Privacy & Cookie Policy

Privacy Policy

PRIVACY POLICY AND INFORMED CONSENT OF THE KANGA CARD WAITLIST

(Version effective from 3 October 2026)

§ 1. General provisions and identity of the Person Responsible for the Database

This Privacy Notice and Informed Consent (hereinafter referred to as the "Policy") sets out the rules for the collection, processing, protection and storage of personal data of persons who join the Kanga Card waitlist through the website available at: https://kangacard.global/waitlist (hereinafter referred to as the "Website"). The coming-soon page at https://kangacard.global does not collect personal data, set cookies or load any analytics or advertising technology.

The Website is a pre-launch information page for the Kanga Card, a payment card that will allow holders to spend cryptoassets. Joining the waitlist is not an application for a card, does not create any contract for financial services, and does not guarantee that a card will be offered to the person who joins.

The entity responsible for the database (hereinafter referred to as the "Controller" or "Administrator") is the company 3-102-93-8308 SRL, registered in the Commercial Register of the Republic of Costa Rica (Registro Nacional) under the identification number 3-102-93-8308, with its registered office at: Provincia 01 San Jose, Canton 02 Escazu, San Rafael, del Centro Comercial La Paco, trecientos metros norte, Plaza Florencia, Local diez.

Contact with the Controller in all matters related to privacy protection and the exercise of the rights of data subjects is carried out electronically at the following e-mail address: [email protected].

The processing of personal data on the Website is subject to the laws of the Republic of Costa Rica, in particular Law No. 8968 on the Protection of Natural Persons against the Processing of Their Personal Data ("Ley 8968") and Implementation Decree No. 37554-JP ("Reglamento 37554-JP"), without prejudice to mandatory data protection laws of the country in which the User resides where those laws apply to the processing.

§ 2. Principle of Informed Consent

The processing of personal data on the Website is based on the Informed Consent granted by the User in a free, express, specific and unambiguous manner when joining the waitlist.

The User expresses Informed Consent by actively checking the checkbox confirming that they have read and accepted this Policy before submitting the waitlist form. Consent to take part in the free card drawing is given separately, by ticking the optional drawing box, and is subject to the Drawing Rules.

Granting consent is entirely voluntary. The User has the right to withdraw (revoke) their consent at any time, using the unsubscribe link included in every e-mail sent to them, or by writing to the contact address in § 1. E-mails about the waitlist are sent from an address that does not accept replies; the unsubscribe link and the contact address in § 1 are the ways to reach the Controller. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. Withdrawal of consent results in the removal of the User from the waitlist and from the drawing.

Consent to analytics and advertising technologies is separate from the consent described above. It is given through the cookie banner shown on the first visit to the Website, is recorded independently of joining the waitlist, and applies equally to visitors who never join it (hereinafter "Guests"). Until it is given, no analytics or advertising technology is loaded and no data is transmitted to the providers listed in § 6.

That consent may be withdrawn at any time through the cookie settings link in the footer of the Website, as easily as it was given, and without any need to contact the Controller. Withdrawal stops any further processing of that kind, does not affect the lawfulness of processing carried out before withdrawal, and does not affect the strictly necessary technologies required for the Website to function.

§ 3. Data quality and purposefulness

The data processed must be adequate, relevant and not excessive in relation to the purposes for which they are collected.

In accordance with the principle of data minimisation, the waitlist asks only for the data needed to notify the User about the Kanga Card and to run the drawing. The Telegram username is optional. No identity documents, financial information, wallet addresses or payment details are requested on the Website, and the User should not provide them.

§ 4. Purposes, scope and legal basis of data processing

The personal data of Users are processed by the Administrator only for the following purposes:

Managing the waitlist and informing the User about the Kanga Card:

Data scope: Name, e-mail address, country of residence, Telegram username (if provided), and the website or advertising link through which the User arrived (where the link carries campaign tags or the browser reports a referring website).

