Legal · BETA
Privacy notice
Version POPDRC-PRIV-2026-10-v0.1 · Effective date 19 October 2026
1. Who we are
The POP DRC website and investor portal (together, the "Service") are operated by POP Global Holdings LLC, a limited liability company organised under the laws of the State of Delaware, United States ("POP Global", "we", "us", "our").
- Registered address: 850 New Burton Road, Suite 201, Dover, DE 19904, USA (registered office)
- Contact for privacy matters: info@pop.global
- We have not appointed a data protection officer. Contact us at info@pop.global.
POP Global is the controller of the personal data described in this notice. Our operations in the Democratic Republic of Congo are carried out by POP Congo SA (RCCM CD/KIN/RCCM/22-B-01417, Kinshasa). Operations staff in the DRC have no access to investor data; any access to personal data for the purpose of operating the Service is given only by name, on our instructions (see section 6).
The POP DRC brand has its own user directory, its own data tables, its own document storage and its own encryption key. Personal data you give to POP DRC is not shared with other brands or businesses, except as described in this notice or with your consent.
2. The standard we apply
We apply the standard of the EU General Data Protection Regulation (GDPR) to all users of the Service, wherever they live. Where you are resident in the Democratic Republic of Congo, you also have the rights given to you by Congolese law on the protection of personal data, including the Digital Code (Code du numérique) of 2023. Where local law in your country gives you stronger rights, those rights apply.
3. How the Service works (and why it matters for your data)
The Service is in BETA and is available by personal invitation only. The steps are:
- Request or receive an invitation. You may request an invitation by writing to us, or we may invite you directly.
- Registration and approval. You create an account. We review your registration, including a check against applicable sanctions lists, before approving it.
- Viewing general information. Once approved, you may view general information about available opportunities and mark your interest.
- Investor verification (KYC) only before signing or payment. We ask for identity, address and source of funds information only when you decide to move towards signing an agreement or making a payment. We do not collect these documents before that point.
- Sensitive details only after signing. The exact location, the coordinates and the identity of the operators on a specific asset are shown only after you have signed, and only for your own asset.
4. What personal data we collect
| Category | Examples | When |
|---|---|---|
| Invitation request | Name, email address, country of residence, the name of the person who referred you | When you request an invitation |
| Account data | Name, email address, phone number (optional), preferred language, password (stored only in hashed form by our identity provider), authenticator app enrolment | When you register |
| Security and log data | Login times, IP address, device and browser information, security events (for example a change of authenticator app and any "not me" report), audit log of actions taken in the account | While you use the Service |
| Approval data | Result of sanctions screening, approval status, country of residence and tax residence | During approval |
| Interest data | Opportunities you mark as "interested", feedback you send us | While you use the Service |
| Investor verification (KYC) data | Identity document, proof of address, source of funds declaration, tax residence, verification result | Only before signing or payment |
| Agreement and signing data | Signed documents, document version, date, time and IP address of signature, one-time code verification records | When you sign |
| Payment data | Bank transfer instructions issued to you, transfer confirmations you upload, the bank account from which you transfer (transfers are accepted only from an account in your name), payment and distribution records | When you invest or receive payments |
| Asset and reporting data | Assets allocated to you, monthly and annual reports, accrued balances, tax reports | After signing, for your own assets only |
| Communications | Emails you send us; messages you send to POP's business WhatsApp line (the contact shown on the website), with the sending phone number and time | When you contact us |
| Website data | Technical data needed to deliver the website securely (see the Cookie Notice) | When you visit the website |
Messages to our business WhatsApp line. Messages you send to POP's business WhatsApp line, the contact shown on the website, are kept in order to reply to you, in the same way as emails.
Information about other people. If you name the person who referred you, please make sure they are happy for you to share their name with us.
Special categories. We do not ask for special categories of personal data (such as health or religious beliefs). Identity documents may show information such as a photograph or nationality. We use it only for verification.
5. Why we use your data and our legal bases
| Purpose | Legal basis |
|---|---|
| Handling your invitation request and deciding whether to invite you | Steps taken at your request before entering into a contract; our legitimate interest in running an invitation-only service |
| Creating and securing your account, including two-factor authentication | Performance of our contract with you (the Terms of Use, POPDRC-TOU-2026-10-v0.1); legitimate interest in security |
| Sanctions screening at approval | Compliance with legal obligations; legitimate interest in not dealing with sanctioned persons or restricted jurisdictions |
| Showing you general information and recording your interest | Performance of our contract with you |
| Investor verification (KYC) before signing or payment | Compliance with legal obligations (including anti-money laundering, sanctions and tax rules); steps before entering into a contract |
| Signing agreements, keeping signature evidence | Performance of a contract; legitimate interest in being able to prove what was signed |
| Processing transfers, allocations, reports and payments | Performance of a contract; compliance with legal obligations (accounting and tax) |
| Service notices by email | Performance of our contract with you |
| Answering and keeping emails and messages sent to us, including messages to POP's business WhatsApp line | Legitimate interest in responding to and keeping a record of messages sent to us |
| Audit logs, fraud prevention, defending legal claims | Legitimate interest; compliance with legal obligations |
| Optional communications or analytics, if ever introduced (there are none during BETA) | Your consent, which you may withdraw at any time |
Where we rely on legitimate interests, we have balanced them against your rights. You may ask us for details of that balancing.
