Privacy Policy
Last Updated: September 29, 2026
Table of Contents
1. Introduction
This Privacy Policy explains how Cassbana Technologies, owner of the CASSBANA brand, collects, uses, processes, stores, protects, transfers, and discloses personal data provided by individuals and institutional customers through Cassbana's websites, mobile applications, electronic platforms, products, and services. References to Cassbana, the Company, we, us, or our mean Cassbana Technologies. References to user, customer, client, you, or your mean the person using our services or, where applicable, an authorised representative of an institutional customer. We may update this policy to reflect changes in our services, technology, legal obligations, or processing. The latest version will state its effective date. Where required by law, we will notify you of material changes and obtain any required consent. This policy is intended to comply with applicable personal data protection laws in the Kingdom of Saudi Arabia, the Sultanate of Oman, and the Arab Republic of Egypt.
2. Purpose and Scope
This policy explains the personal data we collect, collection methods, processing purposes and legal grounds, facial and biometric data practices, disclosures, retention, security, and your rights. It applies when you visit our website, install or use our application, create an account, apply for or use a service, complete onboarding or identity verification, contact us, or otherwise interact with Cassbana. It should be read with our Terms and Conditions and any just-in-time privacy notice.
3. Data Controller and Contact Information
Cassbana Technologies is the data controller responsible for determining the purposes and means of processing personal data collected through its platforms and services, unless another entity is expressly identified as controller. Questions, complaints, rights requests, and requests concerning Facial Data may be sent to info@cassbana.com. Cassbana will designate a data-protection contact or officer where required by law.
4. Personal Data We Collect
Depending on the products and services used, we may collect the following categories: • Identity and profile data, including name, date of birth, nationality, identification number, passport or ID details and images, photograph, login credentials, account reference, and information needed to create or verify a profile. • Contact data, including telephone number, email, residential or mailing address, national address, and communication preferences. • Business data, including business name, commercial and tax registration details, registered address, legal form, establishment date, licences, incorporation records, ownership, beneficial owners, directors, shareholders, authorised representatives, signatories, and authority documents. • Financial and transaction data, including bank information, balances, revenue, income, payment history, transaction records, credit-related information where permitted, invoices, settlements, and service eligibility information. • Device, technical, and usage data, including IP address, device model, operating system, browser, identifiers, app version, network information, timestamps, logs, diagnostics, crash data, security indicators, cookies, accessed features, and interaction records. • Geolocation data, including precise or approximate location obtained with permission or as permitted by law through GPS, IP address, network, Wi-Fi, or device settings. • Communication data, including correspondence, support requests, complaints, recorded calls where notified and permitted, documents, and social-media or messaging communications. • Additional information you voluntarily provide where relevant to the stated purpose.
5. Facial and Biometric Data Processing
Important Notice Regarding Facial Data
Cassbana may capture facial images, selfie photographs, short video recordings, and related facial or biometric data solely for identity verification, liveness detection, Know Your Customer (KYC), fraud prevention, account security, and compliance with applicable legal and regulatory requirements. Cassbana does not use facial data for advertising, marketing, behavioural profiling, emotion analysis, or purposes unrelated to identity verification, security, fraud prevention, or regulatory compliance.
For identity verification, onboarding, authentication, account recovery, security, and compliance, Cassbana or an authorised provider may process a live facial image, selfie, camera image, short liveness video, facial movements, an ID-document photograph, face-match results, facial templates or geometry where generated, liveness or similarity scores, and verification outcomes. These items are collectively called Facial Data. Facial Data may be collected when you register, verify your identity remotely, complete a liveness check, recover or reactivate an account, confirm a sensitive action, update identity information, respond to suspected fraud, or complete a legally required verification. The camera is activated only after the app requests permission and you initiate the relevant feature. Cassbana does not continuously access the camera or capture images in the background. Facial Data is used only to confirm that you are a real person, match your live image with an ID photograph, confirm identity, meet KYC and AML obligations, prevent impersonation and fraud, protect accounts, authenticate sensitive activity, investigate suspected abuse, and maintain legally required compliance evidence. Facial Data is not used for advertising, behavioural profiling, cross-app tracking, emotion analysis, inference of unrelated sensitive characteristics, sale or commercial licensing, or training unrelated general-purpose facial-recognition or AI models. Before collection, Cassbana will provide an appropriate notice and obtain express consent where required. Processing may also rely on contract necessity, legal obligation, fraud prevention, information security, or another ground permitted by law. Facial Data is retained only for the minimum period necessary for verification, security, fraud prevention, legal compliance, or legal claims. Temporary captures and derived templates will be deleted or made unusable when no longer required, while verification results or audit records may be retained where required by law. Facial Data may be shared only with authorised identity-verification or technology processors and competent authorities where required or permitted by law. Cassbana does not sell Facial Data or share it with advertising networks, data brokers, or social-media companies for independent advertising. Facial Data is treated as sensitive and protected through appropriate measures such as encryption, access controls, multi-factor authentication, monitoring, security testing, segregation, confidentiality obligations, vendor assessment, and secure deletion. Subject to law and mandatory retention requirements, you may request confirmation, access, correction, withdrawal of consent, deletion, restriction, provider information, or human review of qualifying solely automated decisions by contacting info@cassbana.com.
6. How We Collect Personal Data
We collect data directly from you; through forms, account use, service interactions, customer support, your device camera when you start verification, identity documents, cookies and logs; from authorised representatives; and, where lawful, from financial institutions, payment providers, credit-information providers, government or official databases, fraud-prevention and verification providers, Cassbana affiliates, service providers, and public sources.
