Privacy Policy

1. Information We Collect

We collect information that you voluntarily provide to us when registering for an account, using our services, or contacting our support team. This may include:

• Personal identification information: full name, email address, phone number, date of birth.
• Government-issued identification documents for KYC verification (e.g., passport, national ID, driver's license).
• Financial information: bank account details, payment card information, transaction history.
• Device information: IP address, browser type, operating system, device identifiers.
• Usage data: pages visited, features used, time spent on the platform, referral URLs.
• Location data: approximate location based on IP address or precise location if you grant permission.
• Communication data: records of your interactions with our support team, including call recordings.

2. How We Use Your Information

We use the collected information for the following purposes:

• To provide, maintain, and improve our money transfer and payment services.
• To verify your identity and comply with anti-money laundering (AML) and know-your-customer (KYC) regulations.
• To process transactions and send you transaction confirmations.
• To detect, prevent, and address fraud, security incidents, and illegal activities.
• To communicate with you about your account, transactions, and changes to our policies.
• To personalize your experience and deliver relevant content and features.
• To comply with legal obligations and regulatory reporting requirements.
• To analyze usage trends and improve the overall user experience.
• To send you marketing communications (with your consent, where required by law).

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), our legal basis for collecting and using your personal information depends on the specific data concerned and the context in which we collect it. We typically rely on the following legal bases:

• Performance of a contract: to provide our services and process transactions.
• Legal obligation: to comply with AML, KYC, and other regulatory requirements.
• Legitimate interests: to improve our services, prevent fraud, and ensure security.
• Consent: for certain marketing activities and optional data processing.

You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

4. Data Sharing & Disclosure

We may share your information with the following third parties:

• Financial institutions and payment processors to facilitate transactions.
• Regulatory authorities and law enforcement agencies as required by applicable law.
• Identity verification services to perform KYC checks.
• Cloud service providers for data storage and processing.
• Analytics providers to help us understand how our platform is used.

We do not sell your personal information to third parties for their marketing purposes. All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. We may also retain your information to comply with legal obligations, resolve disputes, and enforce our agreements.

• Transaction records: retained for at least 7 years as required by financial regulations.
• KYC documents: retained for the duration of your account plus 5 years after account closure.
• Account information: deleted or anonymized within 90 days after account closure, except where retention is required by law.
• Communication records: retained for 3 years from the date of the interaction.

6. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption of data in transit using TLS 1.3 protocols.
• Encryption of sensitive data at rest using AES-256.
• Multi-factor authentication for account access.
• Regular security audits and penetration testing.
• Access controls and employee training on data protection.
• Incident response procedures for data breaches.

While we take these precautions seriously, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access: obtain a copy of the personal data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure (right to be forgotten): request deletion of your data, subject to legal requirements.
• Right to restrict processing: limit how we use your data under certain circumstances.
• Right to data portability: receive your data in a structured, commonly used format.
• Right to object: object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent: withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at privacy@sutcel.com. We will respond to your request within the timeframe required by applicable law.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. When we transfer your data internationally, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the European Commission.
• Binding corporate rules for transfers within our corporate group.
• Data processing agreements with third-party service providers.

By using our services, you consent to the transfer of your data to countries that may have different data protection laws than your country of residence.

9. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform. These include:

• Essential cookies: required for the platform to function properly.
• Analytics cookies: help us understand how users interact with our platform.
• Preference cookies: remember your settings and preferences.
• Security cookies: help detect and prevent fraudulent activity.

You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our platform.

10. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information promptly. If you believe we may have collected information from a child, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We will notify you of any material changes by:

• Posting the updated policy on our platform.
• Sending an email notification to your registered email address.
• Requiring acknowledgment of the updated terms for continued use.

We encourage you to review this policy periodically. Your continued use of our services after changes take effect constitutes your acceptance of the updated policy.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@sutsel.com
Address: Sutcel HQ, Nairobi, Kenya
Data Protection Officer: dpo@sutsel.com

We will respond to your inquiry within a reasonable timeframe, typically within 30 days. If you are unresolved, you have the right to lodge a complaint with your local data protection authority.