Debifi Privacy policy

INTRODUCTION

Our Privacy Policy explains how your personal information is collected, stored, used, removed and disclosed by Debifi («Debifi», «we» or «us»). The rules of this Privacy Policy apply to the information we process when you use the Debifi Platform. All the definitions used in this Privacy Policy shall have the same meaning as in our Terms of Service unless this Policy sets a different meaning.

Please note that any provision of this Privacy Policy may be revised and reissued unilaterally by us without notice at any time. You should visit this page regularly to review the current version of the Privacy Policy, since your continued use of the Debifi Platform will be deemed as irrevocable acceptance of any revisions.

By accessing, using or registering at the Debifi Platform and/or the Debifi App (further when we refer to the «Debifi Platform», this reference shall all the time also include the Debifi App and related services provided via the Debifi Platform), downloading mobile applications from Debifi, you irrevocably express consent for us to collect, store and use the information you share with us as well as the other information mentioned in this Privacy Policy. Should you not accept this Privacy Policy, or any single rule or rules of it, you shall immediately stop using the Debifi Platform and delete your account.

OUR STATUS

We will act as a data controller in relation to personal information about you that may be either provided by you or collected by us. As a data controller, we will solely determine the purposes and means of processing of your personal information.

In some instances, other users (specifically, Lenders) may collect and process your personal information in line with the execution of Lending Deals. Then such users will act as data controller and we may act as data processor solely processing your personal information according to the instructions of data controllers.

HOW WE USE YOUR INFORMATION

Debifi receives and processes some information to operate, provide, improve, understand, customise, support, and market the Debifi Platform, including when you visit, access, register or use the Debifi Platform. The types of information we receive and collect depend on how you use the Debifi Platform. Please note that not all the information you provide to us is personally identifiable information according to the applicable law.

In this Section we have set out:

• the general categories of personal information that we may process;
• the purposes for which we may process personal information; and
• the legal basis of the processing.

Account Data

We may process your account data («account data»). The account data may include your email address, your nickname and an indication of your time zone. In addition, after account creation, you will be able to add other information to your account at your sole discretion, such as a profile picture and information about yourself.

• Source. The source of the account data is you.
• Processing. The account data may be processed for the purposes of providing you access to the Debifi Platform, your account with the Debifi Platform, ensuring the security of the Debifi Platform and communicating with you.
• Legal Basis. The legal basis for this processing is a performance of an agreement between you and us and/or taking steps, at your request, to enter into such an agreement.

Verification data

We may collect and further process or receive from third parties (Lenders) information when we or such Lenders verify your identity («verification data»). Lending Terms may require you to pass the «know your client» (KYC) procedure in the scope designated by a Lender, or in some instances, when we are obliged by the law, we suspect abuse of the Debifi Platform and related services, we settle a dispute between users, we enable geographical restrictions for use of the Debifi Platform or in accordance with our internal policies, we may require you to complete the KYC procedure in the scope designated by us.

The verification data may include first name, last name, address, telephone number, e-mail address, date of birth, taxpayer identification number, a government identification, and, if applicable, information regarding your bank account (such as the name of the bank, the account type, routing number or SWIFT, and account number), driving license or any other national ID, internal or international passport, bank statement, utility bill, tax document and/or other documents that a Lender or we consider necessary for your identification, for resolving submitted dispute or for any other purposes as specified herein. We or a Lender may request from you video identification or your selfie with a specified ID or passport or liveness automatic face recognition. The same verification data may be requested from you in relation to the entity’s directors and ultimate beneficial owners (when you act on behalf of an entity).

• Source. The source of the verification data is you.
• Processing. The verification data may be processed for the purposes of identity verification and the detection of money laundering, terrorist financing, fraud, or any other financial crime, settlement of disputes between users, enabling geographical restrictions and/or performance of our obligations to verify the identity of our customers.
• Legal Basis. The legal basis for this processing is the compliance with our legal obligations, the protection and assertion of our legal rights, your legal rights and the legal rights of others, the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.

