This Privacy Policy explains how SendNOW collects, uses, discloses, stores, and protects personal data when users access the SendNOW website, mobile application, products, and related services. SendNOW is a technology platform. Payment and remittance services may be provided by regulated third-party partners. This Policy should be read together with any applicable service terms, AML/KYC notices, cookie notices, and other notices provided at the time personal data is collected. For purposes of this Policy, “personal data” means any information relating to an identified or identifiable person. “Verification Data” means personal data collected or generated for identity verification, anti-money laundering, fraud prevention, sanctions screening, regulatory compliance, or account-security checks. Verification Data may include selfie images, identity document images, face data, facial biometrics, liveness checks, and related verification results.

We may collect personal data directly from you, from your device, from service providers, from regulated payment/remittance partners, from identity verification providers, and from publicly available or legally permitted sources. Account and contact data: name, email address, phone number, username, password or authentication credentials, country of residence, address, date of birth, nationality, and other account registration information. Transaction and service data: transaction amounts, currencies, beneficiaries/recipients, payment methods, bank or wallet information, transaction references, source-of-funds or source-of-wealth information where required, and customer-support communications. Device and technical data: IP address, device identifiers, browser type, operating system, app version, logs, approximate location, language settings, cookie identifiers, and security telemetry. KYC and Verification Data: government-issued identity documents, document photographs, document metadata, selfie images, video selfies or liveness captures, facial images, facial biometrics / face data, similarity scores, liveness results, verification status, fraud-risk indicators, sanctions/PEP screening results, and records of compliance decisions. Biometric / Face Data: where required for identity verification, fraud prevention, security, or legal compliance, we or our verification provider may process selfie images and facial biometrics / face data to compare your face with the photo on your identity document and to confirm liveness. This processing is limited to verification, security, compliance, and fraud-prevention purposes described in this Policy.

We use personal data to provide, operate, maintain, improve, and secure our services; create and manage accounts; process service requests; communicate with users; provide customer support; comply with applicable laws; and enforce our terms and policies. KYC Verification: we use Verification Data, including selfie images and facial biometrics / face data where necessary, to verify identity, conduct liveness checks, detect forged or manipulated documents, prevent impersonation and fraud, comply with AML/KYC requirements, and satisfy obligations imposed by regulated partners and applicable law. Security and fraud prevention: we may use personal data and Verification Data to detect, prevent, investigate, and respond to fraud, misuse, account takeover, suspicious activity, sanctions evasion, unlawful conduct, and security incidents. No advertising use of biometric data: SendNOW does not use selfie images, facial biometrics, face data, biometric identifiers, biometric templates, liveness results, or biometric verification results for advertising, marketing profiling, ad targeting, or cross-context behavioural advertising. No sale of biometric data: SendNOW does not sell, rent, trade, or otherwise monetise selfie images, facial biometrics, face data, biometric identifiers, biometric templates, liveness results, or biometric verification results. We do not disclose such data in exchange for money or other valuable consideration, except where disclosure to service providers or regulated partners is necessary for the limited purposes described in this Policy and subject to appropriate contractual protections.

SendNOW may use third-party identity verification providers, including Sumsub (means Sum and Substance Ltd (UK) Data Protection Registration Number: ZA222205. Company Registration Number: 09688671. Address: 30 St. Mary Axe, London, England, EC3A 8BF), to perform identity verification, document checks, facial matching, liveness detection, fraud checks, sanctions screening, and related compliance workflows. When you complete KYC verification, you may be asked to upload or capture identity documents and selfie images. Sumsub may process these materials, including facial biometrics / face data, to compare your selfie image with your identity document photo, verify liveness, detect fraud, and return verification results to SendNOW. Sumsub acts as a third-party verification provider and processes Verification Data in accordance with its contract with SendNOW and applicable data protection laws. Depending on the specific workflow and applicable law, Sumsub may act as a processor/service provider or as an independent controller for limited compliance purposes. Where Sumsub is engaged as a processor/service provider, it may process Verification Data only on documented instructions and for the purposes set out in this Policy and the applicable agreement. SendNOW may receive verification results, status updates, risk signals, fraud indicators, extracted identity document data, audit logs, and other compliance information from Sumsub. SendNOW uses this information to decide whether to approve, restrict, review, or reject access to services, subject to any rights available under applicable law.

Where applicable data protection law requires a legal basis, we process personal data under one or more of the following bases: performance of a contract, compliance with legal obligations, legitimate interests, consent where required, and protection of vital interests where relevant. For KYC Verification and Verification Data, our legal bases may include compliance with AML/KYC, sanctions, fraud-prevention, financial-services, and regulatory obligations; legitimate interests in preventing fraud and securing the platform; and consent where specific laws require consent for processing selfie images, facial biometrics, or face data. Where consent is required for processing biometric / face data, we will request consent before collecting or processing such data. Refusal or withdrawal of consent may prevent completion of identity verification and may affect access to services where verification is required by law, regulated partners, or risk controls.

