Privacy Policy
Privacy Policy
Privacy Policy
These terms and conditions establish the rules for using our platform, Moreta.
These terms and conditions establish the rules for using our platform, Moreta.
These terms and conditions establish the rules for using our platform, Moreta.
Executive Summary
This Policy sets forth the guiding principles and standards for the purpose of effectively complying with federal financial information privacy requirements regarding the privacy, use, and sharing of Consumers’ Nonpublic Personal Information (“NPI”).
Moreta Global Inc. (the “Company”) has an affirmative and continuing duty to respect the privacy of its Consumers and to protect the security and confidentiality of those Consumers’ NPI, in accordance with the privacy provisions of the Gramm-Leach Bliley Act (“GLBA”), as implemented by the Consumer Financial Protection Bureau’s Regulation P. This Policy outlines the requirements for the Company to provide notice to Consumers about the Company’s privacy policies and practices. This Policy also describes the requirements and conditions which must be met before the Company may disclose Consumers’ NPI to Nonaffiliated Third Parties.
Purpose
This Policy was developed to ensure that the Company protects and respects the privacy of Consumers’ NPI and treats such NPI in accordance with the requirements of GLBA and Regulation P.
Scope
This Policy shall apply to the Company’s payment network platform that provides a tool (“Moreta App”) for foreigners to access payment network standard QR codes at local Southeast & East Asian merchants. This software tool allows consumers to access funds they have deposited with the Company’s partners to purchase goods and services.
Policy Notices
The Company’s Model Privacy Notice (the “Privacy Notice” or “Notice”) is included in Section 13 of this Policy. The Company provides initial and annual Notices to its Customers in connection with the Moreta App.
The Company provides the initial Privacy Notice to Consumers and Customers and an annual Privacy Notice to Customers, as required under and in accordance with the timing requirements of Regulation P. Privacy Notices provide Consumers and Customers with required information regarding the Company’s collection and disclosure of NPI. Where required under Regulation P, the Company provides Consumers or Customers with an opportunity to Opt Out of certain information sharing. Consumer and Customer Opt Out choices are tracked and honored.
4.1 Initial Privacy Notice to Consumers and Customers
The Company provides a Clear and Conspicuous initial Privacy Notice that accurately reflects the Company’s privacy policies and practices to:
Customers, not later than when the Company establishes a Customer Relationship, unless an exception under Regulation P applies to allow delivery of the Notice within a reasonable time after the Customer Relationship is established.
Consumers, before the Company discloses any NPI about the Consumer to any Nonaffiliated Third Party, unless an exception under Regulation P applies. The Company is not required to provide an initial Notice to a Consumer if it does not disclose any NPI about the Consumer to any Nonaffiliated Third Party and does not have a Customer Relationship with the Consumer.
The Company establishes a Customer Relationship when the Company and the Consumer enter into a continuing relationship.
4.2 Annual Privacy Notice to Customers
During the continuation of the Customer Relationship, the Company provides a Clear and Conspicuous annual Privacy Notice to each Customer, accurately reflecting the Company’s privacy policies and practices.
GLBA and Regulation P do not require the Company to provide an annual notice to a former Customer. Once the Customer becomes a former Customer, the Company is not required to provide an annual Privacy Notice to that former Customer.
4.3 Information to Be Included in Privacy Notices
The Company’s initial, annual, and revised Privacy Notices must contain certain information that applies to the Company and to the Consumers to whom the Company sends its Notices. Such information includes:
The categories of NPI that the Company Collects;
The categories of NPI that the Company discloses;
The categories of Affiliates and Nonaffiliated Third Parties to whom the Company discloses NPI other than pursuant to certain exceptions in Regulation P;
The categories of Affiliates and Nonaffiliated Third Parties to whom Company discloses NPI other than pursuant to certain exceptions in Regulation P;
The categories of NPI about Company’s former Customers that Company discloses and the categories of Affiliates and Nonaffiliated Third Parties to whom Company discloses NPI about its former Customers; and
If Company discloses NPI to a Nonaffiliated Third Party under the service provider exception and no other exception applies, a separate statement of the categories of information Company discloses and the categories of third parties with whom Company has contracted.
The Notices must also include an explanation of the Consumer’s right to Opt Out of any disclosure of NPI to Nonaffiliated Third Parties, the Company’s policies and practices with respect to protecting the confidentiality and security of NPI, and other information required under Regulation P as set forth in the GLBA privacy notice.
If the Company discloses NPI to third parties as authorized under Regulation P’s exceptions for processing and servicing transactions and certain other purposes, it is not required to list those exceptions in the initial or annual Privacy Notice. Rather, when describing the categories with respect to those parties, it is sufficient to state that the Company makes disclosures to other nonaffiliated companies:
For the Company’s everyday business purposes, such as to process transactions, maintain account(s), respond to court orders and legal investigations, or report to Consumer Reporting Agencies; or
As permitted by law.
Use of the model privacy form provided in the appendix to Regulation P, consistent with the instructions in the appendix, constitutes compliance with the Notice content requirements of Regulation P, although use of the model privacy form is not required.
4.4 Opt Out Requirements
All information systems that process NPI, which are maintained by the Company, must, as part of a consent-basis for processing NPI, capture and retain evidence of opt-outs as discussed further below and as required by applicable laws.
Unless an exception under Regulation P applies, the Company may not, directly or through any Affiliate, disclose any NPI about a Consumer to a Nonaffiliated Third Party unless all of the following conditions are satisfied:
The Company has provided an initial Privacy Notice to the Consumer;
The Company has provided an Opt Out notice to the Consumer;
The Company has given the Consumer a Reasonable Opportunity, before disclosing the information to the Nonaffiliated Third Party, to Opt Out of the disclosure; and
The Consumer does not Opt Out.
This restriction applies regardless of whether the Company has established a Customer Relationship with the Consumer.
The Company provides a Clear and Conspicuous notice to each of its Consumers that accurately explains the right to Opt Out of the disclosure. The notice states:
That the Company discloses or reserves the right to disclose NPI about the Consumer to a Nonaffiliated Third Party;
That the Consumer has the right to Opt Out of that disclosure; and
A reasonable means by which the Consumer may exercise the Opt Out right.
For accounts with two or more Consumers (e.g., accounts where two or more Consumers jointly obtained a financial product or service), Company provides a single opt-out notice and treats an Opt-Out direction by a joint Consumer as applying to all of the associated joint Consumers.
A Consumer may exercise the right to Opt Out at any time. A Consumer’s direction to Opt Out is effective until the Consumer revokes it in writing or, if the Consumer agrees, electronically. When a Customer Relationship terminates, the Customer’s Opt Out direction continues to apply to the NPI collected during or related to that relationship. If the individual subsequently establishes a new Customer Relationship with Company, the Opt Out direction that applied to the former relationship does not apply to the new relationship.
Company complies with a Consumer’s opt-out direction as soon as reasonably practicable after it is received.
Sharing With Service Providers
Generally, the Opt Out requirements do not apply when Company provides NPI to a Nonaffiliated Third Party to perform services for Company or on Company’s behalf, if Company:
Provides the initial privacy notice discussed above; and
Enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which Company disclosed the information, including use under an exception in (see further below) in the ordinary course of business to carry out those purposes.
However, the foregoing requirements, in addition to the initial privacy notice requirements and the Opt Out requirements, do not apply if Company discloses NPI as necessary to effect, administer, or enforce a transaction that a Consumer requests or authorizes, or in connection with:
Servicing or processing a financial product or service that a Consumer requests or authorizes; or
Maintaining or servicing the Consumer’s account with Company, or with another entity as part of a private-label credit card program or other extension of credit on behalf of such entity.
“Necessary to effect, administer, or enforce a transaction” means that the disclosure is:
Required, or is one of the lawful or appropriate methods, to enforce Company rights or the rights of other persons engaged in carrying out the financial transaction or providing the product or service; or
Required, or is a usual, appropriate, or acceptable method: (1) to carry out the transaction or the product or service business of which the transaction is a part, and record, service, or maintain the Consumer’s account in the ordinary course of providing the financial service or financial product; (2) to administer or service benefits or claims relating to the transaction or the product or service business of which it is a part; (3) to provide a confirmation, statement, or other record of the transaction, or information on the status or value of the financial service or financial product to the Consumer or the Consumer’s agent or broker; (4) to accrue or recognize incentives or bonuses associated with the transaction that are provided by Company or any other party; or (5) in connection with: (a) the authorization, settlement, billing, processing, clearing, transferring, reconciling, or collection of amounts charged, debited, or otherwise paid using a debit, credit, or other payment card, check, or account number, or by other payment means; (b) the transfer of receivables, accounts, or interests therein; or (c) the audit of debit, credit, or other payment information.
4.5 Revised Privacy Notices
The Company must not, directly or through any Affiliate, disclose any NPI about a Consumer to a Nonaffiliated Third Party other than as described in the initial Privacy Notice that the Company provided to that Consumer unless the Company has provided to the Consumer a Clear and Conspicuous revised Notice that accurately describes the Company’s policies and practices. The revised Notice must provide the Consumer with the ability to Opt Out.
