Privacy Policy

1. Introduction

Dune Payments Limited ("Dune Payments," "we," "us," or "our") is the company that operates Payvora ("Payvora" or the "Service"). Payvora is a digital financial platform offering multi-currency wallets, virtual card infrastructure, international cross-border transfers, and AI-assisted financial insights.

This Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard your personal information when you access or use the Payvora website, mobile application, and related services (collectively, the "Services"). By using the Services, you consent to the practices described in this Policy.

Dune Payments Limited is a financial technology company. Banking and payment services are provided by our licensed partner institutions. Where a partner processes your data, they do so under their own privacy policies, which are referenced where applicable.

2. Data Controller

Dune Payments Limited is the data controller responsible for your personal data in connection with the Payvora Services. If you have questions about how we handle your data, you may contact us at info@payvora.net.

3. Information We Collect

We collect information in the following categories:

3.1 Information You Provide

• Identity information: Full legal name, date of birth, nationality, and government-issued identification details.
• Contact information: Email address, phone number, and residential address.
• Financial information: Bank account details, IBAN, routing numbers, beneficiary details, and wallet preferences.
• Business information: Company registration details, beneficial ownership, and business activity descriptions (for business customers).
• Account preferences: Currency selections, card customisation, notification settings, and auto-payout configurations.

3.2 Information Collected Automatically

• Device and technical data: IP address, browser type, operating system, device identifiers, and time zone.
• Usage data: Pages visited, features used, transaction history metadata, and interaction logs.
• Location data: Approximate location derived from IP address (we do not collect precise GPS location unless you explicitly grant permission).

3.3 Information from Third Parties

• KYC/AML providers: Identity verification results from our compliance partners.
• Banking partners: Account verification and transaction status updates.
• Payment networks: Card network data (Visa, Mastercard) for card issuance and transaction processing.

4. How We Use Your Information

We process your personal information for the following purposes:

• Service delivery: Creating and managing your account, processing transfers, issuing virtual cards, and maintaining wallet balances.
• Compliance: Performing Know Your Customer (KYC), Anti-Money Laundering (AML), and Counter-Terrorism Financing (CTF) checks as required by law and our regulators.
• Transaction processing: Executing deposits, withdrawals, currency conversions, and cross-border transfers through our partner network.
• Security and fraud prevention: Monitoring transactions for suspicious activity, verifying identity, and protecting against unauthorised access.
• AI-powered insights: Generating spending categorisations, transfer recommendations, and financial insights. AI processing is based on your transaction data and does not share your personal information with third-party AI providers beyond what is necessary to deliver the feature.
• Customer support: Responding to inquiries, resolving disputes, and providing assistance.
• Communications: Sending service notifications, security alerts, and (with your consent) product updates.
• Legal obligations: Meeting record-keeping, reporting, and regulatory requirements.

5. Legal Basis for Processing

Where the General Data Protection Regulation (GDPR) applies, we process your personal data on the following legal bases:

• Contractual necessity: To provide the Services you have requested, including account opening and transaction processing.
• Legal obligation: To comply with KYC, AML, tax reporting, and other regulatory requirements.
• Legitimate interests: To prevent fraud, improve our Services, and conduct security monitoring.
• Consent: For optional features such as marketing communications and certain AI insights.

6. How We Share Your Information

We do not sell your personal information. We may share data with:

• Banking and payment partners: Licensed institutions that hold your funds, process transfers, and issue cards.
• Compliance partners: Identity verification and screening services for KYC/AML purposes.
• Payment networks: Visa, Mastercard, and other card networks for card transactions.
• Service providers: Cloud hosting, analytics, and communication providers, under data processing agreements.
• Regulatory authorities: When required by law, court order, or regulatory request.
• Professional advisors: Legal, accounting, and audit firms under confidentiality obligations.

In the event of a merger, acquisition, or asset sale, your data may be transferred subject to this Policy and applicable law.

7. International Data Transfers

Because Payvora is a global platform, your personal information may be transferred to and processed in countries other than your country of residence. Where this involves a transfer outside the European Economic Area or the United Kingdom, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent legal mechanisms.

8. Data Retention

We retain your personal information for as long as your account is active and for a period thereafter as required by law or to meet regulatory, accounting, or reporting obligations. Financial transaction records are typically retained for a minimum of five (5) to seven (7) years, depending on applicable jurisdiction. Data that is no longer needed is deleted or anonymised.

9. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Multi-factor authentication (MFA) for account access.
• Tokenisation of sensitive card data — full card numbers are never stored in plain text.
• Safeguarding or equivalent protections applied by regulated financial partners where required for the relevant product and jurisdiction.
• Continuous monitoring and audit logging of access and transactions.
• Strict access controls based on the principle of least privilege.

Despite these measures, no system can be guaranteed to be 100% secure. We will notify you and the relevant authorities of any data breach in accordance with applicable law.

10. Your Data Protection Rights

Subject to applicable law, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data, subject to legal retention obligations.
• Restriction: Request that we limit processing of your data under certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Withdraw consent for processing that relies on your consent, at any time.

To exercise any of these rights, contact us at info@payvora.net. We will respond within the timeframe required by applicable law (typically 30 days). If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to operate, secure, and improve the Services. Categories include essential cookies (required for core functionality), analytics cookies (to understand usage patterns), and preference cookies (to remember your settings). You can manage cookie preferences through your browser settings. See our Cookie Policy for details.

12. AI-Assisted Features

Payvora uses artificial intelligence to provide features such as automatic transaction categorisation, spending insights, and transfer routing recommendations. These features process your transaction data to generate contextual suggestions. AI suggestions are advisory only — you always retain the final decision on any financial action. We do not use your personal data to train third-party models without your consent.

13. Children's Privacy

The Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, please contact us immediately at info@payvora.net.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated Policy on this page and, where appropriate, by email or in-app notification. The "Last Updated" date above indicates when the Policy was last revised.

15. Contact Us