Privacy Notice
Effective date: January 1, 2026 · Last updated: January 2026
Zavelo Holdings Ltd (“Zavelo,” “we,” “us,” or “our”) is committed to safeguarding your privacy and ensuring the security of your personal data. This Notice sets out how we collect, process, manage, and protect your information when you access our platform, use our investment tools, or interact with our services, in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data Controller
Zavelo Holdings Ltd is the data controller responsible for determining the purposes and means of processing your personal data.
Legal Entity: Zavelo Holdings Ltd
Registered Address: 25 Farringdon Street, London, EC4A 4AB, United Kingdom
Jurisdiction: England and Wales
Privacy Inquiries & DPO Contact: support@zaveloholdings.com
2. Categories of Personal Data We Collect
We collect personal information directly from you when you register, complete verification, fund your account, subscribe to investment plans, or communicate with our team:
Identity Data
Full legal name, date of birth, nationality, country of residence, and government-issued identity documents (passport, national ID, driver's licence).
Contact Data
Email address, telephone number, residential address, and correspondence history.
Financial & Transaction Data
Cryptocurrency wallet addresses, transaction hashes, deposit timestamps, withdrawal requests, account balances, and investment plan records.
KYC & Verification Data
Document imagery, proof of address utility records, proof-of-liveness data, and sanctions/PEP screening verification records.
Technical & Device Data
Internet Protocol (IP) address, login timestamps, browser type and version, operating system, time zone settings, and device identifiers.
Usage & Interaction Data
Page visits, feature utilization, session durations, clickstream analytics, and security interaction logs within the dashboard.
Communications Data
Support tickets, email correspondence, feedback submissions, and dispute resolution documentation.
Marketing & Preferences Data
Your preferences regarding system notifications, investment plan alerts, and email communications.
3. How and Why We Process Your Data
We process your personal data only where we have a lawful basis under UK GDPR Article 6:
A. Contractual Performance (Art. 6(1)(b))
Necessary to establish and administer your account, process cryptocurrency deposits and withdrawals, execute investment plan subscriptions, calculate return accruals, and deliver client services.
B. Legal and Regulatory Compliance (Art. 6(1)(c))
Required to fulfil statutory obligations under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLR 2017), HMRC MSB supervisory requirements, sanction screening rules, tax reporting standards, and fraud prevention obligations.
C. Legitimate Business Interests (Art. 6(1)(f))
To maintain platform security, detect and prevent malicious or fraudulent activity, optimize user interface performance, conduct audit logging, and protect our legal rights.
D. Explicit Consent (Art. 6(1)(a))
Where you have provided explicit opt-in consent for optional market briefings or non-essential analytics cookies. You may revoke consent at any time without penalty.
4. Data Sharing and Third-Party Disclosures
We do not sell, rent, or trade your personal data to third parties. We share data only with authorized service providers and regulatory bodies under strict data processing agreements:
- Identity & AML Verification Partners: Specialized compliance vendors that perform biometric liveness verification and PEP/sanctions database screening.
- Cloud Infrastructure & Security Services: Tier-4 secure hosting, database encryption providers, and DDoS mitigation platforms operating with strict confidentiality.
- Email & Communication Providers: Encrypted email transmission platforms utilized solely for sending transactional notifications, verification codes, and security alerts.
- Statutory & Law Enforcement Authorities: Government agencies, HMRC, regulatory authorities, or law enforcement bodies where strictly compelled by valid legal process or court order.
- Professional Advisers: Certified legal counsel, external financial auditors, and compliance specialists bound by statutory professional privilege.
5. International Data Transfers
When personal data is transferred outside the United Kingdom or European Economic Area (EEA), we ensure equivalent legal protection through:
- Transfers to jurisdictions holding an official adequacy decision by the UK Government or European Commission;
- Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendums approved by the Information Commissioner’s Office (ICO);
- Mandatory end-to-end encryption and robust technical safeguards for all transit and at-rest storage.
6. Data Retention Policy
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to satisfy legal, regulatory, accounting, and compliance requirements.
- Active Accounts: Data is retained throughout the active lifetime of your account relationship.
- AML & Financial Records: Retained for a minimum of 5 years following the date of account closure, in compliance with UK anti-money laundering legislation.
- Technical & Security Logs: Retained for 12 to 24 months for forensic security and threat monitoring purposes.
- Marketing Preferences: Retained until consent is withdrawn or the account is terminated.
7. Your Data Protection Rights
Under the UK GDPR and the Data Protection Act 2018, you hold enforceable rights regarding your personal data:
Right of Access (SAR)
Request a copy of the personal data we hold about you and details of how it is processed.
Right to Rectification
Request the correction of inaccurate or incomplete personal data without delay.
Right to Erasure
Request deletion of your data when it is no longer needed (subject to statutory AML retention requirements).
Right to Restriction
Request that we restrict the processing of your data under specific contested circumstances.
Right to Data Portability
Receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object
Object at any time to processing based on legitimate interests or direct marketing.
To exercise any of these rights, contact our Privacy Desk at support@zaveloholdings.com. We respond to all verified requests within 30 calendar days.
If you believe your data has been handled unlawfully, you have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner’s Office (ICO) at ico.org.uk or by telephone at +44 303 123 1113.
8. Cookies and Storage Technologies
We use strictly necessary session cookies and local browser storage to secure authentication states, maintain active sessions, and safeguard CSRF tokens.
We do not deploy third-party advertising cookies or cross-site tracking trackers. You can configure your browser to reject cookies; however, disabling strictly necessary cookies will render core account features and authentication inaccessible.
9. Technical and Organisational Security
We maintain rigorous security controls including TLS 1.3 encryption in transit, AES-256 encryption at rest, multi-factor authentication requirements, role-based access restrictions, and continuous audit logging.
You are responsible for maintaining the confidentiality of your account credentials and 2FA secrets. Never share your password or security keys with any party.
10. Modifications and Updates
We may revise this Privacy Notice periodically to reflect operational, legal, or regulatory changes. Significant revisions will be notified via email or prominent dashboard banner prior to taking effect. We encourage periodic review of this document.
Have questions regarding your personal data?
Our Data Protection team is ready to answer inquiries and assist with Subject Access Requests.