Legal & Compliance
How we collect, use, and protect your data across every market we operate in — built on GDPR, CCPA, and comparable global standards.
Last Updated: 21 August 2026
Introduction
This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our websites, including y9k.ai and any successor or country-specific Y9K websites, use any Y9K product or Service that has been made available to you from time to time, including, where available, Y9K Bank, Y9K Vault, or Y9K Marketplace (together, the "Services"), interact with our chatbot/virtual financial assistant, or otherwise communicate with us (e.g., as a merchant, supplier, investor, partner, or job applicant) — wherever in the world you are located.
Y9K is expanding across multiple markets, and this Policy is written to apply globally rather than to a single jurisdiction. It is built on a common set of internationally recognized data protection principles — lawfulness, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability — reflected in frameworks such as the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and comparable data protection laws across Africa.
Where a specific country in which we operate has data protection laws that impose additional or different obligations — for example, a specific regulator, additional rights, or stricter transfer rules — those local requirements apply on top of this global Policy for users in that country. In case of any conflict between this global Policy and a mandatory local law, the local law will govern for users in that jurisdiction.
If you do not agree with this Policy, please do not use our website or Services.
Personal Data We Collect
We collect the following categories of data, depending on how you interact with us:
2.1 Information you give us directly
Contact and enquiry data: name, email address, and message content submitted through our "Get in Touch" form, including your reason for contacting us (Investing, Partnership, or Support).
Account and onboarding data (for merchants/users of Y9K Bank, Vault, or Marketplace): full name, phone number, email, national ID or business registration details, date of birth, business name and location, business type, and bank/mobile money details.
Identity verification (KYC/KYB) data: government-issued ID documents, business permits, proof of address, photographs/selfies for liveness checks, and other documents required for Know-Your-Customer/Know-Your-Business and anti-money-laundering (AML) checks.
Financial and transaction data: wallet balances, transaction history, order and repayment history, credit limits, remittance and cross-border transfer details, currency pairs, and payment instrument information.
Communications: records of correspondence with our support team or virtual assistant (chatbot).
2.2 Information collected automatically
Trade and behavioural data: order frequency, stock reorder patterns, supplier interactions, sales records used to build merchant credit and risk profiles.
Device and usage data: IP address, device identifiers, browser type, operating system, pages visited, referral source, and timestamps, collected via our website and apps.
Location data: approximate or precise location (e.g., country/city, or GPS where enabled) used for onboarding, fraud checks, delivery logistics, and regulatory purposes.
Cookies and similar technologies: see Section 8 below.
2.3 Information from third parties
Credit bureaus, mobile network operators, banking partners, payment processors, and identity-verification providers.
Publicly available business registries and sanctions/watchlist databases (for AML/compliance screening).
Referral information from other merchants, suppliers, or partners.
How We Use Personal Data
We use personal data for the following purposes:
Automated Decision-Making
Some of our processing — in particular credit scoring, risk assessment, smart pricing, and fraud detection — relies on automated or AI-assisted systems that analyze your trade and transaction history. These systems may produce decisions that affect your access to credit, pricing, or account status. Where such decisions have a legal or similarly significant effect on you, and where required by applicable law, you may have the right to request human review, obtain an explanation of the decision, and contest it (see Section 7).
Legal Bases for Processing
We process personal data only where we have a valid legal basis to do so. Depending on your location and applicable law, we rely on one or more of the following:
Performance of a contract — to provide the account, wallet, credit, or marketplace services you request.
Legal obligation — to comply with KYC/AML, tax, and financial regulatory requirements in the country where the Services are provided.
Legitimate interests — for fraud prevention, credit risk management, and product improvement, balanced against your rights and interests.
Consent — for marketing communications and non-essential cookies, which you may withdraw at any time.
Vital interests / public interest — in limited circumstances, such as preventing financial crime or responding to a legal emergency.
Where local law defines these bases differently (for example, "opt-out" rights under U.S. state privacy laws rather than "consent"), we apply the standard that gives you the stronger protection.
