Privacy Notice
1. Our approach
We collect only what we need to verify you, run your account, prevent financial crime and meet our legal duties. We do not sell your data. We do not ask for blanket consent to share it. We share it only for the specific reasons listed below. This notice is written with the Somalia Data Protection Act 2023 and US financial privacy law (the Gramm-Leach-Bliley Act) in mind.
2. What we collect
| Category | Examples |
|---|---|
| Identity | Name, date of birth, ID document images, selfie or liveness video, nationality |
| Contact | Phone number, email address, physical address |
| Financial | Mobile money or bank account used for funding, deposits, balance, card spend, merchants used |
| Device and usage | Device identifiers, IP address, app activity, login history |
| Enhanced (only if we ask) | Source of funds or extra documents, when needed for higher limits or a compliance review |
| Support | Messages you send us, including through WhatsApp |
3. Why we use it
- To provide the service: opening your account, funding, issuing cards, paying merchants and support.
- To meet legal duties: identity verification, sanctions screening, anti-money-laundering monitoring, reporting and record-keeping.
- To prevent fraud and protect accounts: spotting shared devices, linked accounts or unusual activity.
- To improve the service: using aggregated or de-identified data only.
We do not use your data for third-party advertising.
4. Who we share it with
- Service providers, sharing only the minimum each one needs. These include identity verification, sanctions screening, transaction monitoring, card issuing, payment and collection partners, cloud hosting and support tools. They are bound by contract to protect your data and use it only for us.
- Fraud and financial-crime partners, where needed to prevent or investigate fraud or money laundering.
- Authorities, where the law requires it (see section 5).
- A successor company, if Baasto is merged or sold, under the same protections.
5. Government requests
We disclose data to government bodies in the US or Somalia only in response to valid legal process, or where the law requires us to report, such as suspicious activity reporting. We review every request and disclose only what is required. Where the law allows, we tell you about a request.
6. Where it's stored
Your data is stored and processed on secure cloud infrastructure in the United States. It is encrypted in transit and at rest. Some of our providers may process data in other countries under contractual safeguards.
7. How long we keep it
We keep account, verification and transaction records for at least 5 years after your account closes, as anti-money-laundering law requires, and longer where a legal hold applies. Waitlist and website enquiries are deleted within 24 months if you don't become a customer.
8. Security
Our safeguards include encryption, least-privilege access, access logging, automated backups and staff training. Verification data is never stored on staff personal devices.
9. Your rights
Subject to the law, you can ask to access, correct or delete your data, object to certain uses, or receive a copy. Some data can't be deleted while we're legally required to keep it. Contact us using the details in section 11. You may also complain to the relevant data protection authority.
10. Website and waitlist
This website has no advertising or tracking cookies. If you join a waitlist or contact us, we use your details only to reply and to manage early access.
11. Changes and contact
We'll notify you before material changes take effect. For questions or requests, email privacy@baasto.com.