Privacy policy

Last Updated: July 31, 2026

1. Introduction

This Privacy Policy explains how Contegen Tech Limited, a company incorporated in Hong Kong SAR with company number 79156927 and registered office at Room 602, 6/F, Kai Yue Comm Building, Mongkok, Kowloon, Hong Kong SAR, operating as "Nalo" ("we", "us", "our", "Nalo"), collects, uses, shares, and safeguards personal data in connection with the Nalo mobile application, our website, and related services (together, the "Services").

We process personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"). Where users are located in the European Economic Area, we also apply the standards of the EU General Data Protection Regulation ("GDPR") to their personal data.

This Policy describes what personal data we collect, why and how we use it, with whom we share it, how long we keep it, and the rights you have. If you have any questions, please contact us using the details below.

2. Definitions

For the purposes of this Policy:

"Personal Data" means information relating to an identified or identifiable individual, such as name, contact details, identification numbers, IP address, or device identifiers.

"Data Subject" means the individual to whom Personal Data relates (you, or any other person whose data we process, including recipients of transfers).

"Data Controller" means the entity that determines the purposes and means of processing Personal Data. Nalo acts as the data controller for the processing described in this Policy.

"Data Processor" means an entity that processes Personal Data on our behalf and on our instructions, such as our IT, hosting, and analytics providers.

"Recipient" means the person to whom you send a money transfer through the Services.

3. Data Protection Officer

We have appointed a Data Protection Officer ("DPO"). To raise questions about this Policy, exercise your rights, or report a concern, contact the DPO at yo@naloapp.co.

4. Personal Data We Collect

4.1 Data You Provide

We do not intentionally collect data about your racial or ethnic origin, sexual orientation, political opinions, philosophical or religious beliefs, genetic data, or trade union membership. When you create an account, complete identity verification, or use the Services, we may collect:

Category	Examples (non-exhaustive)
Identity data	Full name, date of birth, nationality, identity document type and number, document photos, selfie for verification
Contact data	Email address, phone number, residential address
Financial data	Payment details (processed by our payment providers), transaction amounts, currencies, payment methods
Transaction data	Transfer history, recipients, statuses, timestamps, wallet addresses
Device and usage data	Device model, operating system, app version, IP address, language, identifiers for advertising/attribution, usage patterns and session data, crash logs
Marketing data	Marketing preferences, responses to campaigns, referral participation
Account data	Username, account identifiers, settings, support correspondence

4.2 Recipient Data Provided by You

When you initiate a money transfer, you provide us with personal data of your recipient, such as the recipient's full name and payout details. We process this data solely to execute the transfer, comply with legal obligations (including AML and sanctions screening), and prevent fraud. By providing recipient data, you confirm that you are lawfully entitled to share it with us and with our payment partners for these purposes, and that you have informed the recipient about such processing where required by applicable law.

4.3 Data from Third Parties

To provide seamless Services, we may obtain personal data from third-party partners and vendors, who must have lawful grounds for collecting and sharing your data with us. These sources include:

Payment service providers: transaction confirmations, payment statuses, fraud signals.

Identity verification providers: verification results and related data, where we engage such providers.

Sanctions, AML, and PEP screening providers: screening results required for compliance.

Attribution and analytics providers (for example, AppsFlyer and app analytics tools): install attribution, campaign data, and in-app event data.

Public blockchain data: publicly available on-chain transaction data and wallet addresses, used to monitor for illegal activity and ensure compliance with our terms.

4.4 Payment Data

Details of your payment instruments are collected and processed by our third-party payment providers in accordance with their own security standards (including PCI DSS where card payments are used). We do not store full payment instrument details; we may store masked details and payment tokens necessary to provide the Services.

5. How and Why We Use Your Data

We process personal data on the following lawful grounds: performance of a contract with you, compliance with legal obligations, your consent, and our legitimate interests (where they are not overridden by your interests and rights).

Purpose	Description	Lawful Basis
Providing the Services	Operating the App, your account, the wallet interface, and money transfers	Performance of a contract
Executing Transfers	Processing payments and coordinating payouts with our payment partners	Performance of a contract
Identity Verification and Compliance	KYC, AML, counter-terrorist financing, sanctions and PEP screening, regulatory reporting	Legal obligation, Performance of a contract
Fraud Prevention and Security	Detecting and preventing fraud, abuse, and security incidents	Legitimate interest, Legal obligation
Customer Support	Responding to requests and resolving complaints	Performance of a contract
Service Improvement and Analytics	Understanding how the Services are used and improving them	Legitimate interest, Consent (where required)
Marketing and Referral Programs	Sending marketing communications and operating referral campaigns	Consent (see Section 8)
Personalization	Tailoring content and features to your preferences	Legitimate interest, Consent (where required)
Record Keeping	Maintaining records for audit, accounting, and compliance	Legal obligation
Corporate Transactions	Due diligence and transfers in case of merger, acquisition, or restructuring	Legitimate interest

6. How We Share Your Data

We do not sell your personal data.

