Version: 1.4
Effective date: October 19, 2026
Controller: Lafitech UG (Rampa)
Contact: hello@rampa.cash
Registered address: Arnulfstr. 171, 80634 Munich, Germany
Supervisory authority: Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach — see Section 14
Changes in v1.4 (October 2026): roles of each provider clarified (processors vs. independent controllers); RebelFi described as B2B infrastructure acting on our behalf; legal basis for biometric verification added; new sections on saved recipients and the referral program; international transfers, retention periods, automated decisions, your rights and the competent supervisory authority added; general 10-year retention removed.
1) Scope
This Privacy Policy explains how Lafitech UG processes personal data when you use:
• the Rampa mobile application for iOS and Android;
• rampa.cash, app.rampa.cash and related websites, including invitation pages;
• Rampa support and communications; and
• features and services made available through Rampa, including the referral program.
Rampa integrates services provided by third parties, such as identity verification, fiat on/off-ramps, wallet infrastructure and blockchain networks. Where a third party provides a service directly to you under its own terms, it processes your data as an independent controller under its own privacy policy (see Sections 6 and 7).
2) Rampa's role and non-custodial model
Rampa is a non-custodial technology platform operated by Lafitech UG. Lafitech UG does not:
• custody customer funds or hold crypto-assets on behalf of users;
• control or store users' private keys or seed phrases;
• sign blockchain transactions on behalf of users;
• operate customer fiat accounts; or
• provide regulated custody, payment or exchange services itself.
You control your own wallet and authorize every transaction yourself. Regulated services accessible through Rampa, such as fiat on/off-ramping and payouts, are provided by independent licensed providers under their own permissions and compliance obligations.
3) Personal data we process
We process only the data reasonably necessary to operate, secure and improve Rampa and to provide the features you choose.
3.1 Account and profile data
Name, email address, phone number, country or region, internal account identifiers, language and communication preferences, and any information you choose to add to your profile.
3.2 Device, network and app data
Device and app identifiers, push-notification tokens, IP address, approximate country or region derived from your network connection, operating system, device type, app version, language and locale, session information, security events, crash reports and performance data. We use approximate location for security, fraud prevention and geographic eligibility. We do not collect precise GPS location.
3.3 Wallet and blockchain data
Public wallet addresses, transaction hashes, amounts, token identifiers, network, transaction status, on-chain balances and the addresses involved in a transaction. Much of this information is publicly visible on the blockchain independently of Rampa.
3.4 Identity verification and compliance data
When identity verification is required, our verification provider Sumsub processes identity documents, facial images and liveness data (biometric data) on our behalf. Lafitech UG receives and stores only the result: verification status, verification reference, country, sanctions and PEP screening results, risk indicators and eligibility decisions. We do not store copies of your identity documents or biometric data in Rampa's own systems.
3.5 On/off-ramp and payout data
When you use an integrated provider, we receive order identifiers, the selected provider, amount and currency, status, blockchain references, source or destination wallet, country, timestamps and the information needed to display and support the transaction. Bank details, payment credentials and any additional identity data the provider requests are collected by that provider directly.
3.6 Earn data
If you use Earn, we process your wallet address, the instructions and hashes of your deposits and withdrawals, the USDC amounts you allocate, your position, and estimated or accrued returns reported by the infrastructure provider, so we can display and track your position. Figures shown in Rampa come from third-party infrastructure and may change.
3.7 Saved recipients
If you save people you send money to, we store the details you enter for them, such as name or nickname, wallet address and phone number, and your transfer history with them. We use this data only to let you send money and view your history. We do not contact your saved recipients.
3.8 Referral program
Every account has a personal referral code (for example, REF-QPKRASUG) and an invitation link containing it. If you joined with someone's code, we store which code was used when your account was created. We collect the code when you type, paste or scan it in the app, when you open an invitation link, or on Android through the Google Play Install Referrer when you install Rampa from an invitation link.
People who invite others see only aggregated numbers, such as how many people joined with their code and how many completed verification. They never see your name, contact details, balances or activity.
If you create an invitation image, any photo you choose stays on your device; we do not upload it. If other people appear in a photo you share, please make sure they agree.
3.9 Support and communications
Your contact details, the content of your messages, attachments you send us, technical information needed to resolve an issue, and our communications with you.
3.10 Device contacts and permissions
Rampa does not read your phone's address book for invitations or any other purpose unless a feature asks for your permission first and explains why. You can withdraw any device permission in your operating-system settings.
