Privacy Policy

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

mbo.finance Ltd
Company Number: [COMPANY NUMBER]
Registered Address: [REGISTERED ADDRESS]
United Kingdom
Email: privacy@mbo.finance

As a data controller, mbo.finance Ltd determines the purposes and means of processing your personal data. Where we process data on behalf of regulatory or law enforcement authorities, we may act as a data processor.

We are registered with the Information Commissioner's Office (ICO) in the United Kingdom under registration number [ICO REGISTRATION NUMBER].

2. Personal Data We Collect

We collect personal data from you in the following categories:

2.1 Identity Data

• Full legal name
• Date of birth
• Nationality
• Government-issued identification documents (passport, driving licence, national ID card)
• Photographs and selfies submitted for identity verification
• Tax identification numbers where required by law

2.2 Contact Data

• Email address
• Telephone number
• Residential address
• Proof of address documents

2.3 Financial Data

• Account balances and transaction history
• Bank account details provided for withdrawals
• Source of funds and source of wealth information
• Cryptocurrency wallet addresses
• Payment card details (where applicable)

2.4 Technical Data

• IP address and geolocation data
• Browser type and version
• Device type, operating system, and device identifiers
• Login history and session data
• Platform usage data and clickstream data

2.5 Communications Data

• Correspondence with our support team
• Responses to surveys or feedback requests
• Records of consent given

2.6 Special Categories of Data

In certain circumstances, we may process special categories of personal data as defined under applicable data protection law, such as biometric data used for identity verification. We will only process such data where we have a specific legal basis to do so, and we implement enhanced safeguards for its protection.

3. How We Use Your Personal Data

Purpose	Data Used	Legal Basis
Creating and managing your account	Identity, contact	Contract performance
Identity verification (KYC)	Identity, contact, documents	Legal obligation
Processing transactions	Identity, financial	Contract performance
AML/CTF screening and monitoring	Identity, financial, technical	Legal obligation
Fraud prevention and security	Identity, technical	Legitimate interests
Customer support	Identity, contact, communications	Contract performance
Regulatory reporting	Identity, financial	Legal obligation
Service improvement and analytics	Technical, usage	Legitimate interests
Marketing communications	Contact	Consent
Legal claims and disputes	All categories as relevant	Legitimate interests / legal obligation

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR and equivalent legislation:

• Contract performance: Processing necessary to provide the services you have requested, including account management, transaction processing, and customer support.
• Legal obligation: Processing required to comply with AML/CTF regulations, tax reporting obligations, sanctions screening, regulatory reporting, and other applicable laws.
• Legitimate interests: Processing where we have a legitimate business interest, such as fraud prevention, security monitoring, and platform improvement, provided this does not override your rights and freedoms.
• Consent: Processing for marketing communications, where you have given explicit consent. You may withdraw consent at any time by contacting privacy@mbo.finance or using the unsubscribe link in our emails.
• Vital interests: In limited circumstances, processing to protect your vital interests or those of another person.

5. Who We Share Your Data With

We share your personal data only where necessary and with appropriate safeguards in place. Recipients include:

5.1 Service Providers

Third-party companies that provide services on our behalf, including:

• Identity verification providers (KYC/AML technology partners)
• Cloud hosting and infrastructure providers
• Email and communication service providers
• Payment processing partners and banking partners
• Card issuers and card network operators (Mastercard)
• Fraud detection and security providers
• Analytics providers

All service providers are contractually bound to process data only on our instructions and to maintain appropriate security measures.

5.2 Regulatory and Law Enforcement Authorities

We are legally obligated to share data with:

• Financial intelligence units (National Crime Agency in the UK, FINTRAC in Canada, AUSTRAC in Australia, etc.)
• Tax authorities (HMRC in the UK, CRA in Canada, ATO in Australia, etc.)
• Financial regulators (FCA, BaFin, Finansinspektionen, etc.)
• Law enforcement agencies pursuant to valid legal process
• Sanctions screening bodies

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections outlined in this policy.

5.4 Professional Advisers

Lawyers, accountants, auditors, and other professional advisers where necessary for the conduct of our business, subject to professional confidentiality obligations.

We do not sell your personal data to third parties for commercial purposes.

6. International Data Transfers

As a platform serving users in multiple countries, your personal data may be transferred to and processed in countries outside your country of residence, including countries outside the United Kingdom and European Economic Area (EEA).

Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• Adequacy decisions issued by the UK Government or European Commission.
• Standard Contractual Clauses (SCCs) approved by the relevant authority.
• Binding Corporate Rules where applicable.
• Other mechanisms permitted under applicable data protection law.