Usage data

We may process information about your use of the Debifi Platform («usage data»). The usage data may include:

• Log records and usage information. We may collect information about your activity when using the Debifi Platform, including diagnostics, performance related statistics, and service-related information. For example, when you registered to use the Debifi Platform, when you most recently updated your information, when you last used the Debifi Platform, and which features you use, such as offer creation, API, or engaging in contracts etc.

  This also includes information relating to your activity, how you use the Debifi Platform, the time, frequency, and duration you use the Debifi Platform, how you interact with others while using the Debifi Platform, the settings you use when using the Debifi Platform, log files, performance logs, diagnostics (such as crashes and website usage statistics) and other reports; and

• Connection information (device and location). We may collect device information, and other information relating to your connection when you access and use the Debifi Platform, such as your IP and MAC address and related information, browser information, operating system information, and hardware model, etc.; and

• Cookies.

• Source. The source of the usage data is our analytics tracking system and your usage of the Debifi Platform and the Debifi App.

• Processing. This usage data may be processed to analyse, evaluate, engage in troubleshooting, and to improve the Debifi Platform, the Debifi App and related services, for enabling geographical restrictions in using the Debifi Platform as well as for the development, improvement, research, and testing of new features and services, to keep you signed in at the Debifi Platform, to improve and uniquely tailor our services to you, for example, for the purpose of automatically filtering the offer list.

• Legal Basis. The legal basis for this processing is your consent and our legitimate interest, namely enabling geographical restrictions, monitoring and improving the Debifi Platform and related services. In certain scenarios (keeping you logged in and uniquely tailoring our services to you), the legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.

Interaction data

We may process information that you generate while using the Debifi Platform, through your participation in Lending Deals, including your communication with other users while executing Lending Deals, any communication that you send to us, or relating to our customer relationships with you, including communication with us within the dispute resolution process («interaction data»). The interaction data may include your name, text messages, file attachments, your contact details (social media identifier, email address or messengers identifiers you use to communicate with us) and information contained in communications between you and other users or us and you.

• Source. The source of this interaction data is you and your activities at or through the Debifi Platform.
• Processing. This interaction data may be processed for the purposes of providing relevant services to you, to send you notifications, including but not limited to contract status updates, new messages from Lending Contracts you participate in, and any changes to your account, and for the purposes of managing our relationships with customers, communicating with customers, customer support, quality assurance of our customer support and communication with customers, keeping records of those communications and promoting our products and services to customers.
• Legal Basis. The legal basis for this processing is the performance of an agreement between you and us and/or taking steps, at your request, to enter into such an agreement and our legitimate interest, namely the proper management of our customer relationships and administration of the Debifi Platform and promotion of the Debifi Platform (when we use information about your Offers).

Sensitive Data

We do not require you to provide us with personal information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or sexual orientation («sensitive data»).

If you decide to provide us, other users or any third party with and/or allow your sensitive data to be publicly viewed through your account, it should be your voluntary decision taken solely by you. We additionally inform you that information that is public can be seen by anyone and people you share and communicate with may download or copy the content or information you provided to them or make it public. Use caution about the personal information you share with others.

Legal claims and fraud prevention processing

• Processing. We may process any of your personal information identified in this Policy where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure, or for detecting, preventing and addressing fraud and other illegal activity.
• Legal Basis. The legal basis for this processing is our legitimate interest, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.

We may use aggregate, non-identifying statistical data for statistical analysis, marketing, or similar promotional purposes to help improve our offerings to you or to improve your browsing experience by personalising the Debifi Platform.

In addition to the specific purposes for which we may process your personal information set out in this Section, we may also process any of your personal information where such processing is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another individual.

HOW WE USE YOUR INFORMATION FOR MARKETING PURPOSES

Processing. We may process your personal information identified in this Policy to keep you informed about our new products, product upgrades, special offers, webinars, events and promotions that may be of interest to you, to send you updates regarding services you have shown interest in or provide further information related to the topic you requested, or to get your consent to further contacting you regarding any other services you might be interested in.

Legal Basis. The legal basis for this processing is our legitimate interest, namely the development and conducting of our business.

