BNKA Documentary Package, Edition 1.3
Last updated: 22 October 2026
1. Who we are and the architecture of the processing
The BNKA platform is a technological environment operated jointly by its corporate group, subsidiaries and associated financial partners, applying the European Union's General Data Protection Regulation (GDPR) as the matrix and global standard of protection, privacy and security for all its users, both in the European Economic Area and in Latin America.
The processing of your personal data within the digital ecosystem is organised under the following operational roles, in full compliance with the platform's General Terms and Conditions:
The data controller: Byte Neok AI, S.L.U., Tax ID B72527682 (full details in the Legal Notice), technical operator of the Platform, is the controller of the User's technical profile data. Contact: legal@bnka.com.
Local Service and Infrastructure Providers: For each country or region, the technical processing of your verification and compliance (KYC/AML) data and the visual reconciliation of your operational balances is delegated to the respective operating subsidiary, affiliate or group entity assigned for that jurisdiction (the "Local Service Providers" described in the platform's General Terms).
Third-Party Regulated Financial Entities: For the transactional functionalities, issuance of virtual payment accounts (vIBANs) and safeguarding of funds, BNKA acts solely as a technical access interface, legitimately transmitting your instructions to the electronic money institutions, payment service providers or authorised credit institutions that actually provide the fiduciary service.
The processing of your personal data shall be governed by this general European standard (GDPR) and, coexisting with it, by the specific regulations and mandatory retention periods applicable in the corresponding jurisdiction according to the user's country of residence and the service actually contracted.
2. When we collect your personal data
BNKA will begin to process your personal data at the moment you start the process of registering your account on the platform, interact with our application or access our web environments.
3. How we collect your personal data
We collect personal data about you from different sources, including:
Personal data received from you: Information you actively enter in the registration forms, identity validations, profile uploads or communications with support.
Data collected automatically: Technical information about the device, browsing and usage patterns of the application interface.
Data received from external sources and financial partners: Basic transactional information and operational records shared by our Local Service Providers or allied authorised payment entities, strictly necessary to assist you with support, visual reconciliation of balances and technical performance of the platform.
4. What personal data we collect
We have divided the personal data we process into the following categories:
Contact and identity information: Name, surname, residential address, telephone number, email address and copies of official identification documents required for legal compliance processes.
Interaction and usage information: Technical records of how you use the platform account and history of orders and instructions transmitted through the interface.
Device information: IP address, geolocation data, language settings, browser settings, time zone, operating system, platform and unique mobile device identifiers.
Customer service information: Data, transcripts and files you provide to our support service so that we can help you resolve your queries or operational incidents.
5. Why we process your personal data (Purpose and Legal Basis)
In accordance with the GDPR standard, we must have a purpose and a legal basis for processing your personal data. We use the information collected for the following purposes:
Performance of the contractual relationship (Art. 6.1.b GDPR): Necessary for the administration and management of our relationship with you (reviewing your registration, setting up your platform account, performing technical performance analysis, issuing security and support alerts or administrative messages) and facilitating the use and operation of the platform interface in accordance with our General Terms and Conditions.
Compliance with legal obligations (Art. 6.1.c GDPR): Necessary for compliance with the mandatory regulations required by the authorities in the applicable jurisdictions, such as accounting, tax and audit regulations and the regulatory frameworks for the prevention of fraud, money laundering and misuse of our services.
Our legitimate interest (Art. 6.1.f GDPR): Applicable to provide customer service, compile aggregated statistics and data analysis aimed at business development and the improvement of our software services, assess or defend legal claims against us, protect our company from fraud and facilitate reorganisations or commercial transfers of the business.
6. With whom we share your personal data
We may share your personal data with our affiliates, corporate subsidiaries and trusted third-party service providers in order to provide and implement the functionalities of our technological interface.
These recipients may include:
- Providers of IT systems, databases and cloud storage services (cloud hosting) that act as data processors under strict contracts guaranteeing the GDPR security standards.
- The Local Service Providers and allied regulated financial entities (such as Electronic Money Institutions or banks) that issue your virtual accounts and manage your funds, so that they can process your instructions under their respective independent privacy policies.
- Third parties legitimately involved in the group's commercial transactions, such as mergers, acquisitions, reorganisations, asset sales or due diligence audits, subject to standard confidentiality agreements.
- Government agencies, regulators and competent supervisory authorities when required by a mandatory law or formal requirement in the corresponding jurisdiction.
6.1 Who we share your information with
We share personal data only where it is necessary to provide our services, to comply with legal or regulatory obligations, or to support our technological operation. Certain third parties act as data processors and process personal data on behalf of Block Digital Services S.A.C. (RUC 20609311577), following our instructions and under contractual obligations of confidentiality, security and personal data protection, in accordance with Peruvian Law No. 29733 (Personal Data Protection Law) and its Regulation, coexisting with the GDPR standard described in this Policy.