The Consumer must be given a Reasonable Opportunity, before the Company discloses the information to the Nonaffiliated Third Party, to Opt Out of the disclosure. The NPI may only be disclosed if the Consumer does not Opt Out.
A revised Notice must be provided whenever the Company:
Discloses a new category of NPI to any Nonaffiliated Third Party;
Discloses NPI to a new category of Nonaffiliated Third Party; or
Discloses NPI about a former Customer to a Nonaffiliated Third Party if that former Customer has not had the opportunity to exercise an Opt Out right regarding that disclosure.
A revised Notice is not required if the Company discloses NPI to a new Nonaffiliated Third Party that the Company adequately described in its prior Notice.
4.6 Delivering Privacy and Opt Out Notices
The Company must provide any Privacy Notices and Opt Out notices (whether initial, annual, or revised) in writing or, if the Consumer agrees, electronically.
The notices may be delivered:
By hand;
Via U.S. mail to the last known address of the Consumer; or
For Consumers who conduct transactions and agree to receive the notices electronically, by posting current versions of the notices on an electronic site and requiring the Consumer to acknowledge receipt of the notices as a necessary step to using the Company’s payment network platform.
Company provides consumer with the following methods to Opt Out:
Designate check-off boxes in a prominent position on the relevant forms with the Opt Out notice;
Provide an electronic means to Opt Out, such as a form that can be sent via electronic mail or a process at Company’s website, if the consumer agrees to the electronic delivery of information; or
Provide a toll-free telephone number that consumers may call to Opt Out.
Prohibition on disclosure of account numbers
The Company must not, directly or through an Affiliate, disclose, other than to a Consumer Reporting Agency, an Account Number or similar form of access number or access code for a Consumer’s credit card account, deposit account, share account, or Transaction Account to any Nonaffiliated Third Party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the Consumer.
This restriction does not apply if the Company discloses an Account Number or similar form of access number or access code:
To its agent or service provider solely in order to perform marketing for the Company’s own products or services, as long as the agent or service provider is not authorized to directly initiate charges to the account; or
To a participant in a private-label credit card program or an affinity or similar program where the participants in the program are identified to the Customer when the Customer enters into the program.
Exceptions to certain information sharing
Regulation P provides exceptions to its Consumer Notice and Opt Out requirements in certain limited cases. Pursuant to such exceptions, the Company is allowed to share NPI:
With the consent or at the direction of the Consumer, provided that the Consumer has not revoked the consent or direction (and evidence of the Consumer’s consent or direction is retained by the Company);
To a Consumer Reporting Agency in accordance with the Fair Credit Reporting Act;
A proposed or actual securitization, secondary market sale (including sales of servicing rights), or similar transaction related to a transaction of the consumer; or
Necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:
(i) Servicing or processing a financial product or service that a consumer requests or authorizes; or
(ii) Maintaining or servicing the consumer's account with you, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity.With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction;
To protect the confidentiality or security of your records pertaining to the consumer, service, product, or transaction;
(i) To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability;
(ii) For required institutional risk control or for resolving consumer disputes or inquiries;
(iii) To persons holding a legal or beneficial interest relating to the consumer; or
(iv) To persons acting in a fiduciary or representative capacity on behalf of the consumer;To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating you, persons that are assessing your compliance with industry standards, and your attorneys, accountants, and auditors;
To the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.), to law enforcement agencies (including the Bureau, a Federal functional regulator, the Secretary of the Treasury, with respect to 31 U.S.C. Chapter 53, Subchapter II (Records and Reports on Monetary Instruments and Transactions) and 12 U.S.C. Chapter 21 (Financial Recordkeeping), a state insurance authority, with respect to any person domiciled in that insurance authority's state that is engaged in providing insurance, and the Federal Trade Commission), self-regulatory organizations, or for an investigation on a matter related to public safety;
In connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit; or
To comply with Federal, state, or local laws, rules and other applicable legal requirements;
(i) To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, state, or local authorities; or
(ii) To respond to judicial process or government regulatory authorities having jurisdiction over you for examination, compliance, or other purposes as authorized by law.
The Company personnel must receive approval from the Company’s Compliance Department before making any disclosure of NPI based upon any of the exceptions listed in this Section, given that the ability to disclose such may require the satisfaction of other requirements.
Reuse and redisclosure of NPI
If the Company receives NPI from, or discloses NPI to, a Nonaffiliated Third Party (whether pursuant to an exception under Regulation P or otherwise), use and disclosure of such NPI is subject to the restrictions set forth below.
NPI Received Under an Exception
If the Company receives NPI from a Nonaffiliated Third Party under an exception provided by Regulation P, its disclosure and use of that NPI is limited as follows:
The Company may disclose the information to the Affiliate of the Nonaffiliated Third Party from which it received the NPI;
The Company may disclose the NPI to its Affiliates, but its Affiliates may, in turn, disclose and use the NPI only to the extent that the Company may disclose and use the NPI; and
The Company may disclose and use the NPI pursuant to an exception in the ordinary course of business to carry out the activity covered by the applicable exception.
For example, if the Company receives a customer list from a Nonaffiliated Third Party in order to provide account processing services, the Company may disclose that NPI under any exception in the ordinary course of business in order to provide those services. However, the Company could not disclose that NPI to a third party for marketing purposes or use that NPI for Company’s own marketing purposes.
NPI Received Outside of an Exception
If the Company receives NPI from a Nonaffiliated Third Party other than under an exception provided by Regulation P, the Company may disclose the NPI only:
To the Affiliates of the Nonaffiliated Third Party from which it received the NPI;
To its Affiliates, but its Affiliates may, in turn, disclose the NPI only to the extent that the Company can disclose the NPI; and
To any other person, if the disclosure would be lawful if made directly to that person by the Nonaffiliated Third Party from which the Company received the NPI.
For example, if the Company obtains a customer list from a Nonaffiliated Third Party outside of an exception provided by Regulation P, the Company may: (i) use that list for its own purposes; and (ii) disclose that list to another Nonaffiliated Third Party only if the financial institution from which it purchased the list could have lawfully disclosed the list to that Nonaffiliated Third Party. In other words, the Company may disclose the list in accordance with the privacy policy of the financial institution from which it received the list, as limited by the opt-out direction of each consumer whose NPI the Company intends to disclose, and the Company may disclose the list in accordance with an exception provided by Regulation P, such as to its attorneys or accountants.
NPI the Company Discloses Under an Exception
If the Company discloses NPI to a Nonaffiliated Third Party under an exception provided by Regulation P, the Nonaffiliated Third Party may disclose and use that information only as follows:
The Nonaffiliated Third Party may disclose the NPI to the Company’s Affiliates;
The Nonaffiliated Third Party may disclose the NPI to its Affiliates, but its Affiliates may, in turn, disclose and use the NPI only to the extent that the Nonaffiliated Third Party may disclose and use the NPI; and
The Nonaffiliated Third Party may disclose and use the NPI pursuant to an exception provided by Regulation P in the ordinary course of business to carry out the activity covered by the applicable exception.
NPI the Company Discloses Outside of an Exception
If the Company discloses NPI to a Nonaffiliated Third Party other than under an exception provided by Regulation P, the Nonaffiliated Third Party may disclose the NPI only:
To the Company’s Affiliates;
To its Affiliates, but its Affiliates, in turn, may disclose the NPI only to the extent the third party can disclose the information; and
To any other person, if the disclosure would be lawful if the Company made it directly to that person.
Training
To facilitate compliance with this Policy, the Company will provide ongoing training to appropriate employees, including guidance on the standards, processes, and restrictions set forth within this Policy.
Employee and vendor responsibilities
Employees, vendors, consultants, and delegates are expected to adhere to this Policy. The failure to comply with such may result in a range of disciplinary actions, up to and including termination of employment.
Policy administration
The Company requires that this Policy shall be reviewed and, if applicable, updated periodically as necessary to ensure it reflects current obligations and/or its contemplated business activities.
Defined terms and references
Account Number: An Account Number, or similar form of access number or access code for an account that does not include a number or code in an encrypted form, as long as the Company does not provide the recipient with a means to decode the number or code.
Affiliate: Any Company that controls, is controlled by, or is under common control with another Company. Control of a Company means: (1) ownership, control, or power to vote 25 percent or more of the outstanding shares of any class of voting security of the Company, directly or indirectly, or acting through one or more other persons; (2) control in any manner over the election of a majority of the directors, trustees, or general partners (or individuals exercising similar functions) of the Company; or (3) the power to exercise, directly or indirectly, a controlling influence over the management or policies of the Company as determined by the applicable prudential regulator (as defined in 12 U.S.C. 5481(24)), if any.
Clear and Conspicuous: A notice is Clear and Conspicuous if it is reasonably understandable and designed to call attention to the nature and significance of the information in the notice. If provided on a website, the notice must use text or visual cues to encourage scrolling down the page if necessary to view the entire notice. Other elements on the website (such as text, graphics, hyperlinks, or sound) must not distract attention from the notice. In addition, either the notice or a link to the notice must be placed on a screen that Consumers frequently access, such as a page on which transactions are conducted. If a link is used, the link must connect directly to the notice and be labeled appropriately to convey the importance, nature, and relevance of the notice.
