At a Glance — How NALA Handles Your Personal Data

Date: April 2026

Who we are

NALA Inc., a Delaware-incorporated fintech company providing cross-border payment and local currency wallet services. We are the data controller for your personal data.

What we collect

Identity data, account and transaction data, authentication and KYC data, device and usage data. Where biometric data is processed (e.g. facial recognition), this is disclosed separately and your explicit consent obtained.

Why we collect it

To provide your LCY wallet account and process your transactions; meet KYC/AML legal obligations; prevent fraud; improve the service; and communicate with you.

Our legal basis

Contract performance, legal obligation, and legitimate interests — depending on the activity. Consent is used for marketing and for any special category (e.g. biometric) processing only.

Who we share it with

Licensed partners (named in the NALA Partner Schedule); regulated service providers under written DPAs; regulatory/law enforcement authorities when legally required. We do not sell your data.

International transfers

Your data may be transferred internationally. We use SCCs, the UK IDTA, or other approved safeguards. Details available from dpo@nala.money.

How long we keep it

KYC/AML and account data: minimum 5 years. Transaction records: minimum 5 years. Device data: 12 months. Support data: 2 years.

Your rights

Access, correction, deletion, restriction, objection, portability, automated decision-making review, and complaint. We respond within one calendar month.

Contact / DPO

dpo@nala.money — Sunny Vara, Data Protection Officer

Partner Schedule

The licensed partners NALA works with are listed in the NALA Partner Schedule. This is available upon request.