Date: January 1, 2026
Version: 1.0.6
1.1. Statement of Privacy Mandate: This Global Data Privacy & Protection Policy (hereinafter the “Policy”) constitutes a definitive and rigorous framework governing the acquisition, processing, archival, and transmission of Personal Data and Meta-Data within the banxtack™ infrastructure. This Policy is engineered to satisfy the high-velocity requirements of global financial technology standards and ensures compliance with a plurality of international data protection regimes, including but not limited to the General Data Protection Regulation (EU 2016/679) (“GDPR”), the UK Data Protection Act 2018, the California Consumer Privacy Act (“CCPA”), and other equivalent statutory mandates in jurisdictions where the Company’s technology is deployed.
1.2. Bipartite Legal Designation (Controller vs. Processor): A fundamental legal distinction is hereby established regarding the Company’s role in the data lifecycle:
1.3. Jurisdictional Neutrality and Portability: This Policy is designed to remain effective regardless of the specific corporate seat of Syntra Nexus Pte. Ltd.. It acknowledges that data sovereignty laws vary by region; consequently, the Company implements a "Highest Common Denominator" approach to privacy, ensuring that the most stringent global standards are applied to the "Atomic Reconciliation" and ledger-based data processing across the entire ecosystem.
1.4. Incorporation by Reference: This Policy is inextricably linked to, and forms an integral part of, the Master Terms and Conditions. By engaging with the Website or the Infrastructure, you hereby acknowledge the data processing modalities outlined herein as being necessary for the functional integrity of the composable financial system.
1.5. Definition of Terms: For the purposes of this Policy, “Personal Data” refers to any information relating to an identified or identifiable natural person; “Processing” refers to any operation or set of operations performed upon Personal Data, whether or not by automated means; and “Infrastructure Data” refers to the technical metadata generated through the orchestration of fiat and virtual asset flows.
2.1. Categorization by Engagement Tier: The Company classifies the data subject to its processing activities into discrete taxonomies based on the nature of the engagement and the functional pillar of the infrastructure being utilized. This classification is essential for the maintenance of "Atomic Reconciliation" and the rigorous audit trails required for global financial compliance.
2.2. Tier I: Corporate and Client-Level Personal Data: In its capacity as a Data Controller, the Company collects and processes information necessary for the establishment and maintenance of the commercial relationship with its Clients. This includes:
2.3. Tier II: Infrastructure-Derived End-User Data: In its capacity as a Data Processor, the Company processes data on behalf of the Client through the "Identity Orchestration" and "AML Engine" modules. This data taxonomy includes:
2.4. Tier III: Technical, Telemetric, and Security Metadata: To ensure the systemic integrity and cyber-resilience of the composable system, the Company processes technical data points, which may include:
2.5. Anonymized and Aggregated Data Protocols: The Company reserves the right to process anonymized, de-identified, or aggregated data derived from the infrastructure for the purposes of benchmarking, systemic performance optimization, and the training of fraud detection algorithms. Such data, being stripped of all personal identifiers, does not constitute "Personal Data" under this Policy and remains the proprietary intellectual property of the Company.
3.1. Plurality of Legal Grounds: The Company processes Personal Data only where a valid legal basis exists under applicable international data protection statutes. Given the sophisticated nature of the banxtack™ infrastructure, which operates at the intersection of technology and regulated finance, the Company relies on a plurality of legal justifications to ensure the continuity and legality of its operations.
3.2. Performance of Contractual Obligations: The primary basis for the processing of Client-level data and the technical orchestration of End-User data is the necessity to perform the contractual obligations set forth in the Master Terms and Conditions and subsequent Master Services Agreements (MSAs). This includes:
3.3. Compliance with Global Regulatory Mandates: As a provider of financial software infrastructure, the Company is architected to facilitate the Client's compliance with rigorous legal edicts. Processing is deemed necessary for:
3.4. The Doctrine of Legitimate Interests: The Company processes certain data based on its "Legitimate Interests" in maintaining a secure and high-performance ecosystem. These interests are carefully balanced against the privacy rights of the data subjects and include:
3.5. Affirmative Consent and Authorization: Where processing is not covered by contractual necessity or legal obligation—specifically in relation to certain biometric liveness checks or discretionary marketing communications—the Company (or the Client, acting as the Data Controller) shall obtain the affirmative, informed, and unambiguous consent of the data subject. Such consent may be withdrawn at any time through the designated administrative channels, subject to the retention requirements necessitated by the legal bases described in Sections 3.2 and 3.3.
