Privacy Policy

1. Data Controller

The data controller responsible for the personal data collected through this website (https://vishab-otc.com/) is VISHAB OTC, S.A. de C.V. ("VISHAB OTC"), a corporation organized and existing under the laws of the Republic of El Salvador, with registered address at 4a Av. Norte, #5-7, Santa Tecla District, La Libertad Sur Municipality, El Salvador, registered as a Digital Asset Service Provider (PSAD-0089) with the National Digital Assets Commission (CNAD) and as a Bitcoin Service Provider (BSP) with the Central Reserve Bank of El Salvador.
Data Protection Contact: compliance@vishab.org.

2. Collected Data and Purposes

We process data voluntarily provided by you and technical data generated through website access:

• Contact and Institutional Inquiries: Full name, corporate email address, institution, and professional title submitted via contact forms. Purpose: Handling corporate inquiries, institutional preliminary reviews, and business correspondence.
• Technical and System Logs: IP addresses, browser specifications, operating system telemetry, and server traffic logs. Purpose: Network security, defense against DDoS attacks, intrusion prevention, and platform reliability.
• Onboarding and Due Diligence Data (KYB/KYC): When entering into a commercial engagement, we collect corporate incorporation instruments, constitutional documents, identity documentation of authorized signatories and Ultimate Beneficial Owners (UBOs), pursuant to the Digital Assets Issuance Law (LEAD) and applicable AML/CFT regulations.

3. Legal Basis for Processing

Personal data processing is grounded upon:

• Steps taken prior to entering into a contract or the performance of a regulated institutional service contract.
• Compliance with statutory and legal obligations under the LEAD, the RPSAD Regulation, regulatory directives issued by the CNAD, and Salvadoran anti-money laundering legislation.
• Legitimate interests in protecting the integrity, security, and availability of our information systems.

4. Hosting and Cross-Border Data Transfers

This website and its associated technical logs are hosted on VPS infrastructure located within the United States of America (USA). Data may also be processed by institutional compliance, transaction monitoring, and infrastructure service providers located in the European Union, United Kingdom, or the United States under stringent data processing agreements ensuring encryption (AES-256 / TLS 1.3) and international data transfer safeguards.

5. Data Retention

General inquiry records are retained for the duration of the business relationship or until erasure is requested. Information obtained for statutory due diligence (KYB/KYC), transaction monitoring, and audit trails shall be retained for a mandatory statutory period of ten (10) years or as mandated by Salvadoran supervisory frameworks and FATF standards.

6. Data Subject Rights

You may exercise your rights to access, rectification, restriction of processing, and erasure of your personal data by directing a formal request to compliance@vishab.org. These rights are subject to statutory retention exceptions regarding AML/CFT reporting and financial supervision requirements enforced by regulatory bodies (CNAD and FIU).