Privacy Policy

Last updated: 1 February 2026

This Privacy Policy explains how Vaulta Digital Assets Ltd handles personal data in connection with its business-to-business services, and should be read together with our Terms of Service and AML/CFT Policy.

1. Introduction

This Privacy Policy explains how Vaulta Digital Assets Ltd (“Vaulta”, “we”, “us”) collects, uses, stores, and protects personal data in accordance with:

  • the Data Protection Act, 2012 (Act 843) of Ghana; and
  • internationally recognised data protection principles, including GDPR-equivalent safeguards, where applicable.

Vaulta processes personal data strictly in connection with B2B services and regulatory compliance.

2. Data Controller

Vaulta Digital Assets Ltd acts as the Data Controller for personal data processed in connection with its services.

3. Categories of Personal Data

Vaulta may collect and process:

  • identification data (name, date of birth, nationality);
  • contact information (email, telephone number);
  • corporate role, ownership, and control information;
  • government-issued identification documents;
  • biometric and liveness verification outputs (via third-party providers);
  • transaction-related metadata;
  • compliance, screening, and risk assessment data.

4. Sources of Data

Personal data may be obtained from:

  • data subjects directly;
  • corporate clients during onboarding;
  • regulated third-party verification and screening providers;
  • publicly available and regulatory databases.

5. Purpose and Legal Basis for Processing

Vaulta processes personal data for:

  • identity verification and KYB/KYC;
  • AML, CFT, and sanctions compliance;
  • ongoing monitoring and risk assessment;
  • fraud prevention;
  • regulatory reporting and cooperation.

Processing is conducted under lawful bases including legal obligation, contractual necessity, and legitimate compliance interests.

6. Use of Third-Party Processors

Vaulta engages vetted third-party processors, including identity verification and transaction monitoring providers, subject to data processing agreements, confidentiality obligations, and appropriate safeguards.

7. International Data Transfers

Where personal data is transferred outside Ghana, Vaulta ensures appropriate safeguards consistent with Act 843 and GDPR-equivalent standards.

8. Data Retention

Personal data is retained only for as long as necessary to meet legal, regulatory, and legitimate business requirements, typically for a minimum of five (5) years following the end of the business relationship.

9. Data Security

Vaulta implements appropriate technical and organisational measures, including access controls, secure storage, and internal governance procedures, to protect personal data.

10. Data Subject Rights

Data subjects have rights under Ghanaian law, including the right to access, rectify, object to processing, and lodge complaints with the Data Protection Commission of Ghana.

11. Regulatory Disclosure

Vaulta may disclose personal data to regulators, law enforcement agencies, or competent authorities where legally required.

12. Dispute Resolution

Any dispute arising in connection with this Privacy Policy shall first be addressed through good-faith engagement. Where unresolved, disputes may be referred to mediation or arbitration in accordance with Section 11 of the Terms of Service, without prejudice to the right of data subjects to lodge complaints with relevant supervisory authorities.

13. Updates to this Policy

This Privacy Policy may be updated periodically. Material changes will be communicated where required.

Approved by the Board of Directors of Vaulta Digital Assets Ltd.