GECAN™
Create account

OPERATIVE NOTICE · PENNWORTH HOLDINGS

Privacy Notice

Operative and in force, and subject to final settlement by qualified counsel. Formal designations (DPO, DPIA) are completed before general availability — that work is not finished, and this page says so rather than implying otherwise.

What we collect, when, and why

GECAN practices progressive disclosure: at signup we collect only your email. Each further datum is requested at the moment it unlocks something for you, with the reason shown on the request itself — identity documents only when you move to transact, settlement preferences only at your first live deal.

Scanning a code collects nothing about you at all. GECAN records which code was scanned and when, so a business can tell which card or standee is working. There is no field for an IP address, a device fingerprint or a user agent — not left empty, but absent from the table, because a column that exists eventually gets filled.

Your rights & our commitments

  1. Consent ledger. Every consent you grant or withdraw is recorded immutably with the document version — you can always see what you agreed to and when.
  2. Access & portability. Your data is keyed to your membership and exportable on request.
  3. Erasure. Account deletion cascades through your profile, onboarding, and consents; transaction evidence that must be retained is pseudonymized.
  4. Tiered protection. Sensitive data is isolated behind row-level security; identity documents are never visible to other members; deal-room identities stay masked until you accept disclosure terms.
  5. No data sales. We do not sell member data. Integrations receive event notifications you can audit, never raw data access.
  6. Jurisdictions. Built to GDPR / Singapore PDPA / Philippine DPA standards.