Enterprise Privacy Policy

1. Introduction

Digital Finance (Bahamas) Ltd., operating under the CiNKO brand ("CiNKO," "we," "us," or "our"), is committed to protecting the privacy and security of personal data processed in connection with our enterprise platform. This Enterprise Privacy Policy ("Policy") explains how we collect, use, store, and share personal data when providing services to business customers ("Customer," "you," or "your") who integrate with the CiNKO platform via APIs, SDKs, and other developer tools.

CiNKO is a company duly registered under the laws of the Commonwealth of The Bahamas and is regulated by the Securities Commission of The Bahamas ("SCB") under the Digital Assets and Registered Exchanges Act, 2020, as amended (the "DARE Act").

This Policy should be read in conjunction with the Enterprise Terms of Service and any applicable Data Processing Agreement ("DPA"). Capitalized terms not defined herein have the meanings assigned in the Enterprise Terms of Service.

2. Roles and Responsibilities

2.1 Data Controller vs. Data Processor

The allocation of data protection roles depends on the category of personal data being processed:

Data Category	CiNKO's Role	Customer's Role
Customer business contact information (names, emails, phone numbers of authorized representatives)	Controller	Data subject / provider
Customer account and billing data	Controller	Data subject / provider
End User personal data processed through the Platform on Customer's behalf	Processor	Controller
End User KYC/AML data where CiNKO performs due diligence as required by law	Controller (regulatory obligation)	Provider / co-controller where applicable
API logs, webhook metadata, and developer analytics	Controller	Provider
Transaction data subject to AML recordkeeping requirements	Controller (regulatory obligation)	Controller (for its own compliance)

2.2 Customer Obligations as Controller

Where Customer acts as the data controller, Customer is responsible for:

• Establishing a lawful basis for processing End User personal data;
• Providing adequate privacy notices to End Users;
• Responding to data subject access requests, rectification requests, and deletion requests;
• Conducting data protection impact assessments where required; and
• Ensuring compliance with applicable data protection laws in the jurisdictions where Customer operates.

2.3 CiNKO's Obligations as Processor

Where CiNKO acts as a data processor on Customer's behalf, CiNKO shall:

• Process personal data only on Customer's documented instructions (unless required by law);
• Implement appropriate technical and organizational security measures;
• Assist Customer in responding to data subject requests;
• Notify Customer without undue delay of any personal data breach;
• Engage subprocessors only with Customer's authorization (general or specific, as agreed in the DPA); and
• Delete or return personal data upon termination, subject to legal retention obligations.

3. Information We Collect

3.1 Customer Business Information

We collect information about Customer's business, including:

• Corporate information: Company name, registration number, jurisdiction of incorporation, registered address, and beneficial ownership details.
• Authorized representatives: Names, email addresses, phone numbers, and job titles of individuals authorized to manage the Customer account.
• Billing information: Bank account details, payment method information, and invoicing addresses.
• Compliance documentation: Regulatory licenses, AML/KYC policies, compliance certifications, and due diligence documentation.

3.2 API and Technical Data

We automatically collect technical data in connection with Customer's use of our APIs and Platform:

• API request logs: Endpoint called, request/response timestamps, HTTP status codes, request payloads (excluding sensitive fields), and error details.
• Authentication data: API key usage, authentication timestamps, and IP addresses of API requests.
• Webhook delivery logs: Endpoint URLs, delivery timestamps, response codes, and retry history.
• SDK telemetry: SDK version, platform, integration method, and error reports (where telemetry is enabled).
• Dashboard usage: Login events, pages viewed, features accessed, and session data for Customer's authorized users.

3.3 Transaction Data

We process transaction data as necessary to provide the Services, including:

• Transaction identifiers, amounts, currencies, timestamps, and status;
• Sender and recipient wallet addresses, account identifiers, and payment method details;
• Blockchain transaction hashes and network confirmations;
• FX rates applied, fees charged, and settlement details; and
• Card transaction data (merchant details, authorization codes, transaction amounts) where applicable.

3.4 End User Data Processed on Customer's Behalf

When Customer uses our Platform to serve its End Users, we may process End User personal data on Customer's behalf, including:

• Identity information (names, dates of birth, government-issued ID numbers);
• Contact information (email addresses, phone numbers, physical addresses);
• KYC verification data (identity documents, selfie photographs, biometric templates);
• Financial information (account balances, transaction history); and
• Device and location data (IP addresses, device identifiers, geolocation where enabled).

The specific categories of End User data processed depend on the Services used and Customer's integration configuration.

4. How We Use Information

4.1 Service Delivery

We use Customer and End User data to:

• Provide, operate, maintain, and improve the Platform and Services;
• Process transactions, manage wallets, issue cards, and execute payment instructions;
• Authenticate API requests and manage Customer accounts;
• Deliver webhook notifications and API responses; and
• Provide technical support, troubleshooting, and incident resolution.

