Privacy Policy

1. Who We Are

CARDFORNIA PTE. LTD. (UEN: 202625775N) (“Cardfornia”, “we”, “us”, “our”), a company incorporated in Singapore with registered address at 192 WATERLOO STREET #06-08 SKYLINE SINGAPORE (187966), is responsible for the personal data described in this Privacy Policy.

This Policy explains how we handle personal data when you access our website, dashboard, APIs, cards and related services (collectively, the “Services”).

Data Protection Officer. We have appointed a Data Protection Officer as required under the Personal Data Protection Act 2012 (Singapore). You may contact them at dpo@cardfornia.com or by post at the address above, marked for the attention of the Data Protection Officer.

2. Scope and Our Role

Our Services are provided to business customers. Personal data reaches us in two ways, and our role differs in each case.

Where you are a business customer (“Client”). We act as controller of the personal data of your directors, beneficial owners, administrators and authorised contacts. We decide how that data is used, principally to verify your business, meet our legal and partner compliance obligations, and provide the Services to you.

Where you are a cardholder. Your employer or the entity that nominated you (the “Client”) provides your data to us so that a card can be issued to you.

• For identity verification, sanctions screening, fraud prevention, transaction monitoring and regulatory reporting, we act as controller. These are obligations imposed on us and on our partners, and we cannot carry them out on the Client’s instructions alone.
• For managing your card, applying spend controls and reporting your transactions to the Client, we act as processor on the Client’s instructions.

If you are a cardholder and want to know why you were given a card, what your spending is used for internally, or how long your employer keeps its own records, those questions are for the Client, not for us.

Cards and funds. Cards are issued by licensed issuing institutions, and funds are held and processed by licensed partner institutions (“Partners”). Those institutions handle personal data for their own regulatory purposes and act as controllers in their own right. Their handling of your data is governed by their own privacy notices.

3. Personal Data We Collect

3.1 Data you or the Client provide

• Identity data: name, date of birth, nationality, government-issued identification, photograph, and liveness or selfie verification images.
• Contact data: email address, telephone number, postal address.
• Business data: company name and registration details, constitutional documents, ownership and control structure, beneficial ownership information, role and authority within the Client.
• Financial and compliance data: source of funds, source of wealth, expected transaction volumes, bank account and wallet addresses.
• Support data: correspondence, dispute documentation, and records of communications with us.

3.2 Data collected automatically

• Usage data: IP address, browser type and version, device identifiers, operating system, pages visited, dates and times of access, and diagnostic data.
• Transaction data: card authorisations, settlements, declines, refunds, chargebacks, merchant names and categories, transaction amounts, currencies and locations.
• Security data: login records, authentication events, API access logs.

3.3 Data from third parties

• Identity verification providers, who confirm identity against government records and publicly available information.
• Sanctions, PEP and adverse media screening providers.
• Blockchain analytics providers, who screen wallet addresses and transaction flows associated with funding.
• Partners and issuing institutions, who provide transaction, settlement, dispute and compliance information.
• Your financial institutions, where you send funds to us.
• Public registries and corporate databases.

4. How We Use Personal Data, and Our Legal Bases

Where the EU or UK GDPR applies to our processing, the legal bases are as set out below. Under Singapore’s PDPA, we rely on consent or on an applicable exception, including compliance with legal requirements and legitimate interests.

Service communications. We send communications about your account, security, service changes and transactions. These are necessary to provide the Services and you cannot opt out of them while you use the Services.

Marketing. You can opt out at any time by using the unsubscribe link or by contacting us at marketing@cardfornia.com. Opting out of marketing does not stop service communications.

Automated processing. We use automated systems to screen funding, monitor transactions and detect fraud. These systems may automatically decline a transaction, block a card or flag an account for review. Decisions that produce significant effects, such as declining onboarding or suspending an account, are reviewed by a person before they become final. If you believe an automated decision has affected you unfairly, contact us at support@cardfornia.com.

