Introduction
At Hawala Technologies, Inc.(Delaware File Number 10219604) (“Hawala,” “we,” “us,” or “our”), protecting your privacy and maintaining the security of your personal information is fundamental to our mission of providing trusted financial services across the MENA region and beyond. This Privacy Policy explains how we collect, use, share, and protect your information when you use our mobile application, website, and related services (collectively, the “Services”).
By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your information as described herein. If you do not agree with our practices, please do not use our Services.
This Privacy Policy works in conjunction with our Terms and Conditions. Where terms are not defined in this Privacy Policy, they have the meaning given to them in our Terms and Conditions.
Key Privacy Principles
Our Commitment to Your Privacy
We are committed to maintaining the highest standards of privacy protection and transparency in how we handle your personal information.
- Transparency: We are clear and open about what information we collect, why we collect it, and how we use it. We believe you have the right to understand exactly how your data is being processed.
- Purpose Limitation: We only collect personal information that is necessary for providing our Services and complying with legal obligations. We do not collect excessive data or use your information for unrelated purposes.
- Security First: We implement industry-standard security measures to protect your information from unauthorized access, disclosure, alteration, and destruction. Your financial data is encrypted both in transit and at rest.
- User Control: We provide you with meaningful choices about your personal information, including the ability to access, correct, delete, and port your data, subject to legal and operational requirements.
- Regulatory Compliance: We adhere to applicable data protection laws and regulations in all jurisdictions where we operate, including GDPR, CCPA, and regional data protection frameworks in the MENA region.
Information We Collect
3.1. Information You Provide Directly
When you create an account and use our Services, you provide us with:
- Account Information: Full name, email address, phone number, date of birth, and residential address
- Identity Documents:Government-issued ID (passport, driver’s license, or national ID card), selfies for biometric verification, and proof of address documents
- Financial Information: Bank account details, payment card information, transaction history, and source of funds documentation when required
- Transaction Details: Recipient information, transfer amounts, currency preferences, and transaction purposes
- Communications: Messages you send to our support team, feedback, and survey responses
3.2. Information Collected Automatically
When you use our Services, we automatically collect certain technical information:
- Device Information: Device type, operating system, unique device identifiers, mobile network information, and hardware model
- Usage Data: App features used, pages visited, time spent on pages, click patterns, and interaction with app elements
- Location Information: Approximate location based on IP address and, with your permission, precise GPS location for fraud prevention and service optimization
- Log Data: IP addresses, browser type, access times, referring URLs, and error logs
3.3. Information from Third Parties
We may receive information about you from:
- Identity Verification Services: Results of identity checks, sanctions screening, and background verification from our KYC/AML service providers
- Financial Partners: Transaction confirmations and account verification from banks and payment processors
- Credit Reference Agencies: Credit checks and financial history where permitted by law and with your consent
- Public Sources: Information from public databases and registries for compliance and verification purposes
3.4. Permissions-Based Information
With your explicit permission, we may access:
- Contacts: To help you send money to people in your contact list more easily
- Camera and Photos: For document scanning, identity verification, and QR code scanning
- Biometric Data: Fingerprint or facial recognition for secure app access (stored locally on your device)
You can manage these permissions through your device settings at any time.
How We Use Your Information
4.1. Service Provision and Management
- Create and manage your Hawala account
- Process your money transfers and currency exchanges
- Facilitate cash pickups through our partner network
- Provide customer support and respond to inquiries
- Send transaction confirmations and service updates
4.2. Security and Fraud Prevention
Protecting You and Our Community
We use advanced analytics and monitoring systems to detect and prevent fraudulent activities, protecting both your account and our broader user community from financial crimes.
- Verify your identity and authenticate transactions
- Detect and prevent fraud, money laundering, and terrorist financing
- Monitor for unusual account activity and suspicious transactions
- Conduct risk assessments and security audits
- Investigate security incidents and policy violations
4.3. Legal and Regulatory Compliance
- Comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements
- Screen against sanctions lists and politically exposed persons databases
- Report suspicious activities to relevant authorities as required by law
- Respond to legal requests and court orders
- Maintain transaction records as required by financial regulations
4.4. Service Improvement and Development
- Analyze usage patterns to improve user experience
- Develop new features and services based on user needs
- Conduct research and analytics to understand market trends
- Test and optimize our Services for performance and reliability
4.5. Marketing and Communications
With your consent, we may use your information to:
- Send promotional offers and updates about new features
- Provide personalized recommendations and content
- Invite you to participate in surveys and user research
- Keep you informed about changes to our Services
You can opt out of marketing communications at any time through your account settings or by clicking the unsubscribe link in our emails.
Identity Verification & Compliance
Why We Verify Your Identity
Identity verification is essential for maintaining a secure financial ecosystem. It helps us prevent fraud, comply with regulations, and ensure that our Services are used legitimately. While we understand this process may seem intrusive, it is designed to protect you and all our users from financial crimes.
