Introduction
Welcome to Pago-Facil (Stratford Solutions S.L.). We are committed to protecting your personal data. This policy explains how we handle your information in compliance with the GDPR (EU 2016/679) and the Spanish Organic Law 3/2018 (LOPDGDD).
Controller of Personal Data
Stratford Solutions S.L., located at Doctor Benapres 36, 08870, Sitges, Barcelona, Spain. Tax ID: B70711668. Email: [email protected].
Data We Collect
- Identity, Biometric & Identification Data: Full name, date of birth, gender, nationality, passport/DNI/NIE numbers including photographs and expiry dates, and biometric facial recognition data (via Sum and Substance Ltd.) for identity verification.
- Contact Data: Home address, email address, and telephone number.
- Regulatory & Tax Data: Tax Identification Number (NIF/NIE/Tax ID), country of tax residence, and Source of Funds/Wealth documentation.
- Financial Data: Bank accounts (IBAN), SEPA/SWIFT details, payment card information, and cryptocurrency wallet addresses.
- Transaction Data: Transaction monitoring logs, details about payments to and from you, and other details of products and services you have purchased.
- Technical Data: IP address, device ID, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
- Profile Data: Username and password, purchases or orders made by you, interests, preferences, feedback, and survey responses.
- Usage Data: Information about how you use our website, products, and services.
- Marketing and Communications Data: Your preferences in receiving marketing from us and your communication preferences.
Legal Bases for Processing
- Legal Obligation: Compliance with Spanish Law 10/2010 on Anti-Money Laundering (AML) and Bank of Spain VASP requirements (License D950).
- Performance of a Contract: To execute your crypto-to-fiat exchange orders.
- Consent: For marketing or specific cookies (can be withdrawn by contacting us at [email protected] or adjusting your cookie settings).
Data Sharing
We share data with:
- Sum and Substance Ltd.: For automated KYC/KYB and biometric verification. Sum and Substance Ltd. acts as a Data Processor under our strict instructions.
- Banking Partners/PSPs: To process SEPA/SWIFT transfers.
- Custody Providers: To secure your digital assets.
- Regulators: SEPBLAC or the Bank of Spain upon legal request.
Data Security Measures
We implement robust technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include:
- Encryption: All data transmitted between your device and our servers is secured using modern cryptographic protocols (e.g., SSL/TLS over HTTPS).
- Access Control: Access to personal data is strictly limited to authorized personnel who require it to perform their duties (e.g., AML/KYC compliance officers).
- Storage Security: Sensitive data, including biometric templates and financial information, is stored securely with advanced encryption and pseudonymization techniques where possible.
- Third-Party Vetting: We conduct due diligence on all third-party processors, ensuring they meet the same high standards of data security and confidentiality required by the GDPR.
Retention Period
In accordance with Spanish Law 10/2010, we are legally required to retain all KYC and transaction documentation for a period of 10 years after the termination of the business relationship.
Your Rights
You have the right to access, correct, or restrict processing of your personal data.
Please note: The “Right to Erasure” is limited by our 10-year legal obligation to retain AML records.
To exercise your rights, please contact us at [email protected]. You may also lodge a complaint with the Spanish Data Protection Authority — AEPD (aepd.es).