SpendVirtual – Legal Terms & Policies

1.1 Agreement to Terms

By accessing or using SpendVirtual ("Service"), you agree to be bound by these Terms. If you do not agree, you must not use the Service.

1.2 Eligibility

You must:

• Be at least 18 years old
• Have legal capacity to enter a contract
• Provide accurate and complete information

We reserve the right to suspend accounts that do not meet these requirements.

1.3 Account Registration & KYC

To use certain features, you must complete identity verification ("KYC"). You agree to provide:

• Accurate identity information
• Valid government-issued identification
• Proof of address where required

We may:

• Refuse or terminate accounts that fail verification
• Conduct ongoing monitoring in line with AML regulations

1.4 Acceptable Use

You agree NOT to:

• Use the service for illegal activities
• Engage in fraud, money laundering, or sanctions violations
• Circumvent security or verification systems
• Use stolen or unauthorized payment methods

Violations may result in immediate account suspension and reporting to authorities.

1.5 Payments & Card Usage

SpendVirtual may provide virtual cards or payment services. You agree:

• To use cards in compliance with applicable laws
• Not to use cards for prohibited transactions (e.g., illegal goods/services)

We comply with card network rules (Visa/Mastercard) and may block transactions accordingly.

1.6 Fees

We may charge fees for services. All fees will be clearly disclosed before use.

1.7 Suspension & Termination

We may suspend or terminate your account if:

• Required by law or regulators
• Fraud or suspicious activity is detected
• You breach these Terms

1.8 Limitation of Liability

To the maximum extent permitted by law:

• We are not liable for indirect or consequential losses
• Our liability is limited to the amount you paid for the service

1.9 Governing Law

These Terms are governed by the laws of the European Union and applicable local jurisdiction.

2.1 Overview

We process personal data in compliance with the GDPR and applicable financial regulations.

2.2 AML / KYC Legal Basis

We process personal data to comply with:

• EU Anti-Money Laundering Directives (e.g., AMLD5 / AMLD6)
• National financial regulations
• Know Your Customer (KYC) obligations
• Counter-Terrorist Financing (CTF) laws

This includes:

• Identity verification
• Transaction monitoring
• Risk profiling

2.3 Data We Collect

• Identity, contact, and verification data
• Transaction and financial data
• Device and usage data

2.4 Payment & Card Network Compliance

To comply with Stripe, Visa, and Mastercard requirements, we may:

• Share transaction data with payment processors
• Perform fraud detection and risk scoring
• Enforce network rules and prohibited transaction categories
• Store and process payment-related metadata securely

We do not store full card details unless compliant with PCI-DSS standards.

2.5 Fraud & Risk Monitoring

We use automated systems to:

• Detect suspicious activity
• Prevent fraud and chargebacks
• Comply with financial crime regulations

This may involve profiling under GDPR Article 22.

2.6 Data Sharing

We may share data with:

• Payment processors (e.g., Stripe)
• Identity verification providers
• Regulatory authorities
• Card networks

All sharing is limited to what is necessary and legally required.

2.7 Your GDPR Rights

You have rights to:

• Access, correct, or delete your data
• Restrict or object to processing
• Data portability

Note: Some rights may be limited due to AML legal obligations.

2.8 Data Retention (AML Requirement)

We retain personal data for 5–10 years as required by AML laws, even after account closure.

2.9 Security

We implement:

• Encryption
• Access controls
• Continuous monitoring

3.1 What Are Cookies

Cookies are small text files stored on your device when you visit our website.

3.2 Types of Cookies We Use

3.3 Cookie Consent

When you first visit SpendVirtual:

• You will see a cookie banner
• You can accept or reject non-essential cookies
• Consent can be withdrawn at any time

3.4 Managing Cookies

You can control cookies via:

• Browser settings
• Cookie preferences panel on our website

3.5 Third-Party Cookies

Some cookies may be set by third parties such as payment processors or analytics providers. Their respective privacy policies govern these.

4.1 Illegal Activities

• Any activity that violates applicable laws or regulations
• Money laundering, terrorist financing, or sanctions evasion
• Fraud, theft, or deceptive practices

4.2 Financial Misuse

• Use of stolen or unauthorized payment methods
• Circumventing transaction limits or controls
• Cash advance abuse or manufactured spending
• Unauthorized reselling of financial services

4.3 High-Risk or Restricted Businesses

You may not use SpendVirtual for transactions involving:

4.4 Deceptive or Unfair Practices

• Misrepresentation of products or services
• Pyramid schemes or Ponzi schemes
• Fake charities or fundraising

4.5 Sanctions & Restricted Jurisdictions

• Transactions involving sanctioned individuals, entities, or countries
• Use of the service in embargoed regions

4.6 Enforcement

We may:

• Block or decline transactions
• Suspend or terminate accounts
• Report activity to regulators or law enforcement

5.1 Corporate & Legal Structure

• Registered legal entity in jurisdiction (e.g., Ireland/EU)
• Company directors and ownership structure documented
• Terms of Service + Privacy Policy published
• Regulatory classification assessed (e.g., EMI, agent, program manager)

5.2 GDPR Compliance

• Lawful basis for all data processing defined
• Privacy Policy publicly available
• Data subject rights process implemented
• Data Processing Agreements (DPAs) signed with vendors
• Data Protection Impact Assessment (DPIA) completed (if required)
• Data breach response plan in place (72-hour rule)

5.3 AML / KYC Compliance

• Customer identification program (KYC) implemented
• Identity verification provider integrated
• Ongoing transaction monitoring system active
• Suspicious Activity Reporting (SAR) procedures defined
• AML policy and risk assessment documented
• Sanctions screening (EU, UN, OFAC lists) enabled

5.4 Payments & Card Network Compliance

• Integrated with a compliant processor (e.g., Stripe)
• PCI-DSS compliance validated (or outsourced to provider)
• Prohibited activities policy enforced
• Chargeback handling procedures defined
• Fraud detection and prevention systems active
• Card network rules (Visa/Mastercard) reviewed and implemented

5.5 Security & Infrastructure

• Data encryption (in transit and at rest)
• Role-based access control (RBAC) implemented
• Security monitoring and logging enabled
• Regular penetration testing or audits conducted
• Incident response plan documented

5.6 Operational Readiness

• Customer support process in place
• Complaint handling procedure defined
• Account suspension and review workflows implemented
• Internal audit or compliance review scheduled

5.7 Risk & Governance

• Risk assessment framework established
• Compliance officer or MLRO (Money Laundering Reporting Officer) assigned
• Internal policies documented (AML, data protection, security)
• Board-level oversight or governance structure defined

5.8 Cookie & Tracking Compliance

• Cookie banner with opt-in consent implemented
• Consent logging system is active
• Ability to withdraw consent enabled