Privacy Policy

KinPay is the controller (or equivalent under applicable law) for personal data processed as described in this Policy, unless otherwise stated. This Policy applies to personal data about:

• visitors to our websites
• registered users of the Platform (e.g. lenders and borrowers)
• individuals whose information is provided to us by users (e.g. co-borrowers, guarantors, contacts).

For certain services (particularly payment initiation and processing), third-party payment service providers and banks will process your data under their own privacy notices as separate controllers.

We structure our privacy practices around four main principles, aligned with GDPR transparency obligations and US privacy expectations:

• Notice – clear information about what we collect, why, and how we share it.
• Choice – where required, options about how your personal data is used and disclosed, including marketing and certain sharing.
• Access – reasonable mechanisms for you to access, correct and in some cases delete or export your personal data.
• Security – appropriate technical and organisational measures to safeguard your personal data.

We may update this Policy from time to time; the current version will always be available on the Platform and indicate the effective date.

The categories of personal data we collect depend on how you use the Platform.

3.1 Information you provide

We may collect:

• Identification and contact details: name, address, email, phone number, date of birth.
• Account information: username, password, security credentials.
• Loan and contract information: details of User Agreements (e.g. loan terms, parties, repayment schedules, balances) and related documents you upload or generate.
• Financial information: limited bank or payment details needed to connect to Payment Services (e.g. IBAN, account number, sort code), typically handled and tokenised by third-party payment processors, not stored in full by KinPay.
• Communications: messages you send to us (support, feedback) and, where necessary for support or compliance, selected communications sent between users via the Platform.

3.2 Information collected automatically

When you use the Platform, we may automatically collect:

• Technical data: IP address, browser type, device type, operating system, language settings.
• Usage data: pages or screens viewed, features used, dates and times of activity, app and website performance data.
• Log data: login and logout timestamps, configuration changes, security-relevant events.

3.3 Information from third parties

We may receive information from:

• Payment processors and banks (e.g. transaction identifiers, status codes, timestamps).
• Identity verification / fraud-prevention providers (e.g. confirmation of identity, sanctions or watch-list screening results).
• Public or commercial sources (e.g. app stores, analytics providers).

Our websites and applications may use cookies and similar technologies to:

• operate core site and app functions (essential cookies)
• remember your preferences (functional cookies)
• analyse usage and improve performance (analytics/performance cookies)
• support marketing and communication where permitted (marketing cookies).

Where EU/EEA or similar laws require it, we will obtain your consent for non-essential cookies via a cookie banner or settings tool. You can manage cookies via your browser and, where available, our cookie settings; disabling certain cookies may affect Platform functionality.

We process personal data for the following purposes and legal bases, where GDPR or similar laws apply:

1. Providing the Platform and services

• To create and manage your account, authenticate you and provide core Platform features.
• To enable you to create, store and manage User Agreements and see balances, due dates and payment status.

Legal basis: performance of a contract; legitimate interests.

2. Supporting payments via third-party providers

• To transmit your payment instructions and necessary data to payment processors and banks.
• To display transaction status and history within the Platform.

Legal basis: performance of a contract; legitimate interests; legal obligation in some cases.

3. Customer support and communication

• To respond to your requests, complaints and feedback.
• To send you service messages (e.g. security alerts, changes to terms, technical notices).

Legal basis: performance of a contract; legitimate interests; legal obligation for some notices.

4. Security, fraud prevention and compliance

• To protect the Platform, users and KinPay against fraud, misuse and security incidents.
• To comply with legal and regulatory obligations (e.g. bookkeeping, financial regulations, responding to lawful requests from authorities).

Legal basis: legitimate interests; legal obligation.

5. Improvement and analytics

• To monitor and analyse usage and performance to improve our products and develop new features.
• To generate aggregated or anonymised statistics that no longer identify individuals.

Legal basis: legitimate interests; consent where required for analytics cookies.

6. Marketing and optional communication

• To send you information about KinPay products and services that may be relevant to you, subject to your preferences and applicable laws.

Legal basis: legitimate interests; consent where required for electronic direct marketing.

We may share personal data with the following categories of recipients:

1. Other Users (counter-parties)

To the extent necessary to perform and display User Agreements, we share information between relevant parties (for example, a lender and borrower see each other's names and agreed loan details).