3.11 Product analytics
Screens and features used, session activity, the campaign or channel through which you arrived (for example UTM parameters), and technical events. Analytics data is linked to an internal pseudonymous identifier, not to your name or email address. We do not sell personal data or share it with advertisers.
4) Sources of personal data
We obtain personal data directly from you, automatically from your device and your use of Rampa, from public blockchain networks, from the providers you choose to use through Rampa (for example, verification results from Sumsub and order status from on/off-ramp providers), from Google Play (install referrer) and, where required, from authorities.
5) Purposes and legal bases
We process personal data only where the General Data Protection Regulation (GDPR) gives us a legal basis.
• Creating and running your account, showing your wallet, enabling transfers, saved recipients, Earn and integrated services you request, and support: contract — Art. 6(1)(b) GDPR.
• Identity verification, sanctions and PEP screening required to use regulated features: contract — Art. 6(1)(b); legitimate interest in meeting our providers' compliance requirements and preventing unlawful use — Art. 6(1)(f); legal obligation where it applies to us — Art. 6(1)(c).
• Biometric data (facial image and liveness check) used to confirm your identity: your explicit consent, given in the verification flow — Art. 9(2)(a) GDPR.
• Security, fraud and abuse prevention, geographic eligibility: legitimate interest in a safe service — Art. 6(1)(f); legal obligation where applicable — Art. 6(1)(c).
• Storing the details of recipients you save: contract with you — Art. 6(1)(b); for the recipients, our and your legitimate interest in enabling the transfers you request — Art. 6(1)(f).
• Referral program (recording the code used at sign-up and showing aggregated counts to the person who invited you): contract (program terms) — Art. 6(1)(b); legitimate interest in running and preventing abuse of the program — Art. 6(1)(f).
• Product analytics: legitimate interest in improving Rampa — Art. 6(1)(f). Where analytics stores or reads information on your device that is not strictly necessary, we ask for your consent first — § 25(1) TDDDG and Art. 6(1)(a).
• Service messages about your account and transactions: contract — Art. 6(1)(b).
• Optional marketing emails and messages: your consent — Art. 6(1)(a), or, for similar Rampa features, our legitimate interest under § 7(3) UWG — Art. 6(1)(f). You can opt out in every message.
• Establishing, exercising or defending legal claims; answering lawful requests from authorities: legitimate interest — Art. 6(1)(f); legal obligation — Art. 6(1)(c).
You can withdraw consent at any time with effect for the future. Withdrawing consent for biometric verification means we cannot complete your verification, so features that require it will not be available.
You need to provide the data marked as required in the app to open an account. Identity verification is required only for features where our providers need it. Without it, those features cannot be offered.
6) Who receives personal data
We share personal data only where necessary for the purposes above.
6.1 Service providers acting on our behalf (processors, Art. 28 GDPR)
These providers process data only on our instructions and under a data-processing agreement:
• Sumsub (Sum and Substance Ltd.) — identity verification, liveness check, sanctions and PEP screening.
• Para — embedded non-custodial wallet infrastructure and sign-in. Para never gives us access to your keys.
• RebelFi — B2B infrastructure that connects Earn to third-party lending protocols on Solana, such as Jupiter Lend. Processes your wallet address, amounts and position data.
• Klaviyo — email and app communications. Receives account data, including the referral code used at sign-up.
• Zoho (Zoho Mail EU) — email support.
• Expo — app updates and push-notification delivery.
• Cloud hosting and database providers — running our servers and databases.
6.2 Independent controllers
These recipients decide themselves how to process your data and apply their own privacy policies:
• Transak, Noah and Koywe — fiat on/off-ramps and payouts you choose to use. They carry out their own KYC, AML and transaction monitoring.
• Apple and Google — app distribution and, on Android, the Google Play Install Referrer used for invitations.
• Public blockchain networks and protocols (for example Solana and Jupiter) — when you authorize an on-chain transaction, its data is broadcast to the network and becomes public.
• Authorities, courts and advisers — where required by law or necessary to establish, exercise or defend legal claims.
7) Third-party services
When you use a third-party service through Rampa, you may enter into a separate relationship with that provider. Its terms, privacy policy, eligibility rules and retention periods then apply to the processing it carries out. Please review the information each provider shows you before using its service.
8) International data transfers
Some recipients process data outside the European Economic Area (EEA). We transfer data only with an appropriate safeguard:
United Kingdom (for example Sumsub): adequacy decision of the European Commission.