Collect: To obtain information that the Company organizes or can retrieve by the name of an individual or by identifying number, symbol, or other identifying particular assigned to the individual, irrespective of the source of the underlying information.
Consumer: An individual that obtains or has used the payment network platform offered by the Company for personal, family, or household purposes.
Consumer Reporting Agency: Any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages, in whole or in part, in the practice of assembling or evaluating Consumer information for the purpose of furnishing Consumer reports to third parties, and who uses any means or facility of interstate commerce for the purpose of preparing or furnishing Consumer reports.
Customer: A Consumer who has a Customer Relationship with the Company.
Customer Relationship: Customer Relationship means a continuing relationship between a Consumer and the Company under which the Company provides financial products or services to the Consumer that are to be used primarily for personal, family, or household purposes.
Nonaffiliated Third Party: Any person except:
An Affiliate of the Company; or
A person employed jointly by the Company and any Company that is not an Affiliate of the Company (but a Nonaffiliated Third Party includes the other Company that jointly employs the person).
A Nonaffiliated Third Party includes any company that is an Affiliate solely by virtue of the Company’s or a Company Affiliate’s direct or indirect ownership or control of the company.
Nonpublic Personal Information (or NPI): NPI means Personally Identifiable Financial Information and any list, description, or other grouping of Consumers (and publicly available information pertaining to them) that is derived using any Personally Identifiable Financial Information that is not publicly available. NPI includes any list of individuals’ names and street addresses that is derived in whole or in part using Personally Identifiable Financial Information that is not publicly available, such as Account Numbers.
NPI does not include:
Publicly available information;
Any list, description, or other grouping of Consumers (and publicly available information pertaining to them) that was derived from Publicly Available Personally Identifiable Financial Information.
Opt Out: A direction by the Consumer that the Company not disclose NPI about that Consumer to a Nonaffiliated Third Party, other than pursuant to an application exception under GLBA and Regulation P.
Personally Identifiable Financial Information: Any information:
A Consumer provides to the Company in connection with the Company’s payment network platform;
About a Consumer resulting from any transaction involving a consumer-related product or service between the Company and a Consumer relating to its payment network platform; or
The Company otherwise obtains about a Consumer in connection with providing the payment network platform to that Consumer.
Personally Identifiable Financial Information includes:
Information a Consumer provides to the Company to obtain a financial product or service;
Account balance information, payment history, overdraft history, and credit or debit card information;
The fact that an individual is or has been one of the Company’s Customers or has obtained a financial product or service from the Company;
Any information about the Company’s Consumer if it is disclosed in a manner that indicates that the individual is or has been the Company’s Consumer;
Any information that a Consumer provides to the Company or that the Company or its agent otherwise obtain in connection with the payment network platform provided by the Company;
Any information the Company Collects through an internet “cookie” (an information-Collecting device from a web server); and
Information from a Consumer report.
Personally Identifiable Financial Information does not include information that does not identify a Consumer, such as aggregate information or blind data that does not contain personal identifiers such as Account Numbers, names, or addresses. It also does not include a list of names and addresses of Customers of an entity that is not a financial institution.
Publicly Available Information: Publicly Available Information means any information that the Company has a Reasonable Basis to believe is lawfully made available to the general public from:
Federal, state, or local government records;
Widely distributed media (e.g., information from a telephone book, a television or radio program, a newspaper, or a website that is available to the general public on an unrestricted basis. A website is not restricted merely because an internet service provider or a site operator requires a fee or a password, so long as access is available to the general public); or
Disclosures to the general public that are required to be made by federal, state, or local law.
Reasonable Basis: The Company has a Reasonable Basis to believe that information is lawfully made available to the general public if the Company has taken steps to determine:
That the information is of the type that is available to the general public; and
Whether an individual can direct that the information not be made available to the general public and, if so, that the Company’s Consumer has not done so.
The following are some examples of situations where a Reasonable Basis exists:
There is Reasonable Basis to believe that an individual’s telephone number is lawfully made available to the general public if it has been located in the telephone book or the Consumer has informed the Company that the telephone number is not unlisted.
There is a Reasonable Basis to believe that consumer information is lawfully made available to the general public if the information is of the type included on the public record in the relevant jurisdiction.
Reasonable Opportunity (to Opt Out): The following are examples of a Reasonable Opportunity to Opt Out:
By mail. The Company mails the Privacy Notice and Opt Out notice to the Consumer and allows the Consumer to Opt Out by mailing a form, calling a toll-free telephone number, or any other reasonable means within 30 days from the date the Company mailed the notices.
By electronic means. A Customer opens an online account with the Company and agrees to receive the Privacy Notice and Opt Out notice electronically, and the Company allows the Customer to Opt Out by any reasonable means within 30 days after the date that the Customer acknowledges receipt of the notices in conjunction with opening the account.
Isolated transaction with Consumer. For an isolated transaction, such as the purchase of a cashier’s check by a Consumer, the Company provides the Consumer with a Reasonable Opportunity to Opt Out if it provides the Privacy Notice and Opt Out notice at the time of the transaction and requests that the Consumer decide, as a necessary part of the transaction, whether to Opt Out before completing the transaction.
Transaction Account: An account other than a deposit account, a share account, or a credit card account. A Transaction Account does not include an account to which third parties cannot initiate charges.
Model privacy notices
WHAT DOES [MORETA GLOBAL INC.] DO WITH YOUR PERSONAL INFORMATION?
Why?:
Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.
What?:
The types of personal information we can access and share depend on the product or service you have with us. This information can include:
Social Security number and assets
Account balances and account transactions
income and credit history
When you are no longer our customer, we continue to share your information as described in this notice.
How?:
All financial companies need to share [customers’] personal information to run their everyday business. In the section below, we list the reasons financial companies can share their [customer] personal information; the reasons [Moreta Global Inc.] chooses to share; and whether you can limit this sharing.
Executive Summary
This Policy sets forth the guiding principles and standards for the purpose of effectively complying with federal financial information privacy requirements regarding the privacy, use, and sharing of Consumers’ Nonpublic Personal Information (“NPI”).
Moreta Global Inc. (the “Company”) has an affirmative and continuing duty to respect the privacy of its Consumers and to protect the security and confidentiality of those Consumers’ NPI, in accordance with the privacy provisions of the Gramm-Leach Bliley Act (“GLBA”), as implemented by the Consumer Financial Protection Bureau’s Regulation P. This Policy outlines the requirements for the Company to provide notice to Consumers about the Company’s privacy policies and practices. This Policy also describes the requirements and conditions which must be met before the Company may disclose Consumers’ NPI to Nonaffiliated Third Parties.
Purpose
This Policy was developed to ensure that the Company protects and respects the privacy of Consumers’ NPI and treats such NPI in accordance with the requirements of GLBA and Regulation P.
Scope
This Policy shall apply to the Company’s payment network platform that provides a tool (“Moreta App”) for foreigners to access payment network standard QR codes at local Southeast & East Asian merchants. This software tool allows consumers to access funds they have deposited with the Company’s partners to purchase goods and services.
Policy Notices
The Company’s Model Privacy Notice (the “Privacy Notice” or “Notice”) is included in Section 13 of this Policy. The Company provides initial and annual Notices to its Customers in connection with the Moreta App.
The Company provides the initial Privacy Notice to Consumers and Customers and an annual Privacy Notice to Customers, as required under and in accordance with the timing requirements of Regulation P. Privacy Notices provide Consumers and Customers with required information regarding the Company’s collection and disclosure of NPI. Where required under Regulation P, the Company provides Consumers or Customers with an opportunity to Opt Out of certain information sharing. Consumer and Customer Opt Out choices are tracked and honored.
4.1 Initial Privacy Notice to Consumers and Customers
The Company provides a Clear and Conspicuous initial Privacy Notice that accurately reflects the Company’s privacy policies and practices to:
Customers, not later than when the Company establishes a Customer Relationship, unless an exception under Regulation P applies to allow delivery of the Notice within a reasonable time after the Customer Relationship is established.
Consumers, before the Company discloses any NPI about the Consumer to any Nonaffiliated Third Party, unless an exception under Regulation P applies. The Company is not required to provide an initial Notice to a Consumer if it does not disclose any NPI about the Consumer to any Nonaffiliated Third Party and does not have a Customer Relationship with the Consumer.
The Company establishes a Customer Relationship when the Company and the Consumer enter into a continuing relationship.
4.2 Annual Privacy Notice to Customers
During the continuation of the Customer Relationship, the Company provides a Clear and Conspicuous annual Privacy Notice to each Customer, accurately reflecting the Company’s privacy policies and practices.
GLBA and Regulation P do not require the Company to provide an annual notice to a former Customer. Once the Customer becomes a former Customer, the Company is not required to provide an annual Privacy Notice to that former Customer.
4.3 Information to Be Included in Privacy Notices
The Company’s initial, annual, and revised Privacy Notices must contain certain information that applies to the Company and to the Consumers to whom the Company sends its Notices. Such information includes:
The categories of NPI that the Company Collects;
The categories of NPI that the Company discloses;
The categories of Affiliates and Nonaffiliated Third Parties to whom the Company discloses NPI other than pursuant to certain exceptions in Regulation P;
The categories of Affiliates and Nonaffiliated Third Parties to whom Company discloses NPI other than pursuant to certain exceptions in Regulation P;
The categories of NPI about Company’s former Customers that Company discloses and the categories of Affiliates and Nonaffiliated Third Parties to whom Company discloses NPI about its former Customers; and
If Company discloses NPI to a Nonaffiliated Third Party under the service provider exception and no other exception applies, a separate statement of the categories of information Company discloses and the categories of third parties with whom Company has contracted.