VERIFICATION INFORMATION SUBMITTED TO LENDERS

Each Lender determines their intended scope of KYC procedure and thus collection and processing of your verification data. We are not a party to such a request and do not assess or evaluate the reasonableness of such collection. We will not become a controller of such submitted verification data. We will get access to verification data submitted by you to a Lender and/or their KYC Provider according to a separate agreement between us and such Lender, including strict adherence to data processing rules. Once we get access to your verification data, we will process this verification data in adherence to the rules specified above governing our own collection and processing of verification data.

The legal basis of processing your verification data by a Lender shall usually be compliance with the Lender’s legal obligations, the protection and assertion of the Lender’s legal rights, your legal rights and the legal rights of others, and the performance of a contract between you and a Lender and/or taking steps, at your request, to enter into such a contract.

Both we and Lenders utilise the services of a third-party KYC Provider that is technically supported by the Debifi Platform.

PERSONAL INFORMATION RECEIVED FROM THIRD PARTIES

In certain scenarios, we may receive your personal information from third parties.

Other users or businesses may provide us with information about you, such as your nickname, email, your communication with such users and other information covering your relations with such users. Users may also inform us that you use the Debifi Platform. Mainly such disclosure of information could be made when a user submits a dispute for our settlement or reports us your improper activities, violation of the Terms of Service, or potential fraudulent or scamming activities. All users and businesses must have legal rights to use, collect, and share your information before sending your information to us.

Third-party service operators may work with us, and we may receive information about you to improve our operations, and to help us provide the Debifi Platform and related services, customization, understanding, as well as to provide support, research and conduct surveys, market Debifi Platform and related services, and to understand how people use Debifi Platform and related services, the distribution of Debifi Platform and related services, and to provide infrastructure, delivery, and other systems.

We will process all your personal information received from third parties in adherence to the rules specified above governing our own collection and processing of your personal data.

INFORMATION YOU SHARE WITH US

We may share the information that you provide by using and communicating through the Debifi Platform, to improve the Debifi Platform, as well as to understand, support, customise, provide, operate, and market the Debifi Platform.

• Public Information. It can be seen by everyone, even if they don’t have an account, inside and outside of the Debifi Platform. This includes the advertisement of your Offer in the list, as well as your profile and Lending Deals information. You may manage your profile settings to make only specific information visible to others, as well as make your advertisements (Offers) private or not visible to others. Also, anybody can see whether or not you are actively using the Debifi Platform and related services, and the status of your account. By posting a public Offer you automatically grant, represent and warrant that you have the right to grant us an irrevocable, perpetual, exclusive, fully paid, worldwide license to use, copy, perform, display, and distribute such an Offer and to prepare derivative works of, or incorporate it into other works, such personal information.
• Counterparties. People you transact with may store and share your personal information (such as your contact details, messages, or chat attachments) with others who may or may not use the Debifi Platform and/or related services.

Third-Party Sharing. We do not sell your information, and never will. We partner with third parties to help use, provide and improve the Debifi Platform and related services, which allows us to operate globally. We strictly limit how our partners use and disclose the data we provide.

The following are the types of third parties we share information with:

• «Google Analytics» service is used for behavioural statistics. Your IP address may be included in the data we provide to Google Analytics, which is used by Google Analytics to understand how you use our Service. The service is subject to Google’s Privacy Policy. Google’s Privacy Policy is available via the link: https://policies.google.com/privacy?hl=en
• We use the «Oracle» service for storing your personal info. The service is subject to Oracle’s privacy rules available via the link: https://oracle.com/legal/privacy/
• For communications we use «Google Workspace». We may share data with Google that includes your email and nickname. The service is subject to Google’s Privacy Policy. Google’s Privacy Policy is available via the link: https://policies.google.com/privacy?hl=en
• We use «X (formerly Twitter)» service for promotions. We may provide Twitter with data such as your offer information. The service is subject to X (Twitter)’s privacy policy available via the link: https://x.com/en/privacy
• We use «SendGrid» to send critical notifications and product updates regarding the Debifi Platform, informative emails, announcements and marketing emails. The service is subject to Twillio’s privacy policy available via the link: https://twilio.com/en-us/legal/privacy

We may provide anonymous data such as usage statistics about the users of the Debifi Platform and related services to share our traffic patterns, sales, customers, and other information to potential partners, investors, marketers, other reputable third parties, and for other legal purposes, however, none of these statistics will contain your personal information.