United States (for example Para, Klaviyo and Expo): the EU-U.S. Data Privacy Framework where the recipient is certified, otherwise the European Commission's Standard Contractual Clauses, with additional measures where needed.
Other countries: an adequacy decision or Standard Contractual Clauses.
Independent controllers, such as Koywe for Latin American payouts, explain their own transfers in their privacy policies. You can request a copy of the safeguards we use by writing to hello@rampa.cash.
9) Public blockchain information
Information written to a public blockchain may be publicly visible, replicated by many independent participants worldwide, and impossible for anyone, including Lafitech UG, to change or erase. We keep personal data linked to on-chain transactions to a minimum. Please do not include personal information in transaction memos or similar fields.
10) Retention
We keep personal data only as long as needed for the purposes in Section 5, then delete or anonymize it.
• Account and profile data: while your account is active. After you close it, until the end of the third year after closure where needed to handle claims (§§ 195, 199 BGB), unless a longer legal obligation applies.
• Records that form part of our accounting: 6 or 10 years, as required by § 257 HGB and § 147 AO.
• Verification result and screening status: while your account is active and afterwards for as long as the regulated providers that relied on the verification must keep records.
• Identity documents and biometric data (stored by Sumsub on our behalf): only as long as needed to complete the verification and meet the record-keeping obligations of the regulated providers that rely on it, then deleted.
• Transaction and Earn records shown in the app: while your account is active, then as for account data. On-chain data cannot be deleted (Section 9).
• Saved recipients: until you delete them or close your account.
• Referral link (which code you joined with): while both accounts exist. It is deleted when the invited account is closed, and aggregated counts then no longer include it.
• Product analytics: up to 24 months, then deleted.
• Operational and security logs: usually 30–90 days, longer only to investigate a specific incident.
• Support conversations: up to 3 years after the case is closed.
• Marketing preferences: until you opt out. We keep a record of the opt-out so we respect it.
Regulated providers acting as independent controllers, such as Transak, Noah and Koywe, apply their own retention periods under the laws that apply to them.
11) Automated decisions
Identity verification uses automated checks by Sumsub, such as document authenticity, face matching and sanctions screening. A verification can therefore be declined automatically, which means features requiring verification are not available to you. This is necessary to provide those features (Art. 22(2)(a) GDPR).
You can ask for a person to review the decision, explain your point of view and contest it by writing to hello@rampa.cash. We do not use profiling to make other decisions that have legal or similarly significant effects on you.
12) Security
We protect personal data with technical and organizational measures appropriate to the risk. These include encryption in transit, restricted and logged access to systems, and a non-custodial design in which we never hold your private keys. We review these measures regularly. If a personal-data breach is likely to put you at high risk, we will inform you as required by Art. 34 GDPR.
13) Your rights
Under the GDPR you have the right to:
• access your personal data and receive a copy (Art. 15);
• rectify inaccurate data (Art. 16);
• erase your data (Art. 17), subject to legal retention obligations;
• restrict processing (Art. 18);
• data portability for data you provided, in a common machine-readable format (Art. 20);
• withdraw consent at any time, with effect for the future (Art. 7(3)); and
• not be subject to a solely automated decision without the safeguards described in Section 11 (Art. 22).
>> Right to object (Art. 21 GDPR)
You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 6(1)(f)). We will then stop unless we have compelling legitimate grounds that override your interests, or the processing is needed for legal claims. You can object to direct marketing at any time without giving reasons, and we will stop using your data for that purpose.
To exercise your rights, write to hello@rampa.cash. We may ask you to confirm your identity. We answer within one month; for complex requests this can be extended by two further months, and we will tell you if so. You can close your account in the app or by writing to us.
14) Right to lodge a complaint
You can complain to a data-protection supervisory authority. The authority responsible for Lafitech UG is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the authority in the EU country where you live or work, for example the Spanish Data Protection Agency (AEPD) in Spain.
15) Minimum age
Rampa is intended only for people aged 18 or over. We do not knowingly process personal data of anyone under 18. If we learn that an account belongs to a minor, we will close it and delete the related data, unless we are legally required to keep it.
16) Changes to this Privacy Policy
We update this Privacy Policy when our services or the law change. The current version is always available on rampa.cash and in the app. We will inform you in the app or by email before material changes take effect.
17) Language and contact
This Privacy Policy is available in English and Spanish. If the versions differ, the English version prevails, unless mandatory law requires otherwise.
Questions about this Privacy Policy or your data: Lafitech UG (haftungsbeschränkt), Arnulfstr. 171, 80634 Munich, Germany — hello@rampa.cash.