ZENO Contractor Privacy Notice

Net Spot Ltd., Sofia, Bulgaria, Aksakov 11A (ID 207512382) - “we” - is the data controller for personal data processed on this platform, which we use to onboard, verify and pay independent security auditors. Privacy contact: privacy@pashov.com.

• Identity verification (KYC). Verification is performed by our provider Sumsub (Sum and Substance Ltd). Your identity documents, selfie and liveness data are captured and stored by Sumsub on our behalf - this platform stores only your verification status, provider reference IDs, dates and risk flags. Biometric data used for liveness/face matching is processed only with your explicit consent, which Sumsub collects before the verification step (Art. 9(2)(a) GDPR). Identity verification itself is based on our legitimate interest in confirming who we contract with and preventing fraud (Art. 6(1)(f)).
• Sanctions screening. We screen contractors against EU and other sanctions lists. As an EU company we are legally required to comply with EU restrictive measures (Art. 6(1)(c)).
• Onboarding documents. Proof of address, tax residency declarations and signed contractor agreements you upload - processed to perform our contract with you (Art. 6(1)(b)) and stored encrypted in the EU.
• Billing and payment data. Your invoice details (name, address, date of birth or Bulgarian ЕГН where legally required on invoices, company identifiers) and your Ethereum wallet address - processed to perform our contract and to meet Bulgarian accounting and tax obligations (Art. 6(1)(b) and (c)). Sensitive identifiers are stored encrypted.
• Security and audit logs. Sign-ins, sensitive-data access and compliance decisions are recorded (actor, action, timestamp, IP address) based on our legitimate interest in securing a financial platform (Art. 6(1)(f)).
• Passkey credentials. Public keys used for sign-in. Your biometric data for unlocking a passkey never leaves your own device.

We use a small set of processors under data-processing agreements:

• Sumsub - identity verification and sanctions screening (EU data hosting).
• Supabase - database and document storage (Ireland, EU).
• Vercel - application hosting (functions pinned to the EU; certified under the EU-US Data Privacy Framework, with EU Standard Contractual Clauses).

We do not sell your data. Payment of invoices in USDC occurs on the public Ethereum network; your wallet address, once used on-chain, is publicly visible by the network’s nature.

• Invoices and accounting records: up to 11 years (Bulgarian accounting and tax law).
• KYC verification media (held at Sumsub): deleted shortly after the end of our working relationship; we retain only the verification result.
• Onboarding documents and profile data: for the duration of the relationship plus a limited buffer.
• Audit logs: retained for security and accountability purposes.

You may request access to, correction of, export of, or deletion of your personal data, and you may withdraw consent for biometric processing at any time (this stops future verification, not the lawfulness of past processing). Deletion cannot cover data we are legally required to keep (e.g. issued invoices) - Art. 17(3)(b) GDPR. Write to privacy@pashov.com; we respond within one month. You may also complain to the Bulgarian Commission for Personal Data Protection (КЗЛД, cpdp.bg) or your local EU supervisory authority.