Privacy Notice

Operated by Parnasa Heritage Planning Holding Corp.

Effective: 27 May 2026

1. Who we are

ZANVIL is a technology platform operated by Parnasa Heritage Planning Holding Corp. ("Parnasa", "ZANVIL", "we", "us"), a company incorporated in the Federation of Saint Christopher (Saint Kitts) and Nevis under Corporation Number C 63753.

This Privacy Notice describes how ZANVIL collects, uses, shares and protects your personal data when you use the ZANVIL platform. The notice should be read together with the BVNK Privacy Policy (available at help.bvnk.com), the BVNK Data Protection Addendum, and the Lead Bank Privacy Policy and GLBA Notice where applicable.

2. Our role under data protection laws

ZANVIL acts in two distinct roles depending on the processing activity:

• Processor / Sub-processor of BVNK — for personal data processed in connection with the BVNK Embedded Services Offering (e.g., KYC documents collected, identity verification, sanctions screening outputs, payment instructions, audit logs). BVNK is the Controller for these activities.
• Independent Controller — for personal data ZANVIL processes for its own purposes (e.g., website analytics, marketing list management, employee and contractor data, internal support and complaint records).

Where ZANVIL acts as processor, the contractual framework with BVNK governs the processing terms; you can exercise data-subject rights with BVNK directly or with ZANVIL, and ZANVIL will forward your request to BVNK promptly.

3. Personal data we collect

We collect personal data in three main ways:

3.1 Data you give us directly during onboarding and account use

• Identification data: full legal name, date of birth, nationality, government-issued ID numbers (passport, national ID, driver's licence), photograph / selfie, signature.
• Contact data: address, email address, phone number.
• Entity data (for corporate clients): legal name, registered jurisdiction, registration number, beneficial-owner information (UBO ≥ 25%), control-person information, articles of incorporation, good-standing certificates, audited financials.
• Source-of-funds and source-of-wealth declarations and supporting documentation.
• Account configuration: registered second-factor authentication method, designated Administrator details, preferred currencies.
• Transaction data: transaction amounts, counterparties, currencies, network rails used, timestamps, references and notes you provide.
• Customer-support and complaint correspondence — including any messages, attachments and ratings you exchange with ZANVIL Support through the in-product chat (operated by Intercom with the Fin AI Agent) or by email.

3.2 Data we collect automatically

• Device and connection: IP address, device fingerprint, browser type, operating system, language preference, geolocation derived from IP.
• Authentication events: login attempts (successful and failed), MFA challenges, step-up authentication events, session tokens.
• Behavioural: pages visited within the platform, features used, navigation timing.
• Audit log entries for actions taken in your account (by you or by your Administrator).

3.3 Data we receive from third parties

• Identity-verification and KYC outputs from BVNK and BVNK's IDV partners.
• Sanctions, PEP and adverse-media screening results from Sanctions.io.
• Transaction status updates and compliance decisions from BVNK and Lead Bank.
• Threat intelligence and IP reputation data from Cloudflare and other security providers.

4. Why we use your data (legal bases)

We process your personal data for the following purposes and on the following legal bases:

5. Who we share your data with

We share personal data with the following categories of recipients, only as necessary for the purposes above:

We do not sell your personal data, and we do not share your personal data for cross-context behavioural advertising.

6. International transfers

ZANVIL is established in Saint Kitts and Nevis. Sub-processors process data in the United States (Intercom, AWS, Google, Cloudflare, Paxos, Lead Bank), the European Economic Area, the United Kingdom and other jurisdictions as needed for the service. Where personal data of a data subject resident in the EEA or the UK is transferred to a country outside the EEA / UK that does not benefit from an adequacy decision, the transfer is protected by the EU Standard Contractual Clauses (or the UK International Data Transfer Addendum) executed with the sub-processor, complemented by supplementary measures where required.

7. How long we keep your data

Identification documents, screening logs, transaction records, consents and mandates are retained in an immutable repository (AWS S3 with Object Lock in Compliance mode) for at least five (5) years from the later of (a) the date of the relevant transaction or (b) the date the End-User relationship ends, in line with applicable AML and recordkeeping requirements. Customer-support conversation logs (including AI-Agent and human exchanges) are retained for at least five (5) years in line with the Support Policy.

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and request a copy.
• Rectify inaccurate or incomplete data.
• Erase your data, subject to retention obligations imposed by AML, sanctions and other regulatory rules.
• Restrict or object to processing in certain circumstances.
• Receive your data in a structured, machine-readable format (portability), where the processing is based on consent or contract.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

Where ZANVIL acts as a processor of BVNK, your request will be referred to BVNK as Controller within 48 hours of receipt and we will support BVNK in responding within the timeframes required by law. Where ZANVIL is the independent Controller, we will respond to your request directly within the time required by applicable law.

To exercise any right, contact us at privacy@zanvil.app.

9. Cookies and similar technologies

The ZANVIL platform uses cookies and similar technologies that are strictly necessary for authentication, session management, security and load balancing, and a strictly-necessary support widget cookie required to operate the Intercom in-product chat. We do not use third-party advertising cookies. Detailed information is provided in the ZANVIL cookie banner shown when you first access the platform.

10. Security

We protect your personal data through technical and organisational measures set out in our Information Security Policy (Policy 03), including encryption (AES-256 at rest, TLS 1.2+ in transit), centralised identity management with mandatory MFA, least-privilege access controls, immutable audit logging, and vendor due diligence (Policy 12). Vendors processing personal data on our behalf are required to implement equivalent security measures.

11. Changes to this Privacy Notice

12. Contact and complaints

For privacy queries and rights requests: privacy@zanvil.app. For complaints relating to our handling of your personal data: complaints@zanvil.app. Where you are dissatisfied with our response, you may lodge a complaint with the data-protection supervisory authority of your country of residence.