For electronic money functionalities in Peru, the Platform transmits the user's instructions to the authorized electronic money issuer that actually provides the payment service and safeguards the funds. That entity independently determines the processing of the personal data it needs to meet its own regulatory obligations before the Peruvian Superintendency of Banking, Insurance and Pension Funds (SBS).
| Recipient | Purpose |
|---|---|
| Block Digital Services S.A.C. | Local User support entity providing commercial support in Peru. |
| The electronic money issuer identified in the Jurisdiction Module for Peru | Issuance and management of electronic money, processing of payment operations and safeguarding of user funds in Peru, and compliance with its regulatory obligations before the SBS. |
| Sumsub | Identity verification and prevention of fraud, money laundering and terrorist financing (KYC/AML): document validation, biometric verification and screening against lists. |
| Didit | Identity verification and re-verification: document validation and biometric verification. |
| Bridge Ventures LLC | Services in US dollars, only for residents outside the European Economic Area. |
| BCB Group | Services in euros. |
| Customer.io | Delivery and management of push notifications and in-app messages. |
| Brevo | Delivery of transactional communications by email: account verification, security alerts and operational notices. |
| Twilio | Main provider of SMS messages and verification codes (OTP). |
| Zendesk | User support management. |
| Google Firebase | Delivery of notifications and measurement of app stability. |
All recipients and processors are contractually bound to confidentiality, security and personal data protection duties, and to process the data solely for the purposes described here.
6.2 International transfers
Personal data may be processed in Argentina, Peru, Colombia, the United States and the United Kingdom by the providers listed in this Policy, with the safeguards provided for in the GDPR in each case (adequacy decision or standard contractual clauses).
6.3 Biometric data
The processing of biometric data to verify the User's identity, carried out by Sumsub and by Didit, is based on the User's explicit consent, given when the verification starts, and on the legal obligation to prevent money laundering. Its retention is the one set by that legislation.
7. For how long do we keep your data?
We store your personal data for the term of our contractual relationship with you or while we have a legitimate operational contact. When the purpose for which they were collected ceases to be relevant, we will suspend their ordinary processing and they will be securely deleted or anonymised.
Notwithstanding the foregoing, the data will be kept duly blocked and available exclusively to the authorities during the minimum periods required by the accounting, tax and anti-money-laundering legislation applicable to the jurisdiction of each service. For anti-money-laundering and counter-terrorist-financing purposes, data is kept for ten (10) years from the end of the business relationship, in accordance with Spanish anti-money-laundering and counter-terrorist-financing legislation, and afterwards for as long as liabilities may arise.
8. Your rights
As a data subject under the GDPR framework and the local privacy regulations applicable in your country of access, you have the right to request, free of charge:
- Access to and information about what personal data we process about you.
- Rectification or completion of your data if it is inaccurate or incomplete.
- Erasure (right to be forgotten) or restriction of the processing of your personal data under the applicable legal grounds.
- Data portability, meaning to receive your personal data in a commonly used, structured and machine-readable format so as to transfer it to another controller.
- Absolute objection to the processing of your personal data when carried out for direct marketing or advertising purposes.
You may exercise any of these rights by sending a formal communication and proving your identity to the email address: legal@bnka.com.
9. Contacts, Support and Complaints
If you have any complaint or query about the processing of your personal data by BNKA, please contact us at legal@bnka.com or using the support channels within the application. Support is provided in Spanish and English through support@bnka.com and the channels indicated in the app.
Please note that you have the legal possibility of filing a complaint with a supervisory authority if you are not satisfied with the responses provided regarding your privacy. The competent supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es), without prejudice to the authority of the User's country of residence.
10. Job applications
The data of people who submit an application through the bnka.com form (full name, email, phone, country, city, LinkedIn profile, area of interest, cover letter and CV) is processed for the purpose of managing selection processes. The legal basis is the candidate's consent, given when submitting the form. The data is kept for up to 12 months from receipt, unless the candidate requests its deletion earlier. It is not disclosed to third parties, except hosting providers.
11. Cookies and storage
The bnka.com pages in Spanish, English and Portuguese do not install analytics or advertising cookies, only the technical ones that are necessary. The app uses the device's local storage for the session and for security. Any future analytics will be disclosed and consent will be requested before they are activated.
12. Changes to this privacy policy
We may need to modify this privacy policy from time to time to adapt it to the addition of new technological features, due to developments in industry standards or changes in applicable laws and regulations. Any relevant update affecting your rights will be notified to you clearly and with due notice through your email registered on the platform.
