Privacy Policy

1. Introduction

Thank you for choosing the service(s) (the “Services”) and/or product(s) (the “Products”) provided by Vav (hereinafter also referred to as “Vav”, “we”, “us” and “our”). By accessing or using our Services/Products — including joining our waitlist — you consent to the policies and practices set out in this privacy policy (the “Privacy Policy”), and represent and warrant that you have the valid consent and authority from the Relevant Person(s) (defined below) for us to collect, use, disclose and/or process your Personal Data as described herein.

Vav accounts on vav.global are available to businesses only; we do not offer personal or individual accounts. This Privacy Policy therefore covers the personal data of individuals connected with our business customers, such as their directors, beneficial owners, authorized signatories, authorized users and other contacts (the Relevant Persons, defined below), and of people who visit our Site or join our waitlist. In this Privacy Policy, “you” means the business customer or the individual whose Personal Data we process, as the context requires.

This Privacy Policy describes how we collect, use and disclose your personal data when you access or use our Services/Products. You agree that Vav may update this Privacy Policy at any time by posting the amended version on our website and associated application program interfaces or mobile applications (the “Site”) or by sending the latest Privacy Policy to you via email. To the extent that we have notified you of the updated Privacy Policy, your use or continued use of any Services/Products after such amendment shall be deemed your acceptance of and agreement to the same.

2. What personal data we collect

We may from time to time collect, process and store certain personally identifiable information that can be used to contact or identify you and your beneficial owners, directors, officers, authorized signatories, employees, representatives, guarantee/security providers and other natural persons related to you (the “Relevant Persons”) via your use of the Services/Products or where you have given your consent (collectively, the “Personal Data”). Such Personal Data may include contact details, information and data generated in the ordinary course of your relationship with us, and information from cookies or the use of any information technology applications.

A. Waitlist information

When you join the Vav waitlist, we currently collect:

Email address
WhatsApp phone number
Referral code and referral relationships (who invited whom)
Your position on the waitlist and signup timestamp

B. Personal identifying information

When our Services/Products launch, opening and operating a business account may additionally require the following information about the business’s Relevant Persons (such as directors, beneficial owners, authorized signatories and authorized users), without limitation:

Full legal name (including former names and names in other languages, if applicable)
Identification document type and number (e.g., passport, national ID)
Gender, date of birth, place of birth and nationality
Residential address and country/state of residence
Level of activity anticipated
Contact phone number and email address
Biometric data (e.g., facial and/or fingerprint recognition for identity verification, where applicable)
Additional Personal Data or documentation at the discretion of our compliance team

C. Business financial information

This mainly concerns the business, but may include Personal Data of its Relevant Persons, for example where we need to understand the source of wealth of a beneficial owner:

Purpose of account opening
Nature and details of the business, its activities and expected volumes
Source of funds and, where needed, source of wealth of the business and its beneficial owners
Credit history of the business, where relevant
Transaction history and spending patterns
Bank account information

D. Personal location information

Location data (e.g., approximate location derived from your IP address, used to show relevant currencies)
IP address
Device information

E. Sensitive personal information

In certain cases, we may collect “Sensitive Personal Information” as defined under applicable laws (e.g., GDPR). This includes data revealing family, racial origin, political or philosophical opinions, religious beliefs, criminal records, biometric data, or any data related to a person’s health, such as physical, psychological, mental, genetic or sexual condition. We collect and use Sensitive Personal Information only to the limited extent necessary for specific purposes.

3. How we use your personal data

We may use the collected Personal Data for the following purposes:

Category of Personal Data	Specific purposes	Legal basis
A. Waitlist information (email, WhatsApp number, referral code)	Managing your waitlist position and referrals; contacting you about early access, launch updates and rewards.	Your consent, given when you sign up for the waitlist.
B. Personal identifying information (name, ID number, date of birth, address, email, phone)	Identity verification and account setup; providing and personalizing Services/Products; communicating with you; compliance with KYC/AML regulations; fraud detection and security.	Contractual necessity, your consent where applicable, legal obligations, and legitimate interests such as ensuring security.
C. Business financial information (sources of funds and wealth, transaction history, bank details)	Processing payments, deposits, withdrawals and transactions; risk assessment and credit analysis; generating statements, invoices and reports; monitoring fraud or suspicious activity; internal audits and compliance.	Contractual necessity, legal obligations such as anti-money laundering (AML) requirements, and legitimate interests such as risk management.
D. Personal location information (IP address, device data)	Detecting and preventing fraud (e.g., unusual login locations); enhancing user experience (e.g., showing your local currency); compliance reporting (e.g., jurisdictional requirements).	Legitimate interests, such as ensuring security, and your consent for precise location data where applicable.
E. Sensitive personal information (e.g., biometrics)	Enhanced identity verification; limited fraud prevention where required.	Your explicit consent and legal obligations, such as those for high-risk KYC procedures.

