1. Overview and Scope of the Policy

1.1. Introduction and Overview

This privacy policy describes how Trumia (“We, Us, Our”) collects, uses, discloses, transfers, stores, retains, or otherwise processes your information when you visit our website, web application, mobile application, or sign up for a Trumia account (collectively, “Services”).

By continuing your interactions with us, such as by submitting information to us, or using our Services, you confirm that you understand the collection, use, disclosure, and processing of your personal data as described in this Privacy Policy. For the purposes of the EU General Data Protection Regulation (GDPR), the Data Controller is:

Trumia Ltd
Quad Central, Q3 Level 3 Triq l-Esploraturi, Zone 1, Central Business District Birkirkara MALTA CBD 1040.
Email: contactus@trumia.com

1.2. Scope

This Privacy Policy applies to you if you sign up to use Trumia’s services as an individual. It does not extend to your use of other services not owned or managed by Trumia.  Our Services are not intended for individuals under the age of eighteen (18). For our business customers for whom we serve as data processors, kindly refer to the Data Privacy Notice (Business).

2. Collection and Processing of Personal Data

We are bound by data protection laws to respect and protect any personal data we collect from you and we will make our best efforts to abide by such duty.  
We can only use your personal data if we have a lawful reason for doing so. In terms of the data protection laws, we process personal data if you have given us your consent, or it is necessary:

1. for our legitimate interests
2. to carry out our contractual obligations,
3. to comply with a legal obligation, or
4. for any other relevant legal basis set out in the GDPR

2.1 Personal Data We Collect Directly From You:

• ‍Registration/Login information: By registering as account holder and user of our services (or by completing the registration form), the information provided shall be used for the identification of the user and for account management purposes. This information may include, but not limited to the following information: your name, surname, date of birth, email address, address, phone number, occupation, gender, PEP status, IP-address, device, utility bills, bank statements, social security number/national identification number, passport and/or National ID, and any other mandatory details as might be requested at any and all time from you for the purpose of registration and/or continued use of the service. In addition, we may collect certain information as required under various regulations, as well as Know Your Client (“KYC”) and Anti-Money Laundering (“AML”) regulatory requirements, such as your source of funds. The said data is processed in order for the Company to perform its contractual and regulatory obligation with its users and also pursuant to the legitimate interests of the Company.
• ‍Live Chat/Support/Contact Form: We monitor and/or record your conversations with us and retain the recordings for such periods as may be necessary to handle your inquiries for customer support and/or security purposes, or as may be required by law and/or in the best interest of the Company.
  Payment/Financial Information: Any provided account, credit or debit card details, bank account, amount sent or requested, or other information regarding payment transactions will be collected in order to fulfill the payment services requested by you.‍
• Identification Documentation: We collect and store uploaded documents, in order to identify customers, to process your requests and/or to comply with effective laws and regulations including Anti-Money Laundering laws. These documents are also used for the purpose of prevention and detection of fraud, prevention of money-laundering and terrorist funding.‍
• Voluntary Information: We also collect information which you provide to us voluntarily in order to personalize your account or for a specific function. For example, you can provide your gender, date of birth, age, and interests as well as other additional information about yourself which you voluntarily provide at your discretion for a specific function. In addition, we collect your communication when you respond to communications from us, provide us with feedback, communicate with us via email or share additional information about yourself through your use of the Service.‍
• Biometric Information: When you consent in the user experience, we may, through our service providers, collect photo identification or face scans to verify your identity and authenticate you for certain actions related to your account. This includes meeting regulatory requirements, accessing accounts and services, recovering passwords, updating profile information, and managing payments and payment methods.

2.2 Personal Data We Collect From Third Parties‍

We may collect personal data from third party service providers which is relevant to the provision of the services. This may include:

• The bank account or payment service providers you use to transfer money to us will provide us with your personal data, including full name and financial information.
• Advertising networks/partners, analytics providers, and search information providers may provide us with aggregated or pseudonymised data about you.
• Government or public databases to confirm your identity and/or combat fraud.
  We may also use publicly available information about you from selected social media websites or applications to carry out enhanced due diligence checks.

‍2.3 Personal Data Collected From Your Use Of Our Services

• ‍Technical information: In order to enhance the functionality of the service and to provide you with a better user experience, we collect technical information transmitted by your device, including certain software and hardware information (e.g. the type of browser and operating system your device uses, language preference, access time and the domain name of the website from which you linked to the Service, etc.).
• Analytics information: We collect information about your use of the service, such as applications usage, log files, user activity (e.g., pages viewed, user movements, time spent, online browsing, clicks, actions, etc.), time stamps, alerts, etc. This information is collected for amongst other things troubleshooting errors and bugs as well as for research and analytics purposes about your use of the Service. We may also use this information to improve our service offerings to you.

The below table sets out the types of personal data that we may process, why we collect them and the lawful basis:

3. Cookies and Data Tracking

We use cookies and similar tracking technologies ("Tracking Technologies") on our websites.
The Tracking Technologies automatically collect information about you, your online behavior on the websites, and your device (for example, your computer or mobile device), for different purposes, including improving and personalizing your navigation on our Services and enhancing our Services’ performance.
For more information about our use of cookies, refer to our Cookie Policy.

