Privacy Policy

Last updated: October 2026

This Privacy Policy explains how Easyco collects, uses, shares and protects personal data when you visit https://www.itseasyco.com (the “Website“), contact us, or use our services. It should be read together with our Terms and Conditions. Capitalised terms not defined here (such as “Client”, “Entity”, “Representative” and “Services”) have the meaning given in the Terms and Conditions.

Easyco processes personal data under applicable data protection laws, including Peru’s Law 29733 where it applies.

1. Who Is Responsible for Your Data

The controller (responsable del tratamiento) is the Easyco group entity identified as the contracting entity in the proposal, order or invoice issued to you or to the Client you are connected with (the “Contracting Entity“). In this Privacy Policy, “Easyco“, “we” and “us” mean the Easyco brand and the Contracting Entity. For Website visitors and enquiries received before any proposal is issued, the controller is the Easyco group entity that operates the Website. Full controller details, including the controller’s name, registration details and address, are available on request at hello@itseasyco.com.

• Contact for privacy matters and data-subject requests: hello@itseasyco.com
• Data Protection Officer: Not designated. For any privacy matter contact hello@itseasyco.com.

Where another Easyco group entity provides all or part of a Service, including in another country, that entity may also act as a controller for the data it processes for that Service. It applies this Privacy Policy as well as any additional local requirements.

2. Scope

This Privacy Policy applies to visitors of the Website, prospective and current Clients, and the individuals whose data we receive in connection with the Services: shareholders, directors, managers, beneficial owners, authorized signatories, attorneys-in-fact, employees and contractors (including Outsourced Personnel under PEO/EOR services), and contact persons. It does not apply to third-party websites, which have their own privacy policies.

3. Personal Data We Collect

3.1 Identification and contact data: name, nationality, date of birth, identity document or passport details and copies, tax ID, address, email, telephone, signature, and photographs contained in identity documents.

3.2 KYC and AML/CFT data: proof of address, beneficial ownership and the ownership structure, source of funds and wealth, professional and business information, politically exposed person (PEP) status, results of sanctions, watch-list and adverse-media screening, and, where required, judicial or criminal records. Where an identity-verification provider uses facial comparison or similar checks, we also process biometric data from that verification, as described in Section 3.8.

3.3 Corporate and service data: information about the Entity, its bylaws, books, resolutions, powers of attorney, filings and registrations, and the details of the Services you request.

3.4 Financial, banking and tax data: bank account details, transaction information we receive in coordinating bank services, tax filings, accounting records, invoices, payment history and amounts owed.

3.5 Employment data (PEO/EOR, payroll, recruiting, immigration): CVs, employment history, salary, social security and tax data, bank details for payroll, immigration status, and, where the law requires, health data (for example, occupational health exams) and data about dependants.

3.6 Communications: the content of emails, calls, messages, forms and attachments you send us.

3.7 Website and device data: IP address, browser type, internet service provider, pages visited, referring and exit pages, date and time, clicks, and cookie identifiers. See Section 11 (Cookies).

3.8 Sensitive data. Some of the data above may be sensitive personal data under applicable law, such as health data, biometric data or criminal records. We process sensitive data only where it is necessary for the Services or required by law, and, where required, with your express written consent.

3.9 Data you provide about others. If you give us personal data about other individuals (for example shareholders, directors, beneficial owners or employees), you confirm that you have informed them about this Privacy Policy and, where required, obtained their consent.

4. Sources of Data

We collect data directly from you and from your Entity. We also receive data from Representatives, Financial Institutions, Authorities, public registries and other public sources, identity verification and screening providers, referral partners, and the providers who help us run the Website.

5. Purposes and Legal Bases

Providing the data marked as required in our forms is necessary to provide the Services. If you do not provide it, we may be unable to provide the Services. Withdrawing consent does not affect processing that relies on another legal basis, such as a contract or a legal obligation. Nor does it affect the lawfulness of processing carried out before withdrawal.

We do not make decisions that produce legal effects about you based solely on automated processing. Our compliance team may use automated screening tools, but a person reviews the results.

6. Who We Share Data With

We do not sell personal data. We share personal data only as needed for the purposes in Section 5:

• Financial Institutions (banks, financial institutions and payment providers), to open and maintain accounts, perform their own KYC, and carry out the instructions given to them.
• Authorities: public registries, tax authorities, financial intelligence units, courts, regulators, notaries, immigration and labour authorities, and their equivalents in each country where we provide Services.
• Local Representatives: representatives designated by Easyco, whether its personnel, affiliates or third-party service providers, who act for the Client or the Entity.
• Other Easyco group entities and affiliates in the countries where we operate.
• Service providers acting on our behalf: cloud hosting, CRM and email, e-signature, identity verification and screening, accounting and payroll software, payment processors, and IT and security providers. They are bound by confidentiality and data-protection obligations.
• Professional advisers: local law firms, accountants, auditors and insurers.
• Credit bureaus and collection agencies, for overdue debts, as described in Section 5 and in Section 11.9 of the Terms and Conditions.
• Parties to a corporate transaction, as described in Section 5.
• Others, with your consent or where the law requires.

Recipients that are not processors for Easyco, such as banks and Authorities, process data under their own responsibility and privacy policies.

