Privacy Policy — LepoCard

1. General Provisions

This Privacy Policy describes how personal data is collected, used, stored, shared and protected when you use the LepoCard website, the Telegram bot, the Telegram Mini App and other LepoCard digital services (the "Platform").

The Platform is operated by LEPO FINANCE DOO BEOGRAD (VRAČAR), a legal entity registered in the Republic of Serbia, registration number (matični broj) 22122550 (the "Company" or "LEPO FINANCE").

The Company processes personal data in accordance with applicable law, including the Law on Personal Data Protection of the Republic of Serbia and, where applicable, the EU General Data Protection Regulation (GDPR).

2. The Role of LEPO FINANCE and Financial Partners

LEPO FINANCE provides a technology Platform that gives access to selected card and financial products of independent partners.

Depending on the specific operation, LEPO FINANCE may act as an independent controller of personal data or as a processor on behalf of the relevant partner.

Card issuers, financial institutions and identity verification providers may independently determine the purposes and means of processing certain categories of personal data.

The roles and obligations of the parties involved in processing are determined by applicable law and the relevant agreements.

3. Data That May Be Processed

Depending on the Platform features you use, the following may be processed:

Registration data: first name, last name, email address, phone number and account identifier.
Identification data: information from identity documents, date of birth, citizenship and residential address.
Identity verification data: KYC results and information on AML/CFT and sanctions screening, where provided to the Company on a lawful basis.
Card program data: program identifier, application status, card issuance details, available limits and transaction statuses.
Technical data: IP address, device type, browser, interface language, technical logs and security data.
Telegram data: Telegram identifier, username and other information transmitted through the relevant interface.
Request data: messages to support, correspondence and information needed to handle requests.
Consent data: accepted documents, their versions, and the date and time of acceptance.

The Company processes only the data necessary for the relevant lawful purposes.

4. Sources of Personal Data

Personal data may be received directly from you during registration, when filling in forms and when contacting support.

Certain information may be received from Telegram, financial partners, KYC providers, fraud prevention systems and other authorized participants.

Data is obtained from third parties where there is an appropriate legal basis.

5. Purposes of Processing

Personal data may be used to:

create and maintain your account;
provide the features of the Platform;
submit applications to the relevant financial partners;
identify users and perform the necessary checks;
ensure security and prevent fraud;
handle requests and enquiries;
fulfil contractual and legal obligations;
maintain, diagnose and improve the Platform;
send service notifications;
send marketing communications where there is the necessary legal basis.

The Company does not use personal data for purposes incompatible with the stated grounds for processing.

6. Legal Bases for Processing

Depending on the purpose and the applicable law, processing may be based on:

the performance of a contract with you or steps taken before entering into it;
compliance with legal obligations;
the legitimate interests of the Company or third parties, subject to the necessary conditions;
your consent, where required;
other grounds provided by applicable law.

Where processing is based on consent, you may withdraw it in the established manner. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Sharing Data with Financial Partners

To provide certain services, data may be shared with card issuers, payment institutions, KYC/AML providers, technology contractors and other participants in the relevant program.

Data is shared to the extent necessary to provide the service, comply with the law and fulfil contractual obligations.

Independent financial partners may apply their own privacy policies, which are provided to you where required by law.

LEPO FINANCE does not sell users' personal data as a standalone commercial product.

8. International Data Transfers

Due to the international nature of the Platform, personal data may be processed or transferred outside your country of residence.

For such transfers, the Company applies the necessary legal mechanisms and safeguards in accordance with applicable law.

The specific recipients, countries of transfer and legal bases are determined by the actual data processing arrangements and the relevant agreements with partners.

9. Telegram and Third-Party Platforms

When you use the Telegram bot or the Telegram Mini App, certain technical data is processed by Telegram's infrastructure in accordance with its own terms and policies.

LEPO FINANCE processes data received through Telegram only within the lawful purposes of providing the Platform.

Please note that Telegram is an independent provider of technology infrastructure.

10. Cookies and Similar Technologies

The website and certain interfaces of the Platform may use cookies and similar technologies to operate the service, ensure security, save user settings and for other lawful purposes.

Where consent is required for the use of certain technologies, it is requested before they are used.

You are informed about the technologies used and the available settings in accordance with the law.

11. Retention of Personal Data

Personal data is retained for the period necessary to achieve the relevant processing purposes, fulfil contractual obligations and comply with applicable law.

Different retention periods may apply to different categories of data.

When the applicable period expires, data is deleted, anonymized or retained on another legal basis where required by law.

The specific retention periods and criteria are determined by the actual processing operations and the mandatory requirements of the relevant jurisdictions.

12. Data Security

The Company applies organizational and technical measures to protect personal data against unauthorized access, alteration, loss and unlawful disclosure.

Security measures may include access segregation, encryption, activity logging, control of employee access and vetting of technology providers.

No information system can guarantee absolute protection against all threats.

13. Your Rights

Depending on the applicable law, you may have the right to:

receive information about the processing of your personal data;
request access to your data;
request correction of inaccurate information;
request deletion of your data where there are lawful grounds;
request restriction of processing;
object to certain types of processing;
receive your data in a portable format, where the law provides for this right;
withdraw your consent;
lodge a complaint with the competent data protection authority.

The exercise of certain rights may be limited by mandatory legal requirements, including rules on the retention of financial and identification information.

14. Automated Decision-Making

Automated systems may be used to prevent fraud, review applications and manage risks.

Decisions on card issuance and the provision of regulated financial services may be made by the relevant financial partners.

If a decision based solely on automated processing that has legal or similarly significant effects is applied to you, you are given the rights and safeguards provided by applicable law.

15. Data of Minors

The Platform and the relevant card programs are intended for persons who meet the age requirements of applicable law and the rules of the financial partners.

The Company does not knowingly collect personal data of minors without the necessary legal basis.

If unlawful processing of such data is detected, the Company takes the measures provided by law.

16. Changes to This Privacy Policy

The Company may update this Policy in response to changes in the law, the functionality of the Platform or data processing operations.

The current version is published on the official LepoCard website.

In the event of material changes, users are notified in the manner provided by applicable law.

Where a new processing purpose requires separate consent, that consent is requested before such processing begins.

17. Governing Law and Language Versions

Personal data is processed in compliance with the law of the Republic of Serbia and other mandatory rules applicable to the relevant users and operations.

This Policy is prepared in English.

Approved language versions of the Policy may be provided for certain markets.

The existence of a translation does not limit the mandatory rights of users established by applicable law.

18. Contact Information

LEPO FINANCE DOO BEOGRAD (VRAČAR)

Country of registration: Republic of Serbia

Registration number (matični broj): 22122550

Registered address: [to be completed from the current APR extract]

Tax identification number (PIB): 115166771

Official website: https://lepocard.com

Email: contact@lepocard.com

For requests relating to personal data, you can contact the Company at the email address above.