The Notices must also include an explanation of the Consumer’s right to Opt Out of any disclosure of NPI to Nonaffiliated Third Parties, the Company’s policies and practices with respect to protecting the confidentiality and security of NPI, and other information required under Regulation P as set forth in the GLBA privacy notice.
If the Company discloses NPI to third parties as authorized under Regulation P’s exceptions for processing and servicing transactions and certain other purposes, it is not required to list those exceptions in the initial or annual Privacy Notice. Rather, when describing the categories with respect to those parties, it is sufficient to state that the Company makes disclosures to other nonaffiliated companies:
For the Company’s everyday business purposes, such as to process transactions, maintain account(s), respond to court orders and legal investigations, or report to Consumer Reporting Agencies; or
As permitted by law.
Use of the model privacy form provided in the appendix to Regulation P, consistent with the instructions in the appendix, constitutes compliance with the Notice content requirements of Regulation P, although use of the model privacy form is not required.
4.4 Opt Out Requirements
All information systems that process NPI, which are maintained by the Company, must, as part of a consent-basis for processing NPI, capture and retain evidence of opt-outs as discussed further below and as required by applicable laws.
Unless an exception under Regulation P applies, the Company may not, directly or through any Affiliate, disclose any NPI about a Consumer to a Nonaffiliated Third Party unless all of the following conditions are satisfied:
The Company has provided an initial Privacy Notice to the Consumer;
The Company has provided an Opt Out notice to the Consumer;
The Company has given the Consumer a Reasonable Opportunity, before disclosing the information to the Nonaffiliated Third Party, to Opt Out of the disclosure; and
The Consumer does not Opt Out.
This restriction applies regardless of whether the Company has established a Customer Relationship with the Consumer.
The Company provides a Clear and Conspicuous notice to each of its Consumers that accurately explains the right to Opt Out of the disclosure. The notice states:
That the Company discloses or reserves the right to disclose NPI about the Consumer to a Nonaffiliated Third Party;
That the Consumer has the right to Opt Out of that disclosure; and
A reasonable means by which the Consumer may exercise the Opt Out right.
For accounts with two or more Consumers (e.g., accounts where two or more Consumers jointly obtained a financial product or service), Company provides a single opt-out notice and treats an Opt-Out direction by a joint Consumer as applying to all of the associated joint Consumers.
A Consumer may exercise the right to Opt Out at any time. A Consumer’s direction to Opt Out is effective until the Consumer revokes it in writing or, if the Consumer agrees, electronically. When a Customer Relationship terminates, the Customer’s Opt Out direction continues to apply to the NPI collected during or related to that relationship. If the individual subsequently establishes a new Customer Relationship with Company, the Opt Out direction that applied to the former relationship does not apply to the new relationship.
Company complies with a Consumer’s opt-out direction as soon as reasonably practicable after it is received.
Sharing With Service Providers
Generally, the Opt Out requirements do not apply when Company provides NPI to a Nonaffiliated Third Party to perform services for Company or on Company’s behalf, if Company:
Provides the initial privacy notice discussed above; and
Enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which Company disclosed the information, including use under an exception in (see further below) in the ordinary course of business to carry out those purposes.
However, the foregoing requirements, in addition to the initial privacy notice requirements and the Opt Out requirements, do not apply if Company discloses NPI as necessary to effect, administer, or enforce a transaction that a Consumer requests or authorizes, or in connection with:
Servicing or processing a financial product or service that a Consumer requests or authorizes; or
Maintaining or servicing the Consumer’s account with Company, or with another entity as part of a private-label credit card program or other extension of credit on behalf of such entity.
“Necessary to effect, administer, or enforce a transaction” means that the disclosure is:
Required, or is one of the lawful or appropriate methods, to enforce Company rights or the rights of other persons engaged in carrying out the financial transaction or providing the product or service; or
Required, or is a usual, appropriate, or acceptable method: (1) to carry out the transaction or the product or service business of which the transaction is a part, and record, service, or maintain the Consumer’s account in the ordinary course of providing the financial service or financial product; (2) to administer or service benefits or claims relating to the transaction or the product or service business of which it is a part; (3) to provide a confirmation, statement, or other record of the transaction, or information on the status or value of the financial service or financial product to the Consumer or the Consumer’s agent or broker; (4) to accrue or recognize incentives or bonuses associated with the transaction that are provided by Company or any other party; or (5) in connection with: (a) the authorization, settlement, billing, processing, clearing, transferring, reconciling, or collection of amounts charged, debited, or otherwise paid using a debit, credit, or other payment card, check, or account number, or by other payment means; (b) the transfer of receivables, accounts, or interests therein; or (c) the audit of debit, credit, or other payment information.
4.5 Revised Privacy Notices
The Company must not, directly or through any Affiliate, disclose any NPI about a Consumer to a Nonaffiliated Third Party other than as described in the initial Privacy Notice that the Company provided to that Consumer unless the Company has provided to the Consumer a Clear and Conspicuous revised Notice that accurately describes the Company’s policies and practices. The revised Notice must provide the Consumer with the ability to Opt Out.
The Consumer must be given a Reasonable Opportunity, before the Company discloses the information to the Nonaffiliated Third Party, to Opt Out of the disclosure. The NPI may only be disclosed if the Consumer does not Opt Out.
A revised Notice must be provided whenever the Company:
Discloses a new category of NPI to any Nonaffiliated Third Party;
Discloses NPI to a new category of Nonaffiliated Third Party; or
Discloses NPI about a former Customer to a Nonaffiliated Third Party if that former Customer has not had the opportunity to exercise an Opt Out right regarding that disclosure.
A revised Notice is not required if the Company discloses NPI to a new Nonaffiliated Third Party that the Company adequately described in its prior Notice.
4.6 Delivering Privacy and Opt Out Notices
The Company must provide any Privacy Notices and Opt Out notices (whether initial, annual, or revised) in writing or, if the Consumer agrees, electronically.
The notices may be delivered:
By hand;
Via U.S. mail to the last known address of the Consumer; or
For Consumers who conduct transactions and agree to receive the notices electronically, by posting current versions of the notices on an electronic site and requiring the Consumer to acknowledge receipt of the notices as a necessary step to using the Company’s payment network platform.
Company provides consumer with the following methods to Opt Out:
Designate check-off boxes in a prominent position on the relevant forms with the Opt Out notice;
Provide an electronic means to Opt Out, such as a form that can be sent via electronic mail or a process at Company’s website, if the consumer agrees to the electronic delivery of information; or
Provide a toll-free telephone number that consumers may call to Opt Out.
Prohibition on disclosure of account numbers
The Company must not, directly or through an Affiliate, disclose, other than to a Consumer Reporting Agency, an Account Number or similar form of access number or access code for a Consumer’s credit card account, deposit account, share account, or Transaction Account to any Nonaffiliated Third Party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the Consumer.
This restriction does not apply if the Company discloses an Account Number or similar form of access number or access code:
To its agent or service provider solely in order to perform marketing for the Company’s own products or services, as long as the agent or service provider is not authorized to directly initiate charges to the account; or
To a participant in a private-label credit card program or an affinity or similar program where the participants in the program are identified to the Customer when the Customer enters into the program.
Exceptions to certain information sharing
Regulation P provides exceptions to its Consumer Notice and Opt Out requirements in certain limited cases. Pursuant to such exceptions, the Company is allowed to share NPI:
With the consent or at the direction of the Consumer, provided that the Consumer has not revoked the consent or direction (and evidence of the Consumer’s consent or direction is retained by the Company);
To a Consumer Reporting Agency in accordance with the Fair Credit Reporting Act;
A proposed or actual securitization, secondary market sale (including sales of servicing rights), or similar transaction related to a transaction of the consumer; or
Necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:
(i) Servicing or processing a financial product or service that a consumer requests or authorizes; or
(ii) Maintaining or servicing the consumer's account with you, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity.With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction;
To protect the confidentiality or security of your records pertaining to the consumer, service, product, or transaction;
(i) To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability;
(ii) For required institutional risk control or for resolving consumer disputes or inquiries;
(iii) To persons holding a legal or beneficial interest relating to the consumer; or
(iv) To persons acting in a fiduciary or representative capacity on behalf of the consumer;To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating you, persons that are assessing your compliance with industry standards, and your attorneys, accountants, and auditors;
To the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.), to law enforcement agencies (including the Bureau, a Federal functional regulator, the Secretary of the Treasury, with respect to 31 U.S.C. Chapter 53, Subchapter II (Records and Reports on Monetary Instruments and Transactions) and 12 U.S.C. Chapter 21 (Financial Recordkeeping), a state insurance authority, with respect to any person domiciled in that insurance authority's state that is engaged in providing insurance, and the Federal Trade Commission), self-regulatory organizations, or for an investigation on a matter related to public safety;
In connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit; or
To comply with Federal, state, or local laws, rules and other applicable legal requirements;
(i) To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, state, or local authorities; or
(ii) To respond to judicial process or government regulatory authorities having jurisdiction over you for examination, compliance, or other purposes as authorized by law.