3.6. Vital Interests and Public Interest: In exceptional circumstances, the Company may process data where it is necessary to protect the vital interests of an individual or where processing is required for tasks conducted in the public interest, such as the prevention of systemic financial crime or cooperation with law enforcement agencies during emergency forensic investigations.
4.1. The Interconnected Infrastructure Principle: The Counterparty acknowledges that the banxtack™ infrastructure operates as a consolidated gateway to a global ecosystem of financial institutions, payment networks, and compliance providers. To facilitate the "Atomic Reconciliation" and the "Payments & Money Movement" pillars, the Company must disseminate certain data to authorized third-party entities (collectively, “Integrated Partners” or “Sub-Processors”).
4.2. Categories of Authorized Recipients: Personal and Transactional Data may be disclosed to the following categories of recipients, strictly as necessitated by the functional requirements of the Services:
4.3. Sub-Processor Governance and Due Diligence: The Company maintains a rigorous Sub-Processor Selection Policy. Before integrating any third-party provider into the infrastructure, the Company performs an ICT Risk Assessment to ensure the provider employs technical and organizational measures (TOMs) commensurate with the sensitivity of the data being processed.
4.4. Contractual Safeguards (DPAs): In accordance with global data protection standards, the Company enters into formal Data Processing Agreements (DPAs) with all Sub-Processors. These agreements stipulate that the Sub-Processor may only process data under the explicit instruction of the Company, maintain strict confidentiality, and notify the Company of any security incidents within accelerated timeframes.
4.5. Zero-Sale Policy: banxtack™ explicitly represents and warrants that it does not, and will not, "sell" Personal Data (as defined by the CCPA or similar statutes) to third parties for marketing, advertising, or data-brokering purposes. Data dissemination is restricted solely to the operational requirements of the financial software infrastructure.
4.6. Internal Dissemination: Within the Company, access to Client and End-User data is restricted to authorized personnel (e.g., DevOps, FinOps, and Compliance Engineers) on a "Need-to-Know" basis. All internal access is governed by Role-Based Access Control (RBAC) and is monitored through immutable audit logs within the Back-Office command center.
5.1. Transborder Data Flow Mandate: The Counterparty acknowledges that the banxtack™ infrastructure is a globally distributed system designed for high-velocity cross-border asset movement. Consequently, the processing of Personal Data and Transactional Metadata may necessitate the transfer of information across international borders to jurisdictions that may have data protection standards different from those of the Counterparty’s country of origin.
5.2. Data Residency vs. Data Portability: While the Company utilizes geo-redundant data centers to ensure "Atomic Reconciliation" and operational resilience, the functional execution of "Payments & Money Movement" (e.g., SWIFT or SEPA Instant transfers) requires data to follow the financial rails. The Company implements a "Strategic Data Placement" policy, aiming to store data within the region of the Client’s primary operations (e.g., EEA, UK, or North America) unless the technical nature of the transaction dictates otherwise.
5.3. Legal Mechanisms for International Transfers: To ensure the "Fintech Shield" of privacy remains intact during transborder movements, the Company employs the following legal safeguards:
5.4. Compliance with Local Sovereignty Edicts: The Counterparty is responsible for notifying the Company of any specific local data residency requirements (e.g., the Russian Data Localization Law or the Chinese PIPL) that may impact their specific deployment. The Company will employ commercially reasonable efforts to accommodate such localized requirements through its composable infrastructure modules.
5.5. Impact Assessments: The Company periodically conducts Transfer Impact Assessments (TIAs) to evaluate the legal environment of the third countries to which data is transferred. These assessments ensure that the protections afforded by the banxtack™ infrastructure are not undermined by the domestic laws of the recipient jurisdiction.
6.1. The Principle of Storage Limitation: In accordance with the principle of "Data Minimization," the Company implements a rigorous Temporal Data Governance framework. Personal Data and Infrastructure Metadata shall be retained only for the duration necessary to fulfill the specific purposes for which they were collected, as outlined in Section 3 of this Policy, or as mandated by the statutory limitations of the jurisdictions in which the banxtack™ ecosystem operates.
