Coda Portal

Privacy Notice for Publishers

Last Modified: March 10, 2023

1. Scope and Application of Notice

1.1. Coda Payments Pte. Ltd. (“Coda Singapore”) and/or its affiliates or subsidiaries (collectively referred to as “Coda”, “we”, “us”, or “our”) only collect and process personal data from you where it is necessary for us to undertake customer due diligence (also known as Know Your Customer “KYC”). This Privacy Notice (the “Notice”) sets out our privacy practices in respect of the collection, processing, use, disclosure, transfer, retention, storage, and disposal of your Personal Data.

1.2. When you accept this Notice, you agree to the collection, processing, use, disclosure, transfer, retention or storage, and disposal of your Personal Data in the manner described in this Notice.

1.3. “Personal Data” shall refer to your personal information as an individual, whether true or not, from which you can be identified either by itself, or together with other information to which we have or are likely to have access. The Personal Data that we collect and process may include:

  1. Personal details such as first name and last name;

  2. Contact details such as mobile number and email address;

  3. Physical/Postal address details such as street, address line, ZIP/PIN code, city, state, country;

  4. Date and place of birth;

  5. Nationality;

  6. Gender;

  7. Employment details;

  8. Tax residency;

  9. Copies of identity documents (passport, national ID cards, identification numbers); and

  10. Any other personal information that you may provide to us in the course of KYC.

1.4. The collection and processing of your Personal Data enable you to partner with us.

1.5. From time to time, we may update this Notice. Where these changes are material in nature we may notify you either by sending an email directly to you informing you of such changes prior to implementing them, or by posting the most recent version of the Notice on our website with the “Last Updated” date posted at the top. You should check our website frequently for updates. We encourage you to review this Notice frequently to be informed of how we are collecting and protecting your personal data.

2. Collection of Personal Data

2.1. Generally, we collect Personal Data directly from you in circumstances where you provide Personal Data (during the onboarding process, for example). However, in some instances, the Personal Data we collect has been inferred about you based on other information you provide us, or through your interactions with us.

2.2. We also collect your Personal Data from the company or organization for whom you are working or affiliated with. It is because you provided explicit consent to the company or organization you’re working or affiliated with, to provide the Personal Data to us. If your company or organization transfers your Personal Data to us, we expect your company or organization to inform you about this.

2.3. We also collect Personal Data of employees or executive directors not being provided by your company or organization. For example, by retrieving such Personal Data from the Chamber of Commerce or other publicly available sources. You can give this Notice to such individuals so that they can learn how we deal with their Personal Data.

2.4. We may also obtain some information from third parties, e.g., google searches (as part of our screening obligation) or publicly available websites (LinkedIn, Bloomberg, MarketScreener, etc) and screening lists.

2.5. When we ask you to provide Personal Data to us on a mandatory basis, we will inform you of this at the time of collection and we will indicate whether such information is required by the contract or statute. The failure to provide mandatory information will mean that we cannot carry out our services.

2.6. You must provide us with information which is accurate and not misleading.

3. Use and purpose of Personal Data

3.1. Your Personal Data shall be processed for the following purposes:

  1. To register you as our publisher partner;

  2. Assessment, conclusion and performance of business agreements and compliance with our legal obligations that are for the purposes of KYC Process.

  3. Audits and in case of conflicts the settlement of the disputes.

  4. Responding to legal and regulatory requests such as to comply with lawful requests by public authorities, disclosure requests, or where otherwise required or authorized by applicable laws, court orders, government regulations, or regulatory authorities.

  5. To manage our relationship with you, including handling any complaints or queries and notifying you about changes to our terms of agrement and/or Notice;

  6. Enforcing our contractual rights;

  7. To make suggestions and recommendations to you about new proposals, opportunities, and other news (including information about products and services offered by us);

  8. To protect us, our customers, and our services from fraud and theft;

  9. Providing you with information which you have requested from us;

  10. Managing or complying with our internal security or risk management mechanisms; and

  11. Other permitted uses and disclosures such as conducting statistical analysis or market and customer research.

4. Disclosure of Personal Data

4.1. Coda may use the Personal Data collected from you and share it with third parties such as its cloud processor, suppliers, professional service providers (“Processors”), including our affiliates, where it is a necessary part of doing business with you and to carry out KYC checks.

4.2. For the foregoing purposes, your Personal Data will be shared between Coda Singapore, Coda affiliates and our Processors.