7. International Transfers

Easyco provides Services in several countries and uses service providers that may store data outside the country where you are located, for example in the United States or the European Union. Your data will therefore be transferred to the countries where the Services are performed and to the countries where our providers operate. These countries may not offer a level of protection equivalent to the country where the data was collected.

We make these international transfers in accordance with applicable data protection laws. A transfer takes place where the recipient country offers an adequate level of protection, or where the recipient undertakes by contract to protect the data to that standard. It also takes place where an exception applies, in particular where the transfer is necessary to perform the contract with you or to take pre-contractual steps you requested (for example, forming an Entity or opening an account abroad), where it is required by law, or where you have consented. For data subject to the GDPR, we use the safeguards that law requires, such as the Standard Contractual Clauses.

8. Security

We apply technical, organisational and legal security measures appropriate to the risk. These include access restricted to the people who need the data to perform the Services, encrypted cloud storage, secure physical custody of original documents, and confidentiality obligations for staff, Representatives and providers. No system is completely secure. If a security incident occurs that requires notification under applicable law, we will notify the competent data protection authority and, where applicable, the affected individuals, as soon as required by that law.

9. How Long We Keep Data

We keep personal data only as long as necessary for the purposes for which it was collected, and for the periods the law requires or allows. As a guide, our main retention periods are:

Original documents and books belonging to the Client or the Entity are returned in accordance with the Terms and Conditions. When the retention period ends, data is deleted or anonymised. During the retention period, data that is no longer used for Services is blocked and kept only to meet legal obligations or to defend claims.

10. Your Rights

Under applicable data protection laws, you have the right to:

• Information: know the purposes, recipients and other details of the processing of your data;
• Access: obtain your personal data and information about how it is processed;
• Portability: receive your data in a structured, commonly used and machine-readable format, and ask that it be sent to another controller where technically feasible. This applies where the processing is based on consent or a contract, or is automated;
• Rectification: correct inaccurate, incomplete or outdated data;
• Cancellation / erasure: have your data deleted when it is no longer necessary, or when the processing is unlawful, subject to the legal retention duties in Section 9;
• Opposition / objection: object to processing, including for marketing, where there is a legitimate and well-founded reason;
• Objective processing: not be subject to decisions based solely on automated processing that significantly affect you; and
• Revocation of consent at any time, where processing is based on consent.

How to exercise them. Send a request to hello@itseasyco.com with: your full name; a copy of your identity document, or that of your legal representative together with proof of their authority; a description of the right you want to exercise and the data concerned; and an address or email for our reply. Exercising these rights is free of charge.

Response times. We respond within the periods set by the applicable law.

Limits. Some requests may be limited by law. For example, we cannot delete data we must keep under AML or tax rules. AML/CFT laws may also prevent us from disclosing certain information, such as whether a report has been made to the authorities.

Complaints. If you are not satisfied with our response, or we do not respond in time, you may file a complaint with the competent data protection authority in your jurisdiction.

10.1 Additional Rights in Other Jurisdictions

• EU/EEA and UK (GDPR / UK GDPR): to the extent these laws apply, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw consent, and the right to complain to your local data protection supervisory authority. Our legal bases are listed in Section 5.
• California (CCPA/CPRA) and similar US state laws: to the extent these laws apply, you have the right to know which categories and specific pieces of personal information we collect, use and disclose; the right to delete and to correct it; the right to opt out of the “sale” or “sharing” of personal information; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights. Easyco does not sell personal information. To the extent our use of analytics cookies counts as “sharing” under these laws, you may opt out by blocking cookies in your browser settings, by using the Google Analytics opt-out add-on, or by emailing hello@itseasyco.com.

Rights requests from any jurisdiction can be sent to hello@itseasyco.com. We will respond within the period the applicable law requires.

11. Cookies

The Website uses cookies and similar technologies:

• Essential cookies, needed for the Website and its forms to work and to keep them secure, including cookies set by our contact and application forms (Contact Form 7, Zoho Forms and related Zoho tools).
• Analytics cookies, set by Google Analytics (through Google Site Kit) to understand, in aggregate, how visitors use the Website so we can improve it. We use these on the basis of our legitimate interest in running and improving the Website.

Cookies set by third-party providers are governed by those providers’ own privacy policies, including Google’s and Zoho’s. You can block or delete cookies at any time through your browser settings, and you can opt out of Google Analytics with the Google Analytics opt-out add-on. Blocking essential cookies may stop parts of the Website, such as our forms, from working. By continuing to use the Website, you acknowledge this use of cookies.

12. Marketing

We send marketing communications only where you have consented or where the law otherwise permits. You can unsubscribe at any time through the link in each email or by writing to hello@itseasyco.com. Unsubscribing does not stop the service communications we need to send you.

13. Children

Our Services and the Website are intended for adults. We do not knowingly collect personal data from minors, except where a minor’s data is required in connection with a Service, such as the dependants of a client or employee for immigration or payroll. In that case we process it with the consent of the parent or guardian, as applicable law requires. If you believe a minor has provided us with personal data, contact hello@itseasyco.com and we will delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Website with its new “Last updated” date. Where a change is significant, we will notify Clients by email. Where a change requires new consent, we will ask for it.

15. Contact

Easyco · hello@itseasyco.com (full controller details on request) · Terms and Conditions