6.2. Categorized Retention Schedules: The Company maintains a "Multi-Tiered Retention Schedule" to balance operational efficiency with legal compliance:
6.3. Forensic Archival and Legal Hold: Notwithstanding the standard retention schedules, the Company reserves the unilateral right to impose a "Legal Hold" on any data taxonomy. This occurs when data is deemed relevant to an active or anticipated judicial proceeding, regulatory inquiry, or internal investigation within the "Investigations & Reporting" module. Data under Legal Hold is sequestered from the standard purging cycles until the legal necessity has been formally resolved.
6.4. Secure Decommissioning and Irreversible Deletion: Upon the expiration of the mandated retention period, the Company utilizes industry-standard "Secure Decommissioning" protocols. This involves the use of cryptographic erasure (crypto-shredding) or multi-pass digital overwriting to ensure that Personal Data is rendered permanently irrecoverable. The Company provides a "Certificate of Deletion" to Clients upon request following the decommissioning of a branded white-label instance.
6.5. Regulatory Deviation: The Counterparty acknowledges that certain jurisdictions may impose "Sovereign Retention Mandates" that conflict with the Company's standard schedules. In such instances, the "Business Configuration" module allows for the adjustment of retention parameters to ensure the Client remains in compliance with their local administrative edicts.
7.1. Infrastructure Security Posture: The Company maintains an enterprise-grade cybersecurity architecture designed to protect the "Atomic Reconciliation" and data integrity of the banxtack™ infrastructure. In alignment with global operational resilience standards—including the Digital Operational Resilience Act (DORA) and ISO/IEC 27001/27002—the Company implements a "Defense-in-Depth" strategy, ensuring that multiple layers of security controls protect Personal Data and Infrastructure Metadata from unauthorized access, alteration, or exfiltration.
7.2. Cryptographic Protocols and Data Sanitization: To maintain the "Fintech Shield" of privacy, the Company utilizes high-velocity cryptographic standards:
7.3. Network Integrity and Perimeter Defense: The Company utilizes a multi-layered network security framework:
7.4. ICT Risk Management and Continuous Monitoring: The Company operates a proactive ICT Risk Management Framework, which includes:
7.5. Disaster Recovery and Operational Continuity: To ensure the permanence of the multi-asset ledgers, the Company maintains:
7.6. Incident Response and Regulatory Notification: In the event of a material data breach or systemic security failure, the Company maintains a formal Incident Response Plan (IRP). Consistent with global regulatory windows (e.g., GDPR Article 33), the Company shall notify the affected Data Controller (the Client) without undue delay, typically within 24 to 48 hours of confirming the breach, to allow for timely notification to relevant supervisory authorities and affected data subjects.
8.1. Empowerment of the Data Subject: In accordance with global data protection frameworks, including the GDPR and CCPA, banxtack™ acknowledges a comprehensive suite of rights afforded to individuals (the “Data Subjects”) whose information is processed via the infrastructure. The Company is committed to the "Mechanization of Privacy Agency"—the provision of technical and administrative pathways that allow individuals to exercise control over their digital footprint within the composable system.
8.2. Taxonomy of Statutory Rights: Every Data Subject whose information resides within the banxtack™ ecosystem possesses the following non-alienable rights:
8.3. Implementation Protocol in the White-Label Context: The Counterparty acknowledges that because banxtack™ operates as a Data Processor for end-user data, the primary responsibility for responding to "Subject Access Requests" (SARs) rests with the Client (the Data Controller).
8.4. Identity Verification and Request Integrity: To prevent "Privacy-Based Social Engineering" or unauthorized data exfiltration, any request to exercise a statutory right must undergo a rigorous identity verification process. The Company (or the Client) reserves the right to request "Identity Orchestration" proofing before releasing or modifying any data taxonomy.
8.5. Temporal Response Covenants: The Company warrants that it shall act upon instructions from the Data Controller regarding subject rights without undue delay. In its capacity as a Data Controller for its own direct Clients, the Company commits to responding to verified requests within thirty (30) calendar days, unless the complexity of the "Forensic Archival" retrieval necessitates a lawful extension of up to two additional months.
8.6. Non-Discrimination and Financial Incentive: Consistent with the CCPA and global fairness standards, the Company represents that no user shall be discriminated against (e.g., through degraded API performance or increased fees) for exercising their privacy rights.