We may share personal data with service providers, verification providers, regulated payment/remittance partners, banks, payment processors, cloud hosting providers, analytics providers, customer-support vendors, fraud-prevention partners, professional advisers, and public authorities where necessary and lawful. KYC and biometric-related data may be shared with Sumsub and other verification, fraud-prevention, AML, sanctions-screening, or compliance providers solely for identity verification, liveness detection, fraud prevention, security, regulatory compliance, audit, and related support purposes. We may disclose personal data when required by law, subpoena, court order, regulatory request, law enforcement request, sanctions or AML obligation, or to protect rights, safety, security, and the integrity of our services. No sale of biometric data: SendNOW does not sell biometric data, selfie images, facial biometrics / face data, or biometric verification outputs. Service-provider sharing is not a sale where it is necessary to provide identity verification, fraud-prevention, security, compliance, or support services on SendNOW’s behalf and is governed by appropriate contractual restrictions. No advertising use: we do not disclose biometric data, selfie images, facial biometrics / face data, or biometric verification outputs to advertising networks, data brokers, or marketing partners for advertising, ad targeting, or marketing profiling.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining business records, resolving disputes, enforcing agreements, preventing fraud, and complying with legal, regulatory, AML/KYC, tax, accounting, audit, and reporting obligations. Retention period for KYC and Verification Data: unless a shorter retention period is required by applicable law, SendNOW retains KYC Verification Data, including identity document images, selfie images, facial biometrics / face data, liveness results, verification results, and related audit logs, for the duration of the user relationship and for up to five (5) years after account closure, the last transaction, or completion of the relevant compliance review, whichever is later, or for any longer period required or permitted by applicable law, regulators, courts, law-enforcement authorities, or regulated partners. Where Sumsub processes Verification Data on SendNOW’s behalf, Sumsub retains such data in accordance with SendNOW’s instructions, the applicable agreement, and legal requirements. Sumsub may delete, return, anonymise, or securely retain data as required by law, contract, or compliance obligations. When the applicable retention period expires, we will delete, anonymise, or securely archive the data in accordance with our retention procedures, unless continued retention is required or permitted by law or is necessary for legal claims, fraud investigations, security incidents, audits, or regulatory inquiries. Biometric data minimisation: to the extent technically and legally feasible, biometric templates or face matching data will be retained only for verification, fraud-prevention, security, and compliance purposes and not for advertising, marketing, or sale.

SendNOW, regulated partners, Sumsub, and other service providers may process personal data in countries other than the country where you are located. These countries may have data protection laws that differ from those in your jurisdiction. Where required, we use appropriate safeguards for international transfers, such as adequacy decisions, standard contractual clauses, data processing agreements, technical and organisational security measures, and other lawful transfer mechanisms.

We use reasonable technical, organisational, and administrative safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction. These safeguards may include encryption, access controls, logging, vendor due diligence, contractual restrictions, network security controls, monitoring, and employee confidentiality obligations. No method of transmission or storage is completely secure. Users are responsible for maintaining the confidentiality of account credentials and promptly notifying us of suspected unauthorised access or security issues.

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or port your personal data; withdraw consent; opt out of certain processing; and lodge a complaint with a supervisory authority. Where biometric / face data is processed based on consent, you may have the right to withdraw consent. Withdrawal will not affect processing already carried out lawfully before withdrawal, but it may prevent access to services where verification remains legally or operationally required. You may contact SendNOW to exercise rights or ask questions about personal data and Verification Data. We may need to verify your identity before responding to a request, and we may refuse or limit requests where permitted by law, including where retention is required for AML/KYC, fraud prevention, security, legal claims, or regulatory obligations.

Our services are not intended for children or minors under the age required to use the services in the relevant jurisdiction. We do not knowingly collect personal data from children where prohibited by law. If we learn that a child has provided personal data, we may delete it or take other appropriate steps, subject to legal requirements.

We may use cookies and similar technologies to operate the website and app, remember preferences, measure performance, analyse usage, secure services, and improve user experience. Where required, we will request consent for non-essential cookies and provide choices through our cookie banner or settings. Biometric data, selfie images, facial biometrics / face data, and biometric verification outputs are not used for cookies, analytics advertising, marketing profiling, or ad targeting.

We may update this Privacy Policy from time to time. The updated version will be posted on the SendNOW website or app, and the effective date will be updated where applicable. Material changes may be notified by email, in-app notice, website notice, or other appropriate means.

For privacy questions, requests, or complaints, please contact SendNOW through the contact channels available on the SendNOW website or app. If applicable, you may also contact the relevant data protection officer or representative identified in SendNOW’s corporate or legal notices.