5. Who We Share Personal Data With

• Partners and issuing institutions, to issue cards, process transactions, hold and settle funds, and meet their own regulatory obligations.
• Card networks (Visa, Mastercard), processors and acquirers, to authorise, clear, settle and dispute transactions.
• Compliance service providers, including identity verification, sanctions screening and blockchain analytics providers.
• Technology service providers, including cloud hosting, communications and customer support tools, under contracts that limit their use of the data to providing services to us.
• The Client, where you are a cardholder — including your card details, spending, merchants and transaction history.
• Professional advisers, including auditors, lawyers and accountants, where necessary.
• Regulators, law enforcement and other authorities, where required by law, court order or a valid request. In some cases we are legally prohibited from telling you that we have made a disclosure.
• Acquirers of our business, in a merger, acquisition, restructuring or insolvency. We will give notice before your data becomes subject to a different privacy policy, where lawful.

6. International Transfers

Cardfornia is based in Singapore. Our Partners, issuing institutions, card networks and service providers are located in a number of jurisdictions, and personal data will be transferred outside Singapore and outside your own country.

Where we transfer personal data internationally, we take steps to ensure it receives a standard of protection comparable to that required under the PDPA, and where the EU or UK GDPR applies, we rely on an appropriate transfer mechanism such as Standard Contractual Clauses or a finding of adequacy.

You may request information about the safeguards applied to a specific transfer by contacting our Data Protection Officer.

7. How Long We Keep Personal Data

Where a legal claim, investigation or regulatory request is pending, we retain the relevant data until it is resolved.

Retention periods that arise from our Partners’ or issuing institutions’ own obligations are set by those institutions and may differ.

8. Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the data, including access controls, encryption of data in transit and at rest, logging and monitoring, staff access on a need-to-know basis, and vendor security assessments.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also have a role: keep credentials confidential, do not share card details, and notify us immediately at support@cardfornia.com if you become aware of unauthorised access.

9. Your Rights

Depending on the law that applies to you, you may have the right to:

• Access the personal data we hold about you and receive information about how it is processed;
• Correct data that is inaccurate or incomplete;
• Erase data in certain circumstances;
• Restrict or object to processing in certain circumstances, including objecting to processing based on legitimate interests;
• Withdraw consent where processing is based on consent;
• Receive a copy of data you provided to us in a structured, machine-readable format, and have it transmitted to another controller where technically feasible;
• Complain to a supervisory authority.

Please note that we will often be unable to erase or stop processing data that we are legally required to retain, particularly KYC and transaction records held under anti-money laundering law. Where we cannot meet a request in full, we will tell you why.

How to exercise your rights. Contact our Data Protection Officer at dpo@cardfornia.com. We will respond within 30 days, or tell you if we need longer. We may need to verify your identity first.

If you are a cardholder, requests relating to data we process on your employer’s instructions should be directed to your employer in the first instance. We will forward such requests to the Client and assist them in responding.

Complaints. In Singapore, you may complain to the Personal Data Protection Commission (www.pdpc.gov.sg). If you are in the EEA or UK, you may complain to your local supervisory authority.

10. Cookies and Tracking

We use cookies and similar technologies, including web beacons and pixels, to operate the Services, remember your preferences, maintain security and analyse usage.

Strictly necessary cookies are required for the Services to function and cannot be disabled. Analytics and preference cookies are used only where you have consented, where consent is required in your jurisdiction.

You can manage cookies through your browser settings and, where offered, through our cookie banner. Blocking cookies may prevent parts of the Services from working.

11. Children

The Services are provided to businesses and are not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we hold such data, we will delete it and close any associated account. If you believe a person under 18 is using the Services, contact us at marketing@cardfornia.com.

12. Links to Other Sites

The Services may contain links to sites we do not operate, including merchant and Partner sites. We are not responsible for their content or privacy practices, and we recommend reviewing their policies.

13. Changes to This Policy

We may update this Policy. We will post the updated version on this page and update the “Last updated” date.

Where changes are material, we will give notice by email or by prominent notice on the Services at least 30 days before they take effect, unless a shorter period is required by law.

14. Contact

• Data Protection Officer: dpo@cardfornia.com
• General enquiries: support@cardfornia.com
• Marketing Team: marketing@cardfornia.com
• Post: CARDFORNIA PTE. LTD., 192 WATERLOO STREET #06-08 SKYLINE SINGAPORE (187966)