4. With Whom We Share Your Data

We may share your personal data with:

• Our affiliates, subsidiaries, or related companies.
• Your correspondent banks or payment receiver. We may provide them with your identifying information or financial information when our services are used for verifying your identity or account or to prevent money laundering, fraud or other criminal acts or to meet other regulatory and/or legal requirements.
• Business partners and service providers. We may disclose your personal data to third-party service providers that provide us with services. These include credit institutions, payment service providers, payment initiators, acquiring and issuing entities, and also administrative services, cloud storage providers, website hosting providers, consultants, payment processors, marketing affiliates, identity verification and fraud prevention services and our legal service providers.
• Any third parties who provide services in relation to the operation or promotion of our services.
• Auditors, contractors or advisers of any of our business processes;
• To any third parties who investigate, detect or prevent fraudulent or illegal activity (e.g. governmental authorities, police, banks and other investigative organizations);
• Licensing authorities, governmental and regulatory bodies, law enforcement authorities in accordance with applicable laws and regulations; and
• Third parties in the event of or in connection to corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, transfer, divestiture, or sale of all or a portion of our business or assets.
• Third party analytics and advertising companies may also collect personal data through our website and mobile application, including marketing and communications data, demographic data, geolocation data, usage data, and inferences associated with identifiers and device information (such as cookie ID, device ID, and IP address).

5. Marketing and Advertising

We will use your Personal Data, such as your name, home address, email address, telephone number etc., collected by ourselves and/or through our third-party subcontractors for the purpose of providing you with promotional materials via different marketing techniques such as direct email, telephone marketing, SMS and post concerning the Service as well as products, services, websites and applications that may be of interest to you including administering contests, promotions, surveys or other site features which relate to: (i) other companies within the Company's group; or (ii) the Company's business partners and affiliates (collectively: “Marketing Affiliates”), which we believe may interest you.
We may also share and disclose Personal Data with our Marketing Affiliates for the purpose of providing you different marketing offers, which we, or our Marketing Affiliates, believe are relevant for you. Our Marketing Affiliates may use this Personal Data for different marketing techniques, such as direct email, post, SMS, telephone marketing purposes.
We will use your Personal Data for the purpose of providing you with promotional materials solely where we have a legitimate interest in doing so, or where we have obtained your affirmative consent.
You may, at any time, decline receiving further marketing offers from us or from our business partners and marketing affiliates by either: following the links inserted in the promotional emails (e.g., by selecting the opt-out link), by updating the notifications preferences in the personal settings in your account or contacting our customer support or by reaching out to us at contactus@trumia.com. Please note that even if you unsubscribe from our marketing mailing list, we may continue to send you service-related updates and notifications.

‍
6. Transfers of Your Personal Data Outside the EEA

In the event that personal data is stored or transferred outside the EU/EEA, such transfers shall comply with EU/EEA and Maltese data protection laws. Trumia ensures that data is stored or transferred to jurisdictions that provide an adequate level of protection as recognized by the EU/EEA, secured using appropriate technological solutions, and available on a principle of least privilege. Necessary contractual arrangements are in place with third-party providers, in line with the EU Commission’s Standard Contractual Clauses (SCCs) and any additional required measures. Additional information on the transfer mechanisms used can be provided upon request.

7. Personal Data Retention Period

We retain your personal data only for as long as this is necessary to fulfill the purposes for which we collected it and in compliance with applicable laws or regulations.
Upon expiration of the data retention period, we will delete, erase, or anonymise any personal data we have about you.
Should you require further information or clarifications, please do not hesitate to contact us.

8. Your Rights With Respect to Personal Data

You have the following rights if you reside in the EU:

• Right to be Informed: included by being provided with this notice.
• Right of Access: request a copy of your personal data.
• Right to Rectification: request we correct any inaccurate personal data about you.
• Right to be Forgotten: require us to delete your personal data.
• Right to Restriction of Processing: require us to restrict processing your personal data.
• Right to Data Portability: receive your personal data which you provided to us, in a structured, commonly used, and machine-readable format, and transmit that data to another data controller in certain circumstances.
• Right to Object: object to the processing of your personal data in certain circumstances, including continued processing carried out for our legitimate interests.
• Right Not to be Subject to Automated Processing: request not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or significantly affects you.
• Right to Complain to a Data Protection Authority: our supervisory authority is the Office of the Information and Data Protection Commissioner, which may be contacted at:

Information and Data Protection Commissioner
Floor 2, Airways House, High Street, Sliema, SLM 1549. MALTA.
Telephone: (+356) 2328 7100
Email: idpc.info@gov.mt
Website: https://idpc.org.mt/en/Pages/contact/complaints.aspx

Should you require any further information on each of the above rights or would like to exercise any of them, please contact us on www.trumia.com or by email on dpo@trumia.com.

9. Third Party Websites

Our website may contain links to other websites. Please note third party links are not associated with Trumia and we do not have control over how your personal data is collected, stored or used by other websites. Hence, you are advised to refer to their privacy policies prior to providing your data.

10. Protecting Your Personal Data

We are committed to take all appropriate measures to protect the confidentiality and security of the data you provide to us. Trumia has implemented security measures to protect your personal data that we collect from being used or accessed unlawfully or accidentally lost.
We take appropriate organisational and technical measures to secure your personal data and to protect it against unauthorised or unlawful use and accidental loss or destruction, including but not limited to:

• only sharing and providing access to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised basis where possible;
• using secure servers to store your data;
• verifying the identity of any individual who requests access to information prior to granting them access to information;
• using Secure Socket Layer (SSL) protocol (or other similar encryption technologies as may be required from time to time) to encrypt communication to / from our servers; and
• whenever and to the extent possible, we anonymise or pseudonymise the personal data which we hold about you when it is no longer necessary to identify you from such data.

11. Contact Us

You can contact our Data Protection Officer by sending an email to dpo@trumia.com.
You can reach our support department directly by sending an email to contactus@trumia.com.

12. Updates to this Notice

We may update this privacy notice occasionally to keep up with changing legislations, best practices, and the way we process your personal data. Any changes will be immediately placed on our website. We recommend that you check this page regularly to keep up to date.
This Privacy Notice is effective as of May 22, 2024. You can request previous versions of this document by sending us an email at contactus@trumia.com.