Purpose: Confirming the User's place on the waitlist, sending information about the Kanga Card launch, early access and launch offers, and understanding in which countries there is demand for the card.

Legal basis: The User's Informed Consent expressed when joining the waitlist.

Running the free card drawing:

Data scope: Name, e-mail address, country of residence, Telegram username (if provided), the User's answer to the drawing question.

Purpose: Determining eligibility, selecting and contacting winners, and delivering prizes, as described in the Drawing Rules.

Legal basis: The User's Informed Consent and the performance of the Drawing Rules accepted by the User.

Record of consent:

Data scope: The date and time of consent, the version of this Policy accepted, and the answer to the drawing question, kept with the User's entry in the waitlist contact list. Unsubscribing removes the entry.

Legal basis: The Controller's obligation to be able to demonstrate that consent was given.

Website administration and technical security:

Data scope: Data collected automatically (IP address, connection parameters, server logs).

Legal basis: The Controller's legitimate interest in ensuring the stability, security and integrity of IT systems and in preventing automated or fraudulent sign-ups.

The country associated with the IP address may also be used to restrict access to the Website, or to the waitlist, from particular countries, for example where the Controller is not permitted or does not intend to offer Kanga Card there. This check happens at the time of the request; nothing is stored for it.

Anonymous visit counts:

Data scope: For each day, the number of times the Website's start page and waitlist page were opened from each country, the country being derived from the IP address. No cookie is used, and neither the IP address nor any other identifier is stored with these counts, so they cannot be linked to a person.

Legal basis: The Controller's legitimate interest in knowing, in aggregate, where interest in Kanga Card comes from.

Statistical analysis of how the Website is used:

Data scope: Pages viewed and actions taken on the Website, approximate location derived from the IP address, the IP address itself, device and browser characteristics, the referring website or advertisement, and the identifiers stored in the analytics cookies described in § 14.

Legal basis: The Informed Consent of the User or Guest, given separately through the cookie banner and withdrawable at any time. No data is collected for this purpose before that consent is given.

Measurement and delivery of Kanga Card advertising:

Data scope: The automatically collected data described immediately above, the fact that joining the waitlist or another measured action followed a particular advertisement, and the identifiers stored in the advertising cookies described in § 15.

Legal basis: The Informed Consent of the User or Guest, given separately through the cookie banner and withdrawable at any time. No data is collected for this purpose before that consent is given.

§ 5. No profiling and no sale of data

The waitlist database is not used to assess the User's creditworthiness or financial capacity, and no decision producing legal effects concerning the User is taken on the basis of automated processing.

The collected personal data is not sold or otherwise commercialised. Apart from the service providers necessary to operate the Website, the only third parties that receive data are the analytics and advertising providers listed in § 6, and only where the User or Guest has accepted those technologies.

If the User later applies for a Kanga Card, that application is a separate process with its own terms and privacy notice, which may be provided by the card issuer or programme manager. Waitlist data is passed to that process only with the User's further consent.

§ 6. Analytics, advertising and other recipients

Analytics and advertising (only where accepted through the cookie banner):

Where acceptance is given, the Website uses Google Analytics 4 to produce statistics on how the Website is used, Google Ads conversion tracking to measure whether advertising leads to waitlist sign-ups, and the advertising pixels provided by Meta Platforms and by TikTok to measure advertising performance and to present Kanga Card advertising on those platforms. Where that acceptance has not been given, or has been withdrawn, none of this processing takes place.

The recipients of that data are: Google LLC, in respect of Google Analytics 4 and Google Ads; Meta Platforms, in respect of its advertising pixel; and TikTok, in respect of its advertising pixel. Each provider processes the data it receives under its own privacy documentation, and in the case of the advertising services also for its own purposes as an independent controller. These providers may use the data they receive to build advertising audiences and to select the advertising shown to the User or Guest on their own platforms.

The e-mail address and other data entered in the waitlist form are not sent to these providers.

