Platas.io Privacy Policy

Effective Date: November 1st, 2025

Entity: Platas.io Limited (HE 412491)

Registered Address: 4 Foti Pitta Street, Labs Tower, Nicosia, Cyprus

Email: [email protected]

Website: www.platas.io

1. Introduction

Platas.io Limited (“Platas,” “we,” “us,” or “our”) is committed to protecting the privacy and personal data of its clients, employees, and partners.

This Privacy Policy describes how we collect, use, store, and protect personal data in compliance with the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), Cyprus Data Protection Law 125(I)/2018, and other applicable laws.

Platas provides a cloud-based technology platform that consolidates data from banks, bank account information third-party providers, ERP systems, payroll providers, and other financial systems to deliver real-time visibility, automation, and AI-driven financial insights.

Platas acts as a Data Processor for client data and as a Data Controller for its internal operations.

2. Data We Collect

Platas collects and processes personal and business information only when necessary for legitimate business purposes, contractual obligations, or regulatory compliance.

A. Client and Business Data

• Company and contact information (legal entity name, registration number, business address, contact emails).
• User authentication data (name, role, corporate email, access logs).
• ERP and financial data (transactions, invoices, account balances, journals, reconciliation data).
• Banking data (account identifiers such as IBAN, BIC, masked account names, payment metadata).
• Vendor and supplier payment data (beneficiary name, country, payment reference).

B. Banking Data

Platas retrieves account and transaction information securely through regulated Account Information Service Providers (AISPs) such as Salt Edge and similar PSD2-compliant providers.

This may include:

• Account identifiers (IBAN, SWIFT/BIC, account name).
• Account balances and transaction metadata (amount, date, currency, counterparty, payment reference).
• Bank names and account types (corporate accounts only).

Banking data is accessed via customer consent and processed strictly for analytics, reconciliation, and reporting. Platas does not directly access or store banking credentials or login information.

C. Payroll and HR Data (Client Systems)

• Employee name, position, department, and compensation details.
• Employee bank account information (for payroll purposes).
• HR records imported from integrated HRIS systems (e.g., BambooHR).
• Contractor payment data processed via connected payroll vendors or PSPs and payment providers.

D. Analytical and AI Data

• Aggregated, pseudonymized financial data used by Platas’s AI engine to provide insights, anomaly detection, and recommendations.
• Such data is anonymized or pseudonymized to prevent identification of individuals.

E. Website & Communication Data

• Contact information submitted through forms or support channels.
• Technical data such as IP address, browser type, and cookies (for security and analytics purposes).

3. Purpose and Legal Basis of Processing

Platas processes data for the following purposes under GDPR Article 6 lawful bases:

4. Data Hosting and Storage

All data is securely hosted in EU/EEA regions only, using Amazon Web Services (AWS) data centers:

• Germany (Frankfurt - eu-central-1)
• Ireland (Dublin - eu-west-1)

Backups and disaster recovery instances remain within the EU. No personal data is transferred outside the EEA unless protected by Standard Contractual Clauses (SCCs) and adequate safeguards.

5. Data Retention

Platas.io enforces a documented Data Governance and Retention Framework that defines how long different categories of data are retained, how they are secured, and when they are permanently deleted or anonymized.

Retention periods are determined by legal, contractual, and operational requirements, particularly for financial reporting, payroll obligations, and auditability, while ensuring compliance with the GDPR’s data-minimization and storage-limitation principles.

After the defined period, all personal and financial data is securely deleted or anonymized using cryptographic erasure and irreversible overwriting methods. Deletion actions are logged and reviewed by the Data Protection Officer (DPO) as part of Platas’s Data Lifecycle Management Policy.

6. Data Sharing and Third Parties

Platas.io shares personal and financial data only with vetted third-party service providers when strictly necessary to deliver its services or comply with legal obligations. All third parties are bound by written Data Processing Agreements (DPAs) and undergo periodic due diligence and security reviews under Platas’s Vendor Risk Assessment Framework (VRA).

