# Privacy Policy

**⚠️ SAMPLE DOCUMENT — REPLACE WITH FINAL LEGAL TEXT BEFORE PRODUCTION ⚠️**

## 1. Data We Collect
- Company registration details
- Director names, dates of birth, nationalities (for KYB/UBO)
- Contact information (email, phone, address)
- Banking data (IBAN, account name) where applicable
- Platform usage logs

## 2. How We Use Your Data
- To provide the Platform services
- To comply with KYB/AML/sanctions obligations
- To communicate with you about your account
- To prevent fraud and abuse

## 3. Third-Party Sharing
We share data with:
- Fintradax (KYB/AML screening provider)
- Xero (when you authorise connection)
- Regulators and law enforcement (where legally required)

## 4. Retention
We retain records for at least 7 years in line with financial regulation requirements.

## 5. Your Rights (GDPR)
- Right of access
- Right of rectification
- Right to erasure (where not overridden by legal retention)
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with a supervisory authority

## 6. Security
We apply industry-standard technical and organisational measures, including encryption in transit, access controls, and audit logging.

## 7. Contact
Data Protection Officer: [TBC]

---
*Last updated: Sample v1.0 — this is placeholder text pending final legal review.*