Privacy Policy

Last updated: November 2026

This Privacy Policy describes how Ombu [TO BE DEFINED — legal entity name] (“Ombu”, “we”, “us”, or “our”) collects, uses, shares and protects information when you use our platform, API, dashboard and related services (collectively, the “Services”).

1. Information we collect

Information you provide

• Business information: company name, registration number, registered address, industry, website, beneficial ownership details.
• Contact information: full name, work email, phone number, role, LinkedIn profile.
• Onboarding data: KYB/KYC documentation, identity documents, proof of address, corporate documents.
• Transaction data: payment amounts, currencies, sender and beneficiary details, corridor information, invoices and supporting documents.
• Enquiry data: information submitted through our contact form, including payment needs, corridors of interest, estimated volumes and preferred communication channel.

Information collected automatically

• Technical data: IP address, browser type and version, device information, operating system.
• Usage data: pages visited, features used, session duration, interaction patterns.
• Cookies: we use essential cookies to operate our platform and analytics cookies to understand usage. You can manage cookie preferences through your browser settings.

2. How we use your information

We use the information we collect to:

• Provide, operate and maintain our Services, including processing payments and managing accounts.
• Verify your identity and conduct KYB/KYC checks as required by applicable regulations.
• Screen transactions for compliance with anti-money laundering (AML) and counter-terrorism financing (CTF) requirements.
• Communicate with you about your account, transactions and service updates.
• Respond to enquiries submitted through our website.
• Improve our platform, develop new features and analyse usage patterns.
• Comply with legal and regulatory obligations in all jurisdictions where we operate.

3. Information sharing

We share your information with the following categories of recipients, only as necessary:

• Banking and payment partners: to execute transactions, open accounts, settle funds and provide FX services.
• Compliance providers: for identity verification, AML screening, sanctions screening and ongoing monitoring.
• Regulatory authorities: as required by applicable law, regulation, court order or governmental request.
• Service providers: for hosting, analytics, customer support and communication services, subject to appropriate data protection agreements.

We do not sell your personal information. We do not share your information with third parties for their marketing purposes.

4. International data transfers

Given the cross-border nature of our Services, your information may be transferred to and processed in countries other than your country of residence. When we transfer information internationally, we implement appropriate safeguards in accordance with applicable data protection laws, including standard contractual clauses where required.

5. Data retention

We retain your information for as long as your account is active and as required by applicable regulations. Transaction records and compliance documentation are retained for the minimum period required by the relevant jurisdiction, which is typically five (5) to seven (7) years after the end of the business relationship. Enquiry data submitted through our contact form is retained for twelve (12) months unless you become a client.

6. Security

We implement industry-standard technical and organisational measures to protect your information, including encryption in transit (TLS) and at rest, role-based access controls, regular security assessments and monitoring. While we strive to protect your information, no method of transmission or storage is completely secure.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete or port your personal data, restrict or object to its processing, and withdraw consent where applicable. To exercise any of these rights, contact us at the address below. We will respond within the timeframe required by applicable law.

Note that certain requests may be limited where we have a legitimate interest or legal obligation to retain information, particularly for regulatory compliance purposes.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy.

9. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at privacy@ombupay.com.

Ombu [TO BE DEFINED — legal entity name]
[TO BE DEFINED — registered address]