6.1. Verification Process
Our multi-layered verification process includes:
- Document Verification: We use advanced technology to verify the authenticity of your government-issued ID and ensure it matches your provided information
- Biometric Matching: We compare your selfie with your ID photo to confirm you are the person in the document
- Liveness Detection: We use technology to ensure the selfie is taken in real-time and prevent spoofing attempts
- Address Verification: We confirm your residential address through utility bills or bank statements
- Enhanced Due Diligence: For high-value transactions or risk factors, we may request additional information about your source of funds
6.2. Ongoing Monitoring
To maintain the integrity of our platform and comply with regulations, we conduct:
- Regular sanctions screening against global watchlists
- Transaction monitoring for unusual patterns or activities
- Periodic review of account information and activity
- Risk-based assessments based on transaction history and behavior
6.3. Data Minimization in Compliance
While regulatory requirements mandate certain data collection, we apply data minimization principles:
- We only collect information required by law or necessary for risk management
- Verification data is securely stored and access is strictly limited
- We delete verification documents after the required retention period
- Biometric data is converted to mathematical templates and original images are deleted
Data Security
7.1. Technical Safeguards
We implement comprehensive technical measures to protect your information:
- Encryption: All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption
- Secure Infrastructure: Our systems are hosted in SOC 2 Type II certified data centers with redundant security controls
- Access Controls: Multi-factor authentication, role-based access, and principle of least privilege
- Network Security: Firewalls, intrusion detection systems, and DDoS protection
- Application Security: Regular security testing, code reviews, and vulnerability assessments
7.2. Organizational Measures
- Background checks for all employees with access to user data
- Regular security training and awareness programs
- Strict confidentiality agreements with all staff and contractors
- Incident response procedures and breach notification protocols
- Regular third-party security audits and certifications
7.3. Your Security Responsibilities
You play a crucial role in protecting your account:
- Use a strong, unique password for your Hawala account
- Enable biometric authentication where available
- Never share your login credentials or verification codes
- Report suspicious activity immediately
- Keep your app and device software updated
Security Incident Reporting
If you suspect any unauthorized access to your account or discover a security vulnerability, please contact us immediately at support@usehawala.com. We take all reports seriously and will investigate promptly.
Data Retention
8.1. Retention Periods
We retain your information for as long as necessary to provide our Services and comply with legal obligations:
- Account Information: Retained while your account is active and for up to 7 years after closure as required by financial regulations
- Transaction Records: Maintained for 5-7 years depending on jurisdictional requirements
- Identity Verification Documents: Retained for the regulatory period, then securely deleted
- Communications: Customer service interactions retained for 3 years for quality and training purposes
- Marketing Preferences: Updated immediately upon request and retained to ensure we honor your choices
8.2. Deletion and Anonymization
When retention periods expire or upon valid deletion requests:
- Personal data is permanently deleted from our active systems
- Backup systems are purged according to rotation schedules
- Some data may be anonymized for statistical analysis instead of deletion
- Certain records may be retained longer if subject to legal holds
International Data Transfers
9.1. Cross-Border Operations
As a global financial service, your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from those in your country.
9.2. Transfer Safeguards
We ensure appropriate safeguards for international transfers:
- Standard Contractual Clauses: We use EU-approved standard contractual clauses for transfers from the EEA
- Adequacy Decisions: Where available, we rely on adequacy decisions by data protection authorities
- Privacy Shield Principles: We adhere to Privacy Shield principles even though the framework has been invalidated
- Supplementary Measures: Additional technical and organizational measures to ensure data protection
9.3. Data Localization
Where required by local law, we store and process certain data within specific jurisdictions. We maintain data centers and processing facilities in multiple regions to comply with data localization requirements while ensuring service quality.
Your Privacy Rights
You Are in Control
We respect your rights regarding your personal information. Depending on your location, you may have additional rights under local data protection laws. We will honor all valid requests regardless of your location.
10.1. Your Rights Include
- Access: Request a copy of the personal information we hold about you
- Correction: Update or correct inaccurate or incomplete information
- Deletion: Request deletion of your personal information, subject to legal requirements
- Portability: Receive your data in a structured, machine-readable format
- Restriction: Limit how we process your information in certain circumstances
- Objection: Object to processing based on legitimate interests or for direct marketing
- Withdrawal of Consent: Withdraw consent for processing where we rely on consent
- Non-Discrimination: Not be discriminated against for exercising your privacy rights
10.2. How to Exercise Your Rights
To exercise any of these rights:
- Access your account settings in the Hawala app
- Email our privacy team at support@usehawala.com
We will respond to your request within 30 days (or sooner if required by law). We may need to verify your identity before processing your request.
10.3. Limitations on Rights
In some cases, we may not be able to fulfill your request:
- When required to retain data by law or for legitimate business purposes
- If deletion would impair fraud prevention or security measures
- When data is necessary for pending transactions or contractual obligations
- If the request is manifestly unfounded or excessive
We will always explain our reasoning if we cannot fulfill your request.
Children’s Privacy
Hawala’s Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you are under 18, you may not use our Services or provide any personal information to us.
If we learn that we have collected personal information from a child under 18, we will take steps to delete that information as quickly as possible. If you believe we may have information from or about a child under 18, please contact us immediately at support@usehawala.com.
Third-Party Services
13.1. Third-Party Links
Our Services may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.
13.2. Third-Party Integrations
If you connect third-party services to your Hawala account (such as bank accounts or other financial services), we will receive information necessary to provide the integrated service. These integrations are governed by both our Privacy Policy and the third party’s privacy practices.
13.3. Social Media Features
Our Services may include social media features that may collect information about your interaction with these features. These features are governed by the privacy policies of the companies providing them.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes:
- We will update the “Last Updated” date at the top of this policy
- We will notify you through the app, email, or other prominent notice
- For significant changes, we may require you to acknowledge the updated policy
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our Services after changes become effective constitutes acceptance of the updated Privacy Policy.
Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:
Hawala Technologies, Inc.
Privacy Team
Support: support@usehawala.com
Website: www.usehawala.com/privacy
Contact Form: www.usehawala.com/contact
Supervisory Authority:
If you are located in the European Economic Area and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.
Thank you for trusting Hawala with your personal information. We are committed to protecting your privacy and providing transparent, secure financial services.