GDPR & Data Protection Policy

This GDPR Policy details how HYNOGO LLC ("HynoGo", "we", "us", "our") complies with the General Data Protection Regulation (EU) 2016/679 ("EU GDPR") and the UK General Data Protection Regulation as retained in UK law ("UK GDPR").

HynoGo provides corporate formation, tax registration filing, telecommunications, and documentation consultancy services to founders across the European Economic Area (EEA), the United Kingdom, and worldwide. We process personal data strictly in accordance with foundational principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

HYNOGO LLC acts as the Data Controller for personal data gathered via our website (hynogo.com) and client portal (corp.hynogo.com).

We collect and process the following categories of personal data:

• Identification & Demographic Data: Legal full name, date of birth, nationality, country of residence, government ID numbers, passport copies, and proof of residential address.
• Biometric Liveness Tokens: Real-time facial scan geometry tokens captured during automated identity verification via Didit to detect presentation spoofing and verify authentic identity match against official photo IDs.
• Corporate & Beneficial Ownership Details: Proposed company names, shareholding percentages, officer details, and Ultimate Beneficial Owner (UBO) filings.
• Contact & Telecommunications Records: Email addresses, telephone numbers, WhatsApp contact numbers, and HynoConnect call/SMS routing logs.
• Payment Information: Transaction IDs and payment timestamps processed securely via PCI-DSS compliant payment gateways (e.g., Stripe); no raw credit card numbers are stored on our servers.
• Technical Data: IP addresses, browser specifications, secure session tokens, and analytics logs.

We process personal data under recognized lawful grounds pursuant to GDPR Article 6:

• Performance of a Contract (Article 6(1)(b)): Processing is necessary to prepare, submit, and fulfill your company formation order, obtain your EIN/tax certificates, and provision your HynoConnect virtual phone line.
• Compliance with Legal Obligations (Article 6(1)(c)): Processing is required to satisfy statutory AML/KYC regulations, beneficial ownership reporting (US Corporate Transparency Act, UK Companies Act 2006, and UK Money Laundering Regulations 2017), and tax accounting rules.
• Substantial Public Interest (Article 9(2)(g)): Processing of biometric liveness verification tokens is strictly limited to preventing identity theft, fraud, money laundering, and terrorist financing in accordance with statutory compliance frameworks.
• Legitimate Interests (Article 6(1)(f)): Protecting platform cybersecurity, preventing fraudulent transactions, and enhancing service performance.
• Explicit Consent (Article 6(1)(a)): Non-essential analytics and marketing communications, which can be withdrawn at any time.

HynoGo engages authorized third-party sub-processors under written Data Processing Agreements (DPAs) that enforce strict confidentiality and security standards equivalent to GDPR requirements:

• Identity Verification & Biometric Due Diligence (Didit): We partner with Didit (didit.me) to perform automated government document authentication, 3D facial biometric liveness checks, and real-time global sanctions/PEP screening. Didit processes data as an authorized sub-processor, maintains TLS 1.3/AES-256 encryption, and does not sell or retain personal information beyond statutory compliance requirements.
• Payment Processing: Stripe (Level 1 PCI-DSS certified gateway) for secure card billing.
• Cloud Hosting & Infrastructure: Secure tier-4 enterprise cloud servers utilizing AES-256 encryption at rest.

EEA and UK data subjects enjoy specific statutory rights regarding their personal data:

• Right to Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal details.
• Right to Erasure (Art. 17): Request deletion of your personal data where retention is no longer necessary, subject to statutory AML and corporate recordkeeping mandates.
• Right to Restrict Processing (Art. 18): Limit the scope of data processing under certain conditions.
• Right to Data Portability (Art. 20): Obtain your personal records in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing grounded in legitimate interests.

To exercise any right, submit your written request to: [email protected]. We respond without undue delay and within 30 days.

As HynoGo is headquartered in Montana, United States, information collected from EEA and UK residents is transferred to and stored on secure servers located in the US. To ensure adequate data protection, transfers are governed by:

• Standard Contractual Clauses (SCCs) adopted by the European Commission.
• The UK International Data Transfer Agreement (IDTA).
• Stringent technical encryption protocols ensuring confidentiality during cross-border transit.

• Corporate formation and registered agent records: 7 years following entity dissolution (to satisfy statutory corporate and tax audit statutes).
• KYC documents, Didit verification records, and AML screening logs: 5 years from relationship termination, in compliance with federal and international AML regulations.
• Customer support correspondence: 3 years.

If you have concerns about our data handling, please contact [email protected]. You also hold the right to lodge a complaint with your local data protection supervisory authority:

• UK Residents: Information Commissioner's Office (ICO) — ico.org.uk
• EU Residents: Your national data protection authority (e.g., CNIL, BfDI, DPC).

Last updated: September 2026