What information we collect, why we collect it, and how it is used.
Last Updated: 27-Oct-2026
Your privacy is important to us, and this Privacy Policy is meant to help you understand what information we collect, why we collect it, and how it is used.
Note: GlobalFinex B2B may act as either a Data Controller (determines the purposes and means of processing) or a Data Processor (processes data only on the Customer's instructions). The role is determined on a per-service basis.
This Privacy Policy applies to all visitors and users ("you") of GlobalFinex B2B ("we," "our," "us").
If you are a business that has contracted with us, this policy governs the processing of personal data you provide to us or to us via your employees, agents, or authorized third-party partners ("end-users").
By using our Services, you give specific, informed consent for each purpose listed in the tables below.
If you do not agree with any part of this policy, you may refuse to use our Services and may withdraw consent at any time (see "Your Rights").
GlobalFinex B2B provides a number of Services to help connect businesses and streamline their processes. These Services include, but are not limited to:
| Term | Definition | GDPR reference | Quick Example |
|---|---|---|---|
| Personal Data | Any information that can identify an individual either directly or indirectly (e.g., name, email, unique identifier). | GDPR Article 4(1) | Email address, phone number |
| Sensitive Personal Data | Personal data likely to cause harm or discrimination if mishandled; also known as "special categories." | GDPR Article 4(13)(14)(15) | Race, religion, health data, biometric data |
| Data Controller | The entity that determines the purpose and means of processing personal data. | GDPR Article 4(7) | GlobalFinex B2B |
| Data Processor | The entity that processes personal data on behalf of the data controller. | GDPR Article 4(8) | Payment-gateway provider |
| Data Subject | The natural person whose personal data is being processed. | GDPR Article 4(1) | Buyer or supplier contact |
| Third-Party Service Provider | External entity receiving personal data for specific services (hosting, analytics, etc.). | GDPR Article 4(10) | Cloud host, email-marketing platform |
| Processing | Any operation performed on personal data, automated or manual. | GDPR Article 4(8) | Storing records, sending payroll emails |
GDPR article: gdpr-info.eu/art-4-gdpr/
Information provided to us
Information we collect when you use our Services
| Purpose | Legal Basis / Quick Example |
|---|---|
| Transaction & Payment Processing | Contractual / Consent (VCN, EFT) |
| KYC / AML Verification | Consent (special category) |
| Marketing / Promotional Offers | Legitimate interest / Consent |
| Service Provider Communications | Legitimate interest |
| Sharing with Trading Partners | Contractual |
| Regulatory Reporting (AML, tax) | Lawful obligation |
| Security & Fraud Prevention | Legitimate interest |
If you have consented to a specific purpose, you may change your mind at any time; this does not affect already-processed data.
Information Storage & Retention
| Data Type | Minimum Retention | Legal / Regulatory Retention | Deletion Method |
|---|---|---|---|
| Personal Data (name, email, phone) | 6 months | 12 months | Secure deletion (AES wipe, key destruction) |
| Payment Information (VCN, bank details) | 12 months | 12 months | Secure deletion |
| KYC/AML Documents | 7 years | 7 years | Secure deletion (destroy all copies, keys, backups) |
| Technical Data (IP, device ID) | 12 months | 12 months | Secure deletion |
Upon request, or at the end of the retention period, data is securely deleted (e.g., encryption keys destroyed).
Security of Your Information
Breach Notification
International Transfer of Information
For EU personal data transferred outside the EU, we use Standard Contractual Clauses (SCCs) and maintain a documented Transfer Impact Assessment (TIA). Servers are located worldwide; data is protected at the same level as within the EU.
Your Rights
How to Exercise These Rights
Requests can be made via email address in the Contact Us section below.
Our Services are primarily provided to organisations, which then make the Services available to you. The contracting organisation is the administrator and is responsible for end-user privacy controls; contact them for any specific privacy questions.
We may update this Privacy Policy from time to time. For material changes, we provide a prominent banner within the Service and send an email to users who have opted in to receive updates at least 14 days before the change. "Material change" includes new services or data uses that differ from the original consent agreement.