The Company personnel must receive approval from the Company’s Compliance Department before making any disclosure of NPI based upon any of the exceptions listed in this Section, given that the ability to disclose such may require the satisfaction of other requirements.
Reuse and redisclosure of NPI
If the Company receives NPI from, or discloses NPI to, a Nonaffiliated Third Party (whether pursuant to an exception under Regulation P or otherwise), use and disclosure of such NPI is subject to the restrictions set forth below.
NPI Received Under an Exception
If the Company receives NPI from a Nonaffiliated Third Party under an exception provided by Regulation P, its disclosure and use of that NPI is limited as follows:
The Company may disclose the information to the Affiliate of the Nonaffiliated Third Party from which it received the NPI;
The Company may disclose the NPI to its Affiliates, but its Affiliates may, in turn, disclose and use the NPI only to the extent that the Company may disclose and use the NPI; and
The Company may disclose and use the NPI pursuant to an exception in the ordinary course of business to carry out the activity covered by the applicable exception.
For example, if the Company receives a customer list from a Nonaffiliated Third Party in order to provide account processing services, the Company may disclose that NPI under any exception in the ordinary course of business in order to provide those services. However, the Company could not disclose that NPI to a third party for marketing purposes or use that NPI for Company’s own marketing purposes.
NPI Received Outside of an Exception
If the Company receives NPI from a Nonaffiliated Third Party other than under an exception provided by Regulation P, the Company may disclose the NPI only:
To the Affiliates of the Nonaffiliated Third Party from which it received the NPI;
To its Affiliates, but its Affiliates may, in turn, disclose the NPI only to the extent that the Company can disclose the NPI; and
To any other person, if the disclosure would be lawful if made directly to that person by the Nonaffiliated Third Party from which the Company received the NPI.
For example, if the Company obtains a customer list from a Nonaffiliated Third Party outside of an exception provided by Regulation P, the Company may: (i) use that list for its own purposes; and (ii) disclose that list to another Nonaffiliated Third Party only if the financial institution from which it purchased the list could have lawfully disclosed the list to that Nonaffiliated Third Party. In other words, the Company may disclose the list in accordance with the privacy policy of the financial institution from which it received the list, as limited by the opt-out direction of each consumer whose NPI the Company intends to disclose, and the Company may disclose the list in accordance with an exception provided by Regulation P, such as to its attorneys or accountants.
NPI the Company Discloses Under an Exception
If the Company discloses NPI to a Nonaffiliated Third Party under an exception provided by Regulation P, the Nonaffiliated Third Party may disclose and use that information only as follows:
The Nonaffiliated Third Party may disclose the NPI to the Company’s Affiliates;
The Nonaffiliated Third Party may disclose the NPI to its Affiliates, but its Affiliates may, in turn, disclose and use the NPI only to the extent that the Nonaffiliated Third Party may disclose and use the NPI; and
The Nonaffiliated Third Party may disclose and use the NPI pursuant to an exception provided by Regulation P in the ordinary course of business to carry out the activity covered by the applicable exception.
NPI the Company Discloses Outside of an Exception
If the Company discloses NPI to a Nonaffiliated Third Party other than under an exception provided by Regulation P, the Nonaffiliated Third Party may disclose the NPI only:
To the Company’s Affiliates;
To its Affiliates, but its Affiliates, in turn, may disclose the NPI only to the extent the third party can disclose the information; and
To any other person, if the disclosure would be lawful if the Company made it directly to that person.
Training
To facilitate compliance with this Policy, the Company will provide ongoing training to appropriate employees, including guidance on the standards, processes, and restrictions set forth within this Policy.
Employee and vendor responsibilities
Employees, vendors, consultants, and delegates are expected to adhere to this Policy. The failure to comply with such may result in a range of disciplinary actions, up to and including termination of employment.
Policy administration
The Company requires that this Policy shall be reviewed and, if applicable, updated periodically as necessary to ensure it reflects current obligations and/or its contemplated business activities.
Defined terms and references
Account Number: An Account Number, or similar form of access number or access code for an account that does not include a number or code in an encrypted form, as long as the Company does not provide the recipient with a means to decode the number or code.
Affiliate: Any Company that controls, is controlled by, or is under common control with another Company. Control of a Company means: (1) ownership, control, or power to vote 25 percent or more of the outstanding shares of any class of voting security of the Company, directly or indirectly, or acting through one or more other persons; (2) control in any manner over the election of a majority of the directors, trustees, or general partners (or individuals exercising similar functions) of the Company; or (3) the power to exercise, directly or indirectly, a controlling influence over the management or policies of the Company as determined by the applicable prudential regulator (as defined in 12 U.S.C. 5481(24)), if any.
Clear and Conspicuous: A notice is Clear and Conspicuous if it is reasonably understandable and designed to call attention to the nature and significance of the information in the notice. If provided on a website, the notice must use text or visual cues to encourage scrolling down the page if necessary to view the entire notice. Other elements on the website (such as text, graphics, hyperlinks, or sound) must not distract attention from the notice. In addition, either the notice or a link to the notice must be placed on a screen that Consumers frequently access, such as a page on which transactions are conducted. If a link is used, the link must connect directly to the notice and be labeled appropriately to convey the importance, nature, and relevance of the notice.
Collect: To obtain information that the Company organizes or can retrieve by the name of an individual or by identifying number, symbol, or other identifying particular assigned to the individual, irrespective of the source of the underlying information.
Consumer: An individual that obtains or has used the payment network platform offered by the Company for personal, family, or household purposes.
Consumer Reporting Agency: Any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages, in whole or in part, in the practice of assembling or evaluating Consumer information for the purpose of furnishing Consumer reports to third parties, and who uses any means or facility of interstate commerce for the purpose of preparing or furnishing Consumer reports.
Customer: A Consumer who has a Customer Relationship with the Company.
Customer Relationship: Customer Relationship means a continuing relationship between a Consumer and the Company under which the Company provides financial products or services to the Consumer that are to be used primarily for personal, family, or household purposes.
Nonaffiliated Third Party: Any person except:
An Affiliate of the Company; or
A person employed jointly by the Company and any Company that is not an Affiliate of the Company (but a Nonaffiliated Third Party includes the other Company that jointly employs the person).
A Nonaffiliated Third Party includes any company that is an Affiliate solely by virtue of the Company’s or a Company Affiliate’s direct or indirect ownership or control of the company.
Nonpublic Personal Information (or NPI): NPI means Personally Identifiable Financial Information and any list, description, or other grouping of Consumers (and publicly available information pertaining to them) that is derived using any Personally Identifiable Financial Information that is not publicly available. NPI includes any list of individuals’ names and street addresses that is derived in whole or in part using Personally Identifiable Financial Information that is not publicly available, such as Account Numbers.
NPI does not include:
Publicly available information;
Any list, description, or other grouping of Consumers (and publicly available information pertaining to them) that was derived from Publicly Available Personally Identifiable Financial Information.
Opt Out: A direction by the Consumer that the Company not disclose NPI about that Consumer to a Nonaffiliated Third Party, other than pursuant to an application exception under GLBA and Regulation P.
Personally Identifiable Financial Information: Any information:
A Consumer provides to the Company in connection with the Company’s payment network platform;
About a Consumer resulting from any transaction involving a consumer-related product or service between the Company and a Consumer relating to its payment network platform; or
The Company otherwise obtains about a Consumer in connection with providing the payment network platform to that Consumer.
Personally Identifiable Financial Information includes:
Information a Consumer provides to the Company to obtain a financial product or service;
Account balance information, payment history, overdraft history, and credit or debit card information;
The fact that an individual is or has been one of the Company’s Customers or has obtained a financial product or service from the Company;
Any information about the Company’s Consumer if it is disclosed in a manner that indicates that the individual is or has been the Company’s Consumer;
Any information that a Consumer provides to the Company or that the Company or its agent otherwise obtain in connection with the payment network platform provided by the Company;
Any information the Company Collects through an internet “cookie” (an information-Collecting device from a web server); and
Information from a Consumer report.
Personally Identifiable Financial Information does not include information that does not identify a Consumer, such as aggregate information or blind data that does not contain personal identifiers such as Account Numbers, names, or addresses. It also does not include a list of names and addresses of Customers of an entity that is not a financial institution.
Publicly Available Information: Publicly Available Information means any information that the Company has a Reasonable Basis to believe is lawfully made available to the general public from:
Federal, state, or local government records;
Widely distributed media (e.g., information from a telephone book, a television or radio program, a newspaper, or a website that is available to the general public on an unrestricted basis. A website is not restricted merely because an internet service provider or a site operator requires a fee or a password, so long as access is available to the general public); or
Disclosures to the general public that are required to be made by federal, state, or local law.
Reasonable Basis: The Company has a Reasonable Basis to believe that information is lawfully made available to the general public if the Company has taken steps to determine:
That the information is of the type that is available to the general public; and
Whether an individual can direct that the information not be made available to the general public and, if so, that the Company’s Consumer has not done so.
