data of persons who are included in laws, regulations, guidelines, resolutions, programmes or restrictive measures regarding international economic-financial sanctions imposed by the United Nations, the European Union, the United Kingdom and the United States, among others.
• Demographic data: statistical data associated with geographical areas, age groups and/or sectors of activity, which we will link to your personal information.
• Data on public officials and/or corporate links: result of consulting the most recognised information systems on the market, which we will use to supplement the information on your activity.
• Social network data: from the platforms that you link and/or authorize to be consulted.
7. Request for Data Update and/or Rectification
EFY Finance will rectify and update, at the request of the owner, any information that is incomplete or inaccurate, in accordance with the procedure and terms indicated above, for which the following will be taken into account: 1. The owner must send the request to the email address support@efy.finance indicating the update and/or rectification to be made and will provide the documentation that supports their request. 2. EFY Finance may enable mechanisms to facilitate the exercise of this right by the owner, provided that they benefit him/her. Consequently, electronic or other means that it considers pertinent may be enabled, which will be informed in the privacy notice and will be made available to interested parties on the website.
8. For what purposes do we process your personal data?
We may use your personal data to:
• Create and manage your Account;
• Analyze your transactional profile;
• Provide you with access to our Platform and provide you with our services;
• Verify your identity and comply with applicable laws and regulations;
• Cooperate with requests from law enforcement agencies;
• Process your transactions;
• Analyze your use of our website and platform;
• Provide you with customer support;
• Send you updates, newsletters, surveys or promotions;
• Contact you about other aspects of our services. We will not process your personal data for other purposes.
9. What legal bases apply to our processing of personal data?
We have the right to process your personal data based on different legal grounds. The following table contains a summary of the legal grounds we rely on to process specific personal data:
| Treatment Activity | Legal Basis |
|---|---|
| Creating a business profile | Prior consent (allows us to offer you, in particular, our services and promotions). |
| Creating an Account | Execution and Perfection of Contract |
| Verification of your (the entity's) identity (KYC/CDD) | Compliance with legal obligation |
| Marketing Activities (Promotional Communication) | Consent (which you may revoke at any time) |
| Investment Facilitation | Execution and Perfection of Contract |
| Communication data for query management | Execution and Perfection of Contract |
| Browsing information or exchange with government entities by order of law | Our legitimate interest |
• Verify your identity
• Demonstrate your consent
• Perform credit analysis
• Identify and prevent potential fraud
• Identify and prevent potential threats to the security of the platform
• Make advertising and/or promotional contacts
• Comply with PLAFT regulations
• Comply with judicial or administrative requirements
• Personalize and improve services
• Analyze your behavior
In any case, keep in mind that if we make decisions based solely and exclusively on automated processing (i.e. without the participation of a person) that may produce legal effects on you, or that may significantly affect you (for example, with the denial of a product), we will inform you about this and provide you with the right to obtain human intervention, to express your point of view and to challenge the decision.
10. How long do we retain your personal data?
Efy Finance will retain your personal data for as long as necessary to fulfil the purposes for which it was collected, as well as to comply with any legal or regulatory requirements, or for the limitation period of any legal or contractual liabilities. We will also consider whether retaining the data could cause prejudice to the rights or legitimate interests of Efy Finance or third parties. It is important to note that there are regulations that require us to retain certain information for special periods, which may be 2, 5 or even 10 years.
To determine the appropriate retention period for each category of personal data, we assess the amount, nature and sensitivity of the data, as well as the potential risk of unauthorized use or unlawful disclosure. We also consider the purposes of the processing and whether it is possible to achieve those purposes through other legal means.
In short, your personal data will continue to be stored from the time of registration and for as long as your account is active. Once the legal period affecting each specific type of data has ended, or when the purposes for which it was collected have been fulfilled, we will proceed to delete or anonymize it so that it is not possible to identify any person.
11. Who has access to your personal data?
• Our authorized personnel will have access to your personal data on a need-to-know basis. These individuals have undergone a background check prior to employment and are required to treat the information as highly confidential.
• In addition, we may engage third-party service providers to provide ancillary services. If and to the extent such parties come into possession of your personal data, they will act as our data processor. These include, for example, cloud service providers and providers of certain software solutions. We will enter into a data processing agreement with such parties, which will include data security provisions to protect your personal data from potential data breaches. These data processors will only process your personal data to the extent necessary to provide the services for which they have been engaged.
• We may also share personal data with affiliates who have referred you to our website, and with partners for promotions or co-branded service integrations.
• We may provide your personal data to the competent authorities upon request to the extent required by law or to the extent necessary to defend our rights in legal proceedings or investigations. In addition, we reserve the right to disclose your information to other users, entities and/or authorities when there are sufficient grounds to consider that your activity was suspicious and/or there is a reasonable presumption that other people could be harmed.
bFor any other case, before sharing your personal information, we will ask for your prior and express consent, unless there is a sufficient rule or order that allows otherwise.
