Privacy Policy

This Privacy Policy explains how $PeerMarkt("Company," "we," "us") collects, uses, stores, and shares personal data when you use our Platform. This Policy applies globally and is designed to comply with the EU General Data Protection Regulation (GDPR), UK GDPR, Nigeria Data Protection Regulation (NDPR 2019 / NDPA 2023), South Africa Protection of Personal Information Act (POPIA), Morocco Law 09-08 (CNDP), Kenya Data Protection Act 2019, and the California Consumer Privacy Act (CCPA/CPRA).

We process your personal data under the following legal bases:

• Contract performance (GDPR Art. 6(1)(b)) — account operation, trade execution, fee processing
• Legal obligation (GDPR Art. 6(1)(c)) — KYC, AML compliance, sanctions screening, tax reporting, record retention
• Legitimate interests (GDPR Art. 6(1)(f)) — fraud prevention, platform security, service improvement
• Consent (GDPR Art. 6(1)(a)) — marketing communications, optional enhanced features (withdrawable)

After applicable retention periods, data is securely deleted using NIST 800-88 guidelines or irreversibly anonymized. Anonymized data may be retained indefinitely for analytical purposes.

For transfers of personal data outside the originating jurisdiction:

• EU/EEA to third countries: Standard Contractual Clauses (SCCs) — Commission Decision 2021/914
• UK transfers: International Data Transfer Agreements (IDTA)
• Nigeria (NDPR): Personal data transferred abroad only where the receiving country has adequate protections or Nigerian Data Protection Commission (NDPC) approved mechanisms are in place
• South Africa (POPIA): Cross-border transfers only to countries providing comparable protection per POPIA Section 72, or subject to binding contractual obligations
• Morocco (CNDP / Law 09-08): Cross-border transfers require prior authorization from CNDP or be to a country with equivalent protection. Sensitive KYC data is stored on servers within Morocco or the EU where feasible
• Kenya: Transfers comply with Data Protection (General) Regulations 2021 requirements

Response timeframe: 30 days from receipt of request (extendable by 60 days for complex requests). Supervisory authority complaints: EU (national DPA), UK (ICO ico.org.uk), Nigeria (NDPC), South Africa (Information Regulator), Morocco (CNDP), Kenya (ODPC).

• AES-256 encryption for sensitive data at rest including KYC documents and PII fields
• TLS 1.3 for all data in transit
• Role-based access controls — minimum necessary access principle
• Multi-factor authentication required for all staff accessing personal data
• Regular penetration testing and security assessments
• Incident response plan — breaches notified to supervisory authority within 72 hours (GDPR) / 72 hours (NDPR) / as required by applicable law
• Staff data protection training — annual, mandatory

California residents have additional rights under CCPA/CPRA:

• Right to Know: What personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion (subject to legal retention obligations)
• Right to Correct: Correct inaccurate personal information
• Right to Non-Discrimination: We will not discriminate for exercising CCPA rights
• Right to Limit Sensitive PI Use: We use sensitive personal information only for AML compliance — not for inferring characteristics

To exercise California rights, contact privacy@peermarkt.com. We verify identity before processing requests. Response within 45 days (extendable by 45 days).

The Platform is not directed to children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact privacy@peermarkt.com and we will promptly delete it.

We notify you of material changes via email 30 days before the effective date. For minor changes, we update the "Last Updated" date and post notice on the Platform. Continued use after the effective date constitutes acceptance of the revised Policy.