Loading page
Legal
How DDPay Wallet, LLC collects, uses, shares, and protects personal data across the DDPAY Network, including identity verification, transactions, and the Andina USD and IncaCoin products.
DDPay Wallet, LLC ("DDPAY," "the Company," "we," "us," or "our") is a Wyoming, USA limited liability company that operates the DDPAY Network, a cross-border payments and interoperability platform serving individuals and businesses across the United States, Peru, and other Latin American markets. Our principal operating office is located in Lima, Peru, from which our Latin American operations, customer support, and compliance functions for the region are directed.
This Privacy Policy ("Policy") explains how we collect, use, disclose, retain, and protect personal data when you access or use our website, mobile application, wallet infrastructure, and related services (collectively, the "Services"), including services involving Andina USD and IncaCoin.
This Policy applies to consumers, merchants, and business users ("Users," "you") who register for or interact with the Services, wherever located. By using the Services, you acknowledge the data practices described in this Policy.
When you register for the Services, we collect information necessary to verify your identity and comply with Know Your Customer ("KYC") and Anti-Money Laundering ("AML") obligations, including:
Where the Services use selfie capture or liveness detection to confirm you are a real person and to match your face against your identification document (a process sometimes performed through our identity-verification vendor), we or our vendor process biometric identifiers derived from that image. We collect biometric information only for identity verification and fraud-prevention purposes, retain it only as long as necessary for those purposes and applicable recordkeeping law, and do not sell biometric information. Where required by applicable law (including U.S. state biometric privacy statutes), we will obtain your prior consent before collecting biometric identifiers and will provide any additional disclosures required by such law.
We use personal data for the following purposes:
Where applicable data protection law requires a legal basis, we rely on: (i) performance of our contract with you (the Terms of Service and applicable wallet/account agreement); (ii) compliance with legal obligations, including AML/CFT, sanctions, and financial-recordkeeping law; (iii) our legitimate interests in operating a secure, fraud-resistant payments platform; and (iv) your consent, where we specifically request it (for example, for certain biometric processing or marketing communications).
Under Peru's Ley N.° 29733, processing of sensitive personal data and cross-border transfers outside Peru additionally require your informed, prior, and, where applicable, written consent, except where a statutory exception applies (such as compliance with SBS/UIF-Perú regulatory obligations).
Because DDPAY operates across the United States and Peru, personal data may be transferred between, processed in, and stored in both countries, as well as in jurisdictions where our infrastructure and service providers operate (which may include other Latin American and cloud-hosting jurisdictions).
Where we transfer personal data originating in Peru outside of Peru, we will do so on the basis of your consent, contractual necessity, or another basis recognized under Ley N.° 29733 and its regulations, and we will require recipients to maintain a comparable level of protection. Where we transfer personal data originating in the United States internationally (including to our Lima, Peru office or vendors), we apply contractual and technical safeguards designed to protect that data consistent with this Policy.
We retain personal data for as long as necessary to provide the Services and to satisfy the purposes described in this Policy, including:
We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or destruction, including encryption in transit and at rest, access controls, redundant infrastructure, and vendor due diligence.
No system is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal data, we will notify you and applicable regulators as required by law.
If you are located in Peru, you have the right to access, rectify, cancel, and object ("derechos ARCO") to the processing of your personal data, as well as the right to withdraw consent, subject to statutory exceptions (including our AML/CFT and regulatory recordkeeping obligations). Requests may be submitted to the contact channel identified in Section 14.
Depending on your state of residence, you may have rights to know, access, correct, delete, or opt out of certain processing of your personal data, and to be free from discrimination for exercising these rights. We will honor verifiable requests to the extent required by applicable state law and subject to exceptions for information we must retain for legal, security, or regulatory-compliance purposes.
We will take reasonable steps to verify your identity before fulfilling a rights request and will respond within the timeframe required by applicable law. We may decline or limit a request where an exception applies, including where fulfilling the request would conflict with our AML/CFT, sanctions, or recordkeeping obligations.
Where automated and algorithmic tools — including transaction-monitoring and sanctions-screening systems — are applied to your account or transactions, they are used to detect potentially suspicious or prohibited activity. These automated tools may result in a transaction being delayed, held, or declined, or an account being restricted, pending manual review.
You may contact us using the details in Section 14 to request human review of an automated decision that materially affects your access to the Services, subject to our overriding legal and regulatory obligations.
The Services are not directed to, and may not be used by, individuals under 18 years of age. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child without appropriate consent, we will delete it.
The Services may link to or integrate with third-party websites, wallets, or blockchain networks (including public Solana and Stellar infrastructure) that are not controlled by DDPAY. This Policy does not apply to those third parties, and we encourage you to review their privacy practices independently. Please note that transactions recorded on public blockchains are, by their nature, visible on distributed public ledgers.
Questions, requests, or complaints regarding this Policy or our data practices may be directed to:
We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. We will post the revised Policy with an updated "Last Updated" date and, where required by law, provide additional notice or obtain renewed consent before a material change takes effect.