Privacy Policy

TaqFlow LLC ("TaqFlow", "we", "us") is committed to protecting the privacy and personal data of our customers, counterparties, and website visitors. This Privacy Policy applies across every jurisdiction in which we collect user data, maintain physical operations, or actively target customers — currently the United Arab Emirates, Kazakhstan, Uzbekistan, Georgia, Azerbaijan, Armenia, the Kyrgyz Republic, Tajikistan, Turkmenistan, the European Union, and the United States.

We comply with each applicable data protection regime in the jurisdictions listed in Section 10 below. Where requirements conflict, we apply the highest applicable standard.

We collect the following categories of personal data:

• Identification data: Full name, date of birth, nationality, passport, Emirates ID, or national ID details.
• Contact data: Email address, phone number, business address.
• Business data: Company registration, trade licence, beneficial ownership, KYB documentation.
• Transaction data: Payment instructions, source and target currencies, counterparty details, transaction history.
• Technical data: IP address, device information, browser type, usage logs.

We process personal data on the following lawful bases:

• Your explicit consent to process personal data for the purposes described herein.
• Performance of a contract to which you are a party, including executing payment instructions.
• Compliance with legal obligations under applicable AML/CFT laws, central bank regulations, and sanctions regimes in each jurisdiction where we operate.
• Our legitimate interests in operating, securing, and improving our services.

We use your personal data to:

• Onboard and verify your business and its beneficial owners (KYC/KYB).
• Process, settle, and reconcile cross-border payments.
• Conduct sanctions screening, transaction monitoring, and fraud detection.
• Maintain records as required by AML/CFT laws in each operating jurisdiction.
• Provide customer support and communicate about your account.
• Improve our products, services, and risk models.

We do not sell your personal data. We may share it with:

• Banks, correspondent banks, and payment networks required to execute your transactions.
• Regulatory and supervisory authorities in each operating jurisdiction, including central banks and Financial Intelligence Units.
• Sanctions screening providers and compliance partners.
• Cloud infrastructure and service providers bound by data processing agreements.

Cross-border data transfers are conducted using appropriate safeguards, including Standard Contractual Clauses (SCCs) for EU/EEA transfers and equivalent mechanisms for other jurisdictions, ensuring an adequate level of protection in every case.

We retain personal data for the duration of the business relationship and for the minimum period required by law in each jurisdiction. In most operating jurisdictions this is a minimum of five (5) years from the end of the relationship or the date of the relevant transaction, in accordance with local AML/CFT retention rules.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data, subject to legal retention obligations.
• Object to or restrict certain types of processing.
• Withdraw consent for processing at any time, where processing is based on consent.
• Receive your data in a portable, machine-readable format (EU/EEA and applicable jurisdictions).
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact privacy@taqflow.io. We will respond within the timeframe required by your local law (generally 30 days).

We implement bank-grade security measures including AES-256 encryption at rest, TLS 1.3 in transit, two-factor authentication, IP allowlisting, and segregated client accounts. Access to personal data is restricted to authorised personnel on a need-to-know basis.

For any privacy-related enquiries or to exercise your rights, please contact our Data Protection Officer at privacy@taqflow.io or write to TaqFlow LLC, DIFC, Dubai, United Arab Emirates.

United Arab Emirates: This policy complies with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Complaints may be lodged with the UAE Data Office.

European Union / EEA: We comply with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). Our legal bases under the GDPR are consent (Art. 6(1)(a)), contract performance (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), and legitimate interests (Art. 6(1)(f)). Complaints may be lodged with your local Data Protection Authority or the Irish DPC.

United States: We comply with applicable state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the CPRA, and other state data protection statutes. US residents may exercise their rights by contacting privacy@taqflow.io.

Kazakhstan: We comply with the Law of the Republic of Kazakhstan "On Personal Data and Its Protection" No. 94-V. Complaints may be lodged with the Ministry of Digital Development.

Uzbekistan: We comply with the Law of the Republic of Uzbekistan "On Personal Data." Complaints may be lodged with the Personal Data Protection Authority under the Cabinet of Ministers.

Georgia: We comply with the Law of Georgia "On Personal Data Protection." Complaints may be lodged with the Personal Data Protection Service of Georgia.

Azerbaijan: We comply with the Law of the Republic of Azerbaijan "On Personal Data." Complaints may be lodged with the Ministry of Digital Development and Transport.

Armenia: We comply with the Law of the Republic of Armenia "On Protection of Personal Data." Complaints may be lodged with the Ministry of Justice.

Kyrgyz Republic, Tajikistan & Turkmenistan: We comply with each country's applicable personal data protection legislation and cooperate with the respective national supervisory authorities.