2. Service providers and partners

• Payment processors and banks that execute payment orders and provide ACH/SEPA or card infrastructure.
• Cloud hosting providers, IT and security vendors, customer support tools, and analytics providers.
• Professional advisors (e.g. auditors, lawyers) where necessary.

These service providers act typically as processors under our instructions and are bound by contractual data protection obligations.

3. Affiliates and corporate transactions

We may share information with our group entities for internal administrative purposes, and with third parties in connection with a merger, acquisition, reorganisation or sale of our business, subject to appropriate safeguards.

4. Authorities and legal obligations

We may disclose data where required by law, regulation, legal process or governmental request, or to protect our rights, users or the public (e.g. to tax authorities, regulators or law-enforcement).

We limit sharing to what is necessary for the relevant purpose and require recipients to handle data in accordance with applicable law and appropriate security standards.

KinPay may store and process personal data in countries outside the one in which you are located. Where we transfer personal data from the EU/EEA or UK to countries without an adequacy decision, we implement appropriate safeguards such as:

• EU/EEA and UK Standard Contractual Clauses, or equivalent contractual instruments, and
• additional technical and organisational measures where necessary.

You can contact us for more details about applicable transfer mechanisms.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or destruction. These may include:

• encryption in transit and at rest where appropriate
• access controls and role-based authorisation
• logging and monitoring of critical systems
• secure development, testing and deployment practices
• regular review of our security controls.

You are responsible for maintaining the confidentiality of your login credentials and for using secure devices and networks when accessing the Platform. Email is not always secure; for sensitive information, we encourage the use of secure areas of the Platform.

We retain personal data only as long as necessary for the purposes described in this Policy, or as required by applicable laws (for example, commercial, tax or financial regulations).

In general:

• Account-related data is kept while your account is active.
• Loan and transaction-related data may be kept for a number of years after closure to comply with legal, accounting and audit obligations and to handle disputes (often 5–10 years, depending on jurisdiction).
• Where we no longer need personal data, we will anonymise or securely delete it; anonymised data may be used for analytics and product development.

Where GDPR or similar laws apply, you may have some or all of the following rights:

• Right of access – to obtain confirmation whether we process your personal data and to receive a copy.
• Right to rectification – to correct inaccurate or incomplete data.
• Right to erasure – to request deletion in certain circumstances (e.g. where data is no longer necessary or you withdraw consent and there is no other legal basis).
• Right to restriction – to request that we limit processing in specific situations.
• Right to data portability – to receive certain data in a structured, commonly used and machine-readable format and to transmit it to another controller.
• Right to object – to object at any time to processing based on our legitimate interests, and to direct marketing.
• Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

You can exercise these rights by contacting us using the details above. We may need to verify your identity before responding.

If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection authority. We encourage you to contact us first so we can seek to resolve your concerns.

For users in the US, similar rights may be available under state law (for example, access or deletion in some states). Where such rights apply, you can exercise them by contacting us using the same channels, and we will respond as required by applicable law.

We may send you service-related communications that are necessary for providing our services (such as security alerts, system notifications and changes to terms); you cannot opt out of these while maintaining an account.

With your consent where required, or where otherwise permitted by law, we may send you marketing communications about KinPay products and services. You can opt out at any time by using the unsubscribe link in the message or contacting us. Opting out of marketing does not affect service-related communications.

The Platform may contain links to or integrations with third-party websites, apps and services, including payment processors, analytics providers and identity verification services. These third parties have their own privacy notices and are responsible for their own practices. We encourage you to review their policies before using their services or providing data to them.

The Platform is not directed to children under 18 (or the age of legal capacity in the relevant jurisdiction), and we do not knowingly collect personal data from such individuals without appropriate consent. If we learn that we have collected personal data from a child in violation of applicable law, we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or the Platform. When we do so, we will update the "Last updated" date and, where appropriate, provide additional notice (for example, via email or in-app notification).

Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the changes.

If you have any questions, concerns or requests regarding this Privacy Policy or our handling of your personal data, please contact:

• Email: support@kinpay.me
• Postal address: CL. RODODENDRO, 44 – 29630 Benalmádena (Málaga)

If GDPR applies to you and KinPay does not have a physical establishment in the EU/EEA, we may appoint an EU representative; details will then be provided here or in a separate notice, in accordance with Article 27 GDPR.