4.2 Compliance and Legal Obligations

We process data to comply with legal and regulatory obligations, including:

• Anti-money laundering (AML) and counter-terrorism financing (CTF) requirements under the DARE Act and Bahamian law;
• Know-your-customer (KYC) and customer due diligence (CDD) obligations;
• Transaction monitoring and suspicious activity reporting;
• Sanctions screening against applicable sanctions lists;
• Tax reporting and withholding obligations; and
• Responding to lawful requests from regulators, law enforcement, and judicial authorities.

4.3 Security and Fraud Prevention

We process data to detect, prevent, and investigate fraud, security incidents, and unauthorized access, including monitoring API usage patterns, detecting anomalous transactions, and conducting security audits.

4.4 Analytics and Improvement

We use aggregated and anonymized data to analyze platform performance, usage patterns, and service quality. We may use API usage analytics to improve documentation, identify common integration issues, and enhance developer tools. Analytics data is not used to identify individual End Users.

4.5 Communications

We use Customer contact information to communicate about service updates, security notifications, compliance requirements, billing matters, and product announcements. Customer may opt out of non-essential communications at any time.

5. Sharing of Information

5.1 Subprocessors

We engage trusted third-party subprocessors to provide components of the Services. Subprocessors are bound by data processing agreements with obligations no less protective than those in this Policy. Current categories of subprocessors include:

• Cloud infrastructure: Hosting, storage, and compute services;
• Custody providers: Digital asset safekeeping and key management (e.g., Fireblocks);
• KYC/AML providers: Identity verification, document verification, and screening services (e.g., Persona, Chainalysis);
• Payment processors: Fiat payment rails, card issuance, and local payment methods (e.g., Rain, Bridge, dLocal, Localpayment);
• Blockchain networks: Transaction processing and settlement on supported networks;
• Communication providers: Email, SMS, and notification delivery services; and
• Analytics providers: Platform monitoring, error tracking, and performance analytics.

A list of current subprocessors is available upon request. CiNKO shall notify Customer of any material changes to its subprocessor list in accordance with the DPA, providing Customer with an opportunity to object.

5.2 Regulatory and Legal Disclosures

We may disclose personal data to comply with applicable laws, regulations, judicial proceedings, or government requests. This includes disclosures to the SCB, financial intelligence units, tax authorities, law enforcement agencies, and courts as required by the DARE Act and other applicable legislation.

5.3 Partners and Affiliates

We may share information with affiliates and strategic partners solely to the extent necessary to provide the Services, process transactions, or fulfill regulatory obligations. Partners and affiliates are subject to appropriate confidentiality and data protection obligations.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, Customer Data may be transferred as part of the transaction. CiNKO shall notify Customer of any such transfer and ensure that the receiving entity assumes equivalent data protection obligations.

6. Data Processing Agreement (DPA) Provisions

6.1 Scope of Processing

Where CiNKO processes personal data as a processor on Customer's behalf, the processing is governed by the DPA (or, where no separate DPA has been executed, by the provisions of this Section 6). The scope, duration, nature, and purpose of processing, as well as the categories of personal data and data subjects, shall be as described in this Policy and the applicable Order Form.

6.2 Instructions

CiNKO shall process End User personal data only on Customer's documented instructions, unless processing is required by applicable law. Customer's instructions are documented through this Agreement, the DPA, API configurations, and Customer's use of the Platform.

6.3 Security Measures

CiNKO implements and maintains appropriate technical and organizational security measures, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256);
• Multi-party computation (MPC) key management for digital asset custody;
• Role-based access controls with principle of least privilege;
• Regular security assessments, penetration testing, and vulnerability scanning;
• Audit logging and monitoring of access to personal data;
• Incident response procedures and business continuity planning; and
• Employee security training and confidentiality agreements.

6.4 Data Breach Notification

CiNKO shall notify Customer without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting End User data processed on Customer's behalf. Notification shall include:

• A description of the nature of the breach, including categories and approximate number of data subjects affected;
• The name and contact details of CiNKO's data protection contact;
• A description of the likely consequences of the breach; and
• A description of the measures taken or proposed to address the breach and mitigate its effects.

6.5 Data Subject Rights

CiNKO shall assist Customer in fulfilling its obligations to respond to data subject requests (access, rectification, erasure, portability, restriction, and objection) through appropriate technical and organizational measures. CiNKO shall promptly notify Customer if it receives a request directly from a data subject, unless prohibited by law.

6.6 Audits

CiNKO shall make available to Customer, upon reasonable request and subject to confidentiality obligations, information necessary to demonstrate compliance with data processing obligations. CiNKO shall allow and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, subject to reasonable advance notice and scope limitations.

7. Cross-Border Data Transfers

7.1 Transfer Mechanisms

CiNKO operates globally and Customer Data may be transferred to, stored in, or processed in jurisdictions outside of Customer's country of establishment. Such transfers may be necessary to provide the Services, comply with regulatory requirements, or engage subprocessors.

