Our Privacy and Data Policy

We collect only what is essential and relevant to your engagement with us, under the Legal Basis of GDPR Art. 6:

• Identification information, such as your full name, date of birth, national ID or passport number, and KYC documents. GDPR Art. 6: (b) Contract, (c) Legal obligation, (f) Legitimate interest
• Contact information, including your email address, phone number, mailing address, and preferred language. GDPR Art. 6: (b) Contract, (f) Legitimate interest
• Financial information, such as your bank account details, tokenized card data, and transaction history. GDPR Art. 6: (b) Contract, (c) Legal obligation
• Professional information, including your job title, employer, and any relevant accreditations. GDPR Art. 6: (f) Legitimate interest
• Usage and technical data, including your IP address, device identifiers, browser type, interaction logs, and cookies. GDPR Art. 6: (a) Consent, (f) Legitimate interest
• Special category data, which we do not intentionally process, unless required for compliance (e.g., sanctions screening), in which case we rely on a lawful basis GDPR Art. 9 (2)(g) or (c).

Your data may come from:

• Directly from you (forms, onboarding, KYC, support tickets)
• Technical sources (via cookies, SDKs, server logs, and similar technologies )
• Verified third parties (Sumsub KYC, credit reference agencies, public registers)

Each method is designed to be transparent and proportionate.

We process your personal data only for legitimate, clearly defined purposes, always with your trust and security in mind:

• To verify your identity and comply with AML/CFT regulations during account creation and onboarding.
• To deliver, maintain, and improve our services, ensuring the platform operates seamlessly and evolves with your needs.
• To process transactions, detect fraud, and handle payments, enabling secure and compliant financial operations.
• To provide timely and effective customer support, responding to inquiries and resolving issues with care and efficiency.
• To send relevant updates, product news, and offers, based on your preferences and with your prior consent.
• To meet regulatory obligations and conduct audits, including legal reporting, dispute resolution, and risk assessments.
• To protect the platform and your account through security measures, including access controls, monitoring, and incident response.
• To enhance user experience through analytics, using performance data and behavioral insights—always anonymized where possible.

At WELF, we never process your data without purpose, and we never sell it. Your trust is our most valuable asset.

We use select cookies and tracking technologies to enhance your experience and improve our platform—never to exploit your data.

• Meta Pixel is used to track conversions and optimize advertising performance, with data retained for 90 days and requiring your consent.
• HubSpot enables CRM integration, chat functionality, and marketing automation, with data stored for up to 13 months and subject to your consent.
• Google Analytics helps us understand how users interact with our platform (with IP anonymization enabled), retaining data for 26 months and requiring your consent.

You can withdraw or manage your cookie preferences at any time via the Cookie Settings panel—no questions asked, no barriers added.

Sharing is limited, transparent, and always under strict contracts to protect your data.

• Group Companies & Affiliates – only those who need data to perform services.
• Service Providers – HubSpot (CRM), Microsoft 365 E5, Azure IAM, SendGrid (email), Sumsub (KYC). All operate under DPAs with the latest Standard Contractual Clauses.
• Regulated Counterparties – banks, payment processors.
• Authorities – only when legally compelled.
• Professional Advisers – auditors, lawyers, insurers under confidentiality.

Every employee, contractor, and thirdparty partner signs a DPA and NDA and undergoes background checks. Privacy is baked into our supply chain.

We protect your data like it’s our own:

• Zero-trust architecture with Azure IAM & Conditional Access
• Encryption: TLS 1.3 in transit, AES256 at rest
• Network & application firewalls (WAF, DDoS mitigation)
• 24/7 monitoring & SIEM
• Annual penetration tests & DORA aligned incident response playbooks
• Least privilege access enforced via RBAC
• Mandatory staff training on GDPR, DORA, and security best practices.

We retain your personal data only for as long as necessary—no longer, no less—based on legal, regulatory, and operational requirements.

• Identification and KYC data is retained for the lifetime of your account plus five years, to meet anti-money laundering, tax, and audit obligations.
• Transaction and financial records are kept for the lifetime of your account plus five years, in accordance with regulatory standards.
• Marketing preferences and related consent data are retained until you withdraw consent or for up to two years after your last interaction.
• Technical logs are stored for up to two years to support platform security, performance monitoring, and analytics.
• Data under legal hold is retained for as long as required to comply with investigations, litigation, or legal obligations.

All deletions are executed using secure industry-standard methods, including cryptographic erasure or secure wipe.

You have full control over your personal data, and we are committed to making the exercise of your rights simple, respectful, and free of charge.

• Access – You can request a copy of the personal data we hold about you at any time.
• Rectification – You can correct or update any inaccurate or incomplete information.
• Erasure – You may ask us to delete your data when it’s no longer needed or if you withdraw consent.
• Restriction – You can request a pause on processing while a concern or dispute is under review.
• Data Portability – You can receive your data in a structured, machine-readable format for reuse or transfer.
• Object – You can object to data processing based on legitimate interests or for direct marketing purposes.
• Withdraw Consent – You can withdraw your consent at any time, without penalty or disruption.
• Complain – You may lodge a complaint with your local supervisory authority if you believe your rights have been violated.

To exercise any of these rights, email us at privacy@welf.com or dpo@welf.com. We respond to all valid requests within the legal timeframe and always acknowledge them within 72 hours.