Privacy Policy

Last updated: October 2026

1. Who we are and to whom this applies

Alodiga is a B2B financial technology provider. This policy explains how we process personal data in two different roles:

As controller: data of the representatives and contacts of our clients and prospects, and of visitors to this website.
As processor on behalf of the client institution: data of the end users of banks, cooperatives, exchange houses and fintechs that use our platform. In that case the institution is the controller, determines the purposes and is the obligated entity before SUDEBAN. We only process that data following its instructions and the contract.

2. Legal framework

Venezuela does not currently have a general personal data protection law. We therefore apply the rights and principles recognized by:

Constitution of the Bolivarian Republic of Venezuela, articles 28 (habeas data), 48 (secrecy of communications) and 60 (protection of private life against the use of information technology).
Case law of the Constitutional Chamber of the Supreme Court of Justice (TSJ) on personal data protection (ruling of August 4, 2011), which sets out the principles of consent, purpose limitation, data quality, time limitation and security.
Decree with Rank, Value and Force of Law on Banking Sector Institutions (Ley de Instituciones del Sector Bancario, Official Gazette – G.O. Ext. No. 6.154 of 11/19/2014), in particular banking secrecy and the outsourcing of services.
Organic Law against Organized Crime and Terrorist Financing (LOCDOFT) and SUDEBAN Resolution No. 010.25 on ML/TF/PF risks (LC/FT/FPADM).
SUDEBAN Resolution No. 001.21 (financial technology services) and SUDEBAN Resolution No. 641.10 (electronic banking).
Decree-Law on Data Messages and Electronic Signatures (Ley sobre Mensajes de Datos y Firmas Electrónicas) and Special Law against Computer Crimes (Ley Especial contra los Delitos Informáticos).
Central Bank of Venezuela (BCV) regulations on payment systems, interest rates and the foreign exchange regime.

As a best-practice reference, we also follow the ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27701 standards. If an institution operates in another country, that country's data protection law also applies.

3. Data we process

Professional contact details: name, position, institution, email, phone and country.
Data we process on behalf of the institution: identification, identity documents, contact details, financial and transactional information, and results of KYC/KYB checks and sanctions list screening.
Biometric data (on behalf of the institution): facial image, liveness check and fingerprint, used only to verify identity.
Technical and security data: access logs, IP addresses, device identifiers and fingerprint, and audit events.

4. Why we use data and on what basis

To provide and maintain the contracted services (performance of the contract).
To meet the legal obligations of the institution and of Alodiga: prevention of ML/TF/PF under the LOCDOFT and SUDEBAN Resolution No. 010.25, record keeping and responding to requests from authorities (legal obligation).
To prevent fraud and protect the security of the platform and its users (legitimate interest and legal obligation).
To verify identity with biometrics, only with the express consent obtained by the institution.
To improve our products and AI models, within the limits of sections 6 and 7.
To send commercial communications to professional contacts, in accordance with section 8.

We do not use data for purposes incompatible with those for which it was collected, and we do not sell it.

5. Banking secrecy and biometric data

Information about the transactions of the institution's users is protected by the banking secrecy established in the Law on Banking Sector Institutions. Alodiga treats it with the same confidentiality, only to provide the service, and does not disclose it to third parties except in the exceptions provided by law and at the request of a competent authority.

Biometric data is used only to verify identity. It is stored encrypted, separately from other data, and is not reused for other purposes.

6. Artificial intelligence and automated decisions

We use AI in fraud scoring, transaction monitoring, identity verification and PIE's operations assistant. For these systems we apply the following rules:

Human oversight: the AI recommends and the institution decides. No decision with significant legal or financial effects on a person is left without the possibility of human review.
Explainability: each risk result shows the factors behind it, so the institution can justify it to the user and to SUDEBAN.
Right to review: users can ask their institution to have a person review an automated decision, and Alodiga provides the necessary information.
Fairness and quality: we evaluate models before each release to detect bias and degradation, and we document the data, metrics and limitations of each one.
Risk management: a model inventory and controls aligned with ISO/IEC 42001 and the OECD AI Principles. We will adapt these practices to the Artificial Intelligence Law enacted by the National Assembly.

