LegalLast updated:
ENGAGEX collects sensitive identity data because a Policy needs KYC approval before it can be active for claims, and it logs site visits for security and fraud prevention. This policy explains what we collect, why we collect it, who processes it, how long we keep it and how you can use your rights.
1. Who we are
This Privacy Policy explains how Engagex Global LLC (ENGAGEX, we, us or our) handles personal data when you use our website, dashboard and related services (the Service).
Engagex Global LLC is the controller of your personal data. Our address is 1309 Coffeen Avenue, Wyoming 82801, USA. You can reach us about privacy at support@engagex.life.
The Service cannot be provided without identity checks, so please read this policy carefully, in particular the section on sensitive data.
2. Personal data we collect
KYC data. When you complete KYC we collect:
- your country and state;
- your document type: driving license, passport or government ID;
- a live selfie taken through your device camera;
- photos of both sides of your document;
- your official full name;
- your mobile number;
- your date of birth;
- your precise device location; and
- your IP address.
Wallet and policy data. We collect your public wallet address, your takePolicy transaction, your Assured Amount, Premium and the start and end time of your policy. We match our wallet records to the policy data recorded on-chain by the smart contract. You tick acceptance of the terms in the Dashboard, and the transaction is your record of acceptance.
Account activity logs. We log account activity at each KYC step. The log records the step reached, your IP address, device and browser details, the approximate location derived from your IP address, and your precise device location when you share it. Authorised admin staff can view these logs for each wallet.
Site visit logs. We log every page visit to the site. Each log entry records the page visited, the time, your IP address, the approximate location derived from your IP address (country, region and city), your browser and device details, the referring page, and your wallet address when you are signed in. We also set a first-party cookie, described in the section on cookies, that links visits from the same browser. These logs are used for security, fraud prevention and understanding how the site is used. They are visible to authorised ENGAGEX admin staff and are kept for 2 years.
Claim data. When you file a claim we collect the incident type, partner, transaction hashes, loss amount, date, description and evidence files, along with any further material you give us during an investigation. Evidence files may contain data about you or about other people.
Support data. If you contact us, we keep your messages, contact details and our replies.
Technical data. When you use the Service, our systems process your IP address, device and browser information, and server logs, as needed to deliver and secure the Service. This includes the site visit logs described above.
Public blockchain data. We read public on-chain records connected to your wallet, for example to verify a payment or a loss. Those records are public and are not controlled by us.
3. Sensitive data
We treat two types of data with particular care: your precise device location, and your selfie images, which are biometric-adjacent because they show your face. Your identity document photos are also highly sensitive.
Precise location. Sharing your precise device location is mandatory for KYC. We ask for it through your device’s location permission. We use it to confirm the country and state you gave us, to apply restrictions on where the Service is available, and to help detect fraud. If you refuse permission, you cannot complete KYC.
Live selfie. The live selfie is taken through your device camera and is reviewed by authorised ENGAGEX staff, who compare it with your document to help confirm that you are the person on it. The review is carried out by people. We do not use automated biometric matching or automated liveness detection.
We use this data only for identity verification, eligibility, fraud prevention, claims handling where identity needs to be confirmed, and legal compliance. We do not use it for marketing.
4. How we use personal data and our lawful basis
If the GDPR or a similar law applies to you, we rely on the following lawful bases. Where it does not, we use your data for the same purposes.
- To provide the Service and perform your Policy, including matching your wallet to its on-chain Policy, and handling claims. Lawful basis: performance of a contract.
- To verify identity and eligibility, including your age and location. Lawful bases: performance of a contract and our legitimate interest in knowing who we contract with and preventing fraud. For precise location and selfie images, where the law requires it, your explicit consent, which you give when you complete those steps.
- To prevent fraud and financial crime and to screen for sanctions. Lawful bases: legal obligation, where one applies, and our legitimate interest in protecting ENGAGEX and its users.
- To investigate claims and pursue recovery of funds. Lawful bases: performance of a contract and our legitimate interest in establishing, exercising and defending legal claims.
- To run, secure and improve the Service, including keeping site visit logs, preventing fraud and understanding how the site is used, and fixing faults. Lawful basis: our legitimate interests in a safe and reliable Service.
- To communicate with you, including support, service notices and changes to our documents. Lawful bases: performance of a contract and our legitimate interests.