The following are some examples of situations where a Reasonable Basis exists:
There is Reasonable Basis to believe that an individual’s telephone number is lawfully made available to the general public if it has been located in the telephone book or the Consumer has informed the Company that the telephone number is not unlisted.
There is a Reasonable Basis to believe that consumer information is lawfully made available to the general public if the information is of the type included on the public record in the relevant jurisdiction.
Reasonable Opportunity (to Opt Out): The following are examples of a Reasonable Opportunity to Opt Out:
By mail. The Company mails the Privacy Notice and Opt Out notice to the Consumer and allows the Consumer to Opt Out by mailing a form, calling a toll-free telephone number, or any other reasonable means within 30 days from the date the Company mailed the notices.
By electronic means. A Customer opens an online account with the Company and agrees to receive the Privacy Notice and Opt Out notice electronically, and the Company allows the Customer to Opt Out by any reasonable means within 30 days after the date that the Customer acknowledges receipt of the notices in conjunction with opening the account.
Isolated transaction with Consumer. For an isolated transaction, such as the purchase of a cashier’s check by a Consumer, the Company provides the Consumer with a Reasonable Opportunity to Opt Out if it provides the Privacy Notice and Opt Out notice at the time of the transaction and requests that the Consumer decide, as a necessary part of the transaction, whether to Opt Out before completing the transaction.
Transaction Account: An account other than a deposit account, a share account, or a credit card account. A Transaction Account does not include an account to which third parties cannot initiate charges.
Model privacy notices
WHAT DOES [MORETA GLOBAL INC.] DO WITH YOUR PERSONAL INFORMATION?
Why?:
Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.
What?:
The types of personal information we can access and share depend on the product or service you have with us. This information can include:
Social Security number and assets
Account balances and account transactions
income and credit history
When you are no longer our customer, we continue to share your information as described in this notice.
How?:
All financial companies need to share [customers’] personal information to run their everyday business. In the section below, we list the reasons financial companies can share their [customer] personal information; the reasons [Moreta Global Inc.] chooses to share; and whether you can limit this sharing.
Executive Summary
This Policy sets forth the guiding principles and standards for the purpose of effectively complying with federal financial information privacy requirements regarding the privacy, use, and sharing of Consumers’ Nonpublic Personal Information (“NPI”).
Moreta Global Inc. (the “Company”) has an affirmative and continuing duty to respect the privacy of its Consumers and to protect the security and confidentiality of those Consumers’ NPI, in accordance with the privacy provisions of the Gramm-Leach Bliley Act (“GLBA”), as implemented by the Consumer Financial Protection Bureau’s Regulation P. This Policy outlines the requirements for the Company to provide notice to Consumers about the Company’s privacy policies and practices. This Policy also describes the requirements and conditions which must be met before the Company may disclose Consumers’ NPI to Nonaffiliated Third Parties.
Purpose
This Policy was developed to ensure that the Company protects and respects the privacy of Consumers’ NPI and treats such NPI in accordance with the requirements of GLBA and Regulation P.
Scope
This Policy shall apply to the Company’s payment network platform that provides a tool (“Moreta App”) for foreigners to access payment network standard QR codes at local Southeast & East Asian merchants. This software tool allows consumers to access funds they have deposited with the Company’s partners to purchase goods and services.
Policy Notices
The Company’s Model Privacy Notice (the “Privacy Notice” or “Notice”) is included in Section 13 of this Policy. The Company provides initial and annual Notices to its Customers in connection with the Moreta App.
The Company provides the initial Privacy Notice to Consumers and Customers and an annual Privacy Notice to Customers, as required under and in accordance with the timing requirements of Regulation P. Privacy Notices provide Consumers and Customers with required information regarding the Company’s collection and disclosure of NPI. Where required under Regulation P, the Company provides Consumers or Customers with an opportunity to Opt Out of certain information sharing. Consumer and Customer Opt Out choices are tracked and honored.
4.1 Initial Privacy Notice to Consumers and Customers
The Company provides a Clear and Conspicuous initial Privacy Notice that accurately reflects the Company’s privacy policies and practices to:
Customers, not later than when the Company establishes a Customer Relationship, unless an exception under Regulation P applies to allow delivery of the Notice within a reasonable time after the Customer Relationship is established.
Consumers, before the Company discloses any NPI about the Consumer to any Nonaffiliated Third Party, unless an exception under Regulation P applies. The Company is not required to provide an initial Notice to a Consumer if it does not disclose any NPI about the Consumer to any Nonaffiliated Third Party and does not have a Customer Relationship with the Consumer.
The Company establishes a Customer Relationship when the Company and the Consumer enter into a continuing relationship.
4.2 Annual Privacy Notice to Customers
During the continuation of the Customer Relationship, the Company provides a Clear and Conspicuous annual Privacy Notice to each Customer, accurately reflecting the Company’s privacy policies and practices.
GLBA and Regulation P do not require the Company to provide an annual notice to a former Customer. Once the Customer becomes a former Customer, the Company is not required to provide an annual Privacy Notice to that former Customer.
4.3 Information to Be Included in Privacy Notices
The Company’s initial, annual, and revised Privacy Notices must contain certain information that applies to the Company and to the Consumers to whom the Company sends its Notices. Such information includes:
The categories of NPI that the Company Collects;
The categories of NPI that the Company discloses;
The categories of Affiliates and Nonaffiliated Third Parties to whom the Company discloses NPI other than pursuant to certain exceptions in Regulation P;
The categories of Affiliates and Nonaffiliated Third Parties to whom Company discloses NPI other than pursuant to certain exceptions in Regulation P;
The categories of NPI about Company’s former Customers that Company discloses and the categories of Affiliates and Nonaffiliated Third Parties to whom Company discloses NPI about its former Customers; and
If Company discloses NPI to a Nonaffiliated Third Party under the service provider exception and no other exception applies, a separate statement of the categories of information Company discloses and the categories of third parties with whom Company has contracted.
The Notices must also include an explanation of the Consumer’s right to Opt Out of any disclosure of NPI to Nonaffiliated Third Parties, the Company’s policies and practices with respect to protecting the confidentiality and security of NPI, and other information required under Regulation P as set forth in the GLBA privacy notice.
If the Company discloses NPI to third parties as authorized under Regulation P’s exceptions for processing and servicing transactions and certain other purposes, it is not required to list those exceptions in the initial or annual Privacy Notice. Rather, when describing the categories with respect to those parties, it is sufficient to state that the Company makes disclosures to other nonaffiliated companies:
For the Company’s everyday business purposes, such as to process transactions, maintain account(s), respond to court orders and legal investigations, or report to Consumer Reporting Agencies; or
As permitted by law.
Use of the model privacy form provided in the appendix to Regulation P, consistent with the instructions in the appendix, constitutes compliance with the Notice content requirements of Regulation P, although use of the model privacy form is not required.
4.4 Opt Out Requirements
All information systems that process NPI, which are maintained by the Company, must, as part of a consent-basis for processing NPI, capture and retain evidence of opt-outs as discussed further below and as required by applicable laws.
Unless an exception under Regulation P applies, the Company may not, directly or through any Affiliate, disclose any NPI about a Consumer to a Nonaffiliated Third Party unless all of the following conditions are satisfied:
The Company has provided an initial Privacy Notice to the Consumer;
The Company has provided an Opt Out notice to the Consumer;
The Company has given the Consumer a Reasonable Opportunity, before disclosing the information to the Nonaffiliated Third Party, to Opt Out of the disclosure; and
The Consumer does not Opt Out.
This restriction applies regardless of whether the Company has established a Customer Relationship with the Consumer.
The Company provides a Clear and Conspicuous notice to each of its Consumers that accurately explains the right to Opt Out of the disclosure. The notice states:
That the Company discloses or reserves the right to disclose NPI about the Consumer to a Nonaffiliated Third Party;
That the Consumer has the right to Opt Out of that disclosure; and
A reasonable means by which the Consumer may exercise the Opt Out right.
For accounts with two or more Consumers (e.g., accounts where two or more Consumers jointly obtained a financial product or service), Company provides a single opt-out notice and treats an Opt-Out direction by a joint Consumer as applying to all of the associated joint Consumers.
A Consumer may exercise the right to Opt Out at any time. A Consumer’s direction to Opt Out is effective until the Consumer revokes it in writing or, if the Consumer agrees, electronically. When a Customer Relationship terminates, the Customer’s Opt Out direction continues to apply to the NPI collected during or related to that relationship. If the individual subsequently establishes a new Customer Relationship with Company, the Opt Out direction that applied to the former relationship does not apply to the new relationship.
Company complies with a Consumer’s opt-out direction as soon as reasonably practicable after it is received.
Sharing With Service Providers
Generally, the Opt Out requirements do not apply when Company provides NPI to a Nonaffiliated Third Party to perform services for Company or on Company’s behalf, if Company:
Provides the initial privacy notice discussed above; and
Enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which Company disclosed the information, including use under an exception in (see further below) in the ordinary course of business to carry out those purposes.