4.3 You understand and accept that we may also disclose your Personal Data to our affiliates, or other parties as permitted or required by applicable law, such as government authorities or regulators, or other necessary persons, for the following purposes:

  1. For or in connection with the negotiation of any merger, sale of company stock or assets, financing, acquisition, divestiture, or dissolution of all or a portion of our business; or

  2. If we believe that disclosure is reasonably necessary to (i) comply with any applicable law, regulation, legal process, or governmental request; (ii) assist in any investigations or proceedings; and (ii) protect the security or integrity of the services, us, or any of our users or the public from harm or illegal activities.

5. Storage of your Personal Data

We store your Personal Data in AWS servers located in Frankfurt, Germany for the EMEA region, N. California for the US region and APAC for the APAC region. However, please note that in order to fulfill our contractual obligations and to provide customer service/support, certain Personal Data is transferred to Singapore as well as other countries by our Processors (For detailed information please refer to Section 9 and 11).

We process Personal Data only if at least one of the following applies:

  1. The existence of our legitimate interest, or that of a third party, which justifies that we process the Personal Data;

  2. The performance of a contract between you and us requires that we process the Personal Data;

  3. We are required to comply with legal and regulatory obligations, which require the processing of the Personal Data concerned; and/or

  4. You have given consent to the processing of your Personal Data.

7. Your choices, rights and exceptions

7.1. Your right of information: You acknowledge that this Notice provides you with information about the purposes, legal framework, interests, recipients or categories of recipients with whom your Personal Data is shared, and the Personal Data transfer to a third country or international organization. In addition to this information and with the aim of ensuring fair and transparent processing of your Personal Data, you further acknowledge that you have received additional information concerning the period for which your Personal Data will be kept and the existence of the rights which are granted to you and how you can exercise them. If we decide to process Personal Data for purposes other than those indicated, all information relating to those new purposes will be communicated to you.

7.2. Your right to erasure of your Personal Data and your right to withdraw your consent: You have the right to have your Personal Data removed or withdraw consent (when processing we carry out is based on your consent) to the processing thereof. If you wish to have your Personal Data erased, or want to withdraw your consent, please contact us. However, please note that if your Personal Data is removed or you withdraw your consent for any of the purposes stated above, depending on the nature of your request, we may not be in a position to continue providing the Services to you. Additionally, the exercise of right to erasure will not be possible when the retention of your Personal Data is necessary for compliance with laws and regulations and in particular for the establishment, exercise or defense of legal claims and withdrawal of consent will have no impact on the previous transactions based on the consent you gave before the withdrawal, subject to compliance with the statutory and regulatory obligations which requires data retention to which we are subject.

7.3. Your right of access to and rectification of your Personal Data: You have the right to access, update, or request correction of the Personal Data that you have provided to us at any time. If you would like to access the Personal Data that we have on file about you or request that we update or correct your Personal Data, you may contact us. Depending on the nature of your request, we may charge a reasonable administration fee, of which we will inform you as soon as reasonably practicable.

7.4. EEA, UK, Switzerland residents’ privacy rights: If you are a resident of EEA, UK or Switzerland, please note that you have certain rights with respect to your Personal Data under the GDPR and other applicable local data protection legislation. This Section 7.4 supplements the information contained in this Notice.

7.4.1 Your right to restriction of processing: You may request restriction of processing of your Personal Data in the cases provided for by applicable law and regulations.

7.4.2 Your right to object to data processing: You have the right to object to the processing of Personal Data concerning you.

7.4.3 Your right to data portability: You have the right to request that your provided Personal Data be moved to a third party, if the processing is based on consent or contract and the processing is carried out by automated means.

7.4.4 Your right to lodge a complaint with a supervisory authority: If your request or concern is not satisfactorily resolved by us, you may approach the Dutch Data Protection Authority (“Dutch DPA”). The Dutch DPA can provide further information about your rights and our obligations in relation to your Personal Data, as well as deal with any complaints that you have about our processing of your Personal Data. Please refer to the Dutch DPA contact details here.

7.5. California residents’ privacy rights: If you are a California resident, please note that you have certain rights with respect to your Personal Data under the California Consumer Privacy Act (“CCPA”). This Section 7.5 supplements the information contained in this Notice.

