Legal

About this policy

Dovo SA ("Dovo", "we", "us" or "our"), a Swiss company with registry number CHE-419.702.318 and registered offices at Rue du Rhône 14, 1204 Geneva, Switzerland, operates getdovo.com and the Dovo platform. This policy explains how we collect, use, disclose, store, secure and dispose of personal data.

It applies to visitors to our website, to people who apply for a Dovo account, to the directors, beneficial owners and Authorised Users of our business customers, and to the people they pay. Where we decide why and how personal data is processed, we are the controller of that data.

We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). Using the platform does not oblige you to accept anything in this policy that the law does not permit us to require.

What personal data we collect

Personal data is information that identifies a natural person, directly or in combination with other information. Depending on your relationship with us, we may collect:

Identity and contact data

Name, date of birth, nationality, residential address, email address, phone number, and the details of an identity document — passport, national ID or residence permit — together with the images taken during a document or liveness check.

Business and role data

Your company, its registration details, your position in it, your shareholding, and where relevant your status as a director, signatory or beneficial owner. For politically exposed persons, the information a regulator requires us to hold.

Financial and transaction data

Account and IBAN details, balances, payment instructions, counterparties, card transactions, stablecoin addresses and on-chain movements, currency conversions, and the source of funds or wealth evidence you supply.

Compliance and risk data

The results of sanctions, PEP and adverse media screening, risk scores we assign, the outcome of transaction monitoring alerts, and any record we are required to keep about a report made to an authority.

Technical and usage data

IP address, approximate location derived from it, device and browser characteristics, operating system, referring page, the pages you visit on our site and how you move through them, and diagnostic logs.

Communications

Emails, support tickets, chat transcripts and call notes, together with feedback and survey responses you choose to give us.

We do not seek special-category data. Where a document you submit happens to reveal it — a photograph, or a place of birth — we process only what is necessary to verify identity, and no further.

How we use personal data

We use personal data to:

• Open, operate and maintain accounts, and to execute the payments, conversions and card transactions you instruct.
• Verify identity, run KYB and KYC checks and complete ongoing due diligence.
• Detect, investigate and prevent fraud, money laundering, terrorist financing and sanctions breaches.
• Meet legal, regulatory, tax and reporting obligations, and respond to lawful requests from authorities.
• Manage risk, set limits, place holds and make credit and exposure decisions.
• Provide support, answer questions and investigate complaints and disputes.
• Keep the platform secure, monitor for abuse and maintain records for audit.
• Analyse how the platform is used so we can improve it, and measure whether a marketing channel actually works.
• Send service messages about changes to the product, the fees or these policies.
• Take legal advice, enforce our rights and defend claims.

We do not sell personal data. We do not use automated decision-making that produces a legal effect on you without a human being able to review it; where an automated screening rule blocks a payment, you can ask us to look at it again.

Our legal bases

We rely on the following grounds:

• Performance of a contract — to open and run your account and carry out your instructions.
• Compliance with a legal obligation — anti-money-laundering law, sanctions, tax reporting and record retention.
• Legitimate interests — securing the platform, preventing fraud, improving the product and running our business, where those interests are not overridden by your rights.
• Consent — for optional analytics and marketing cookies, and for marketing email. You can withdraw consent at any time, and doing so does not affect processing already carried out.

Who we share personal data with

We disclose personal data only where there is a reason to, and only to the extent needed. Recipients fall into these categories:

• Licensed partner institutions that issue accounts, IBANs and cards, and the payout networks and correspondent banks that move the money.
• Identity verification and screening providers that check documents and run sanctions, PEP and adverse media searches.
• Cloud hosting, database, logging and email providers that run the infrastructure behind the platform.
• Analytics providers, under contract and with identifiers minimised.
• Professional advisers — auditors, lawyers, accountants — under a duty of confidence.
• Regulators, tax authorities, law enforcement and courts, where the law requires or permits it.
• A buyer or successor, if the business or part of it is sold, merged or reorganised.