9.1. The Doctrine of Regulatory Transparency: banxtack™ acknowledges that the operation of financial infrastructure is subject to the rigorous oversight of global administrative, judicial, and financial regulatory authorities. The Company is committed to a policy of "Constructive Cooperation" with such entities to maintain the security and legality of the global financial system, while simultaneously protecting the "Fintech Shield" and the data sovereignty of its Clients.
9.2. Jurisdictional Compulsion and Law Enforcement Access: The Company may be legally compelled to disclose Personal Data, Transactional Metadata, or Infrastructure Logs to competent governmental authorities, including law enforcement agencies, financial intelligence units (FIUs), and tax authorities. Such disclosure shall only occur under the following conditions:
9.3. Notification Protocols and "Gag Orders": * (a) General Rule of Notification: Unless prohibited by law or the specific terms of a court order, the Company shall utilize its best efforts to notify the Client (the Data Controller) of any third-party request for their data. This notification is intended to allow the Client to seek protective orders or contest the disclosure through their own legal counsel.
9.4. Mechanization of Investigative Support: The infrastructure provides the Client with autonomous tools within the "Investigations & Reporting" module to fulfill their own regulatory reporting obligations.
9.5. Non-Interference with Systemic Integrity: Under no circumstances shall the Company grant any regulatory body or law enforcement agency direct, unmonitored "Backdoor Access" to the core infrastructure, source code, or cryptographic keys. All investigative disclosures are performed through controlled, documented, and audited administrative pathways to ensure the continued security of the broader banxtack™ ecosystem.
9.6. Indemnification for Compelled Disclosure: The Counterparty agrees to indemnify and hold the Company harmless from any claims, losses, or liabilities arising from the Company’s good-faith compliance with a seemingly valid legal request from a sovereign authority. The Company shall not be liable for the consequences of any data disclosure performed under the color of legal authority.
10.1. Iterative Policy Evolution: The Counterparty acknowledges that the financial technology landscape, regulatory environment, and the banxtack™ infrastructure itself are subject to continuous evolution. Consequently, the Company reserves the unilateral and absolute right to modify, amend, or restate this Global Data Privacy & Protection Policy at any time. Such revisions are conducted to ensure the "Fintech Shield" remains resilient against emerging cyber-threats and compliant with shifting international data sovereignty edicts.
10.2. Manifestation of Continued Assent: Any amendments to this Policy shall be deemed effective immediately upon their publication on the Website or within the Back-Office Operational Command Center. The "Effective Date" at the commencement of this document shall serve as the primary indicator of the policy’s current version. Your continued utilization of the Website, APIs, or any infrastructure pillar following the posting of an updated version constitutes your irrevocable manifestation of assent to the revised terms of processing.
10.3. Communication of Material Changes: In the event of a "Material Change"—defined as a significant alteration to the legal basis for processing, a change in the primary data residency, or the integration of a Tier-1 Sub-Processor that substantially impacts the data flow—the Company shall employ commercially reasonable efforts to provide direct notification to its Clients via the designated administrative contact channels.
10.4. Hierarchy of Governance: In the event of any irreconcilable conflict between the provisions of this Policy and the data processing stipulations contained within a bespoke Master Services Agreement (MSA), the terms of the MSA shall take precedence, provided that such terms do not violate the mandatory requirements of the prevailing data protection statutes.
10.5. Mechanization of Feedback and Privacy Inquiries: The Company maintains a dedicated Privacy Office to oversee the governance of the infrastructure’s data lifecycle. All inquiries regarding this Policy, requests for Data Processing Addendums (DPAs), or the exercise of statutory rights should be directed to the following verified channels:
10.6. Formal Service of Process and Corporate Ingress: For formal legal notices or communications regarding data sovereignty that require physical service, such correspondence must be directed to the Company’s registered office:
Syntra Nexus Pte. Ltd.
68 Circular Road, #02-01, 049422, Singapore
10.7. Severability and Survival: If any provision of this Policy is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect. All obligations regarding data confidentiality, forensic archival, and indemnification shall survive the termination of the Counterparty’s relationship with the Company in perpetuity.
Financial infrastructure that stays out of the spotlight.
Syntra Nexus Pte. Ltd. (banxtack™) provides software and financial infrastructure while clients retain all regulatory licenses and obligations. All services are subject to applicable laws and regulations in your jurisdiction. banxtack™ does not provide financial advice or hold customer funds.
© 2026 banxtack™. All rights reserved.