Privacy Policy

This policy explains how Secret Intelligence Private Limited, a company incorporated in Singapore and operating as FiatDesk (FiatDesk, we, us), collects, uses, discloses and protects personal data. We handle personal data in accordance with Singapore’s Personal Data Protection Act 2012 (PDPA) and other laws that apply to us.

1. Who this policy covers

• visitors to fiatdesk.com and the FiatDesk Wiki
• people who contact us or book a call with us
• directors, shareholders, beneficial owners, authorised signatories and staff of businesses that apply to use, or use, FiatDesk (clients)

2. Personal data we collect

When you visit the website

We do not use analytics, advertising or tracking cookies, and we do not set cookies of our own. Like any website, the services that deliver our pages receive your IP address and browser details when you visit (see section 5).

When you contact us or book a call

Your name, email address, company, role, the time you book and anything you tell us about your business and payment flows.

When your business applies to use FiatDesk or uses it

To meet anti-money laundering, counter-terrorist financing and sanctions obligations, we and our partner banks collect:

• identity data: full name, date of birth, nationality, residential address, identity documents and their images, and the results of identity and liveness checks
• company data: incorporation documents, licences, ownership and control structure, and details of directors, shareholders and beneficial owners
• source of funds and source of wealth information, and the expected nature and volume of your business
• wallet addresses, transaction data, and the results of wallet screening and blockchain analytics
• sanctions, politically exposed person and adverse media screening results
• communications with us and records of how you use the platform

3. How we use personal data

We use personal data to:

• respond to enquiries and arrange calls
• verify identities and carry out KYC, KYB, source-of-funds, sanctions and other compliance checks
• prepare onboarding files and share them with partner banks so they can decide whether to provide services
• screen deposits, monitor transactions and flows, and escalate findings to partner banks
• operate, secure and improve the platform and the website
• meet our legal and regulatory obligations, and respond to lawful requests from authorities
• establish, exercise or defend legal claims

We do not sell personal data, and we do not use it for third-party advertising.

4. Consent and other grounds

Where the PDPA requires consent, we ask for it, and you can withdraw it at any time by contacting us. We may also collect, use and disclose personal data without consent where the PDPA or other law permits, for example to meet legal obligations, for business improvement, or where it is necessary to evaluate or provide services you have asked for. If you withdraw consent, we may no longer be able to provide some services.

5. Who we share personal data with

• Partner banks, which provide accounts, deposit addresses, conversions and payments, and make their own compliance decisions
• Compliance and verification providers, including identity verification (Didit) and wallet screening and blockchain analytics (MistTrack by SlowMist)
• Service providers that host and run our website and systems: Netlify (website hosting), Google Fonts (typefaces loaded by the website), Amazon Web Services CloudFront (delivery of the website’s background video), Cal.com (call booking) and our email and cloud providers
• Professional advisers, such as lawyers, auditors and accountants
• Regulators, law enforcement and other authorities, where the law requires or permits it
• A buyer or successor, if all or part of our business is sold or restructured

Service providers may only use personal data to provide services to us, under contractual protections.

6. Transfers outside Singapore

Some of the organisations above are located, or store data, outside Singapore. When we transfer personal data outside Singapore, we take steps to ensure it receives a standard of protection comparable to the PDPA, for example through contractual safeguards.

7. How long we keep personal data

We keep personal data only as long as we need it for the purposes above or as the law requires. Compliance records, including identity documents and transaction records, are generally kept for at least five years after a client relationship ends, or longer where applicable anti-money laundering law or a partner bank requires it. Enquiry and booking data is kept for as long as it is useful for our relationship with you.

8. How we protect personal data

We use reasonable security arrangements to protect personal data, including encryption in transit, access controls limited to staff and providers who need access, and secure handling of compliance documents. No method of transmission or storage is completely secure. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commission and affected individuals as the PDPA requires.

9. Your rights

Under the PDPA you can ask us to:

• give you access to your personal data and tell you how it has been used or disclosed in the past year
• correct personal data that is inaccurate or incomplete
• withdraw your consent to our use of your personal data

Contact our Data Protection Officer to make a request. We may need to verify your identity, and may charge a reasonable fee for access requests where the PDPA allows it. Some requests may be limited where we must keep data to meet legal obligations, such as anti-money laundering record-keeping.

10. Children

The website and our services are for businesses. They are not intended for anyone under 18, and we do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. The updated version applies from the date shown at the top of this page.

12. Contact and complaints

Data Protection Officer, Secret Intelligence Private Limited: contact@fiatdesk.com.

If you are not satisfied with our response, you may contact Singapore’s Personal Data Protection Commission at pdpc.gov.sg.