You may request details of the specific safeguards we have in place for international data transfers by contacting privacy@mbo.finance.

7. How Long We Keep Your Data

Data Category	Retention Period	Reason
Account and identity data	5 years after account closure	AML/CTF legal obligations (UK: MLR 2017)
Transaction records	5 years after account closure	AML/CTF legal obligations
KYC documents	5 years after account closure	AML/CTF legal obligations
Communications / support records	3 years after last contact	Legitimate interests / legal claims
Marketing consent records	Until withdrawn + 3 years	Proof of consent
Technical / log data	12 months	Security monitoring
Cookie data	Up to 12 months	See Cookie Policy below

Retention periods may be extended where required by applicable law, ongoing investigations, or legal proceedings. Where data is no longer required, it is securely deleted or anonymised.

Canada (PIPEDA): Personal data is retained only as long as necessary to fulfil the stated purposes and legal obligations, after which it is destroyed, erased, or anonymised.

Australia (Privacy Act): We take reasonable steps to destroy or de-identify personal data when it is no longer needed for any purpose for which it may be used or disclosed.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our platform. Our use of cookies is limited to:

Cookie Type	Purpose	Duration
Essential / Session	Maintaining your login session, security, preventing fraud	Session / Up to 24 hours
Preference	Remembering your cookie consent choice	12 months
Analytics	Understanding how users interact with our platform (anonymised)	Up to 12 months

We do not use advertising or tracking cookies. We do not share cookie data with advertising networks.

You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of our platform. You may withdraw your consent to non-essential cookies at any time by clearing your browser cookies.

9. Your Privacy Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@mbo.finance. We will respond within one month (extendable by two further months for complex requests). We may need to verify your identity before fulfilling a request.

Please note that some rights are subject to exceptions, particularly where we are required to retain data for legal or regulatory reasons.

10. Children's Privacy

mbo.finance does not knowingly collect personal data from individuals under the age of 18. Our services are not directed at children. If you believe we have inadvertently collected personal data from a child, please contact us immediately at privacy@mbo.finance and we will take steps to delete that information.

11. Security

We implement technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• 256-bit SSL/TLS encryption for all data in transit.
• Encryption of sensitive data at rest.
• Two-factor authentication for account access.
• Access controls limiting data access to authorised personnel only.
• Regular security assessments and penetration testing.
• Secure session management with automatic timeout.
• Monitoring and logging of access to personal data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach and, where required, notify affected individuals without undue delay.

12. Jurisdiction-Specific Privacy Rights

United Kingdom (UK GDPR)

UK users have the rights described in Section 9 above under the UK General Data Protection Regulation and the Data Protection Act 2018. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Sweden (GDPR + Swedish DPA)

Swedish users have rights under the EU General Data Protection Regulation (GDPR) and Swedish data protection legislation. Complaints may be lodged with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

Norway (GDPR + Norwegian DPA)

Norwegian users have rights under the EEA-applicable GDPR and Norwegian Personal Data Act (Personopplysningsloven). Complaints may be lodged with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

Germany (GDPR + BDSG)

German users have rights under the EU GDPR and the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Complaints may be lodged with the relevant State Data Protection Authority (Landesbeauftragte für Datenschutz) or the Federal Commissioner for Data Protection and Freedom of Information (BfDI) at bfdi.bund.de.

Canada (PIPEDA)

Canadian users have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation. You have the right to access your personal information and challenge its accuracy. Complaints may be lodged with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

We have designated a Privacy Officer responsible for compliance with PIPEDA obligations. Contact our Privacy Officer at privacy@mbo.finance.

Australia (Privacy Act 1988)

Australian users have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You have the right to access and correct your personal information. Complaints may be lodged with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

New Zealand (Privacy Act 2020)

New Zealand users have rights under the Privacy Act 2020 and the Information Privacy Principles (IPPs). You have the right to access and correct your personal information. Complaints may be lodged with the Privacy Commissioner at privacy.org.nz.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send a notification to your registered email address where the changes are significant.
• Display a prominent notice on our platform.

We encourage you to review this Privacy Policy periodically. Your continued use of mbo.finance after any changes constitutes acceptance of the updated policy.

14. Contact Us and How to Complain

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a complaint about how we handle your personal data, please contact our Data Protection team:

Method	Details
Email (preferred)	privacy@mbo.finance
General support	support@mbo.finance
Post	Data Protection Officer, mbo.finance Ltd, [Registered Address], United Kingdom

We will respond to all privacy-related requests within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction (see Section 12).