Privacy Policy

Introduction

Veloci Capital ("we", "us", "the platform") operates a regulated invoice discounting and factoring marketplace in Peru. This Privacy Policy explains what personal data we collect when you visit our website, open an account, invest, or list an invoice — and how we use, share, store and protect it. We process personal data in accordance with Peru’s Personal Data Protection Law (Ley N.° 29733) and its regulations, and with the record-keeping and reporting obligations imposed on us by the SMV (Superintendencia del Mercado de Valores) and SUNAT. Last updated: 3 August 2026.

Information We Collect

We collect the following categories of data: • Identity and contact data — full name or legal company name, DNI or RUC, entity type, address, country, email address and telephone number. • Verification data (KYC / KYB) — identity and company registration documents, proof of address, representative details, and the results of AML, PEP and sanctions screening performed by our verification providers. • Financial data — bank account details, wallet balances and movements, deposits and withdrawals, investments, payouts and settlement records. • Transaction data — the invoices you upload, confirm or pay, the deals you fund, your ownership percentage over time, and your secondary-market listings and purchases. • Agreement data — your acceptance of the framework agreement and per-investment risk disclosures, including the signature record and the signed document. • Technical data — IP address, device and browser information, session and login history, and the pages you visit. • Communications — the emails, notifications and support requests exchanged with us.

How We Use Your Information

We use your personal data only for these purposes: • To open, operate and secure your account, including login, multi-factor authentication and session management. • To verify your identity and, where you act for a company, its legal existence and representation — a legal precondition before any money can move. • To carry out AML, PEP and sanctions screening and to comply with our anti-money-laundering obligations. • To execute your instructions: deposits, investments, invoice uploads and confirmations, secondary-market trades, payouts and withdrawals. • To calculate returns, fees and taxes, and to settle transactions through the escrow account. • To send you transactional notifications (verification results, funding, settlement, payment reminders) and, where you have opted in, service updates. • To produce the reports the SMV requires and the tax records SUNAT requires. • To detect and prevent fraud, abuse and unauthorised access, and to maintain an audit trail of sensitive actions. We do not sell your personal data, and we do not use it for automated decisions that produce legal effects on you without human review.

Legal Basis for Processing

We process your data on one of the following bases: your consent, given when you register and when you accept a specific disclosure; the performance of the contract between us, including the framework agreement and each investment; compliance with a legal obligation, in particular AML, SMV and SUNAT requirements; and our legitimate interest in keeping the platform secure and preventing fraud. Where processing depends on your consent, you may withdraw it at any time — but note that we cannot operate an account, or return funds already committed to a transaction, without the data the law requires us to hold.

Who We Share Your Information With

We share personal data only where it is necessary, and only with: • Service providers acting on our instructions — identity verification and AML screening, the regulated escrow institution and payment providers, the electronic-signature provider, email and SMS providers, and our cloud hosting and storage provider. Each is bound by confidentiality and may use the data only to provide its service. • Regulators and authorities — the SMV, SUNAT, the UIF-Perú and judicial or administrative authorities, where required by law or a valid order. • Transaction counterparties, in strictly limited form — a debtor named on an invoice is told which company issued it and the invoice details it must confirm; a seller sees the confirmation status of its own invoices. Investors are never shown each other’s identity, and sellers are never shown the identity of the investors funding their invoices. • Professional advisers and auditors, under a duty of confidentiality. Some providers process data outside Peru. Where that happens, we require contractual safeguards consistent with Ley N.° 29733 for the international transfer of personal data.

How We Protect Your Information

Sensitive personal data — identity document numbers and bank details among them — is encrypted at rest with AES-256, and all traffic between you and the platform travels over TLS. Personal data is masked in our application logs. Access is granted by role and permission, on a default-deny basis: staff can only reach the data their function requires, multi-factor authentication protects account access, and every sensitive action is written to an append-only audit log. Funds never sit in our own accounts — they move exclusively through a regulated escrow account under SMV oversight. No system is completely secure. If a breach affects your personal data, we will notify you and the competent authority as required by law.

How Long We Keep Your Information

We keep account and verification data for as long as your account is open. Financial records — the ledger, settlements, invoices and the audit trail — are kept for at least seven years after the transaction, because SMV, SUNAT and anti-money-laundering rules require it. Notification logs are kept for twelve months. Closing your account therefore does not erase records we are legally required to retain; it stops us using them for anything other than that legal purpose.

Your Rights

Under Ley N.° 29733 you have the right to access your personal data, to have inaccurate data rectified, to cancel data we no longer have a lawful basis to hold, and to object to a particular use (the ARCO rights). You may also request a copy of the data you provided us and withdraw a consent you previously gave. To exercise any of these rights, write to hi@velocicapital.com from the email address registered on your account. We will respond within the period established by law. Where we cannot act on a request — typically because a regulatory retention period applies — we will tell you why. If you believe your rights have not been respected, you may file a claim with the Autoridad Nacional de Protección de Datos Personales.

Cookies and Similar Technologies

We use strictly necessary cookies to keep you signed in and to protect your session against cross-site request forgery; these cannot be switched off without breaking the service. We also store your language preference so the site opens in the locale you chose. Where we use analytics to understand how the site is used, it is configured so as not to identify you individually. You can block or delete cookies in your browser settings, accepting that session cookies are required to log in.

Changes and Contact

We may update this Privacy Policy as the platform or the applicable rules evolve. The current version is always published on this page, and we will notify registered users by email before a material change takes effect. Questions about this policy or about how we handle your data: hi@velocicapital.com.