Privacy Policy

This Privacy Policy ("Policy") describes how PBoxGlobal, Inc. and its affiliates (“PBoxGlobal”, “we”, “us”, or “our”) collect, use, disclose, retain, and protect personal information in connection with our website, our financial platform, and any related applications, APIs, dashboards, or services we make available (collectively, the "Service"). This Policy applies to visitors, prospective customers, registered users, authorized representatives of business accounts, and individuals whose information we process on behalf of our customers.

This Policy should be read together with our Terms of Service. Capitalized terms not defined here have the meaning given to them in the Terms of Service. If you do not agree with this Policy, you should not use the Service.

PBoxGlobal is a financial technology company. Certain regulated services described in this Policy — including deposit-taking, card issuing, and payment settlement — are provided in partnership with licensed banks, electronic money institutions, and payment processors ("Banking Partners"). Those partners may act as independent controllers of your information for the purposes of the regulated services they provide, and may issue their own privacy notices.

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or erasure.
• "Controller" means the entity that determines the purposes and means of processing Personal Data.
• "Processor" means an entity that processes Personal Data on behalf of a Controller.
• "Sub-processor" means a third party engaged by a Processor to assist in fulfilling its obligations.
• "Sensitive Data" means special categories of Personal Data (e.g., government identifiers, biometric data) that require heightened protection under applicable law.

• Identity information: full legal name, date of birth, nationality, government-issued identification numbers, and copies of identity documents.
• Contact information: postal address, email address, and telephone number.
• Business information: legal entity name, registration number, tax identification number, beneficial ownership details, and business activity description.
• Financial information: bank account details, source-of-funds documentation, transaction instructions, and payment history.
• Account credentials: username, password (stored as a salted hash), and multi-factor authentication settings.
• Communications: content of support requests, survey responses, and correspondence with our team.

• Device and technical data: IP address, browser type, operating system, device identifiers, and language settings.
• Usage data: pages viewed, features used, session duration, referring URLs, and clickstream data.
• Location data: approximate geographic location derived from IP address, and where permitted, precise location from mobile devices.
• Cookies and similar technologies: as described in Section 12 below.

• Identity-verification and know-your-customer (KYC) providers, who confirm the authenticity of identity documents and perform liveness checks.
• Sanctions, watchlist, and politically-exposed-person (PEP) screening providers.
• Credit bureaus and fraud-prevention networks, where permitted by law and necessary for risk assessment.
• Banking Partners and payment networks that process transactions on your behalf.
• Publicly available sources, such as corporate registries, where relevant to verifying a business account.
• Your employer or contracting business, if you are a payee or team member added to a business account.

We process Personal Data for the following purposes and on the following legal bases:

As a regulated financial platform, we are legally required to verify the identity of our customers and monitor transactions for signs of money laundering, terrorist financing, fraud, and sanctions violations. To meet these obligations we:

• Verify identity documents and perform liveness detection at onboarding and periodically thereafter.
• Screen customers and beneficial owners against global sanctions, watchlists, and PEP databases.
• Monitor transactions using automated systems and, where flagged, manual review by our compliance team.
• Retain verification and transaction records for the periods required by applicable financial-services law, which may exceed the retention periods described in Section 9.
• Share necessary information with regulators, law enforcement, and Banking Partners where legally required, including via Suspicious Activity Reports where applicable.

We do not sell your Personal Data to third parties for monetary consideration. We disclose Personal Data only as described below, and each recipient is bound by contractual confidentiality and data-protection obligations appropriate to the sensitivity of the data:

• Banking Partners and payment networks that issue accounts, cards, and process settlement on our behalf.
• Service providers that support hosting, cloud infrastructure, identity verification, fraud detection, customer support tooling, and analytics.
• Professional advisors, including auditors, insurers, and legal counsel, on a need-to-know basis.
• Regulators, law enforcement, and government authorities, where required by law, court order, or to protect our rights and the rights of others.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations.
• Other parties with your consent, such as a third-party application you choose to connect via our developer API.