We share personal data only where necessary for the purposes described above, with:

Payment partners and financial institutions that execute payments and payouts. To deliver a transfer, we share the data necessary for its execution (including recipient data) with the payment partner responsible for the payout, which may be located in the destination country of your transfer.

Identity verification and compliance screening providers.

IT, hosting, analytics, attribution, and communication service providers acting on our behalf.

Advertising and marketing partners, where you have consented where required.

Professional advisers (legal, audit, accounting) under confidentiality obligations.

Courts, regulators, and law enforcement authorities, where required by applicable law or to protect our legal rights.

A successor entity in the event of a merger, acquisition, restructuring, or insolvency, in accordance with applicable law.

7. International Data Transfers

Our partners and service providers may be located outside Hong Kong and outside your country of residence, including in the destination countries of your transfers. Where personal data is transferred internationally, we take steps to ensure it remains protected, including contractual data protection obligations with our partners and, where applicable to EEA users, appropriate safeguards under the GDPR (such as standard contractual clauses). Note that executing a money transfer inherently requires sharing the data necessary for the payout with the payment partner in the destination country. For questions about international transfers, contact our DPO at yo@naloapp.co.

8. Direct Marketing

We will only use your personal data for direct marketing (for example, emails or push notifications about offers, promotions, and referral programs) where you have given consent, or where otherwise permitted by applicable law. You may opt out of direct marketing at any time, free of charge, by using the unsubscribe link in our emails, adjusting notification settings in the App, or contacting us at yo@naloapp.co. Opting out of marketing does not affect service communications necessary for the operation of your account and transfers.

9. How Your Data Is Secured

We apply technical, organizational, and administrative measures to protect personal data, including encryption of data in transit and at rest, access controls and the need-to-know principle, employee confidentiality and training, data minimization, backups, logging and monitoring, and incident response procedures. No system is completely secure; we encourage you to use a strong unique password, enable available authentication protections on your device, and keep your credentials, keys, and backup data confidential.

10. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, and as required by law:
‍
‍

Category	Retention Period
KYC/AML records and transaction records	At least 5 years after the end of the business relationship or completion of the transaction, as required by applicable AML law
Support correspondence	Up to 5 years
Technical, device, and log data	Up to 1 year (security and access logs up to 5 years)
Marketing data	Until you withdraw consent or opt out
Consent records	Duration of consent plus 5 years after withdrawal
Public blockchain data	On-chain data is recorded on public blockchains and cannot be deleted by us

11. Your Rights

Subject to applicable law, you have the right to:

- access the personal data we hold about you and obtain a copy;
- request correction of inaccurate or incomplete data;
- request deletion of your data, subject to our legal retention obligations;
- object to, or request restriction of, certain processing;
- withdraw consent at any time, where processing is based on consent, without affecting processing before withdrawal;
- receive your data in a portable format, where applicable; and
- lodge a complaint with a supervisory authority, including the Office of the Privacy Commissioner for Personal Data, Hong Kong, or (for EEA users) your local data protection authority.

To exercise your rights, contact our DPO at yo@naloapp.co. We respond to legitimate requests within the timeframes required by applicable law (generally within 30 days); complex requests may require more time. Requests are handled free of charge unless they are manifestly unfounded or excessive, in which case a reasonable fee may apply or we may decline the request, as permitted by law.

Please note that certain data (for example, KYC/AML and transaction records) must be retained by law and cannot be deleted on request during the mandatory retention period. Data recorded on public blockchains cannot be altered or deleted by us.

12. Cookies, SDKs, and Similar Technologies

Our website and App use cookies and software development kits (SDKs) for functionality, analytics, attribution, and (with consent, where required) marketing. This includes attribution and analytics tools such as AppsFlyer and app analytics services, which help us measure installs, campaigns, and in-app events. On our website, you can manage your cookie preferences through the consent banner. You can limit ad tracking and reset advertising identifiers in your device settings.

13. Children

The Services are intended for persons aged 18 or over. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated through the App and/or by email, and the updated Policy will be published on our website with a revised "Last updated" date.