Service providers:

Personal data is also disclosed to service providers that process it on the Controller's behalf and under its instructions, to the extent necessary to operate the Website and the waitlist:

Storage of waitlist entries and e-mail communication with Users: GetResponse S.A. (Poland), in whose systems the waitlist contact list is kept.

Website hosting: Railway Corporation (United States), which hosts the Website and a statistics database. That database holds no names, e-mail addresses or Telegram usernames; it records only anonymous events and counts (daily page-view totals per country, and for each sign-up or unsubscribe: the date of a sign-up or unsubscribe, the country selected, the country detected from the IP address — the IP address itself is not stored —, the answer to the drawing question, and the campaign tags or referring website, if any).

E-mail delivery: Resend (Plus Five Five, Inc., United States).

Security, bot protection and content delivery: Cloudflare, Inc. (United States), including the Cloudflare Turnstile check on the waitlist form.

These providers are established outside the Republic of Costa Rica, in the European Union and the United States, and may process the data in other countries in which they or their sub-processors operate. The safeguards applied to those transfers are those stated by each provider in its data processing terms.

§ 7. ARCO rights (Acceso, Rectificación, Cancelación y Oposición)

Every User has full rights to control their personal data:

Right of Access: The User has the right to know whether their personal data is being processed, for what purposes, where it was obtained, and which databases contain it.

Right to Rectification: The User has the right to request that their data be immediately corrected, updated or supplemented if it is untrue, incomplete or out of date.

Right to Delete / Suppress: The User has the right to request the complete and permanent deletion of their personal data from the Controller's database if the purpose of the processing has been achieved or if the User has withdrawn their Informed Consent.

Right to Object: The User has the right to object, for legitimate reasons relating to their particular situation, to the processing of their personal data.

The exercise of these rights is completely free of charge. All requests should be submitted electronically to the contact address in § 1. The Administrator undertakes to respond and fulfil the request without undue delay, within the deadlines specified by applicable law.

§ 8. Data retention periods and blocking

Personal data is stored only for the time necessary to achieve the purposes for which it was collected.

Waitlist data is retained until the User withdraws consent or, at the latest, 24 months after the User joined the waitlist.

Data concerning the drawing is retained until 90 days after the prizes have been delivered, except that winners' data may be kept for as long as required by law for tax or prize-promotion records.

Server logs are retained for no longer than 30 days.

Data collected through analytics and advertising technologies is retained for the periods stated for each cookie in § 14 and § 15, and no longer than is necessary for the purpose for which it was collected. Where acceptance is withdrawn, no further data of that kind is collected; data already transmitted to a provider is retained and deleted in accordance with that provider's retention rules.

If the User requests deletion of their data or withdraws consent, and legal provisions require its continued retention, the data will be blocked: it may only be stored for the purpose of providing it to competent courts or authorities and may not be subject to any other processing. After the relevant limitation periods expire, the data will be irrevocably deleted or permanently anonymised.

§ 9. Security

The Controller implements the necessary technical, physical and organisational security measures to prevent unauthorised access, loss, destruction, disclosure or modification of personal data.

All data transmissions on the Website are encrypted using the TLS (HTTPS) protocol. Only authorised staff of the Administrator with individual access rights have access to the waitlist database.

§ 10. Applicable law and supervisory authority

This Policy shall be governed by the laws of the Republic of Costa Rica, subject to mandatory provisions of law.

The supervisory authority competent for the protection of personal data processed by the Controller is the Agencia de Protección de Datos de los Habitantes (PRODHAB), San José, Costa Rica, www.prodhab.go.cr. Users residing in the European Economic Area also have the right to lodge a complaint with the data protection authority of their country of residence.

COOKIE POLICY OF THE KANGA CARD WEBSITE

§ 11. Scope of this policy

This policy explains how the Website, available at https://kangacard.global/waitlist, uses cookies and similar technologies. It forms part of the Privacy Policy and should be read together with it. Similar technologies, such as advertising pixels and browser storage, are treated in the same way as cookies throughout this policy.

