This Privacy Policy ("Policy") explains how Global Chains ERP and its operating entity ("Global Chains ERP," "we," "us," or "our") collects, uses, discloses, stores, and protects information in connection with our cloud software platform and related services (collectively, the "Service"). The Service is designed as financial and business operations infrastructure, including without limitation: smart invoicing; accounts payable and receivable; vendor and client records; treasury, wallet, and payment-orchestration tooling; multi-currency and reconciliation features; M-Pesa and other payment-channel integrations where enabled; subscription billing; organization and workspace management; roles and approvals; APIs, webhooks, and third-party integrations; document and logo uploads; PDF ingestion where offered; email and messaging-related features; optional blockchain or digital-asset-related workflows; optional push notifications; ledger or accounting-oriented exports/sync where offered; and administrative or compliance-oriented logging.
Important: This Policy is provided for transparency. It does not constitute legal advice. Financial, payroll, tax, sanctions, and data-protection requirements vary by jurisdiction and use case. Engage qualified counsel and, where applicable, execute a Data Processing Addendum (DPA) with us for enterprise deployments.
Last updated: May 10, 2026
This Policy applies to visitors to our websites, registered users, organization administrators and members, payors or counterparties who interact with public or tokenized flows we host (such as hosted invoice or payment pages or vendor submission links), and individuals whose information is submitted into the Service by a customer (for example employees, vendors, or clients of our customers).
If you interact with the Service only as an employee or contact of our customer, that customer is typically responsible for informing you about processing and for honoring privacy requests for business data they control. We may still process certain information as an independent controller for security, billing, and platform integrity.
The Service is multi-tenant. In general:
Where laws require a lawful basis (such as under GDPR/UK GDPR), we rely on contract, legitimate interests (balanced against rights), legal obligation, or consent as appropriate to the activity. California and other U.S. state laws may classify certain processing differently; see Section 18.
Depending on how you use the Service, we may collect:
We may use rules-based systems or machine learning for fraud scoring, risk flags, categorization, suggestions, or workflow routing. Such processing may produce recommendations only; it does not replace your judgment unless you explicitly configure automation. Where required, you may have rights to human review or to object.
Where GDPR, UK GDPR, Kenya Data Protection Act, Nigeria NDPA, South Africa POPIA, India DPDP Act, UAE frameworks, or comparable laws apply, we process personal data under one or more of: performance of a contract, legitimate interests (e.g. securing the Service, preventing fraud—balanced against individual rights), legal obligation, vital interests (rare), or consent where required (e.g. non-essential cookies or certain marketing). Public-sector or employment contexts may impose additional rules.
We may disclose information to:
A Subprocessor Disclosure may list names and purposes; the list may change. We will provide enterprise customers notice where contractually required before engaging a new subprocessor that processes personal data on their behalf.
We may process and store data in the United States, European Economic Area, United Kingdom, Kenya, and other regions depending on deployment and vendor locations. Where transfers from the EEA, UK, Switzerland, or other restricted jurisdictions occur, we implement appropriate safeguards such as Standard Contractual Clauses, the UK Addendum, or other lawful mechanisms. Copies of transfer assessments or DPAs may be available to enterprise customers upon request.
Unless a separate enterprise agreement specifies a region, data may be processed globally to operate the Service. Certain regulated workloads may require dedicated deployment; contact us for enterprise options.
We implement commercially reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the Service, including access controls, encryption in transit where standard for the protocol, vulnerability management, logging, and vendor review. No system is perfectly secure. We do not represent that the Service is immune to compromise, "unhackable," or free from defects. You are responsible for safeguarding credentials, API keys, and devices used to access the Service.
We may record events such as authentication, role changes, configuration edits, approvals, exports, treasury or payout instructions initiated through the Service, webhook receipts, and administrative actions. Logs support security monitoring, dispute resolution, regulatory inquiries, and forensic investigations. Retention follows operational and legal requirements and may extend beyond account deletion where mandated for accounting or anti-fraud purposes.
We retain personal data for as long as necessary to provide the Service, comply with law (including tax, AML, and bookkeeping retention), resolve disputes, and enforce agreements. Categories such as security logs, billing records, and accounting entries may have longer retention. Backups may persist for a limited period after deletion requests. Enterprise customers may negotiate schedules in a DPA.
You may request export or deletion subject to law and technical feasibility. Where we act as processor, requests may need to be routed through your organization's administrator. Some information must be retained by law or for legitimate interests (e.g. billing proofs, abuse prevention). Public blockchain records cannot be erased by us.
We use essential, functional, analytics, and security-related cookies or similar technologies. A dedicated Cookie Policy or cookie banner may provide granular choices where required. Disabling certain cookies may impair functionality.
We may send product updates or offers where permitted. You may opt out of marketing communications; transactional or security notices may continue.
The Service is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children.
We prohibit use of the Service for sanctions evasion, money laundering, terrorist financing, fraud, or other illegal financial activity. We may screen data where required, block activity, freeze features, or terminate accounts consistent with law and risk policies.
Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to processing, and to lodge a complaint with a supervisory authority. California residents may have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of certain "sales" or "sharing" (we do not sell personal information for money in the traditional sense; we may use cookies or analytics that could constitute "sharing" under some definitions—see our Cookie disclosures). Other U.S. states are adopting similar laws. We will verify requests as permitted by law.
If we determine a personal data breach requires notification under applicable law, we will notify regulators and affected individuals as required. Customers acting as controllers are responsible for notifying their own data subjects where their business data is affected and they have the relationship.
The Service may link to third-party sites or embed widgets. Their privacy practices are governed by their own policies. Wallet extensions, banking portals, or social login providers may collect data independently.
We may update this Policy to reflect product, legal, or operational changes. We will post the updated Policy with a new "Last updated" date and, where required, provide additional notice. Continued use after changes may constitute acceptance where permitted.
Privacy questions and requests:
Email: privacy@globalfinance.com
Data protection: dpo@globalfinance.com
Address: [Your Business Address]