12. Is your personal data secure?
We use technical and organizational security measures to protect our customers' personal data against loss, theft, misuse or unauthorized access.
We treat your personal data with the greatest possible care and scrutiny. This means that we will adopt appropriate technical and organizational measures to ensure that all information is correct, up-to-date and complete, and to prevent unauthorized persons, within and outside of our organization, from accessing it. We use "best practices" to protect our people. For example, our personal data is encrypted with SSL (Secure Sockets Layered) technology and our directories and databases are protected by senha.
13. How do we transfer personal data internationally?
Due to the nature of the services we provide, it is necessary to use cloud servers and services, which may mean that some of the personal data we collect is stored or processed in countries other than the country of origin.
Where personal data is transferred to a country that does not provide an adequate level of data protection in accordance with applicable law, we will implement additional technical and/or organisational security measures to ensure the protection of your personal data. Where necessary, we will require the service provider to also implement these measures or supplement them with other appropriate measures.
These safeguards may include the use of binding corporate rules, contractual clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority. These measures seek to ensure compliance with personal data protection regulations and ensure that data subjects have enforceable rights and access to effective legal remedies.
14. On operations carried out on the blockchain
Blockchain technology operates as a shared, immutable ledger that facilitates the process of recording and tracking transactions and assets, both tangible and intangible. Anything of value can be tracked and traded on a Blockchain network, reducing risks and costs for all participants.
This technology generates a constantly growing list of records called blocks. Each block contains a cryptographic hash of the previous block, a timestamp, and other data related to the transaction. Immutability is one of the key features of Blockchain: no information stored in a block can be added, deleted, or modified without affecting the hash value and altering subsequent blocks. Once a transaction is recorded on the shared ledger, no participant can change or falsify that transaction. If a mistake is made in the record, a new transaction must be added to correct it, but both transactions will be visible.
It is important to note that due to the nature of Blockchain, it is not possible to modify or correct transactions made on the Efy Finance platform or to remove personal data required by the blockchain for such transactions.
When you make a transaction with cryptoassets, certain personal information will be recorded on the respective blockchain, including the address of the source and destination wallet, the amount of the transaction, and the date and time of the transaction. Once the transaction is confirmed, this information will not be under our control and we will not be able to help you exercise your rights over it. The blocks are linked chronologically and the data recorded in them is practically unalterable or deletable.
This particularity of Blockchain can affect your ability to exercise certain rights as a data subject, such as the right to deletion or rectification. Although there are smart contracts that can block certain personal information from third parties, the data will still be present and cannot be deleted.
In short, if you want to ensure that your rights are not affected in any way, avoid making transactions on Blockchain, as some prerogatives may not be fully available or may not be fully exercised. In general, blockchains are open to the public and any personal data published on them will be public knowledge.
15. What are your rights regarding my personal data?
• You have the right to ask us whether we are processing your personal data. You may exercise your right of access to your personal data at any time and at reasonable intervals. Upon consultation, you may ask us to rectify or erase any (inaccurate) data or to restrict or stop the processing of your personal data. However, we reserve the right to refuse such a request to restrict or stop the processing of your personal data if we have a legitimate interest in continuing to process your personal data, in particular if we need the information in (possible) legal proceedings.
• You have the right to ask us to transfer (some of) your personal data to you or another party.
• If the processing of your personal data is based on your consent, you may revoke it at any time. To exercise this right and the rights mentioned above, please contact us using the contact information provided in this Privacy Policy.
16. Use of cookies
We use cookies when you visit our Website and use our Platform. A cookie is a small file that is stored on your computer, tablet or mobile phone when you visit a website. With the help of cookies, user preferences can be saved for later use, or browsing habits can be tracked for statistical purposes. Many improvements to the user experience and performance of a website are possible thanks to the implementation of cookies. For more information, you can consult our Cookie Policy published on our Platform.
17. How can I file a complaint?
If you have a complaint about how we treat your personal data, you can contact us using the contact details provided in this Privacy and Personal Data Processing Policy. We will be happy to help you find a solution. In addition, you can lodge a complaint about the way we treat your personal data with the supervisory authority of the country in which you reside (if applicable).
This privacy policy is governed by the laws of El Salvador and any dispute related to our handling of our clients' data will be resolved in accordance with the laws of El Salvador.
This privacy policy may be updated at any time, and we will publish any changes on our website.
Authorization for the processing of personal data will be requested and deemed accepted and understood when the user creates an account and when the user accepts the terms and conditions of use of the site, with which evidence of authorization is obtained.
If you have any questions or concerns about our privacy policy, please feel free to contact our customer service team or send us an email at the address listed on our “Contact” page, we will be happy to address any questions or concerns you may have.
18. How do we notify policy changes?
This Privacy Statement may be updated. We therefore recommend that you periodically visit this page to stay informed of any changes. However, if we make material changes that require your consent, we will post the update and inform you by email so that you can stay informed. If you do not agree to this Privacy Statement, you must discontinue using the platform.