Privacy Policy

1. Who we are and the architecture of the processing

The BNKA platform is a technological environment operated jointly by its corporate group, subsidiaries and associated financial partners, applying the European Union's General Data Protection Regulation (GDPR) as the matrix and global standard of protection, privacy and security for all its users, both in the European Economic Area and in Latin America.

The processing of your personal data within the digital ecosystem is organised under the following operational roles, in full compliance with the platform's General Terms and Conditions:

The Owner of the Platform: The digital infrastructure, technical development and maintenance of the visual interface (frontend) are owned by the group's parent company (as identified in Section 1 of the General Terms). This entity acts as data controller for the basic management of your technical user profile.

Local Service and Infrastructure Providers: For each country or region, the technical processing of your verification and compliance (KYC/AML) data and the visual reconciliation of your operational balances is delegated to the respective operating subsidiary, affiliate or group entity assigned for that jurisdiction (the "Local Service Providers" described in the platform's General Terms).

Third-Party Regulated Financial Entities: For the transactional functionalities, issuance of virtual payment accounts (vIBANs) and safeguarding of funds, BNKA acts solely as a technical access interface, legitimately transmitting your instructions to the electronic money institutions, payment service providers or authorised credit institutions that actually provide the fiduciary service.

The processing of your personal data shall be governed by this general European standard (GDPR) and, coexisting with it, by the specific regulations and mandatory retention periods applicable in the corresponding jurisdiction according to the user's country of residence and the service actually contracted.

2. When we collect your personal data

BNKA will begin to process your personal data at the moment you start the process of registering your account on the platform, interact with our application or access our web environments.

3. How we collect your personal data

We collect personal data about you from different sources, including:
Personal data received from you: Information you actively enter in the registration forms, identity validations, profile uploads or communications with support.

Data collected automatically: Technical information about the device, browsing and usage patterns of the application interface.
Data received from external sources and financial partners: Basic transactional information and operational records shared by our Local Service Providers or allied authorised payment entities, strictly necessary to assist you with support, visual reconciliation of balances and technical performance of the platform.

4. What personal data we collect

We have divided the personal data we process into the following categories:
Contact and identity information: Name, surname, residential address, telephone number, email address and copies of official identification documents required for legal compliance processes.
Interaction and usage information: Technical records of how you use the platform account and history of orders and instructions transmitted through the interface.

Device information: IP address, geolocation data, language settings, browser settings, time zone, operating system, platform and unique mobile device identifiers.

Customer service information: Data, transcripts and files you provide to our support service so that we can help you resolve your queries or operational incidents.

5. Why we process your personal data (Purpose and Legal Basis)

In accordance with the GDPR standard, we must have a purpose and a legal basis for processing your personal data. We use the information collected for the following purposes:

Performance of the contractual relationship (Art. 6.1.b GDPR): Necessary for the administration and management of our relationship with you (reviewing your registration, setting up your platform account, performing technical performance analysis, issuing security and support alerts or administrative messages) and facilitating the use and operation of the platform interface in accordance with our General Terms and Conditions.

Compliance with legal obligations (Art. 6.1.c GDPR): Necessary for compliance with the mandatory regulations required by the authorities in the applicable jurisdictions, such as accounting, tax and audit regulations and the regulatory frameworks for the prevention of fraud, money laundering and misuse of our services.

Our legitimate interest (Art. 6.1.f GDPR): Applicable to provide customer service, compile aggregated statistics and data analysis aimed at business development and the improvement of our software services, assess or defend legal claims against us, protect our company from fraud and facilitate reorganisations or commercial transfers of the business.

6. With whom we share your personal data

We may share your personal data with our affiliates, corporate subsidiaries and trusted third-party service providers in order to provide and implement the functionalities of our technological interface.

These recipients may include:

- Providers of IT systems, databases and cloud storage services (cloud hosting) that act as data processors under strict contracts guaranteeing the GDPR security standards.

- The Local Service Providers and allied regulated financial entities (such as Electronic Money Institutions or banks) that issue your virtual accounts and manage your funds, so that they can process your instructions under their respective independent privacy policies.

- Third parties legitimately involved in the group's commercial transactions, such as mergers, acquisitions, reorganisations, asset sales or due diligence audits, subject to standard confidentiality agreements.

- Government agencies, regulators and competent supervisory authorities when required by a mandatory law or formal requirement in the corresponding jurisdiction.

6.1 Who we share your information with

We share personal data only where it is necessary to provide our services, to comply with legal or regulatory obligations, or to support our technological operation. Certain third parties act as data processors and process personal data on behalf of Block Digital Services S.A.C. (RUC 20609311577), following our instructions and under contractual obligations of confidentiality, security and personal data protection, in accordance with Peruvian Law No. 29733 (Personal Data Protection Law) and its Regulation, coexisting with the GDPR standard described in this Policy.

For electronic money functionalities in Peru, Block Digital Services S.A.C. acts as a technological access interface and transmits the user's instructions to the authorized electronic money issuer that actually provides the payment service and safeguards the funds. That entity independently determines the processing of the personal data it needs to meet its own regulatory obligations before the Peruvian Superintendency of Banking, Insurance and Pension Funds (SBS).

All recipients and processors are contractually bound to confidentiality, security and personal data protection duties, and to process the data solely for the purposes described here.

7. For how long do we keep your data?

We store your personal data for the term of our contractual relationship with you or while we have a legitimate operational contact. When the purpose for which they were collected ceases to be relevant, we will suspend their ordinary processing and they will be securely deleted or anonymised.
Notwithstanding the foregoing, the data will be kept duly blocked and available exclusively to the authorities during the minimum periods required by the accounting, tax and anti-money-laundering legislation applicable to the jurisdiction of each service (applying, for example, the retention standard of up to seven years for records linked to the European infrastructure).

8. Your rights

As a data subject under the GDPR framework and the local privacy regulations applicable in your country of access, you have the right to request, free of charge:

- Access to and information about what personal data we process about you.

- Rectification or completion of your data if it is inaccurate or incomplete.

- Erasure (right to be forgotten) or restriction of the processing of your personal data under the applicable legal grounds.

- Data portability, meaning to receive your personal data in a commonly used, structured and machine-readable format so as to transfer it to another controller.

- Absolute objection to the processing of your personal data when carried out for direct marketing or advertising purposes.
You may exercise any of these rights by sending a formal communication and proving your identity to the email address: legal@bnka.com.

9. Contacts, Support and Complaints

If you have any complaint or query about the processing of your personal data by BNKA, please contact us at legal@bnka.com or using the support channels within the application. Our support and customer service is fully available in Spanish and English 24 hours a day, 7 days a week, every day of the year.

Please note that you have the legal possibility of filing a complaint with a supervisory authority if you are not satisfied with the responses provided regarding your privacy. You can find the direct link to your local European Union regulatory authority through the European Data Protection Board (EDPB): https://edpb.europa.eu/about-edpb/board/members_en

10. Changes to this privacy policy

We may need to modify this privacy policy from time to time to adapt it to the addition of new technological features, due to developments in industry standards or changes in applicable laws and regulations. Any relevant update affecting your rights will be notified to you clearly and with due notice through your email registered on the platform.