01
PDPA (Regional)
Personal Data Protection Acts across Southeast Asian markets — consent management, purpose limitation, data subject rights, and breach notification.
Trust Centre
Compliance, protection, and accountability — by design.
How we handle data, meet regional regulations, and keep client and regulator trust across emerging markets.
What we comply with
Regulatory & compliance frameworks
Frameworks we align with across the markets we serve. Specific applicability depends on the operating region and client scope.
02
GDPR (EU)
General Data Protection Regulation for clients and data subjects in the European Union — lawful basis, data subject rights, DPIA, and cross-border transfer safeguards.
03
LGPD (Brazil)
Lei Geral de Proteção de Dados for Brazilian operations — legal bases, data subject rights, DPO accountability, and ANPD reporting.
04
LFPDP (Mexico)
Ley Federal de Protección de Datos Personales en Posesión de los Particulares — lawful processing, consent, data subject rights, and INAI reporting for Mexican operations.
05
KYC
Know Your Customer onboarding aligned with local financial sector regulators — identity verification, beneficial ownership, and risk-rated customer profiles.
06
AML & CFT
Anti-Money Laundering and Counter-Financing of Terrorism controls — transaction monitoring, sanctions screening, suspicious activity reporting, and record-keeping.
How we protect data
Data protection practices
Technical and organisational measures applied across the data lifecycle.
01
Encryption
TLS 1.2+ in transit, AES-256 at rest, and envelope encryption for sensitive fields. Key rotation on a defined schedule with HSM-backed custody.
02
Access control
Role-based access, least-privilege default, MFA for all production systems, and just-in-time elevation with audit logging. PII access is pseudonymised by default.
03
Retention & deletion
Purpose-bound retention schedules, automated expiry, and documented deletion workflows. Data subject deletion requests are fulfilled within regulatory SLAs.
Privacy commitment
Privacy policy summary
The key commitments of our privacy policy. The full policy is available to clients and partners on request.
We collect data only for specified, legitimate purposes (credit scoring, fraud detection, compliance). We minimise what we collect, pseudonymise where possible, and never sell personal data. Data subjects can exercise access, correction, deletion, and portability rights. Sub-processors are bound by data processing agreements and reviewed annually. Cross-border transfers use adequate safeguards (SCCs, BCRs, or recognised frameworks).
Data residency
Region-specific storage & processing
We deploy region-specific storage and processing to meet local residency and sovereignty rules.
Data for Southeast Asian clients is processed in regional infrastructure; data for Latin American clients is processed in LATAM infrastructure. No cross-region replication of personal data without client consent and legal basis.
Talk to our team