Legal — 02
Privacy Policy
Last updated: July 16, 2025
At saf., a digital-asset services provider based in El Salvador, we protect the privacy and personal data of our customers and partners. This policy describes how we collect, use, store and protect personal data in accordance with El Salvador's Personal Data Protection Law.
We act as data controller under the principles of accuracy, fairness, consent, minimization, transparency, security, lawfulness, time limitation and demonstrated accountability.
Data controller
SAF SV, S.A.S. de C.V.
Calle El Mirador, entre 87 y 89 Av. Norte, Col. Escalón, Oficina SNBX, Plaza Futura, San Salvador, El Salvador
Data Protection Officer: ilse@saf.money
Data we collect
We collect data needed to provide our services: identification (full name, date of birth, nationality, ID document, address, email and phone), financial information (bank details, transaction history), KYC/AML verification data (identity documents, selfies and biometric data for facial recognition), and usage data (IP address, activity logs).
For commercial partners we also collect basic corporate information. Sensitive data is only processed with express consent. We apply the data-minimization principle.
How we collect data
Directly from you when you register, complete forms or interact with the platform; from third parties and commercial partners with your consent; and from public or official sources.
Purposes of processing
Primary purposes: verify your identity, comply with legal obligations, process transactions, manage accounts, maintain platform security, and meet regulatory requirements.
Secondary purposes (require express consent): commercial communications, statistical analysis and service improvement.
We retain data only as long as needed: 5 years for tax purposes, 15 years for transaction records under compliance rules, or until you withdraw consent.
Legal basis
We process your data on the basis of your consent, contract performance, compliance with legal obligations (including anti-money-laundering rules), our legitimate interests, and protection of vital interests where applicable.
Data sharing & transfers
We share data only where necessary and, unless an exception applies, with your consent: with data processors under contract, with commercial partners for joint services, and through international transfers to jurisdictions with adequate protection or equivalent contractual safeguards.
We do not sell or trade your personal data.
Security measures
We implement technical, administrative and physical safeguards: encryption in transit and at rest, role-based access control, continuous monitoring, multi-factor authentication (MFA), limited retention policies and backup procedures.
We operate on Amazon Web Services (AWS), aligned with standards such as ISO 27001, SOC 2 and zero-trust principles. In the event of a notifiable security breach we will inform the ACE, the Attorney General and affected data subjects within 72 hours.
Your rights
As a data subject you can exercise rights of Access, Rectification, Cancellation, Opposition, Portability, Erasure and Restriction of processing, subject to legal exceptions.
To exercise them, send a request to the Data Protection Officer at ilse@saf.money, including your name, identification and a clear description of the right invoked. We respond within 20 business days. Exercising your rights is free of charge, except for reproduction or delivery costs.
Changes to this policy
We will notify changes by email or via our website with at least 15 days' notice. Changes take effect upon publication, unless new consent is required.
Contact
Data Protection Officer: ilse@saf.money
Calle El Mirador, entre 87 y 89 Av. Norte, Col. Escalón, Oficina SNBX, Plaza Futura, San Salvador, El Salvador
If you believe your rights have been violated, you may file a complaint with the State Cybersecurity Agency (ACE).