ZENO Contractor Privacy Notice

Net Spot Ltd., Sofia, Bulgaria, Aksakov 11A (ID 207512382) - “we” - is the data controller for personal data processed on this platform, which we use to onboard, verify and pay independent security auditors. Privacy contact: privacy@pashov.com.

• Identity verification (KYC). Verification is performed by our provider Didit. Your identity documents, selfie and liveness data are captured and stored by Didit on our behalf - this platform stores only your verification status, provider reference IDs, dates and risk flags. Biometric data used for liveness/face matching is processed only with your explicit consent(Art. 9(2)(a) GDPR), which you give in the consent form and again in the provider’s own flow. If you prefer not to complete a biometric check, we offer a manual verification route instead; we cannot engage or pay you until your identity is verified by some means. Identity verification itself is based on our legitimate interest in confirming who we contract with and preventing fraud (Art. 6(1)(f)).
• Sanctions screening. We screen contractors against EU, UN, UK and US sanctions lists before engagement and periodically afterwards (at least every six months), and we screen payout wallet addresses against sanctions lists. As an EU company we are legally required to comply with EU restrictive measures (Art. 6(1)(c)). A screening alert is always reviewed by a member of our staff before it results in a refusal.
• Onboarding documents. Tax residency, billing and contractual documents you provide, and the agreements you accept in the platform - processed to perform our contract with you (Art. 6(1)(b)) and stored in the EU.
• Billing and payment data. Your invoice details (name, address, date of birth or Bulgarian ЕГН where legally required on invoices, company identifiers) and your Ethereum wallet address - processed to perform our contract and to meet Bulgarian accounting and tax obligations (Art. 6(1)(b) and (c)). Sensitive identifiers are stored encrypted.
• Security and audit logs. Sign-ins, sensitive-data access and compliance decisions are recorded (actor, action, timestamp, IP address) based on our legitimate interest in securing a financial platform (Art. 6(1)(f)).
• Passkey credentials. Public keys used for sign-in. Your biometric data for unlocking a passkey never leaves your own device.

We use a small set of processors under data-processing agreements:

• Didit - identity verification and AML/sanctions screening (EU data hosting).
• Supabase - database hosting (Ireland, EU).
• Vercel - application hosting (functions pinned to the EU; certified under the EU-US Data Privacy Framework, with EU Standard Contractual Clauses).
• Chainalysis - payout wallet screening against sanctions lists (United States, under the EU-US Data Privacy Framework and EU Standard Contractual Clauses).

We do not sell your data. Payment of invoices in USDC occurs on the public Ethereum network; your wallet address, once used on-chain, is publicly visible by the network’s nature.

• Invoices and accounting records: up to 11 years (Bulgarian accounting and tax law).
• KYC verification media (held at Didit): deleted shortly after the end of our working relationship; we retain only the verification result.
• Onboarding documents and profile data: for the duration of the relationship plus a limited buffer.
• Audit logs: retained for security and accountability purposes.

You may request access to, correction of, export of, or deletion of your personal data, and you may withdraw consent for biometric processing at any time (this stops future verification, not the lawfulness of past processing). Deletion cannot cover data we are legally required to keep (e.g. issued invoices) - Art. 17(3)(b) GDPR. Write to privacy@pashov.com; we respond within one month. You may also complain to the Bulgarian Commission for Personal Data Protection (КЗЛД, cpdp.bg) or your local EU supervisory authority.