7. How We Use Personal Data
We use personal data only for lawful and stated purposes. Create, administer, and secure accounts; provide services; review applications; verify identity and business information; perform facial matching and liveness checks; complete KYC and compliance procedures; process payments and transactions; send account and transaction notices; support customers; manage disputes, fees, payments, and collections; detect and investigate fraud and unlawful activity; protect users and systems; meet legal and regulatory duties; improve security and functionality; conduct internal analysis, audit, research, and risk management; personalise permitted features; send lawful marketing communications; and establish, exercise, or defend legal claims.
8. Legal Grounds for Processing
Depending on the circumstances, processing may be based on consent or express consent, performance of a contract or pre-contract steps, compliance with law, protection of vital interests, a public-interest task where applicable, fraud and security prevention, or Cassbana's legitimate interests where permitted and not overridden by your rights.
9. Disclosure to Third Parties
Relevant data may be disclosed to identity and biometric verification providers; hosting, cloud, cybersecurity, and IT providers; payment processors and financial institutions; authorised credit-information providers; fraud, sanctions, and compliance providers; auditors, accountants, lawyers, and advisers; customer-support and communications providers; collection and insurance providers; Cassbana affiliates; competent governmental, judicial, tax, regulatory, supervisory, or law-enforcement authorities; and lawful purchasers, investors, or successors in a corporate transaction subject to safeguards. Recipients may process data only for authorised purposes and under applicable contractual and legal duties.
10. International Data Transfers
Some providers or affiliates may process data outside the country of collection. Cassbana will implement measures required by law, which may include consent, regulatory approval, adequacy assessment, approved contractual safeguards, transfer-risk assessment, and recipient security obligations. Facial Data will be transferred internationally only where legally permitted and appropriately safeguarded.
11. Data Retention
Cassbana retains data only as long as reasonably necessary to provide services, manage the customer relationship, fulfil stated purposes, meet legal, regulatory, accounting, tax, AML, and reporting obligations, resolve disputes, prevent fraud, and manage legal claims. Retention considers the amount, nature, sensitivity, purpose, legal requirements, and risks. Data no longer required will be securely deleted, destroyed, or irreversibly anonymised unless retention is legally required.
12. Data Security
Cassbana maintains organisational, administrative, physical, and technical safeguards designed to prevent loss, misuse, unauthorised access, alteration, or disclosure. Access is limited to authorised persons with a business need and confidentiality obligations. No electronic system is completely secure, but controls will be proportionate to the data's sensitivity. Required breach notifications will be made to competent authorities and affected individuals.
13. User Accounts and Authentication
You are responsible for protecting account credentials and promptly notifying Cassbana of suspected unauthorised use. We may request additional identity information before granting account access or processing a privacy request.
14. Your Data-Protection Rights
Subject to applicable law, you may have rights to be informed; know what data is held; access and obtain a readable copy; correct, update, or complete data; request deletion or destruction; withdraw consent; object to or restrict processing; request portability where applicable; request review of certain solely automated decisions; opt out of direct marketing; and complain to Cassbana or a competent authority. Rights may be limited where processing or retention is required by law, needed to protect another person, prevent fraud, maintain security, or establish or defend legal claims.
15. Exercising Your Rights
Submit requests to info@cassbana.com and describe the request clearly. Cassbana may request information reasonably necessary to verify identity and prevent unauthorised access or deletion.
16. Response Time
Cassbana aims to respond to valid privacy requests within 30 days or the period required by applicable law. Where a request is complex, extensive, repetitive, or requires additional verification, additional time may be used where permitted, and you will be informed.
17. Automated Processing
Cassbana or an authorised provider may use automated systems for identity verification, liveness detection, fraud detection, risk assessment, or security monitoring. Failed verification may lead to a request for more information or manual review. Where law provides a right regarding a solely automated decision with legal or similarly significant effects, you may request information or human review.
18. Marketing Communications and Opt-Out
Cassbana may send promotional communications where you have consented or another ground permits them. You may opt out through the unsubscribe method, available preference settings, or info@cassbana.com. Opting out does not stop essential account, security, transaction, legal, or service messages.
20. Camera Permission
The app may request camera access to capture identity documents, selfies, facial verification, and liveness detection. The camera is used only when you initiate a relevant feature and is not activated continuously or in the background. You may revoke permission in device settings, but this may prevent completion of required identity verification.
21. Children and Minors
Services are not intended for persons under 18 unless a different age is legally permitted and required guardian consent and safeguards are in place. Cassbana does not knowingly collect Facial Data from minors without required authority. Unlawfully collected minor data will be restricted and securely deleted unless retention is legally required. Concerns may be sent to info@cassbana.com.
22. Accuracy and Updating
You should ensure submitted data is accurate, complete, and current. Update it through the platform where available or contact Cassbana when information changes.
23. Purpose Limitation and Data Minimisation
Cassbana collects data reasonably necessary, relevant, and proportionate to identified purposes. Data will not be used for a materially incompatible new purpose unless permitted by law, appropriate notice is provided, and additional consent is obtained where required.
24. External Links
Cassbana platforms may link to external services not controlled by Cassbana. Cassbana is not responsible for their privacy, security, availability, or content. Review third-party privacy policies before providing data.
25. Complaints
If you believe Cassbana has violated this policy or applicable law, contact info@cassbana.com. Cassbana will review the complaint and respond within the legally required period. You may also complain to the competent data-protection or regulatory authority.
26. Changes to This Policy
Cassbana may update this policy for changes in services, technology, law, or processing. The latest version will be published on the website or app with its effective date. Additional notice or renewed consent will be provided where required.
27. Contact Us
Cassbana Email: info@cassbana.com