- To meet legal obligations and respond to authorities. Lawful basis: legal obligation.
If you withdraw consent, this does not affect earlier use of your data. We may be unable to keep your KYC approved or to provide the Service, and we may need to keep certain records where another lawful basis applies.
You must give us the KYC data listed in this policy to use the Service. Without it we cannot activate your Policy or pay a Benefit.
5. Decisions made by people
KYC submissions are reviewed by authorised ENGAGEX staff. Decisions on claims are made by people. We do not make decisions with legal or similarly significant effects about you solely by automated means.
6. Where your data is stored
KYC photos, including selfies and document images, are stored in private Cloudflare R2 object storage. They are not publicly accessible.
KYC records and other account, policy and claim records are stored in a PostgreSQL database. Only authorised ENGAGEX staff who need access for their role can review KYC material.
8. How long we keep data
We keep personal data, including KYC data and photos, for 5 years after our relationship with you ends, unless the law requires otherwise.
Site visit logs, including the visitor id cookie value linked to them, are kept for 2 years from the date of the visit.
Our relationship with you ends at the latest of: the end of your last Policy, the closing of your last claim including any dispute or recovery, and your last use of the Service. If your KYC is rejected and you never hold a Policy, it ends when your application is closed.
We may keep data for longer where the law requires it, or where it is needed for a pending claim, dispute, investigation or legal hold. When a retention period ends, we delete data or make it anonymous.
9. Security
We use technical and organisational measures designed to protect personal data. These include private object storage for photos, access controls that limit KYC review to authorised staff, and encrypted connections between your browser and the Service.
No system is completely secure, and we cannot guarantee the security of data. You are responsible for protecting your own device and wallet.
If a personal data breach occurs that affects you, we will notify you and any relevant authority where the law requires us to do so.
10. Your privacy rights
Depending on where you live, you may have rights over your personal data. To use them, email support@engagex.life. We may need to verify your identity first, and we will reply within the time the law requires.
GDPR style rights. If you are in the European Economic Area, the United Kingdom or a place with similar laws, you may have the right to:
- access your personal data and receive a copy of it;
- correct inaccurate or incomplete data;
- ask us to delete your data;
- restrict how we use your data;
- object to our use of your data based on legitimate interests;
- receive data you gave us in a portable format;
- withdraw consent at any time, where we rely on it; and
- complain to your local data protection authority.
CCPA style rights. If you are a California resident, or live in a US state with a similar law, you may have the right to:
- know what personal information we collect, use and disclose, and receive a copy of it;
- ask us to delete it, and to correct it;
- opt out of any sale or sharing of personal information for targeted advertising, although we do not do either;
- limit the use of sensitive personal information, although we use it only for the purposes in this policy that the law allows;
- use an authorised agent to make a request; and
- not be treated less favourably for using these rights.
The categories of data we collect, our purposes and the types of recipient are described in this policy. In the terms used by those laws, the sensitive information we collect includes government identifiers, precise geolocation and images of you.
These rights have limits. They do not allow us to delete data that is recorded on the blockchain, such as your wallet address, amounts and dates, because we cannot remove it. For example, we may keep data that we must retain by law, or that we need for fraud prevention or legal claims. If we cannot meet a request, we will tell you why. Deleting KYC data while a Policy is in force may mean that no Benefit can be paid.
11. International transfers
ENGAGEX is based in the United States, and our service processors may process data in the United States and in other countries. These countries may have data protection laws that differ from those of your own country.
Where the law requires a safeguard for transferring your data, we rely on an approved mechanism, such as standard contractual clauses, or on another basis the law allows, such as a transfer needed to perform your contract. You can contact us for more information.
13. Children
The Service is only for people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, contact support@engagex.life and we will take appropriate steps to delete it, unless the law requires us to keep it.
14. Third-party sites
The Service may link to wallets, dapps and sites that we do not control. Their privacy practices are their own. This policy does not apply to them.
15. Changes to this policy
We may update this policy. We will post the new version with a new “Last updated” date and, for material changes, will give notice through the Service.
16. Contact
For privacy questions or requests, contact support@engagex.life or write to Engagex Global LLC, 1309 Coffeen Avenue, Wyoming 82801, USA. See also our KYC and AML Policy.