We will never share Your IP and/or MAC address and/or any other sensitive information with anyone (even you) if we believe that it can harm our customers or if there is no legal obligation for us to do so.

GENERAL PROCESSING

Our processing means any operation or set of operations which is performed on personal information, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, support, maintenance, etc. The processing of personal information is carried out using computers and/or IT-enabled tools, following organisational procedures and modes strictly related to the purposes indicated.

We do not make automated decisions, including profiling.

Your personal information is processed at our operating offices and in any other place where the parties involved with the processing are located.

We have implemented measures designed to secure your personal information from accidental loss and unauthorised access, use, alteration, and disclosure.

DISCLOSING YOUR PERSONAL INFORMATION

We may disclose your personal information to our affiliates, our contractors and our service providers insofar as reasonably necessary for the purposes, and on the legal bases, set out in this Policy. For example, we may share your personal information with our service providers who perform identity verification of users, however, in some cases, you may directly interact with such service providers and they will act as data controllers in relation to the personal information you provide to them directly.

Your personal information may be accessible to certain types of our employees or contractors, involved with the operation of the Debifi Platform (customer support, marketing, moderation, compliance, legal, system administration) or external parties (such as third-party technical service providers, identity verification service providers, hosting providers, software development service providers, communication agencies) appointed, if necessary, as data processors by us.

Disclosure to Authorized Key Holder. We may share your personal information with the Authorized Key Holder — a party designated to hold a private key necessary for the signing of cryptocurrency transactions, that may be involved in the process of settling disputes between users as well as signing transactions related to multi-signature wallets. We will share with such Authorized Key Holder only such a portion of your personal information that is reasonably needed for the performance of the Authorized Key Holder’s obligations. At the date of the last revision and update of this Policy, the Authorized Key Holder is AnchorWatch Inc.

Disclosure to KYC Provider. We or a Lender, as a case may be, may refer you (either upon our initiative or a request of a Lender) to such KYC Provider for completion of the KYC procedure, when you will be required to submit your verification data. In this case, we and a Lender will not be a part of such KYC procedure, however, we may have access to such verification data or documents in accordance with our Privacy Policy and the privacy policies of a respective KYC Provider. At the date of the last revision and update of this Policy, the KYC Provider is Sum and Substance Ltd. (brand name Sumsub) and your submission of your verification data is subject to Sumsub’s privacy notice available via the link: https://sumsub.com/privacy-notice-service/

In addition to the specific disclosures of personal information set out in this Section, we may disclose your personal information where such disclosure is necessary (i) for compliance with a legal obligation to which we are subject or in response to a subpoena, court order, or other legal mechanisms, or (ii) in order to protect your vital interests or the vital interests of another natural person. We may disclose your personal information to our professional advisers insofar as reasonably necessary for the purposes of managing risks, obtaining professional advice, or the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure or detecting, preventing and addressing fraud and other illegal activity.

If we transfer your personal information outside the EEA zone, UK or Switzerland, we will ensure an adequate level of protection by any of the recognised methods of transfer, including but not limited to entry into the standard contractual clauses for the transfer of personal information to processors established in third countries.

RETAINING AND DELETING PERSONAL INFORMATION

We only retain your personal information for as long as it is necessary for us to use your information as described above or to comply with our legal obligations and legitimate interests. We will retain your personal information for no longer than 5 years from: i) the deletion of your account with the Debifi Platform or ii) from the last contact we receive from you, whichever is later. We will delete your personal data when we are not required to process your data. Please be aware that legal and regulatory requirements may require us to store your personal data for a longer period, pursuant to any applicable statutory limitation period.

Otherwise, we either delete or anonymise the personal information collected. In case personal information was transferred to backup storage and, therefore, cannot be deleted, we continue to store it securely, but do not use it for any purpose. In all the other cases, we proceed with the deletion of personal information.

YOUR RIGHTS

As a data subject (a person whose personal information is collected, stored and processed) you have several rights under data privacy laws:

1. Right of access. You have the right to obtain confirmation if your personal information is being processed by us. If that is the case, you can access your personal information and the following information: (i) the purposes of the processing; (ii) the categories of personal information; (iii) to whom the personal information has been or will be disclosed; (iv) the envisaged period for which the personal information will be stored, or the criteria used to determine that period.

