Privacy Policy
Effective date: 4 September 2026
Controller: Wealth Boutique OÜ, Estonian registration number 17355664, registered office Uus-Sadama tn 21-207, 10120 Tallinn, Estonia
Contact: privacy@ladumapay.com
1. What this policy covers
1.1. This policy explains what personal data Wealth Boutique OÜ ("we", "us") processes about you when you use the Ladumapay software interface at ladumapay.com and its associated mobile / web surfaces (the "Interface").
1.2. This policy covers only data we control. When you use a third-party service reached through the Interface — a self-custodial wallet, a routing aggregator, a card programme — that provider is a separate data controller for the personal data it collects about you (KYC documents, transaction history, address checks, etc.). Their privacy notices govern that processing. See our Availability & Providers page for who they are.
2. What we collect
We keep the data footprint narrow. Categories:
a) Account and contact data. Email address, phone number, chosen display name, wallet address (as a public identifier), device / browser identifier used to sign in.
b) Country and device data. Country you select, country your IP address resolves to (used only for geofencing and fraud prevention), device type, browser, operating system, referrer, language.
c) Usage data. Pages viewed, features used, timestamps, error logs, session identifiers. Kept for operating and securing the Interface.
d) Support data. Messages you send to support (email, form submissions) and our replies.
e) Cookies and similar technologies. See section 8 and the Cookie Notice.
We do not collect passwords or private keys — wallets are self-custodial and keys never reach us. We do not collect KYC documents (identity documents, selfies, proof of address, source-of-funds evidence): those go directly to the third-party provider that requires them.
3. Sources
- Directly from you when you sign up, complete a form, or contact us.
- Automatically when you use the Interface (device, IP, cookies, telemetry).
- From service providers we use to operate the Interface (hosting, error monitoring, email delivery).
We do not buy personal data. We do not enrich profiles with data brokers.
4. Purposes and legal bases (EEA / UK GDPR)
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the Interface (accounts, sign-in, session, preferences) | Account, contact, device | Contract (Art. 6(1)(b)) |
| Enforce eligibility and geofencing | Country, IP | Legal obligation / legitimate interest (fraud and sanctions) (Art. 6(1)(c) / (f)) |
| Security, abuse prevention, incident response | Usage, device, IP | Legitimate interest (Art. 6(1)(f)) |
| Communicate with you (transactional emails, support) | Contact, support | Contract / legitimate interest (Art. 6(1)(b) / (f)) |
| Analytics (aggregate product improvement) | Usage, device | Consent for non-essential cookies (Art. 6(1)(a)); legitimate interest for server-side aggregates (Art. 6(1)(f)) |
| Legal, regulatory and law-enforcement requests | As required | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data. We do not use it for profiling that produces legal or similarly significant effects.
5. Sharing
We share personal data only when needed:
- Sub-processors that operate the Interface — hosting, database, email delivery, error monitoring, analytics. Bound by data-processing terms.
- Third-party providers you choose to use — when you use a wallet, routing, or card service reached through the Interface, we pass the minimum data needed to establish the connection (typically your wallet address and a session token). Those providers then process further data as separate controllers under their own privacy notices.
- Regulators and law enforcement — where we are legally required to disclose, or where we reasonably believe disclosure is necessary to protect our rights, users, or the public.
- Corporate transactions — if all or part of Wealth Boutique is transferred (merger, acquisition, restructuring), your data may be transferred to the acquirer under equivalent privacy commitments.
We do not sell or rent personal data to advertisers.
6. International transfers
The Interface is operated from Estonia. Some sub-processors are located outside the EEA (for example in the United States or the United Kingdom). Where we transfer personal data outside the EEA to a country without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) or an equivalent legal mechanism, and apply supplementary technical and organisational measures where needed.
7. Retention
We keep personal data only as long as we need it:
- Account data: while your account exists, plus up to 12 months after closure for dispute-handling and legal defence.
- Support correspondence: 24 months.
- Server logs and security telemetry: up to 12 months.
- Anonymised / aggregated statistics: indefinitely.
Where a longer retention period is required by law (accounting, AML record-keeping obligations of our providers, court order), we retain the relevant data for that period.
8. Cookies and similar technologies
The Interface uses only cookies that are strictly necessary to operate (session, authentication, security, load balancing) by default. Any analytics or preference cookies that are not strictly necessary are loaded only after you give explicit consent through the cookie banner, and you can withdraw that consent at any time from the cookie settings. See the Cookie Notice for the current list.
9. Security
We use industry-standard technical and organisational measures to protect personal data, including transport encryption (TLS), access controls, least-privilege principles for staff and providers, environment isolation, and monitoring. No system is perfectly secure. If you believe your account is compromised, contact security@ladumapay.com immediately.
10. Your rights
Depending on your country of residence, you have rights over your personal data:
- Access — get a copy of your personal data we hold.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete data we hold, subject to legal retention.
- Restriction — ask us to limit processing.
- Objection — object to processing based on legitimate interest.
- Portability — receive certain data in a portable format.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
- Complain — lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the supervisory authority in your country of residence.
To exercise a right, email privacy@ladumapay.com. We may ask for information to verify your identity. We respond within one month; complex requests may be extended by two further months, in which case we tell you.
11. Children
The Interface is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, email privacy@ladumapay.com and we will delete it.
12. Automated decision-making
We do not carry out solely automated decision-making that produces legal or similarly significant effects on you. Geofencing and fraud-prevention checks are rule-based and reviewable by a human on request.
13. Third-party links and providers
The Interface contains links to third-party services (Privy, LI.FI, Entry / Third National and others named on Availability & Providers). We do not control those services and are not responsible for their privacy practices. Read their privacy notices directly.
14. Changes to this policy
We may update this policy from time to time. The current version is always available at ladumapay.com/privacy with the effective date at the top. Material changes will be highlighted at the top of the page for at least 14 days.
15. Contact
Privacy questions and requests: privacy@ladumapay.com
Security incidents: security@ladumapay.com
Post: Wealth Boutique OÜ, Uus-Sadama tn 21-207, 10120 Tallinn, Estonia
Ladumapay is a technology interface operated by Wealth Boutique OÜ (Estonia). Not a bank, not a card issuer, not a custodian.