A. Categories of Authorized Third Parties

B. Sub-Processor Oversight

• Platas maintains an internal Sub-Processor Register, reviewed annually by the Data Protection Officer (DPO).
• No sub-processor may access personal or banking data without contractual approval, audit rights, and verified compliance with GDPR, ISO 27001, and SOC 2 requirements.
• All transfers of data outside the EU/EEA (if any) are safeguarded using EU Standard Contractual Clauses (SCCs) or equivalent mechanisms per GDPR Chapter V.

C. Use of Open Banking Partners (Plaid & Salt Edge)

Platas uses regulated Account Information Service Providers (“AISPs”) — including Plaid for U.S. financial institutions and Salt Edge for EU/UK institutions — to securely retrieve account and transaction data on behalf of clients.

When you connect a bank account or authorize financial data sharing, your information is processed by Plaid or Salt Edge according to their respective privacy policies:

• Plaid Privacy Policy
• Salt Edge Privacy Policy

By using Platas services that rely on Open Banking connectivity, you acknowledge and consent that:

1. Your financial data (such as account identifiers, balances, and transaction metadata) will be processed by these providers to facilitate connectivity.
2. Platas does not access or store your banking credentials (e.g., usernames, passwords, tokens).
3. Data retrieved via AISPs is used solely for the purposes of financial reporting, reconciliation, analytics, and other contracted services.
4. You may withdraw consent at any time by disconnecting your bank account or contacting Platas at [email protected].

Plaid and Salt Edge operate as independent data controllers for the information they process on your behalf and are fully responsible for their compliance with GDPR, PSD2, and other applicable laws.

D. No Unauthorized Data Sharing

Platas.io does not sell, rent, or trade client or user data to any third party.

Data sharing occurs exclusively for:

• Service delivery and performance improvement;
• Regulatory reporting or legal obligations; or
• Security incident management (if required by law enforcement or supervisory authorities).

7. Data Security Measures

Platas implements technical and organizational measures aligned with ISO 27001 and NIST standards, including:

• Encryption at rest (AES-256) and in transit (TLS 1.2+).
• Multi-Factor Authentication (MFA) and Role-Based Access Control (RBAC).
• Continuous monitoring via CloudTrail, CloudWatch, and SIEM (ELK/Splunk).
• Annual vulnerability assessments and penetration tests.
• Immutable audit logs (WORM storage).
• Annual staff training on GDPR and data protection.

8. Data Subject Rights

Under GDPR, data subjects have the right to:

• Access their data and receive a copy.
• Rectify inaccurate data.
• Request erasure (“right to be forgotten”).
• Restrict or object to processing.
• Request data portability.

Requests can be made by emailing [email protected]. Responses are provided within 30 days in compliance with GDPR Articles 12-23.

9. Consent Withdrawal

Where processing is based on consent, individuals may withdraw consent at any time by contacting [email protected].

Withdrawal requests are processed promptly, and relevant data is deleted or anonymized unless retention is required by law.

10. Data Breach Notification

Platas maintains an active Incident Response Plan (IRP). In the event of a personal-data breach:

• Clients and affected parties will be notified without undue delay (and within 72 hours, where applicable).
• Platas will provide details of the breach, scope, and remediation actions.
• Records of incidents are retained for audit and regulatory review.

11. International Transfers

Platas does not transfer personal data outside the EU/EEA except where:

• Transfers are necessary for technical support or vendor processing, and
• Standard Contractual Clauses (SCCs) and equivalent safeguards are in place.

12. Children’s Data

Platas does not knowingly process data of individuals under 18 years of age. If such data is inadvertently collected, it will be deleted immediately upon discovery.

13. Updates to This Policy

This policy may be updated periodically to reflect changes in technology, law, or business operations. Any updates will be posted at www.platas.io/privacy-policy with the revised effective date.

14. Contact and Supervisory Authority

For questions, complaints, or data-subject requests:

📧 [email protected]

🏢 Platas.io Limited, 4 Foti Pitta Street, Labs Tower, Nicosia, Cyprus

Supervisory authority:

Office of the Commissioner for Personal Data Protection (Cyprus)
Website: www.dataprotection.gov.cy