Legal
Privacy Policy
1. Data we collect
- Identity and contact. Name, date of birth, nationality, government identity document, likeness image, address, email, and mobile number.
- Account and device. Sign-in events, device identifiers, app version, IP address, and the language you choose.
- Financial activity. Account balances, deposit and withdrawal details, conversions, Visa authorisations, fees, and the software partner that sent an instruction.
- Business records. Company details, ownership and control, and the identity of authorised users and cardholders.
- Compliance. Screening results, source-of-funds information, documents you upload, and records of alerts and decisions.
- Support. Messages you send us and our replies.
We do not ask you to send a government identity document by ordinary email. Use the upload flow in the app.
2. How we use it
- to open and run your account and to provide storage, deposits, withdrawals, conversion, and Visa spend;
- to identify you and to meet anti-money laundering, counter-terrorist financing, and sanctions duties described in the AML Policy;
- to prevent fraud, to authorise or decline a card payment, and to investigate disputes;
- to tell you about a transaction, a hold, or a change to the User Agreement;
- to improve the reliability of the app, using aggregated or limited operational data;
- to answer a regulator, a court, a card network, or a law-enforcement authority when the law requires it.
We do not sell personal data. We do not use it to train a public model.
3. Legal bases
Where a data-protection law such as the GDPR applies, we rely on: performance of the contract with you; compliance with a legal obligation, especially financial-crime law; our legitimate interests in preventing fraud and keeping the service secure, where those interests are not overridden by your rights; and consent where we ask for it separately, which you may withdraw without affecting a use that rests on another basis.
4. Who we share it with
- the regulated partner that issues your Visa card, safeguards a balance, or executes a deposit, withdrawal, or conversion, and an approved software partner acting on your instruction, to the extent they need the data to do that work and to meet their own legal duties;
- identity, sanctions, and fraud screening providers;
- card networks, and merchants or ATM operators as part of an authorisation you initiate;
- infrastructure vendors who host the app under contract and may not use the data for their own purposes;
- professional advisers, and a buyer of the business if one is proposed, under confidentiality;
- authorities and other financial institutions where the law, a court order, or a financial-crime report requires disclosure.
5. International transfers
Partners and vendors can be in a country other than yours. Where the law requires a safeguard for that transfer, we use a mechanism the law recognises, such as a contractual clause, or we transfer because the payment you asked for cannot be completed otherwise. The card issuer and the payout institution named in the app are the places a given payment is processed.
6. Retention
We keep personal data for as long as the account is open and for at least five years after it closes or after a transaction, where anti-money laundering law requires that period. Some records are kept longer if a dispute, a report, or a legal hold is open. When the period ends, we delete the data or irreversibly anonymise it, unless a further legal duty applies.
7. Security
We use encryption in transit, access controls, multi-factor authentication for customer sign-in, and logging of administrative access. No method of transmission or storage is perfectly secure. You must protect your device and your credentials. Tell us at service@locopay.com if you believe your account has been accessed without authority.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to complain to a data-protection authority. A request to delete data does not override a duty to keep records for financial-crime law. We will explain a refusal. Send requests to service@locopay.com. We may need to verify your identity before we act.
9. Children
The services are not for anyone under 18. We do not knowingly open an account for a child. If we learn that we have done so, we will close it, subject to any record we must keep.
10. Changes
We will post changes on this page and change the date above. A material change is also notified in the app or by email where the law requires it.