No automated decisions. Approval, verification and investment decisions are taken by a person. We do not make decisions about you based solely on automated processing.
6. Who we share your data with
- POP Congo SA (our operations in the DRC): operations staff have no access to investor data. Where a person in the DRC needs access to personal data to operate the Service, access is given only to that named person, limited by role and on our instructions. Staff below owner level see only whether investor verification has been passed or not, and do not see your identity documents.
- Service providers acting on our instructions:
- Cloud hosting, identity and email delivery: Amazon Web Services, EU (Frankfurt) region; the public website is stored in that region and delivered through the AWS CloudFront global content delivery network, and access logging in CloudFront and S3 is switched off
- Email: Google Workspace (Google LLC)
- WhatsApp, a Meta service, for messages to our business WhatsApp line
- Electronic signature and investor verification (KYC): handled internally. Any external provider will be named here before it is used.
- Our bank, for incoming and outgoing transfers
- Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality.
- Authorities, regulators and courts where we are required by law, or to protect our rights.
- A buyer or successor of all or part of our business, under confidentiality and only for the same purposes.
We do not sell your personal data. We do not share it for advertising.
7. International transfers
POP Global is in the United States. POP Congo SA is in the Democratic Republic of Congo. Our service providers may process data in other countries. This means your data will be transferred outside your country of residence, including outside the European Economic Area, the United Kingdom and the DRC.
Where the law requires it, we protect these transfers with appropriate safeguards, such as:
- a data processing agreement between POP Global Holdings LLC and POP Congo SA, incorporating the European Commission's Standard Contractual Clauses where applicable;
- Standard Contractual Clauses or equivalent contracts with our service providers, or reliance on a provider's certification under the EU-US Data Privacy Framework where available;
- the transfer conditions set by Congolese law for data of residents of the DRC.
You may ask us for a copy of the relevant safeguards (commercial terms may be removed).
8. How long we keep your data
| Data | Retention |
|---|---|
| Investor verification (KYC) data | 5 years from the end of our relationship with the investor, or longer if the law requires |
| Agreements, signature evidence, payment records and tax records | 7 years from the end of our relationship with the investor, or longer if the law requires |
| Invitation requests not followed by an invitation (including requests from restricted countries) | Up to 2 years from the last activity |
| Account data of a person who never invested | Up to 2 years from the last activity |
| Security logs and audit logs | Up to 2 years from the last activity |
| Emails and WhatsApp messages sent to us | Up to 2 years from the last activity |
| All other personal data | Up to 2 years from the last activity |
When a retention period ends, we delete or anonymise the data, unless we need to keep it to establish, exercise or defend legal claims.
9. How we protect your data
- Encryption in transit and at rest, with a separate encryption key for the POP DRC brand.
- Separate user directory, data tables and document storage for POP DRC.
- Two-factor authentication with an authenticator app for every account. Notification of security changes with a "not me" option.
- Role-based access, with identity documents and bank details restricted to owner-level access.
- Audit log of actions, including actions by our own staff.
- Separate backups for the POP DRC brand.
No system is completely secure. If a personal data breach is likely to result in a risk to your rights, we will notify the competent authorities and, where required, you, within the time limits set by applicable law.
10. Your rights
Subject to the conditions of applicable law, you have the right to:
- be informed about how we use your data (this notice);
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- erase your data, where there is no longer a lawful reason to keep it;
- restrict our use of your data in certain cases;
- object to processing based on legitimate interests;
- data portability, in a structured, machine-readable format, where processing is based on consent or contract;
- withdraw consent at any time, where we rely on consent, without affecting earlier processing;
- not be subject to decisions based solely on automated processing;
- complain to a data protection authority.
If you are resident in the DRC, Congolese law gives you rights over your personal data, and you may complain to the competent Congolese authority. If you are in the EU or UK, you may complain to the supervisory authority in your country. We would appreciate the chance to address your concern first.
To exercise your rights, write to info@pop.global. We may need to confirm your identity. We will reply within the time required by applicable law.
Some data must be kept even if you ask us to delete it, for example records we are legally required to keep, or signed agreements while an investment is in place.
11. Is providing data mandatory?
Account data is needed to give you access to the Service. Investor verification data is needed before you can sign or pay. Without it, we cannot proceed with that step. Optional information is marked as optional.
12. Eligibility
The Service is not intended for persons under 18. We do not knowingly collect data of children.
13. Cookies
We use only strictly necessary cookies and browser storage. See the Cookie Notice (POPDRC-COOK-2026-10-v0.1).
14. Changes to this notice
Each version of this notice has its own document ID and effective date. If we make a material change, we will ask you to review and accept the new version once, the next time you sign in, and we will keep a record of which version you accepted and when. Minor changes (for example, fixing typing errors) will be shown with a new document ID without a new acceptance.
15. Language
This notice is published in French and in English. The English version prevails in case of any difference.