§ 12. Your choice comes first

When you first visit the Website you are shown a cookie banner. Analytics and advertising cookies are not placed, and no analytics or advertising script is loaded, unless and until you accept them. If you decline, or close the banner without accepting, only the strictly necessary technologies listed in § 13 are used, and the Website, including the waitlist form, works normally.

You can change your decision at any time using the cookie settings link in the footer. Withdrawing your acceptance is as easy as giving it, and stops any further use of those cookies.

§ 13. Strictly necessary cookies and storage

These are needed for the Website to work. They are set by the Website itself, are read only by this Website, and are not used for analytics or advertising. They do not require your consent.

kc_consent — remembers whether you accepted or declined cookies, so you are not asked again on every visit. Set when you answer the cookie banner. Lifetime 6 months. First-party.

kc-intro-seen — remembers that the opening animation has already been shown during this visit. Stored in your browser's session storage, not as a cookie. Contains no personal data, is not sent to our servers, and is deleted when you close the tab. First-party.

__cf_bm — security. Distinguishes automated traffic from people. Set by Cloudflare, which delivers the Website. Possible on any request. Lifetime about 30 minutes. First-party.

Cloudflare Turnstile — the security check on the waitlist form. Runs in a frame from challenges.cloudflare.com to confirm that the form is being completed by a person. It is not used for analytics or advertising.

§ 14. Analytics cookies, used only if you accept

If you accept, Google Analytics 4 is used to understand how the Website is used: which pages are visited, whether the video is watched, whether the waitlist form is completed, and how visitors arrive. It is not used to identify you personally, and it is not used to assess your financial situation.

_ga — distinguishes one browser from another for visit statistics. Set by Google Analytics 4. Lifetime up to 2 years. First-party.

_ga_CONTAINERID — keeps session state for Google Analytics 4. Set by Google Analytics 4. Lifetime up to 2 years. First-party.

§ 15. Advertising cookies, used only if you accept

If you accept, advertising technologies are used to measure whether our advertising leads visitors to the Website and to the waitlist, and to present Kanga Card advertising on the platforms of the providers listed below. These providers receive data about your visit, including your IP address and the pages you view, and process it under their own privacy documentation, for the advertising services also for their own purposes.

_gcl_au — measures which advertisement led to a sign-up (conversion linking). Set by Google Ads. Lifetime up to 90 days. First-party.

_fbp — measures advertising performance and builds audiences. Set by the Meta pixel. Lifetime up to 90 days. First-party.

fr — advertising delivery and measurement. Set by Meta. Lifetime up to 90 days. Third-party.

_ttp and ttclid — measure advertising performance for TikTok campaigns. Set by the TikTok pixel. Lifetime up to 13 months. First or third-party.

The lifetimes above are the maximum periods published by each provider. A provider may shorten them, and may change the names of its cookies; where that happens this policy is updated as described in § 18.

§ 16. Where this data goes

Accepting analytics or advertising cookies means that data about your visit is sent to Google LLC, in respect of Google Analytics 4 and Google Ads; Meta Platforms, in respect of its advertising pixel; and TikTok, in respect of its advertising pixel.

These providers are established outside the Republic of Costa Rica, principally in the United States, and may process the data in other countries in which they or their sub-processors operate. The safeguards applied to those transfers are those stated by each provider in its privacy documentation.

If you do not accept, no data is sent to any of these providers.

§ 17. How to control cookies

Besides the cookie banner and the cookie settings link in the footer, you can delete cookies already stored on your device, and prevent new ones being stored, through your browser settings.

§ 18. Changes to this policy

If the way the Website processes personal data, or the cookies and similar technologies it uses, change, this Policy is updated and the new version is published on this page with a new effective date. Where a change requires your consent, it is requested before the change applies to you.

§ 19. Contact

Questions about this Policy, and requests concerning your personal data, can be sent to the contact address in § 1.