Where personal data is transferred to a jurisdiction that does not provide an adequate level of data protection, CiNKO shall implement appropriate safeguards, which may include:

• Standard contractual clauses approved by relevant regulatory authorities;
• Binding corporate rules (where applicable);
• Adequacy decisions by the relevant supervisory authority;
• Contractual obligations that provide equivalent protection; or
• Other mechanisms recognized under applicable data protection law.

7.2 Transfer Impact Assessments

CiNKO shall cooperate with Customer in conducting transfer impact assessments where required and shall implement supplementary measures as necessary to ensure appropriate protections for transferred data.

7.3 Jurisdictions

CiNKO's primary processing locations include The Bahamas, the United States, and other jurisdictions where our infrastructure providers and subprocessors operate. Details of specific jurisdictions for each subprocessor category are available upon request.

8. Data Retention

8.1 Retention Periods

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and enforce our agreements. Specific retention periods include:

Data Category	Retention Period	Basis
Customer account and business contact data	Duration of Agreement + 7 years	Contractual obligation, regulatory compliance
Transaction records	Minimum 5 years from transaction date	DARE Act, AML recordkeeping requirements
KYC/CDD documentation	Minimum 5 years after end of business relationship	DARE Act, AML recordkeeping requirements
API logs and technical data	12 months (rolling)	Operational, security, and debugging purposes
Webhook delivery logs	90 days (rolling)	Operational support and troubleshooting
Billing and invoicing records	Duration of Agreement + 7 years	Tax and financial recordkeeping
End User data (processed as processor)	As instructed by Customer, subject to legal minimums	Customer instructions, applicable law

8.2 Deletion and Return

Upon termination of the Agreement and expiration of the wind-down period, CiNKO shall, at Customer's election, return or securely delete End User personal data processed on Customer's behalf, except where retention is required by applicable law. CiNKO shall provide written confirmation of deletion upon request.

9. Blockchain Transactions

9.1 Immutability of Blockchain Data

Transactions executed on blockchain networks result in data being recorded on a decentralized, immutable ledger. This data may include wallet addresses, transaction amounts, timestamps, and transaction hashes. Once confirmed on a blockchain, this data cannot be modified, rectified, or deleted by CiNKO or any other party.

9.2 Implications for Data Subject Rights

The immutable nature of blockchain data may limit the exercise of certain data protection rights, including the right to erasure and rectification, with respect to on-chain data. CiNKO implements appropriate measures to minimize the personal data recorded on-chain and maintains off-chain records that can be modified in accordance with data subject requests.

10. Data Security

10.1 Security Program

CiNKO maintains a comprehensive information security program designed to protect the confidentiality, integrity, and availability of Customer Data and End User data. The program includes:

• Encryption of data in transit and at rest using industry-standard algorithms;
• Multi-party computation (MPC-CMP) key management via Fireblocks for digital asset custody;
• Segregated environments for production, staging, and development;
• Network segmentation, firewalls, and intrusion detection systems;
• Regular security assessments, including third-party penetration testing;
• Incident detection, response, and recovery procedures;
• Physical security controls at data center facilities (via infrastructure providers); and
• Security awareness training for all personnel.

10.2 Customer Responsibilities

Customer is responsible for maintaining the security of its own systems, API Credentials, and integration implementations. Customer shall:

• Protect API keys and secrets using industry-standard security practices;
• Implement secure webhook endpoints with signature verification;
• Use HTTPS for all API communications;
• Rotate credentials regularly and immediately upon suspected compromise; and
• Notify CiNKO promptly of any security incident that may affect the Platform.

11. Your Rights

11.1 Customer Rights

With respect to personal data for which CiNKO acts as a controller (e.g., Customer business contact information, account data), Customer's authorized representatives may:

• Access: Request confirmation of whether personal data is being processed and obtain a copy;
• Rectification: Request correction of inaccurate or incomplete personal data;
• Erasure: Request deletion of personal data, subject to legal retention obligations;
• Portability: Request a copy of personal data in a structured, machine-readable format;
• Restriction: Request restriction of processing in certain circumstances; and
• Objection: Object to processing based on legitimate interests.

11.2 End User Rights

End User data subject requests should be directed to Customer as the data controller. CiNKO shall assist Customer in responding to such requests in accordance with the DPA and applicable law. Where CiNKO receives a data subject request directly from an End User, CiNKO shall promptly redirect the request to Customer unless prohibited by law.

11.3 Exercising Rights

To exercise data protection rights, contact us at [email protected]. We will respond to requests within the timeframes required by applicable law.

12. Changes to This Policy

CiNKO may update this Policy from time to time to reflect changes in our practices, Services, or applicable law. We shall notify Customer of material changes at least thirty (30) days before they take effect, via email to Customer's designated contact or through the Platform dashboard. Continued use of the Services after the effective date of changes constitutes acceptance.

13. Contact Us

For questions, requests, or concerns regarding this Enterprise Privacy Policy or CiNKO's data processing practices, please contact:

Digital Finance (Bahamas) Ltd.
Operating as CiNKO
Email: [email protected]
General inquiries: [email protected]