How We Share Personal Data
We do not sell personal data for monetary consideration. Where applicable law treats certain advertising, analytics, or other disclosures as a "sale" or "sharing" of personal data, we provide the rights required under applicable law. We may share personal data with:
Banking, payment, and treasury partners that help process wallets, credit, and cross-border settlements (including stablecoin/digital-asset infrastructure providers).
Suppliers and logistics partners on the Marketplace, to the extent needed to fulfil and deliver orders.
Identity verification, credit bureau, and fraud-prevention vendors.
Cloud hosting, analytics, and IT service providers, acting under contractual data protection obligations.
Regulators, law enforcement, and courts, where required by law.
Professional advisers (auditors, lawyers) and prospective investors/acquirers, in connection with fundraising, audits, or corporate transactions, subject to confidentiality obligations.
Affiliates within the Y9K group (Bank, Vault, Marketplace), to operate the connected ecosystem described on our website.
International Data Transfers
As a company operating across multiple markets — and using banking, cloud, and technology infrastructure providers that may be located in other countries — personal data may be transferred to, stored in, or accessed from countries other than the one in which you are located, including countries whose data protection laws may differ from your own.
Where required by applicable law, we implement appropriate safeguards for international transfers of personal data, which may include standard contractual clauses or equivalent transfer mechanisms, adequacy determinations, binding corporate agreements with our affiliates and vendors, and contractual data protection and security obligations imposed on recipients.
Your Rights
Subject to the law that applies in your country, you have the right to:
Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion of your data, subject to our legal and regulatory retention obligations (e.g., AML record-keeping).
Restrict or object to certain processing, including profiling used for credit scoring or marketing.
Data portability, where technically feasible.
Withdraw consent at any time, where processing is based on consent.
Opt out of the sale or sharing of personal data and of certain automated profiling, where such rights exist under local law (e.g., U.S. state privacy laws).
Non-discrimination — we will not penalize you for exercising your privacy rights.
Lodge a complaint with your local data protection or privacy regulator. Where we have identified the relevant authority for your country, we will name it in a local addendum to this Policy or on request; if none is publicly designated yet in a market we newly enter, you may still contact us directly and we will route your request appropriately.
Not every right listed above will be legally available in every country, but as a matter of practice we aim to honor requests consistent with the spirit of this list wherever we operate, unless doing so would conflict with a legal or regulatory obligation (such as AML recordkeeping).
To exercise these rights, contact us at privacy@y9k.ai. We will verify your identity before acting on a request and will respond within the timeframe required by applicable law and, where no statutory timeframe applies, within a reasonable period.
Cookies and Tracking Technologies
Our website uses cookies and similar technologies to operate core functionality, remember preferences, and understand site usage. You can control cookies through your browser settings. Disabling certain cookies may limit some website functionality.
Data Retention
We retain personal data only as long as necessary to:
Provide the Services and maintain your account;
Meet legal, regulatory, tax, and AML record-keeping obligations (which in financial services can require retention for several years after the end of a relationship); and
Resolve disputes and enforce our agreements.
When data is no longer needed, we securely delete or anonymize it.
Data Security
We implement technical and organizational measures — including encryption, access controls, and monitoring — designed to protect personal data against unauthorized access, loss, misuse, or alteration. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Children's Privacy
Our Services are intended for businesses and individuals who are at least 18 years old and legally able to enter into financial transactions. We do not knowingly collect personal data from children.
Third-Party Links
Our website may link to third-party sites (e.g., LinkedIn, media coverage). We are not responsible for the privacy practices of those third parties, and we encourage you to review their policies.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, products, or legal requirements. We will post the updated version on this page with a revised "Last Updated" date, and where changes are material, we will provide additional notice (e.g., via email or in-app notification).
Contact Us
If you have questions, requests, or complaints about this Privacy Policy or how we handle your personal data, please contact:
Email: privacy@y9k.ai
Investors & Partners