PBoxGlobal operates globally, and Personal Data may be transferred to, stored, and processed in countries other than the one in which you reside, including the United States and other jurisdictions that may not provide the same level of data protection as your home country. Where we transfer Personal Data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on recognized transfer mechanisms, including Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, adequacy decisions, or other lawful transfer mechanisms, together with supplementary technical and organizational safeguards where appropriate.

We maintain a risk-based information security program designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. Measures include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls on a least-privilege basis, with mandatory multi-factor authentication for internal systems.
• Continuous network and endpoint monitoring, intrusion detection, and logging.
• Independent penetration testing and vulnerability assessments performed at least annually.
• A documented incident-response plan with defined breach-notification procedures consistent with applicable law.
• Employee background checks and mandatory security and privacy training.

No system is completely secure. If we become aware of a breach affecting your Personal Data, we will notify you and applicable regulators as required by law.

We retain Personal Data for as long as necessary to fulfil the purposes described in this Policy, including the duration of your account relationship, plus any additional period required to comply with legal, tax, accounting, or regulatory obligations, resolve disputes, and enforce our agreements. As a general guide:

• Identity-verification records and transaction history: retained for a minimum of five (5) years after account closure, or longer where required by applicable financial-services law.
• Marketing preference records: retained until you opt out, plus a reasonable period to record that preference.
• Support communications: retained for up to three (3) years to resolve recurring issues and for quality purposes.
• Technical and log data: typically retained for 12–24 months for security and troubleshooting purposes.

Depending on your jurisdiction, you may have some or all of the following rights regarding your Personal Data:

• Right to access — request confirmation of whether we process your Personal Data and obtain a copy of it.
• Right to rectification — request correction of inaccurate or incomplete Personal Data.
• Right to erasure — request deletion of your Personal Data, subject to legal retention obligations.
• Right to restrict or object to processing — request that we limit or stop certain processing activities.
• Right to data portability — receive your Personal Data in a structured, commonly used, machine-readable format.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Right to lodge a complaint — with your local data-protection authority or, for California residents, the California Privacy Protection Agency.
• Right to opt out of certain sales/sharing and targeted advertising — where applicable under U.S. state privacy laws such as the CCPA/CPRA.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us using the details in Section 14. We may need to verify your identity before fulfilling your request, and we will respond within the timeframe required by applicable law (generally 30–45 days, extendable where permitted).

We use automated systems, including risk-scoring models, to help detect fraud, assess transaction risk, and support KYC decisions. Where an automated decision produces a legal or similarly significant effect on you — such as a decision to decline onboarding or restrict an account — you have the right to request human review, to express your point of view, and to contest the decision by contacting us using the details in Section 14.

We use cookies, pixels, and similar technologies to operate the Service, remember your preferences, understand usage patterns, and support marketing. Categories include:

• Strictly necessary cookies — required for core functionality such as authentication and security; cannot be disabled.
• Preference cookies — remember settings such as language and region.
• Analytics cookies — help us understand how the Service is used so we can improve it.
• Marketing cookies — used to measure the effectiveness of our campaigns; only set with your consent where required by law.

You can manage cookie preferences through our cookie-consent banner where available, or through your browser settings. Disabling certain cookies may limit functionality of the Service.

The Service is intended for use by individuals who are at least 18 years old and businesses acting through authorized representatives. We do not knowingly collect Personal Data from children. If we learn that we have collected Personal Data from a child without appropriate consent, we will take steps to delete it.

Questions, requests, or complaints regarding this Policy or our data practices can be directed to our Data Protection Officer at support@pboxglobal.com, or by mail to PBoxGlobal, Inc., Attn: Privacy Team. EU/UK data subjects may also contact our appointed representative for cross-border inquiries.

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Where changes are material, we will provide notice through the Service, by email, or by other reasonable means, at least 14 days before they take effect, unless a shorter period is required by law. The "last updated" date above reflects the most recent revision, and this Policy is effective as of July 1, 2026.