7. Internal machine learning

Alodiga trains and improves its own models solely for internal use, under the following conditions:

Permitted purposes: improving the detection of fraud and suspicious transactions, identity verification, and platform security and performance.
Alodiga's own data (professional contacts, website usage and technical telemetry): only aggregated, anonymized or pseudonymized.
Data of an institution's users: only with that institution's express written authorization in the contract. Before use, the data is anonymized or pseudonymized, processed in the agreed environment and under banking secrecy, and controls are applied to prevent re-identification.
Prohibitions: we do not sell or transfer the data or any models that may contain it; we do not train third-party public models with client data; we do not use end users' data to profile them for our own commercial purposes.
The institution may withdraw its authorization at any time. From then on, its data is no longer used in new training.
Each training dataset is documented: source, authorization, anonymization technique, purpose and retention period.

8. Commercial communications

We use the data of professional contacts (not that of the institutions' end users) for internal commercial analysis and to send information about Alodiga's products, events and news. You can unsubscribe at any time using the link in each communication or by writing to privacy@alodiga.com. We do not share this data with third parties for their own advertising.

With the client institution, which is the controller of its users' data.
With providers that help us deliver the service (for example, cloud infrastructure or identity verification), under confidentiality and security agreements equivalent to this policy.
With AI model providers only when the contract prohibits them from using the data to train their models, and only with the minimum data necessary.
With SUDEBAN, the BCV, the National Financial Intelligence Unit (UNIF), courts and other competent authorities, when required by law.
In a corporate reorganization, with the successor, which will be bound by this policy.

10. International transfers

Part of the infrastructure may be located outside Venezuela. We only transfer data when the institution authorizes it, with contractual security and confidentiality safeguards, and in compliance with SUDEBAN requirements on outsourcing and supervisory access.

11. Security

AES-256 encryption at rest and TLS in transit; keys managed in HSMs.
Multi-factor authentication, least privilege and immutable audit logs.
Controls aligned with ISO/IEC 27001 and ISO/IEC 27002, and with PCI DSS for card data.
Secure development: static code analysis, peer review, automated testing and periodic penetration testing.
Incident notification to the institution without undue delay, so it can meet its reporting duties before SUDEBAN.

Unauthorized access to or use of the systems may constitute a criminal offense under the Special Law against Computer Crimes (Ley Especial contra los Delitos Informáticos).

12. Retention

We retain data for the duration of the contractual relationship and, thereafter, for the minimum periods required by the LOCDOFT, SUDEBAN regulations, commercial and tax legislation, or the contract with the institution. Once those periods expire, the data is deleted or irreversibly anonymized.

13. Your rights

Under article 28 of the Constitution and TSJ case law, you may:

Access your data and know how and for what purpose it is used.
Request that it be updated, corrected or, where appropriate, deleted.
Object to processing based on legitimate interest and unsubscribe from commercial communications.
Withdraw your consent, without retroactive effect.
Request human review of an automated decision (section 6).

If you are a user of an institution that uses Alodiga, exercise your rights before that institution; we will assist it. For data for which Alodiga is the controller, write to privacy@alodiga.com. We will respond within a reasonable time, without prejudice to a habeas data action before the courts.

14. Cookies

This website uses a technical cookie to remember the language you chose and another to store your cookie decision. Only if you accept it in the cookie notice does the site load third-party measurement tools (Google Analytics 4 and LinkedIn Insight Tag) to understand, in aggregate, how the site is used and which campaigns generate contacts. We do not use advertising cookies without your consent.

You can accept, reject or change your choice at any time from the "Cookie preferences" link in the footer of every page. If you reject measurement, the site works exactly the same.

15. Minors

Our services are aimed at institutions and professionals. We do not directly collect data from minors.

16. Changes

We will publish any changes on this page with their update date. If a change is significant, we will notify clients in advance.

17. Contact

Privacy: privacy@alodiga.com
Phone: +1 305 815 4862
Website: alodiga.com