7.5.1. Categories, sources, purposes, and recipients of the Personal Data we collect: Please note that we collect the categories of Personal Data described in Section 1.3 of this Notice. The sources from which we collect Personal Data, and the purposes for which we collect and process it, are described in Sections 2 and 3, respectively. We have disclosed for business purposes each of the categories of Personal Data with the categories of third parties as described in Section 4.

7.5.2. Sale of Personal Data: Please note that we do not sell your Personal Data. By ‘sell’ we mean that we do not share your Personal Data with third parties in exchange for valuable consideration. However, we disclose your Personal Data to our third parties as described in Section 4 of this Notice.

7.5.3. As a resident of California you have the right to (i) know what personal information we collect, use, disclose and sell; (ii) request deletion of your Personal Data, subject to certain exceptions; (iii) request information about the Personal Data we have sold or disclosed to third parties for business purposes, in the preceding 12 months; (iv) opt out from the sale of your Personal Data, if applicable; and (v) not be discriminated against for exercising your rights under the CCPA.

To exercise your rights described above, please contact us. We will contact you to request for additional information which we need in order to verify your identity and if we are unable to verify your identity then we will deny your request. Please note that you may designate an authorized agent to make requests on your behalf for exercising your rights under the CCPA. However, before accepting any request from your agent, we will require your agent to provide us with proof that you have authorized the agent to act on your behalf and we may need you to verify your identity directly with us.

All the rights enumerated above can be exercised by contacting us (please refer to Section 12 of this Notice).

8. Retention and Disposal of Personal Data

Your Personal Data will be retained for as long as is necessary to fulfill or complete the purpose for which it was collected and until it is no longer necessary for any other legal or business purposes. Thereafter, we dispose of your Personal Data in a manner that prevents further access or processing, including but not limited to deletion or irreversible anonymization. ​

9. Data Processors

For fulfilling our contractual obligations, providing customer support/services and storage of your Personal Data we use the following service providers:

  1. Amazon Web Services (“AWS”): AWS helps us in storage of Personal Data. Please refer to their privacy notice here; and

  2. Know Your Customer Limited (“KYC Ltd”): KYC Ltd. helps us in performing KYC checks. Please refer to their privacy notice here.

Please note that these Processors may transfer your Personal Data to a location outside of EEA, UK, Switzerland, US or other countries depending on their respective privacy policies. Therefore, we recommend you to read each of the privacy policies to learn about the privacy terms applicable to you.

10. Security

Coda makes reasonable efforts to safeguard Personal Data in our possession or under our control, in order to protect against loss, misuse, modification, unauthorised or accidental access or disclosure, alteration, or destruction. Unfortunately, no data transmission or storage over the internet can be guaranteed as totally secure. Nonetheless, we have adopted and currently practice administrative, organizational, technical, and physical security measures to protect your Personal Data to the best of our reasonable capacity, including but not limited to the following:

  1. Limiting Personal Data access to authorized and/or necessary personnel;

  2. Implementing technical solutions to ensure information security;

  3. Continuous monitoring and review of Personal Data protection measures; and

  4. Other security measures as may be required by the laws and regulations applicable in the country where you are located.

11. International Transfer of Personal Data

11.1. As we operate internationally, your Personal Data may be stored and processed in a country outside of the European Economic Area (“EEA”), UK, Switzerland, US or other countries where we have operations depending on applicable data localisation regulations, or share your Personal Data with recipients (such as the Processors, or Coda affiliates/subsidiaries) who are located in countries other than the country in which your Personal Data was originally collected. You therefore accept and understand that we may share your Personal Data with recipients who are located in countries other than the country in which your Personal Data was originally collected, for the purposes set out in this Notice.

11.2. In such circumstances, we take steps to ensure that overseas recipients shall provide a standard of protection to the Personal Data transferred that is comparable to the protection under the EU General Data Protection Regulations (“GDPR”), the CCPA as well as the local data protection laws applicable in your jurisdiction. We will take all steps reasonably necessary to ensure that your Personal Data is subject to appropriate safeguards, such as relying on a recognized legal adequacy mechanism, and/or by using standard contractual clauses, where applicable and that it is treated securely and in accordance with this Notice.

12. Contact Us

To contact us on any aspect of this Notice or your Personal Data, including but not limited to withdrawing consent, requesting access to your Personal Data, requesting an update or correction to your Personal Data, or exercising any of your rights under this Notice or applicable data protection laws, you may contact our Data Protection Officer at dpo@codapayments.com.