In addition to the purposes outlined above, we may also use collected Personal Data:

To provide and manage our Services/Products

To make decisions relating to the provision or continued provision of the Services/Products to you.
To verify or maintain the quality or safety of the Services/Products, and to administer, operate, deliver, improve and personalize the Services/Products.
To provide Services/Products to you, such as maintaining or servicing accounts, providing customer service, processing your payments and transactions, verifying customer information and providing storage.

For security and fraud prevention

To monitor and record the usage of the Services/Products and communications with you and/or the Relevant Persons (including for investigation and fraud prevention purposes).
To detect, prevent and address technical issues and security incidents that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal information.

For risk management

To conduct risk assessment and data analysis (including data processing, anti-money laundering and credit analyses), internal management and internal/external audits.
To resist malicious, deceptive, fraudulent or illegal actions directed at Vav or our users, and to prosecute those responsible for those actions.

For communication

To communicate with you, your affiliates and/or your representatives in relation to events, our Services/Products and other products or services offered by Vav or its affiliates, unless you have opted not to receive such information.
To provide you with statements, invoices, receipts and other related information in relation to the Services/Products.

For marketing and analytics

To conduct market research, surveys, promotions and contests, and to analyse your preferences, interests and behaviour in relation to the Services/Products.

For compliance

To fulfil any applicable legal, regulatory and compliance requirements (including anti-money laundering and tax obligations applicable to us).

For legal purposes

To enforce or defend the rights or property of Vav, its affiliates and other users.

For other purposes

To carry out any other purpose(s) described to you at the time the data was collected.

We do not use or disclose Personal Data for any purpose other than those expressly permitted under this Privacy Policy and applicable law.

We may share your Personal Data with the following persons for the purposes stated above:

Identity verification & compliance providers: we share your Personal Data with identity verification providers (document, biometric and sanctions screening) for “Know Your Client” (KYC) checks, to verify your identity and comply with anti-money laundering regulations.
Fin, our banking partner: customer funds are held by Fin, our banking partner. We share the Personal Data Fin needs to open and operate your business’s accounts, hold its funds and process its payments (such as the identity details of its Relevant Persons, verification results and transaction information).
Payment processors & financial institutions: we share your Personal Data with our account, payout and card partners (in the US, Canada and Hong Kong), card networks, banks, financial institutions and/or payment processors, merchants and loyalty programme partners to facilitate deposits, withdrawals and transactions. Vav is a technology and orchestration layer on top of licensed partners and does not itself hold customer funds; they are held by Fin.
IT & infrastructure providers: we share your Personal Data with service providers that provide website hosting, data analysis, information technology, mailing and telecommunications, data processing, payments, credit references or other services. This includes the storage of waitlist signups in our infrastructure (including a Google Sheets backup) and the use of an IP-based geolocation service to display your local currency.
Marketing & analytics partners: we share your Personal Data with social media platforms, online platforms or third-party websites for marketing, advertising or promoting our Services/Products, but only if you have provided consent for such sharing.
Professional advisers: we share your Personal Data with our professional advisers as necessary to help administer, operate, deliver and improve the Services/Products, including any person to whom we are under an obligation or otherwise required to make disclosure pursuant to legal process or any foreign or domestic legal, tax and/or regulatory obligation or request.
Vav’s affiliates: we share your Personal Data with any actual or proposed assignee or business transferee of Vav and/or its affiliates who is under a duty of confidentiality to the disclosing entity.
Others: we share your Personal Data with persons or entities that you authorize or consent to receive your Personal Data, such as your authorized representatives, agents, advisors or beneficiaries.

We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

5. Do we transfer your personal data

Your information, including Personal Data, may be transferred to and maintained on computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. Please note that we may transfer the data, including Personal Data, outside your jurisdiction and process it there. Your consent to this Privacy Policy and your submission of such information represent your agreement and consent to that transfer. Information you provide to us may also be stored on our and/or third-party cloud servers.

We will take reasonable measures to ensure that your Personal Data is treated securely and in accordance with this Privacy Policy, and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of your Personal Data and other personal information.

We rely on appropriate safeguards for data transfers, which may include:

Standard Contractual Clauses (SCCs): we use EU Standard Contractual Clauses approved by the European Commission for transfers from the EEA to third countries.
Data Protection Impact Assessments (DPIAs): we conduct DPIAs for high-risk processing activities, including transfers to countries without an adequacy decision, to ensure your data is protected.
Due diligence: we conduct rigorous information security due diligence on all third-party vendors and sub-processors who will receive your data.

6. How long do we retain your data

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. By accessing or using our Services/Products, you are giving consent for us to retain your Personal Data.

