Privacy Policy

Last Updated: October 2025

OBAN Limited, trading as SettlePal (“we”, “us”, “our”), respects your privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect your information when you use our services.

1. Who We Are

OBAN Limited is incorporated in the British Virgin Islands and is authorized by the BVI Financial Services Commission (FSC) as a Virtual Asset Service Provider (VASP). As a regulated entity, we adhere to strict data protection, Know Your Customer (KYC), Anti-Money Laundering (AML), sanctions screening, and counter-terrorist financing standards.

2. Information We Collect

We collect information to provide institutional settlement services, operate our platform, protect against fraud, and comply with financial regulations.

Identity Information: Name, date of birth, government-issued ID, proof of address, corporate documentation, beneficial ownership information, and other verification materials required for KYC and AML checks.
Contact Information: Email address, phone number, business contact details, and social media or messaging handles where you choose to contact us through those channels.
Financial and Transaction Information: Wallet addresses, transaction history, settlement preferences, payment information, source-of-funds information, and records required for compliance and reporting purposes.
Sensitive financial data is collected solely through our secure encrypted portal or approved onboarding channels, not through public advertising forms.
Usage and Device Data: IP address, browser type, operating system, device identifiers, referral URLs, website interactions, session data, and analytics data relating to how you use our website and services.
Communications Data: Records of correspondence with us, including support requests, onboarding communications, compliance queries, and service-related messages.

3. Cookies, Tracking Technologies, and Advertising

We use cookies, pixels, web beacons, and similar technologies to operate our website, improve user experience, analyze traffic, and measure the effectiveness of our advertising campaigns.

Essential Cookies

Certain cookies are necessary for the operation and security of our platform, including authentication, fraud prevention, session management, security monitoring, and website functionality.

Analytics and Advertising Cookies

With your consent where required by law, we may use analytics and advertising technologies provided by third parties such as Meta (Facebook) and Google.

These technologies may collect information regarding:

Device identifiers
Browser activity
IP address
Website interactions
Referral URLs
Advertising engagement data

Meta Pixel and Custom Audiences

We use the Meta Pixel and related technologies to measure campaign effectiveness, understand user interactions, and deliver relevant advertising.

We may share limited hashed identifiers, such as encrypted email addresses, with advertising partners including Meta and Google solely for attribution, audience matching, and advertising measurement purposes.

Consent Management

Where required under applicable law, non-essential cookies and advertising technologies will only be activated after you provide consent through our cookie management tools.

You may withdraw or modify your consent preferences at any time through our website cookie settings.

Opt-Out Options

Meta (Facebook): https://www.facebook.com/adpreferences/ad_settings
Google Ads Settings: https://adssettings.google.com
General EU Opt-Out: https://www.youronlinechoices.eu
General US Opt-Out: https://optout.aboutads.info

4. How We Use Your Information

We use your information to:

Verify identity and complete KYC, AML, sanctions screening, and fraud prevention checks.
Provide, operate, maintain, and improve SettlePal’s settlement services.
Process, monitor, and settle transactions.
Maintain account records, transaction records, compliance logs, and audit trails.
Detect, prevent, and investigate fraud, unauthorized activity, suspicious transactions, and security incidents.
Comply with legal, regulatory, reporting, and law enforcement obligations.
Communicate with you about onboarding, account activity, service updates, compliance matters, and support requests.
Marketing and Analytics: Analyze platform performance, measure campaign effectiveness, and deliver updates or offers regarding our services, subject to applicable consent and opt-out requirements.

5. Legal Basis for Processing

We process personal data under one or more of the following legal bases:

Contractual Necessity

Processing necessary to provide our services, maintain accounts, process settlements, and fulfill our contractual obligations.

Legal and Regulatory Obligations

Processing necessary to comply with applicable laws, including AML, KYC, sanctions screening, fraud prevention, regulatory reporting, recordkeeping, and law enforcement obligations.

Legitimate Interests

Processing necessary for:

Platform security
Fraud prevention
Business analytics
Service improvement
Limited direct marketing communications

Where we rely on legitimate interests, we balance those interests against users’ privacy rights.

Consent

Where required by law, we rely on user consent for:

Advertising cookies and tracking technologies
Certain marketing communications
Optional promotional activities

Users may withdraw consent at any time.

6. Sharing of Information

We may share personal data where necessary to provide our services, comply with legal obligations, protect our platform, and support legitimate business operations.

Regulators and Law Enforcement: Information may be shared where required by BVI law, applicable regulation, court order, lawful request, international treaty, or competent authority.
Service Providers: Entities assisting with KYC checks, AML screening, sanctions screening, transaction routing, payment processing, cloud hosting, cybersecurity, analytics, customer support, or secure data storage.
Banking, Liquidity, and Settlement Partners: Where necessary to process, monitor, verify, or settle transactions.
Advertising Partners: Limited hashed identifiers may be shared with platforms such as Meta and Google for attribution, audience matching, and advertising measurement, subject to applicable law and consent requirements.
Professional Advisers: Lawyers, auditors, consultants, insurers, and other advisers where necessary for compliance, risk management, dispute resolution, or business operations.

We do not sell personal data to third parties.

6A. International Data Transfers

As an international financial technology platform, your personal data may be processed or stored in jurisdictions outside your country of residence, including jurisdictions that may not provide the same level of data protection as the European Economic Area or the United Kingdom.

Where required by applicable law, we implement appropriate safeguards for international data transfers, including contractual protections and reliance on service providers maintaining recognized security and compliance standards.

7. Data Retention

We retain personal data only as long as necessary to:

Provide services and maintain account and activity records.
Comply with legal and regulatory obligations, including AML, KYC, sanctions, audit, and reporting requirements.
Resolve disputes, investigate suspicious activity, and enforce agreements.
Maintain security, fraud prevention, and compliance records.
Lead Data: Marketing form data that does not result in an active account is deleted or anonymized after 12 months, unless a longer retention period is required for legal, regulatory, compliance, fraud prevention, or dispute-resolution purposes.

Financial, compliance, and transaction records may typically be retained for 5–7 years or longer where required by applicable law, regulation, regulator instruction, litigation hold, or compliance obligation.

8. Security

We use technical and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These safeguards may include encryption, access controls, secure onboarding portals, monitoring, internal policies, vendor due diligence, and restricted access to sensitive data.

While no system is completely risk-free, we apply security measures appropriate to the nature of the data we process and the risks associated with regulated financial technology services.

9. Your Privacy Rights

Depending on your jurisdiction and applicable law, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your personal data, subject to legal and regulatory retention obligations.
Restrict or object to certain processing activities.
Withdraw consent where processing is based on consent.
Request portability of your personal data.
Object to direct marketing communications.
Lodge a complaint with a competent data protection authority.

To exercise your rights, contact us at:
📧 support@settlepal.com

We may request identity verification before processing certain requests.

10. Contact Us

For questions about this Privacy Policy or your data rights:
OBAN Limited (trading as SettlePal)
Authorized VASP under the BVI FSC

📧 support@settlepal.com

11. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes.

Where required by applicable law, we will notify users of material changes through appropriate communication channels.

The updated version will always be available on this page with the revised “Last Updated” date.