Every processor acts on our documented instructions under a written contract, and is held to security standards no lower than our own. Where the law forbids us from telling you that data was disclosed — as it does for a suspicious activity report — we will not disclose it.

International transfers

Cross-border payments are, by definition, cross-border data. Personal data may be transferred outside Switzerland and the European Economic Area — to a partner bank, a payout network or a hosting provider in another country.

Where a destination country is not recognised as offering adequate protection, we rely on the European Commission's Standard Contractual Clauses, recognised by the Swiss Federal Data Protection and Information Commissioner, together with the additional technical and organisational safeguards a transfer assessment identifies. Ask us and we will describe the safeguards used for a specific transfer.

How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for, and then for as long as the law requires us to keep a record of it.

• Identity, due diligence and transaction records: ten years from the end of the relationship or the date of the transaction, as Swiss anti-money-laundering law requires.
• Accounting records: ten years, under the Swiss Code of Obligations.
• Support correspondence: three years from the last contact.
• Website analytics: twenty-six months, in aggregate form after that.
• Applications that are declined or abandoned: two years, so that we can evidence the decision.

When a retention period ends, data is deleted or irreversibly anonymised.

Your rights

Subject to the conditions and exceptions in the applicable law, you have the right to:

• Ask what personal data we hold about you and get a copy of it.
• Have inaccurate data corrected and incomplete data completed.
• Ask for deletion, where we have no overriding legal obligation to keep it.
• Ask us to restrict processing while a dispute about accuracy or legitimacy is resolved.
• Object to processing based on our legitimate interests, on grounds relating to your situation.
• Receive the data you gave us in a portable, machine-readable format.
• Withdraw a consent you gave, at any time.
• Complain to a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner; in the EEA, the authority for your country.

To exercise any of these, write to business@getdovo.com. We answer within 30 days, and will ask you to verify your identity first so that we do not disclose your data to someone else. Note that anti-money-laundering law limits what we can delete, and prevents us from confirming or denying that a report was made about a transaction.

Cookies and similar technologies

A cookie is a small text file a site stores on your device. We use them, and comparable technologies such as pixels and local storage, in three ways:

• Strictly necessary — signing you in, keeping a session alive, protecting a form against cross-site request forgery. These cannot be switched off without breaking the site.
• Analytics — counting visits and understanding which pages people actually read, so we can improve them. You can stop them with your browser's cookie controls or a tracking blocker.
• Attribution — remembering that you arrived through a referral or campaign link, so that a partner is credited correctly. We store a referral code in your browser's local storage for 60 days; the first one wins, and it is not shared with third parties.

You can refuse non-essential cookies when you first arrive, change that choice later, and clear stored cookies through your browser at any time. Blocking cookies may break parts of the platform that depend on them.

Security

We protect personal data with measures proportionate to the risk: encryption in transit and at rest, access granted on a least-privilege basis and reviewed regularly, two-factor authentication for staff and customers, segregated environments, logging and monitoring, and an incident response process that is tested rather than filed.

Our staff and contractors are bound to confidentiality. Where a breach is likely to result in a high risk to your rights, we will notify you and the competent authority within the deadlines the law sets.

No system is perfectly secure. Keep your credentials to yourself, enable two-factor authentication, and tell us immediately if you think an account has been compromised.

Other websites

Our site links to sites we do not run — partner institutions, regulators, documentation. This policy covers only Dovo. Read the privacy policy of any site you follow a link to; we are not responsible for how it handles your data.

Changes to this policy

This policy is effective from 16 August 2026. We may update it as the product, the law or our providers change, and the current version always lives on this page.

Where a change is material, we will tell you by email to your registered address or by a prominent notice on the site before it takes effect. Continued use of the platform after that date means you have been informed of the change.

Contact us

Questions, requests and complaints about privacy go to business@getdovo.com, or by post to Dovo SA, Rue du Rhône 14, 1204 Geneva, Switzerland.