However, the foregoing requirements, in addition to the initial privacy notice requirements and the Opt Out requirements, do not apply if Company discloses NPI as necessary to effect, administer, or enforce a transaction that a Consumer requests or authorizes, or in connection with:
Servicing or processing a financial product or service that a Consumer requests or authorizes; or
Maintaining or servicing the Consumer’s account with Company, or with another entity as part of a private-label credit card program or other extension of credit on behalf of such entity.
“Necessary to effect, administer, or enforce a transaction” means that the disclosure is:
Required, or is one of the lawful or appropriate methods, to enforce Company rights or the rights of other persons engaged in carrying out the financial transaction or providing the product or service; or
Required, or is a usual, appropriate, or acceptable method: (1) to carry out the transaction or the product or service business of which the transaction is a part, and record, service, or maintain the Consumer’s account in the ordinary course of providing the financial service or financial product; (2) to administer or service benefits or claims relating to the transaction or the product or service business of which it is a part; (3) to provide a confirmation, statement, or other record of the transaction, or information on the status or value of the financial service or financial product to the Consumer or the Consumer’s agent or broker; (4) to accrue or recognize incentives or bonuses associated with the transaction that are provided by Company or any other party; or (5) in connection with: (a) the authorization, settlement, billing, processing, clearing, transferring, reconciling, or collection of amounts charged, debited, or otherwise paid using a debit, credit, or other payment card, check, or account number, or by other payment means; (b) the transfer of receivables, accounts, or interests therein; or (c) the audit of debit, credit, or other payment information.
4.5 Revised Privacy Notices
The Company must not, directly or through any Affiliate, disclose any NPI about a Consumer to a Nonaffiliated Third Party other than as described in the initial Privacy Notice that the Company provided to that Consumer unless the Company has provided to the Consumer a Clear and Conspicuous revised Notice that accurately describes the Company’s policies and practices. The revised Notice must provide the Consumer with the ability to Opt Out.
The Consumer must be given a Reasonable Opportunity, before the Company discloses the information to the Nonaffiliated Third Party, to Opt Out of the disclosure. The NPI may only be disclosed if the Consumer does not Opt Out.
A revised Notice must be provided whenever the Company:
Discloses a new category of NPI to any Nonaffiliated Third Party;
Discloses NPI to a new category of Nonaffiliated Third Party; or
Discloses NPI about a former Customer to a Nonaffiliated Third Party if that former Customer has not had the opportunity to exercise an Opt Out right regarding that disclosure.
A revised Notice is not required if the Company discloses NPI to a new Nonaffiliated Third Party that the Company adequately described in its prior Notice.
4.6 Delivering Privacy and Opt Out Notices
The Company must provide any Privacy Notices and Opt Out notices (whether initial, annual, or revised) in writing or, if the Consumer agrees, electronically.
The notices may be delivered:
By hand;
Via U.S. mail to the last known address of the Consumer; or
For Consumers who conduct transactions and agree to receive the notices electronically, by posting current versions of the notices on an electronic site and requiring the Consumer to acknowledge receipt of the notices as a necessary step to using the Company’s payment network platform.
Company provides consumer with the following methods to Opt Out:
Designate check-off boxes in a prominent position on the relevant forms with the Opt Out notice;
Provide an electronic means to Opt Out, such as a form that can be sent via electronic mail or a process at Company’s website, if the consumer agrees to the electronic delivery of information; or
Provide a toll-free telephone number that consumers may call to Opt Out.
Prohibition on disclosure of account numbers
The Company must not, directly or through an Affiliate, disclose, other than to a Consumer Reporting Agency, an Account Number or similar form of access number or access code for a Consumer’s credit card account, deposit account, share account, or Transaction Account to any Nonaffiliated Third Party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the Consumer.
This restriction does not apply if the Company discloses an Account Number or similar form of access number or access code:
To its agent or service provider solely in order to perform marketing for the Company’s own products or services, as long as the agent or service provider is not authorized to directly initiate charges to the account; or
To a participant in a private-label credit card program or an affinity or similar program where the participants in the program are identified to the Customer when the Customer enters into the program.
Exceptions to certain information sharing
Regulation P provides exceptions to its Consumer Notice and Opt Out requirements in certain limited cases. Pursuant to such exceptions, the Company is allowed to share NPI:
With the consent or at the direction of the Consumer, provided that the Consumer has not revoked the consent or direction (and evidence of the Consumer’s consent or direction is retained by the Company);
To a Consumer Reporting Agency in accordance with the Fair Credit Reporting Act;
A proposed or actual securitization, secondary market sale (including sales of servicing rights), or similar transaction related to a transaction of the consumer; or
Necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:
(i) Servicing or processing a financial product or service that a consumer requests or authorizes; or
(ii) Maintaining or servicing the consumer's account with you, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity.With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction;
To protect the confidentiality or security of your records pertaining to the consumer, service, product, or transaction;
(i) To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability;
(ii) For required institutional risk control or for resolving consumer disputes or inquiries;
(iii) To persons holding a legal or beneficial interest relating to the consumer; or
(iv) To persons acting in a fiduciary or representative capacity on behalf of the consumer;To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating you, persons that are assessing your compliance with industry standards, and your attorneys, accountants, and auditors;
To the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.), to law enforcement agencies (including the Bureau, a Federal functional regulator, the Secretary of the Treasury, with respect to 31 U.S.C. Chapter 53, Subchapter II (Records and Reports on Monetary Instruments and Transactions) and 12 U.S.C. Chapter 21 (Financial Recordkeeping), a state insurance authority, with respect to any person domiciled in that insurance authority's state that is engaged in providing insurance, and the Federal Trade Commission), self-regulatory organizations, or for an investigation on a matter related to public safety;
In connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit; or
To comply with Federal, state, or local laws, rules and other applicable legal requirements;
(i) To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, state, or local authorities; or
(ii) To respond to judicial process or government regulatory authorities having jurisdiction over you for examination, compliance, or other purposes as authorized by law.
The Company personnel must receive approval from the Company’s Compliance Department before making any disclosure of NPI based upon any of the exceptions listed in this Section, given that the ability to disclose such may require the satisfaction of other requirements.
Reuse and redisclosure of NPI
If the Company receives NPI from, or discloses NPI to, a Nonaffiliated Third Party (whether pursuant to an exception under Regulation P or otherwise), use and disclosure of such NPI is subject to the restrictions set forth below.
NPI Received Under an Exception
If the Company receives NPI from a Nonaffiliated Third Party under an exception provided by Regulation P, its disclosure and use of that NPI is limited as follows:
The Company may disclose the information to the Affiliate of the Nonaffiliated Third Party from which it received the NPI;
The Company may disclose the NPI to its Affiliates, but its Affiliates may, in turn, disclose and use the NPI only to the extent that the Company may disclose and use the NPI; and
The Company may disclose and use the NPI pursuant to an exception in the ordinary course of business to carry out the activity covered by the applicable exception.
For example, if the Company receives a customer list from a Nonaffiliated Third Party in order to provide account processing services, the Company may disclose that NPI under any exception in the ordinary course of business in order to provide those services. However, the Company could not disclose that NPI to a third party for marketing purposes or use that NPI for Company’s own marketing purposes.
NPI Received Outside of an Exception
If the Company receives NPI from a Nonaffiliated Third Party other than under an exception provided by Regulation P, the Company may disclose the NPI only:
To the Affiliates of the Nonaffiliated Third Party from which it received the NPI;
To its Affiliates, but its Affiliates may, in turn, disclose the NPI only to the extent that the Company can disclose the NPI; and
To any other person, if the disclosure would be lawful if made directly to that person by the Nonaffiliated Third Party from which the Company received the NPI.
For example, if the Company obtains a customer list from a Nonaffiliated Third Party outside of an exception provided by Regulation P, the Company may: (i) use that list for its own purposes; and (ii) disclose that list to another Nonaffiliated Third Party only if the financial institution from which it purchased the list could have lawfully disclosed the list to that Nonaffiliated Third Party. In other words, the Company may disclose the list in accordance with the privacy policy of the financial institution from which it received the list, as limited by the opt-out direction of each consumer whose NPI the Company intends to disclose, and the Company may disclose the list in accordance with an exception provided by Regulation P, such as to its attorneys or accountants.
NPI the Company Discloses Under an Exception
If the Company discloses NPI to a Nonaffiliated Third Party under an exception provided by Regulation P, the Nonaffiliated Third Party may disclose and use that information only as follows:
The Nonaffiliated Third Party may disclose the NPI to the Company’s Affiliates;
The Nonaffiliated Third Party may disclose the NPI to its Affiliates, but its Affiliates may, in turn, disclose and use the NPI only to the extent that the Nonaffiliated Third Party may disclose and use the NPI; and
The Nonaffiliated Third Party may disclose and use the NPI pursuant to an exception provided by Regulation P in the ordinary course of business to carry out the activity covered by the applicable exception.
NPI the Company Discloses Outside of an Exception
If the Company discloses NPI to a Nonaffiliated Third Party other than under an exception provided by Regulation P, the Nonaffiliated Third Party may disclose the NPI only:
To the Company’s Affiliates;
To its Affiliates, but its Affiliates, in turn, may disclose the NPI only to the extent the third party can disclose the information; and
To any other person, if the disclosure would be lawful if the Company made it directly to that person.