   If you would like to have a copy of your personal information from us, we will provide it if (i) you prove your identity, (ii) it will not adversely affect the rights and freedoms of others. The first copy will be provided for free, for any further copies we may charge a reasonable fee based on administrative costs.

2. Right to rectification. You have the right to demand that we correct without undue delay your personal information which we have in our systems if it is inaccurate or incomplete.

3. Right to erasure («right to be forgotten»). You have the right to demand that we erase your personal information, and we shall erase it without undue delay where one of the following grounds applies: (i) this personal information is no longer necessary in relation to the purposes for which it was processed; (ii) you withdraw consent on which the processing is based, and where there is no other legal ground for the processing; (iii) you object to the processing and there are no overriding legitimate grounds; (iv) your personal information has been unlawfully processed; (v) your personal information has to be erased for compliance with a legal obligation.

4. Right to restrict processing. You have the right to restrict us in the ability of processing your information where one of the following applies: (i) you contest the accuracy of your personal information and we are verifying it; (ii) the processing is unlawful and you want to restrict it instead of erasure; (iii) we no longer need your personal information, but you need it for establishment, exercise or defence of legal claims; (iv) you have objected to processing and we are verifying whether legitimate grounds override your request.

5. Right to data portability. You have the right to receive your personal information which you provided to us in a structured, commonly used and machine-readable format and have the right to transmit those data to another company, where: (i) the processing is based on your consent or on a contract; and (ii) the processing is carried out by automated means.

   Where technically feasible, you can demand that we transmit those data directly to another company.

6. Right to object. You have the right to object to the processing of your personal information based on our legitimate interests. We shall no longer process your personal information unless we demonstrate compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims.

   Where personal information is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal information for such marketing.

7. Right to withdraw consent. You have the right to withdraw your consent for processing of your personal information at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

COOKIE POLICY

What Are Cookies?

It’s common for most professional websites to use cookies, as the Debifi Platform does. Cookies are very small files that are temporarily, or permanently, downloaded to your computer, for the sole purpose of improving your experience as a user of the website. Here we describe the purpose of a cookie, which is the information they gather, we also explain how we use this information and why we sometimes need to store these cookies. We also explain how you can prevent these cookies from being stored, however this may limit site functionality or render it unusable.

How We Use Cookies?

Unfortunately, like many if not most websites, there are no options for disabling cookies, without completely disabling the functionality and usability of the site. Fortunately, our cookies are harmless. So it is recommended that you leave on — all cookies — as they are likely required to provide you with the Debifi Platform.

Turning Off Cookies

You can block cookies by changing the settings on your browser (typically located under the privacy settings in your browser). Please be aware that disabling cookies will affect the functionality of the Debifi Platform, and many others that you visit. Disabling cookies usually results in limiting the functionality and features of websites. Therefore, we recommend that you do not disable cookies.

Cookies We Issue

Once you create an account with us, we will use cookies for administration purposes such as managing the signup process, as well as for preventing the abuse & misuse of the Debifi Platform. Cookies will usually be deleted when you log out, however, in some cases they remain afterwards, for example, to remember your site preferences for the next time you log in. In other words, once you are logged in, we use cookies to remember your site preferences. Furthermore, cookies prevent you from having to log in every time you visit a new page. These cookies are usually deleted when you log out to ensure you only have access to restricted features and areas when you are logged in. In order to provide you with a great experience on the Debifi Platform, we give you the ability to set your own preferences for how our site runs, whenever you use it. We set cookies so your customizations and preferences are remembered whenever you use a particular page.

Third-Party Cookies

Sometimes we also use cookies from trusted third parties. For now, the third parties are all part of Google company’s services, such as:

• Google Analytics;
• Youtube;
• reCAPTCHA.

For more information on Google Analytics cookies, you can see the official Google Analytics page. For more information on reCAPTCHA cookies, you can see the Privacy Policy for reCAPTCHA page. For more information on Google cookies, you can see the types of cookies used by Google page.

CONTACT INFORMATION

If you have any questions or requests related to our policies you may contact our data protection office through email: [email protected].