Your privacy, protected

Azany Group LLC (“Azany Group,” “we,” “us,” or “our”) operates My Island Visa (“MIV”), a Caribbean-focused multi-currency payment card and digital wallet that enables cardholders to hold, convert, send, and spend across multiple currencies, including transfers between Caribbean islands and diaspora communities abroad. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you apply for, activate, or use a My Island Visa card, our mobile application, our website, or any related services (collectively, the “Services”).

This Policy applies to all users of the Services worldwide, including diaspora customers and users accessing My Island Visa from within any Caribbean market we support or from abroad. By using the Services, you acknowledge that your information will be processed as described in this Policy. If you do not agree with this Policy, please do not use the Services.

2.1 Information You Provide Directly

• Identity information: full name, date of birth, nationality, government-issued ID number, photograph, and signature, collected to satisfy Know Your Customer (KYC) obligations.
• Contact information: mailing address, email address, and phone number.
• Financial information: linked bank account details, source-of-funds declarations, transaction history, and card usage data.
• Account credentials: username, password, and security question responses.
• Support communications: information you provide when contacting customer support, including chat transcripts and call recordings where permitted by law.

2.2 Information Collected Automatically

• Device & technical data: IP address, device identifiers, browser type, operating system, and mobile network information.
• Usage data: app interactions, session duration, feature usage, and crash diagnostics.
• Location data: approximate or precise location where enabled, used for fraud prevention and regional service delivery.
• Transaction metadata: merchant category, transaction amount, currency corridor, and timestamp for each card or wallet transaction.

2.3 Information From Third Parties

• Identity verification and sanctions-screening providers.
• Card network and payment-processing partners (including issuing bank and processor partners).
• Credit bureaus or alternative credit-data providers, where applicable to your market.
• Publicly available sources used for fraud prevention and compliance screening.

• To create, verify, and manage your My Island Visa account and card.
• To process transactions, currency conversions, and cross-island transfers.
• To detect, investigate, and prevent fraud, money laundering, and other financial crime.
• To comply with KYC, anti-money laundering (AML), counter-terrorist financing, and sanctions-screening obligations under applicable law.
• To provide customer support and respond to inquiries.
• To personalize the Services, including seasonal and cultural promotions relevant to your community.
• To send transactional communications, security alerts, and — where you have consented — marketing communications.
• To analyze usage trends and improve the Services, pricing, and product design.
• To meet regulatory reporting obligations of the jurisdictions in which we and our banking partners operate.

Where applicable data protection law requires a legal basis for processing personal data — including under the EU/UK General Data Protection Regulation (“GDPR”) and comparable regimes — we rely on one or more of the following bases:

We do not sell your personal data. We share information only as necessary with:

• Issuing banks & card network partners who issue and process My Island Visa cards and transactions.
• Payment processors and foreign-exchange partners that execute currency conversion and cross-border transfers.
• Identity verification and compliance vendors engaged to satisfy KYC/AML obligations.
• Regulators and law enforcement where required by applicable law, court order, or regulatory request.
• Service providers supporting hosting, analytics, customer support, and communications, under contractual confidentiality obligations.
• Professional advisors and successors in connection with audits, financing, or a merger, acquisition, or sale of assets.

Because MIV facilitates multi-currency transfers across Caribbean markets and to diaspora communities in North America, the United Kingdom, and Europe, your personal data may be transferred to, stored in, and processed in countries other than your country of residence — including the United States and other jurisdictions in which our banking, processing, and cloud-infrastructure partners operate.

Where we transfer personal data out of the European Economic Area (EEA), the United Kingdom, or other jurisdictions with data-localization or cross-border transfer restrictions, we rely on recognized transfer mechanisms, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the UK International Data Transfer Addendum.
• Adequacy decisions recognizing that a destination country provides an adequate level of protection.
• Binding contractual and technical safeguards imposed on our processors and banking partners.
• Your explicit consent, where required, for a specific cross-border transfer.

By using the Services to send or receive funds across borders, you acknowledge that your transaction data will necessarily be processed in both the originating and receiving jurisdictions to complete your transfer.