Training
To facilitate compliance with this Policy, the Company will provide ongoing training to appropriate employees, including guidance on the standards, processes, and restrictions set forth within this Policy.
Employee and vendor responsibilities
Employees, vendors, consultants, and delegates are expected to adhere to this Policy. The failure to comply with such may result in a range of disciplinary actions, up to and including termination of employment.
Policy administration
The Company requires that this Policy shall be reviewed and, if applicable, updated periodically as necessary to ensure it reflects current obligations and/or its contemplated business activities.
Defined terms and references
Account Number: An Account Number, or similar form of access number or access code for an account that does not include a number or code in an encrypted form, as long as the Company does not provide the recipient with a means to decode the number or code.
Affiliate: Any Company that controls, is controlled by, or is under common control with another Company. Control of a Company means: (1) ownership, control, or power to vote 25 percent or more of the outstanding shares of any class of voting security of the Company, directly or indirectly, or acting through one or more other persons; (2) control in any manner over the election of a majority of the directors, trustees, or general partners (or individuals exercising similar functions) of the Company; or (3) the power to exercise, directly or indirectly, a controlling influence over the management or policies of the Company as determined by the applicable prudential regulator (as defined in 12 U.S.C. 5481(24)), if any.
Clear and Conspicuous: A notice is Clear and Conspicuous if it is reasonably understandable and designed to call attention to the nature and significance of the information in the notice. If provided on a website, the notice must use text or visual cues to encourage scrolling down the page if necessary to view the entire notice. Other elements on the website (such as text, graphics, hyperlinks, or sound) must not distract attention from the notice. In addition, either the notice or a link to the notice must be placed on a screen that Consumers frequently access, such as a page on which transactions are conducted. If a link is used, the link must connect directly to the notice and be labeled appropriately to convey the importance, nature, and relevance of the notice.
Collect: To obtain information that the Company organizes or can retrieve by the name of an individual or by identifying number, symbol, or other identifying particular assigned to the individual, irrespective of the source of the underlying information.
Consumer: An individual that obtains or has used the payment network platform offered by the Company for personal, family, or household purposes.
Consumer Reporting Agency: Any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages, in whole or in part, in the practice of assembling or evaluating Consumer information for the purpose of furnishing Consumer reports to third parties, and who uses any means or facility of interstate commerce for the purpose of preparing or furnishing Consumer reports.
Customer: A Consumer who has a Customer Relationship with the Company.
Customer Relationship: Customer Relationship means a continuing relationship between a Consumer and the Company under which the Company provides financial products or services to the Consumer that are to be used primarily for personal, family, or household purposes.
Nonaffiliated Third Party: Any person except:
An Affiliate of the Company; or
A person employed jointly by the Company and any Company that is not an Affiliate of the Company (but a Nonaffiliated Third Party includes the other Company that jointly employs the person).
A Nonaffiliated Third Party includes any company that is an Affiliate solely by virtue of the Company’s or a Company Affiliate’s direct or indirect ownership or control of the company.
Nonpublic Personal Information (or NPI): NPI means Personally Identifiable Financial Information and any list, description, or other grouping of Consumers (and publicly available information pertaining to them) that is derived using any Personally Identifiable Financial Information that is not publicly available. NPI includes any list of individuals’ names and street addresses that is derived in whole or in part using Personally Identifiable Financial Information that is not publicly available, such as Account Numbers.
NPI does not include:
Publicly available information;
Any list, description, or other grouping of Consumers (and publicly available information pertaining to them) that was derived from Publicly Available Personally Identifiable Financial Information.
Opt Out: A direction by the Consumer that the Company not disclose NPI about that Consumer to a Nonaffiliated Third Party, other than pursuant to an application exception under GLBA and Regulation P.
Personally Identifiable Financial Information: Any information:
A Consumer provides to the Company in connection with the Company’s payment network platform;
About a Consumer resulting from any transaction involving a consumer-related product or service between the Company and a Consumer relating to its payment network platform; or
The Company otherwise obtains about a Consumer in connection with providing the payment network platform to that Consumer.
Personally Identifiable Financial Information includes:
Information a Consumer provides to the Company to obtain a financial product or service;
Account balance information, payment history, overdraft history, and credit or debit card information;
The fact that an individual is or has been one of the Company’s Customers or has obtained a financial product or service from the Company;
Any information about the Company’s Consumer if it is disclosed in a manner that indicates that the individual is or has been the Company’s Consumer;
Any information that a Consumer provides to the Company or that the Company or its agent otherwise obtain in connection with the payment network platform provided by the Company;
Any information the Company Collects through an internet “cookie” (an information-Collecting device from a web server); and
Information from a Consumer report.
Personally Identifiable Financial Information does not include information that does not identify a Consumer, such as aggregate information or blind data that does not contain personal identifiers such as Account Numbers, names, or addresses. It also does not include a list of names and addresses of Customers of an entity that is not a financial institution.
Publicly Available Information: Publicly Available Information means any information that the Company has a Reasonable Basis to believe is lawfully made available to the general public from:
Federal, state, or local government records;
Widely distributed media (e.g., information from a telephone book, a television or radio program, a newspaper, or a website that is available to the general public on an unrestricted basis. A website is not restricted merely because an internet service provider or a site operator requires a fee or a password, so long as access is available to the general public); or
Disclosures to the general public that are required to be made by federal, state, or local law.
Reasonable Basis: The Company has a Reasonable Basis to believe that information is lawfully made available to the general public if the Company has taken steps to determine:
That the information is of the type that is available to the general public; and
Whether an individual can direct that the information not be made available to the general public and, if so, that the Company’s Consumer has not done so.
The following are some examples of situations where a Reasonable Basis exists:
There is Reasonable Basis to believe that an individual’s telephone number is lawfully made available to the general public if it has been located in the telephone book or the Consumer has informed the Company that the telephone number is not unlisted.
There is a Reasonable Basis to believe that consumer information is lawfully made available to the general public if the information is of the type included on the public record in the relevant jurisdiction.
Reasonable Opportunity (to Opt Out): The following are examples of a Reasonable Opportunity to Opt Out:
By mail. The Company mails the Privacy Notice and Opt Out notice to the Consumer and allows the Consumer to Opt Out by mailing a form, calling a toll-free telephone number, or any other reasonable means within 30 days from the date the Company mailed the notices.
By electronic means. A Customer opens an online account with the Company and agrees to receive the Privacy Notice and Opt Out notice electronically, and the Company allows the Customer to Opt Out by any reasonable means within 30 days after the date that the Customer acknowledges receipt of the notices in conjunction with opening the account.
Isolated transaction with Consumer. For an isolated transaction, such as the purchase of a cashier’s check by a Consumer, the Company provides the Consumer with a Reasonable Opportunity to Opt Out if it provides the Privacy Notice and Opt Out notice at the time of the transaction and requests that the Consumer decide, as a necessary part of the transaction, whether to Opt Out before completing the transaction.
Transaction Account: An account other than a deposit account, a share account, or a credit card account. A Transaction Account does not include an account to which third parties cannot initiate charges.
Model privacy notices
WHAT DOES [MORETA GLOBAL INC.] DO WITH YOUR PERSONAL INFORMATION?
Why?:
Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.
What?:
The types of personal information we can access and share depend on the product or service you have with us. This information can include:
Social Security number and assets
Account balances and account transactions
income and credit history
When you are no longer our customer, we continue to share your information as described in this notice.
How?:
All financial companies need to share [customers’] personal information to run their everyday business. In the section below, we list the reasons financial companies can share their [customer] personal information; the reasons [Moreta Global Inc.] chooses to share; and whether you can limit this sharing.
To limit our sharing:
Email support@moreta.io or Visit us online: moretapay.com
Please note:
If you are a new customer, we can begin sharing your information [30] days from the date we sent this notice. When you are no longer our customer, we continue to share your information as described in this notice.
However, you can contact us at any time to limit our sharing.
Questions?:
Email support@moreta.io or visit us online: moretapay.com
What we do
How does [Moreta Global Inc.] protect my personal information.
To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.
How does [Moreta Global Inc.] collect my personal information?
We collect your personal information, for example, when you
Open an account or give us your contact information
Deposit money or provide account information
Show your government-issued ID
We collect your personal information from other companies.
Why can’t I limit all sharing?
Federal law gives you the right to limit only
sharing for affiliates’ everyday business purposes—information about your creditworthiness affiliates from using your information to market to you sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. [See below for more on your rights under state law.]
Definitions
Affiliates
Companies related by common ownership or control. They can be financial and nonfinancial companies.
Our affiliates include companies with a [Moreta] name; financial companies such as [Moreta Inc.];
Nonaffiliates
Companies not related by common ownership or control. They can be financial and nonfinancial companies.
Nonaffiliates we share with can include financial institutions, financial technology companies, and KYC/AML providers.
Joint marketing
A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
[Moreta Global Inc.] doesn't jointly market.
Other important information
Rights Under State Law: You may have privacy rights under various state laws. We will comply with these laws to the extent they apply.
For California residents: We will not share information we collect about you with nonaffiliated third parties, except as permitted by law, including, for example, with your consent or to service your account.
For Vermont residents: We will not share information we collect about you with nonaffiliated third parties, except as permitted by law, including, for example, with your consent or to service your account.