Privacy Notice

Berpay > Privacy Notice

Overview

This Privacy Notice explains how Berpay Limited (“Berpay”, “we”, “us” or “our”) collects, uses, discloses, stores and protects personal information in connection with the Berpay mobile application and related services (the “Services”).

Berpay is a Bermuda-incorporated company operating in the Bermuda Monetary Authority’s regulatory sandbox under a Class T licence pursuant to the Digital Asset Business Act 2018 (as amended). We handle personal information in accordance with Bermuda’s Personal Information Protection Act 2016 (PIPA) and applicable regulatory expectations.

Who we are and how to contact us

    • Data controller: Berpay Limited.
    • Privacy contact (Data Protection Officer): The Compliance Officer acts as Berpay’s Data Protection Officer for the Class T period.
    • Email: support@berpay.io (Attention: Data Protection Officer).

Personal information we collect

We may collect the following categories of personal information:

    • Identity information: name, date of birth, nationality, residency details and similar identifiers.
    • Verification information: copies of identity documents, selfie/biometric verification outputs, and KYC/AML screening results.
    • Contact information: email address, telephone number and postal address.
    • Account information: username, device identifiers, authentication data, and account status.
    • Transaction information: wallet balances, transfers, merchant payments, deposit and withdrawal records, timestamps, blockchain transaction identifiers (for example transaction hashes), wallet addresses, and related metadata. Public blockchain data may be processed in connection with monitoring and reconciliation.
    • Technical and usage information: app interactions, log data, device/OS details, IP address and approximate location derived from IP (where available).
    • Communications: customer support messages, complaint records, and call or chat logs (where applicable).

How we collect personal information

    • Directly from you when you register, complete verification, use the Services, or contact support.
    • Automatically through the App and our systems when you access or use the Services (for example, log data and device identifiers).
    • From service providers used for identity verification, screening, digital asset infrastructure, transaction monitoring and blockchain analytics and from financial institutions involved in settlement flows (where applicable).
    • From public sources and databases where required for screening and due diligence (for example, sanctions lists and adverse media sources).

Purposes and legal bases for use

We use personal information only for purposes that are appropriate in the circumstances, including the following:

    • To provide, operate and improve the Services, including to create and administer your Account.
    • To verify your identity, conduct due diligence, and comply with AML/ATF and sanctions requirements.
    • To process transactions you initiate, and to prevent and detect fraud, security incidents and misuse.
    • To manage risk, conduct audits and monitoring, and maintain operational resilience.
    • To communicate with you, provide support, respond to enquiries and handle complaints.
    • To comply with legal obligations, regulatory requests, and reporting requirements.
    • With your consent (where required), to send service-related notices and, where applicable, marketing communications that you can opt out of.

Where PIPA requires consent, we will obtain it as required. In other cases, we may process personal information as necessary to perform a contract with you, to comply with legal obligations, or for legitimate business purposes consistent with PIPA.

Disclosures and third parties

We may disclose personal information to:

    • Service providers that help us operate the Services (including identity verification, screening providers, and digital asset infrastructure providers).
    • Blockchain analytics and compliance providers that support transaction monitoring and sanctions exposure screening for on-chain activity.
    • Travel Rule solution providers and counterparties (where applicable) to support compliance with information sharing requirements for qualifying transfers.
    • Banks, payment processors and other financial institutions supporting settlement flows (where applicable).
    • Professional advisers (including auditors, legal advisers, and consultants) subject to confidentiality obligations.
    • Regulators and competent authorities, including the Bermuda Monetary Authority, law enforcement agencies, and the Financial Sanctions Implementation Unit, where required or appropriate.
    • Other parties with your consent or at your direction.

We require service providers to implement appropriate safeguards, including confidentiality obligations, security measures, and restrictions on use of personal information.

International transfers

    • Some service providers and systems we use may be located outside Bermuda. Where personal information is transferred outside Bermuda, we take reasonable steps to ensure appropriate protections are in place, consistent with PIPA, including contractual safeguards and security controls.

Retention

    • We retain personal information for as long as necessary to provide the Services and to meet legal, regulatory, and business requirements. This may include retaining records for AML/ATF, sanctions compliance, audit, and dispute resolution purposes. When no longer required, information is securely deleted or anonymised.

Security

    • We maintain administrative, technical and physical safeguards designed to protect personal information against loss, misuse, unauthorised access, disclosure, alteration and destruction. Security measures include access controls, encryption where appropriate, monitoring, incident response procedures, and vendor oversight.

Your rights and choices

    • Subject to applicable law, you may have the right to request access to, correction of, or information about your personal information we hold. You may also withdraw consent where processing is based on consent (subject to legal restrictions).
    • To make a request, contact us at support@berpay.io (Attention: Data Protection Officer). We may need to verify your identity before responding.
    • If you have concerns about our privacy practices, you may also raise them with the Office of the Privacy Commissioner in Bermuda.

Children

    • The Services are not intended for individuals under 18. We do not knowingly collect personal information from children under 18.

Updates to this Privacy Notice

    • We may update this Privacy Notice from time to time. We will provide notice of material updates through the App or by other reasonable means.

 

Updated August 26, 2026