7.1 Caribbean Community (CARICOM) Member States

We process personal data of users in Caribbean markets in accordance with applicable national data protection laws, including (where applicable) Trinidad and Tobago’s Data Protection Act, Jamaica’s Data Protection Act, Barbados’s Data Protection Act, The Bahamas’s Data Protection (Privacy of Personal Information) Act, and equivalent frameworks in other CARICOM member states in which My Island Visa operates. Where local law imposes stricter requirements — including data-localization or local-representative obligations — we comply with those requirements in the relevant market.

7.2 European Economic Area & United Kingdom (GDPR / UK GDPR)

If you are located in the EEA or the UK, you have the rights described in Section 10, and you have the right to lodge a complaint with your local data protection supervisory authority. Our processing relies on the legal bases identified in Section 4.

7.3 United States

We comply with applicable U.S. federal and state privacy and financial-services laws, including the Gramm-Leach-Bliley Act (GLBA) as applicable through our banking partners, and applicable state consumer privacy laws (such as the California Consumer Privacy Act, as amended). Residents of certain states may have additional rights described in Section 10.

7.4 Canada

We process personal data of Canadian users in accordance with applicable federal and provincial privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable.

7.5 Diaspora Markets

For users accessing the Services as part of our diaspora programs outside the Caribbean, we apply the protections of this Policy in addition to any applicable local data protection and consumer-financial-protection requirements.

We retain personal data for as long as necessary to provide the Services, satisfy the purposes described in this Policy, and comply with legal, regulatory, tax, and accounting requirements. Financial transaction records and KYC/AML documentation are generally retained for a minimum period following account closure as required by applicable financial-services regulation in the relevant jurisdiction (commonly five to seven years), after which data is securely deleted or anonymized unless a longer retention period is required by law.

We implement administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit and at rest, access controls, and independent security assessments of our issuing, processing, and cloud infrastructure partners. No method of transmission or storage is completely secure; we cannot guarantee absolute security, and you should safeguard your own account credentials and notify us immediately of any suspected unauthorized access.

Depending on your location, you may have some or all of the following rights regarding your personal data. To exercise any of these rights, contact us using the details in Section 16.

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request deletion of your data, subject to our legal and regulatory retention obligations.
• Restriction & objection: request that we restrict or stop certain processing, including direct marketing.
• Portability: request your data in a structured, commonly used, machine-readable format.
• Withdraw consent: withdraw consent at any time for processing that relies on consent, without affecting the lawfulness of prior processing.
• Non-discrimination: we will not discriminate against you for exercising your privacy rights.

We will respond to verified requests within the timeframe required by applicable law. We may need to verify your identity before fulfilling a request and may decline requests that conflict with our legal or regulatory obligations, including AML/KYC record-keeping requirements.

Our website and app use cookies, SDKs, and similar technologies to operate the Services, remember preferences, measure performance, and — where you consent — support marketing and analytics. You can manage cookie preferences through your browser or device settings and, where required by law, through an on-site consent banner. Disabling certain cookies may limit functionality.

The Services are not directed to children, and we do not knowingly collect personal data from individuals under the minimum age required to hold a financial account in their jurisdiction (generally 18, unless a lower age is permitted by local law for a supervised or guardian-linked product). If we learn that we have collected personal data from an ineligible minor, we will take steps to delete it.

We and our partners use automated tools, including risk-scoring and sanctions-screening systems, to detect fraud, assess transaction risk, and satisfy compliance obligations. These tools may affect decisions such as transaction approval, account limits, or account restrictions. Where required by applicable law, you have the right to request human review of, or to contest, a decision based solely on automated processing that produces legal or similarly significant effects.

The Services may contain links to third-party websites or integrate third-party services (including merchant partners and payment rails). This Policy does not apply to those third parties, and we encourage you to review their privacy practices independently.

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or the markets we serve. We will post the updated Policy with a revised “Last Updated” date and, where required by law, provide additional notice or seek renewed consent before material changes take effect.

If you have questions, concerns, or requests regarding this Policy or our data practices, please contact our Data Protection Office:

This document is a policy template prepared for My Island Visa and does not constitute legal advice. Azany Group should have this Policy reviewed by qualified legal counsel in each jurisdiction in which My Island Visa operates prior to publication, to confirm compliance with all applicable local, national, and international data protection and financial-services requirements.