What Personal Data We Collect

Date: April 2026

The following categories of personal data are collected in connection with your LCY wallet account.

Personal identification information

Full name; date of birth; nationality; email address; phone number; government-issued ID; residential address; selfie or portrait photograph for KYC purposes. We need this. Without it, we cannot open your account or verify who you are and meet KYC/AML obligations.

Account information

Account number; account type; account status; transaction history; account balances; linked payment methods (bank account details, card details); account preferences. We need this to run your account and provide the Service.

Authentication and identity verification data

Username; password (hashed); security questions; one-time passcodes; device trust data. Where biometric processing occurs (facial recognition, liveness detection), explicit consent obtained. We need this to keep your account secure. We will always ask your permission before using biometric checks.

Transaction data

Transaction amounts; source and destination currencies; sender and recipient names and account details; timestamps; exchange rates applied; fees charged; reference numbers; payment routing information. We need this to send and receive money on your behalf and keep a record of your transactions.

Communication and support data

Records of communications with customer support; feedback, complaints, and enquiries; marketing communication preferences. Only collected when you contact us. Your marketing preferences are optional so you can change them at any time.

Device and usage data

IP address; device type and identifiers; operating system; browser type; app version; session data; feature usage patterns; crash and error logs. Collected automatically when you use the app or website. You can control non-essential tracking through our Cookie Notice, this can be located at https://nala.money/cookie-notice

Financial crime compliance data

Politically exposed person (PEP) status; sanctions screening results; source of funds declarations; enhanced due diligence documentation where required. The law requires this. We are legally obliged to carry out these checks under anti-money laundering rules.

Special category data — biometric processing

NALA or our KYC providers may process biometric data (facial recognition, liveness detection) to verify your identity. This is special category data requiring additional legal protections.

Lawful basis: Your explicit consent (DPPA 2019 s.20; PDPA 2022 s.22; UK GDPR Art.9(2)(a)).You may withdraw consent at any time, however withdrawal may mean we cannot complete KYC and therefore cannot provide the Service.

Payment card data — PCI DSS

Card data is handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS). Card details are processed through certified payment processors. Full card numbers are never accessible to NALA staff.

Children's data — minimum age

The NALA Service is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. Contact dpo@nala.money if you believe we hold data relating to a child.