Privacy Policy for BorderPay Velocity

BorderPay Africa, Inc. ("BorderPay," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our mobile app, website (borderpayafrica.com), and related services (collectively, the "Services"). BorderPay Africa, Inc. is a corporation incorporated under the laws of the State of Delaware, United States, with its principal place of business at 1111 B South Governors Avenue 39961, Dover, DE 19904, United States.

BorderPay Africa, Inc. provides global B2B payment and treasury infrastructure in supported jurisdictions. Eligible products include USD, EUR and GBP account rails plus USDC, USDT and EURC wallets. Identity and business verification may require valid government-issued and corporate documents.

This Privacy Policy complies with:

• Delaware: The Delaware Personal Data Privacy Act (DPDPA, effective January 1, 2025), which requires controllers to limit data collection to what is adequate, relevant, and necessary; conduct data protection assessments for high-risk processing (e.g., targeted advertising or sensitive data); and provide rights to access, correct, delete, and opt-out of data sales/profiling.
• African Data Protection Frameworks: We comply with applicable local regulations across Africa, including Nigeria's data-protection framework, South Africa's POPIA, Kenya's Data Protection Act 2019, Ghana's Data Protection Act 2012, and other relevant requirements. Eligible products include USD, EUR and GBP account rails and USDC, USDT and EURC wallets through regulated financial infrastructure.
• Global Banking Standards: We adhere to financial services regulations including AML/CFT requirements, KYC standards, and cross-border payment regulations across our operating jurisdictions.

By using the Services, you consent to this Policy. We may update it; continued use constitutes acceptance.

We collect personal data to provide and improve our Services (e.g., cross-border payments, multi-currency wallets, and planned card access when available). Categories include:

BorderPay onboarding is for Business accounts only. This Policy also covers directors, beneficial owners, authorised representatives, team members and personal information retained from previously provided services. We do not onboard consumer accounts.

We collect this directly from you or your authorized partner (e.g., registration forms), automatically (e.g., logs), or from regulated financial infrastructure for planned card access, banking, stablecoin settlement, and identity or business verification processing. We limit collection to what is adequate, relevant, and necessary under applicable data protection laws. Eligibility is subject to supported jurisdictions and compliance policy. The Services are not offered to children under 18.

We process data for legitimate purposes under Delaware and African data protection laws (e.g., contract performance, legal obligation, consent):

• Provide Services (e.g., account top-ups, planned card access when available, payments, bank transfers, eligible African local-bank and mobile-money routes where available, and stablecoin transactions through regulated financial infrastructure).
• Verify identity (KYC/AML compliance through regulated verification infrastructure).
• Evaluate job applications, communicate with candidates, administer recruitment, and maintain necessary hiring records.
• Process transactions including ACH, wire, SEPA and Faster Payments for eligible USD, EUR and GBP account rails, and supported USDC, USDT and EURC transfers.
• Improve Services (analytics, fraud detection).
• Communicate (marketing with consent).
• Legal compliance (e.g., reporting suspicious activity to African financial authorities).

For high-risk processing (e.g., profiling for fraud), we conduct data protection impact assessments (DPIAs) per DPDPA and African data protection standards. We use data protection by design/default (e.g., encryption, access controls).

We share data only as necessary:

• Service Providers: Regulated financial infrastructure for accounts, planned cards when available and stablecoin settlement, identity verification providers, regulated banking infrastructure, cloud hosts (e.g., AWS), analytics tools (with data protection agreements).
• Affiliates: Within BorderPay Group for operations.
• Legal/Regulatory: To African financial authorities for AML/CFT reporting or in response to subpoenas (Delaware law).
• Business Transfers: In mergers (with notice).

No sales of personal data (DPDPA opt-out right). Data transfers comply with applicable African and Delaware data protection laws. No sharing with third parties for marketing without consent.

Under DPDPA and African data protection laws, you have rights (exercisable via \n privacy@borderpayvelocity.xyz):

• Access: Request confirmation and copy of your data.
• Rectification: Correct inaccuracies in your personal information.
• Erasure: Delete data when no longer needed (subject to legal retention requirements).
• Restriction: Limit processing during disputes or verification.
• Portability: Receive data in structured format for transfer to another service.
• Objection: Oppose processing for marketing/profiling purposes.
• Opt-Out: Of sales/targeted ads (DPDPA); withdraw consent anytime (no effect on prior processing).

We respond within 45 days (extendable 45 days with notice). Appeals: Contact DPO at dpo@borderpayvelocity.xyz. You may revoke consent for account access anytime. No automated decisions with legal effects without human review.

We use technical/organizational measures (e.g., TLS 1.3 encryption, access controls, regular audits) to protect data (DPDPA and African data protection standards). Breaches reported within 72 hours to relevant African data protection authorities and affected users (if high risk).

Retention: As long as needed for purposes (e.g., 7 years for financial records per African AML laws), then securely deleted/anonymized.

We use cookies for functionality (essential), analytics (Google Analytics, consent-based), and advertising (targeted, opt-out via settings). See our Cookie Policy for details. Consent banners comply with applicable data protection laws.

Services not for children under 18. If collected inadvertently, deleted upon notice (DPDPA and African data protection laws).

Data is processed in the US (Delaware) for our incorporated entity and across our global operating regions through regulated banking, stablecoin, and payment infrastructure. Cross-border transfers comply with applicable data protection laws in each jurisdiction.

For questions: privacy@borderpayvelocity.xyz

DPO: dpo@borderpayvelocity.xyz

Complaints: You may file complaints with your country's data protection authority:

• 🇳🇬 Nigeria: National Information Technology Development Agency (NITDA)
• 🇿🇦 South Africa: Information Regulator (inforegulator.org.za)
• 🇰🇪 Kenya: Office of the Data Protection Commissioner (odpc.go.ke)
• 🇬🇭 Ghana: Data Protection Commission (dataprotection.org.gh)
• Or your respective country's data protection authority