7. Marketing communications

We may communicate company news, promotions and information relating to our products and services. We may share Personal Data with our affiliates to send marketing communications. We will only send you such marketing communications if we have received your express consent in the relevant channels in the Services/Products — for the waitlist, that consent is given when you provide your email and WhatsApp number to receive your invite and updates.

If you change your mind and wish not to receive these communications, please send an email to hello@vav.global with the subject “MARKETING OPT OUT”.

To ensure the quality of our Services/Products, for Services/Products-related communications — such as amendments to terms and conditions, updates and operational notifications — you understand you will not be able to opt out of receiving such information.

While you access the Site, we may use the industry practice of placing a small amount of data that will be saved by your browser (“Cookies”) or similar technologies such as browser local storage. This information can be placed on your computer or other devices used to visit the Site. It helps us recognize you as a customer, remember your preferences, collect information about your use of our Services/Products to better customize our services, and improve your experience. We may also use the information collected to ensure compliance with our compliance programme and to ensure your account security has not been compromised by detecting irregular or suspicious account activities.

Most browsers are set up to accept Cookies automatically. Some Cookies expire when you end your session and other Cookies remain on your computer or other devices until deleted or expired. You have the option to decline the use of Cookies and to clear local storage through your browser settings, but this may affect the functionality of the Services/Products or your user experience (for example, the Site may no longer remember your theme preference).

Some browsers have a do-not-track feature that lets you tell websites that you do not want your online activities tracked. As of the date of this Privacy Policy, we do not respond to browser do-not-track signals.

9. Information security

We endeavour to protect ourselves and you from unauthorized access, alteration, disclosure or destruction of the data we collect and store. We take various measures to ensure information security, including encryption of our communications with SSL/TLS, periodic review of our Personal Data collection, storage and processing practices, and restricted access to your Personal Data on a need-to-know basis.

The security of your data is important to us, but you understand and acknowledge that no method of transmission over the Internet, or method of electronic storage, is fully secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

10. Links to other sites

Our Site may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy of every site you visit. You understand we have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party sites or services.

11. Minor policy

We do not provide Services/Products to anyone who is regarded as a “minor” or equivalent under applicable law. We do not knowingly and intentionally collect personally identifiable information from anyone who is regarded as a “minor” or equivalent under applicable law. If you are a parent or guardian and you are aware that your child (being a “minor” or equivalent under applicable law) has provided us with Personal Data, please contact us and we will take appropriate measures.

12. Your contact with other customers

You understand you are solely responsible for your interactions with other users. We reserve the right, but have no obligation, to monitor disputes between you and other users.

13. Your rights

A. Contacting us about privacy questions or concerns

If you have any questions about this Privacy Policy or the use of your Personal Data, please contact us by sending an email to hello@vav.global with the subject “PRIVACY ENQUIRY”.

B. Right to know and data portability

You have the right to request that we disclose certain information to you about our collection and use of your Personal Data over the past 12 months. Once we receive and confirm your verifiable request, we will disclose to you:

The categories of Personal Data we collected about you.
The categories of sources for the Personal Data we collected about you.
Our purposes for collecting that Personal Data.
The categories of third parties with whom we share that Personal Data.
The specific pieces of Personal Data we collected about you (also called a data portability request).

To exercise your right to data portability, you may request a machine-readable copy of your Personal Data by contacting hello@vav.global.

C. Right to correct, delete and limit the use of personal data

You have the right to request that we correct any inaccurate Personal Data we hold about you. You also have the right to request that we delete any of your Personal Data that we collected from you and retained, subject to certain exceptions (e.g., for compliance with law or legal purposes).

You have the right to request to limit the use of your Personal Data, or withdraw your consent to the use of your Personal Data. Where you or a Relevant Person withdraws consent or fails to supply relevant information or data required for us to provide our Services/Products to you, we may be unable to provide or continue to provide Services/Products to you.

To make your request, please contact hello@vav.global with the subject “DATA REQUEST”. We will do our best to respond to your request as soon as possible (generally within 15 working days of the receipt of your request), with the exception that we may refuse your deletion request in certain circumstances, such as compliance with law or legal purposes.

In response to a data access, correction, deletion or data portability request, we will verify the requesting party’s identity to ensure that he or she is legally entitled to make such a request. While we aim to respond to these requests free of charge, we reserve the right to charge you a reasonable fee, especially if the request is repetitive or onerous.

14. Language

The official and controlling language of this Privacy Policy is English. If this Privacy Policy is translated into any other language from English, the English language version shall prevail to the extent of any inconsistency.

15. Contact and complaints

If you have any questions or complaints concerning the security of your Personal Data, or wish to exercise your data rights, please contact us at hello@vav.global.

We are committed to resolving any complaints about our collection or use of your Personal Data. We will acknowledge receipt of your complaint and respond to you generally within 15 working days.