Privacy Policy

Introduction

This notice explains how Invest Consult Europe Ltd and Aerapass Ltd ("we", "us") collect, use, disclose and protect the personal data of our customers, in line with [Applicable Data Protection Law] and, for people in the EU/EEA, the GDPR. It covers data we hold or that organisations acting for us hold.

Our principles

• Fair collection: only lawful, relevant data tied to your account or enquiry.
• Accuracy and retention: accurate data, kept no longer than needed.
• Purpose limitation: used for the purposes collected or directly related ones, unless you consent otherwise.
• Security: protected against unauthorised access, loss or misuse.
• Transparency: clear information about your rights and our use of data.
• Access and correction: you can see and correct your data.

Personal data

1. A "customer" is anyone who contacts us about our services or has a relationship with us. "Personal data" is information that identifies a person, alone or combined with other information.
2. Depending on your interaction, we may collect name, address, email, phone, nationality, date of birth, ID documents and photos, employment, corporate and beneficial-ownership details, financial and wallet information, and website usage data.

Collection, use and disclosure

1. We collect data you provide directly or through your authorised representative, after informing you of the purposes and, where required, obtaining consent, or where the law permits collection without consent.
2. Purposes include providing requested services; verifying identity (KYC/KYB); processing payments and conversions; responding to queries and complaints; managing our relationship; collecting fees; complying with laws, sanctions and authority requests; fraud prevention; and related business purposes.
3. We may disclose data to Aerapass Ltd group entities, banks and payment or settlement counterparties, KYC/AML and technology providers, professional advisers, and regulators or authorities, in your jurisdiction or abroad.
4. These purposes may continue for a reasonable period after your relationship with us ends, for example to enforce our rights.

Legitimate interests

1. Where the law allows, we may process data without consent for legitimate interests, after assessing that they are not outweighed by the impact on you. Examples: fraud detection and prevention, preventing misuse of services, and network analysis to counter financial crime.

Withdrawing consent

1. Consent remains valid until you withdraw it by writing to our Data Protection Officer. We will normally process the request within [22] business days and tell you the consequences, which may include our being unable to continue providing services.
2. Withdrawal does not affect processing the law permits or requires without consent.

Access and correction

1. You may request a copy of your data or its correction by writing to the DPO. A reasonable fee may apply to access requests, and we will tell you beforehand.
2. We aim to respond within [22] business days, and within [30] days at the latest we will tell you if more time is needed.

Protection, accuracy and retention

1. We use administrative, physical and technical safeguards such as encryption, access controls, multi-factor authentication, secure backups, patching and regular security testing. No internet transmission or storage is completely secure.
2. Please keep your information up to date by notifying the DPO of changes.
3. We keep data only as long as needed for the purpose collected or as laws require, then delete it or remove the link to you.

International transfers

1. Where we transfer data across borders, we obtain consent where required and ensure protection at least comparable to the law applicable to you. For data from the EU/EEA we use adequacy decisions, Standard Contractual Clauses or equivalent safeguards.

Cookies

1. We use necessary cookies to run the site, and aggregate analytics to improve it. We do not link this data to your customer information or share it for third-party marketing. You can refuse cookies in your browser settings; by using the site you accept necessary cookies. [Cookie banner details to be completed.]

Data Protection Officer

1. Questions or requests: Marco Notarnicola, info@aerapass.com.

Changes to this notice

1. We may update this notice from time to time; the date above shows the latest revision. Continued use of our services means you accept the changes.

Appendix — EU / EEA data protection

1. Roles. We act as controller where we decide purposes and means, and as processor where we process data on a client's instructions.
2. Categories. Identity, contact, financial and wallet, KYC/AML, employment and corporate, technical and usage, communications, and other data needed for our services or required by law.
3. Purposes and lawful bases.

4. Recipients. Group companies, service providers, professional advisers, regulators and authorities, successors in a reorganisation, and others with your consent, all bound to use data only as we authorise.
5. Retention. Periods vary by data category and are subject to legal and regulatory requirements; ask the DPO for a schedule.
6. Your rights. Access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and not to be subject to solely automated decisions with significant effects. We respond within one month, extendable for complex requests. You may complain to your supervisory authority.
7. Automated decisions. Where used with significant effects, we will inform you, explain the logic and offer human review.
8. Breaches. We investigate, notify the supervisory authority within 72 hours where required, and inform affected individuals when risk is high.
9. DPIAs. Carried out where processing is likely to be high-risk.
10. Minors. We do not knowingly collect data from children under [16] without verifiable parental consent.

Contact

Invest Consult Europe Ltd, 21 Stonelea Court, Meanwood, Leeds, England, LS7 2UH (Company No. 09371842)