Privacy policy

Valid from 01 August 2023

This Policy describes the rules by which Blocktrade processes Data subject’s personal data. Blocktrade receives the personal data when Data subject visits Blocktrade Platform or uses Blocktrade Services.

1. Definitions

1.1. In the Policy, the following definitions shall apply:

Agreement	terms of use governing the use of the Platform, their affiliates’ IT services and Services by the User and any ancillary documents to the terms and conditions (such as fee schedules and transaction information)
Blocktrade	means BlocktradeOperations OÜ, a company incorporated in Estonia under company number: 14901959 and registered as a virtual asset service provider with the Estonian Financial Intelligence Unit under the number FTV000299, whose registered office is at Maakri 19/21, 10145, Tallinn, Estonia as the operator of the Platform
Data Subject	means a natural person who is visiting Blocktrade website at https://blocktrade.com (Website) and/or who has registered as a User on the Platform
GDPR	regulation (EU) 2016/679 of the European Parliament and of the Council, 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Personal Data	means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Platform	means application, including but not limited to apps on the Website and any mobile devices application, which provides the access and use of Services for Users with registered accounts
Policy	this privacy policy
Services	any services which are provided by Blocktrade on the Platform
Terms	means the Terms of use and any of its annexes available at [https://blocktrade.com/terms-of-use/]
User	a natural person who has registered as a uUer of the Platform in accordance with the terms of use applicable in Platform

1.2. Unless otherwise indicated in clause 1.1 of this Policy, terms used in this Policy shall have the same meaning as under GDPR and any other applicable privacy law.

2. Controller of personal data

2.1. According to the GDPR, a controller is a person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2.2. Blocktrade is the data controller responsible for Data Subject’s Personal data

3. Personal data

Blocktrade may process different kinds of Personal data about Data subject which have grouped together as follows:

3.1. Submitted Personal data This is Personal Data Subject may give to Blocktrade by filling in forms on Platform and/or corresponding with Blocktrade by mail, phone, email or otherwise	Identity data	first name, maiden name, last name, title, date of birth, username, password, and other registration information and/or similar identifiers
	Contact data	address, e-mail address, phone number
	Financial data	Data Subject Crypto-Asset private wallet accounts, balance of Assets on (registered Blocktrade) account, origin of the assets which are being deposited on registered Blocktrade account, financial background of the total assets, which are being deposited on registered Blocktrade account including occupation and business activity of the actual contributor of the assets, and/or details of bank account including the bank account number, bank sort code, IBAN, details of Data Subject’s debit and credit cards including the long number, relevant expiry dates and CVC
	Identity verification information	images of government issued ID, passport, national ID card, or driving license, ID number, numbers that they may use or have registered with his/its local tax authority, or other data which can be used for personal identification purposes and that may be required to comply with legislation on prevention of money laundering, money laundering, terrorist financing, fraud, or any other financial crime
	Residence verification information	utility bill, proof of residence with relevant details
	Marketing and Communications Data	Data Subject preferences in receiving marketing material from Blocktrade, its third parties and Data Subject preferences in communication means
	Beneficial owners	When embarking upon a legal relationship with Blocktrade and/or concluding occasional transactions by using Blocktrade Services through legal entities and similar entities, Blocktrade is legally obligated to identify beneficial owners, whereas “beneficial owner” means a natural person on whose initiative or in whose interest a transaction or activity is carried out or a business relationship is ultimately constituted. In the case of such legal entities, the “beneficial owner” is also the natural person in whose possession or under whose control the legal entity ultimately is situated
3.2. Personal data collected by using automated technologies This is Personal data which is collected by using cookies, server logs and other similar technologies	Transaction data	Transaction date, time, amount, currencies used, exchange rate, beneficiary details, details and location of the counterparty associated with the transaction, IP address of sender and recipient, sender’s and recipient’s name and registration information, messages sent or received with the payment, device information used to facilitate the payment and the payment instrument used
	Trading data	date, time, amount, currencies used, exchange rate, beneficiary details, details of the counterparty associated with the individual transaction, IP address of sender and recipient, sender’s and recipient’s name and registration information, messages sent or received with the payment, device information used to facilitate the payment and the payment instrument used
	Profile Data	purchases or orders made by the Data Subject or on Data Subject company’s behalf, Data Subjects/companies’ interests, preferences, feedback and survey responses
	Usage Data	includes information about how Data Subject accesses and uses Platform and/or Services
	Technical Data	includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices used for access to Platform
3.3. Personal data obtained with authorized third parties or publicly available sources These sources are publicly available registers such as political party registers, international sanctions lists, company registers and other publicly accessible sources which provide reliable data about Data Subject, his/her family members and/or his/her close business associates	Data necessary for verification	Identity data of Data Subject, his/her family members (spouse, partner considered equivalent to a spouse under national law, children and their spouses or partners and parents) and/or close business associates that corresponds to identity information of persons which shall be recognized in public Political party registers, international sanctions lists, trade sanctions lists and other publicly accessible sources which provide reliable data for Blocktrade to perform due diligence of Data Subject in accordance with Anti-money laundering and counter terrorist financing regulation

4. Legal ground and the purposes of the personal data processing

4.1. Blocktrade has set out below, in a table format, a description of all the purposes Data Subject Personal data is processed and legal grounds for such processing. 4.2. Note that Blocktrade may process Data Subject Personal data for more than one lawful ground depending on the specific purpose for which Blocktrade is using Personal data. Data Subject is welcome to contact Blocktrade if he/she wish to receive more details.

Purpose of processing Personal data	Type/category of Personal data	Lawful basis
Identification and prevention of money laundering, organized crime and terrorist financing in accordance with applicable anti-money laundering legislation, ensure the fulfilment of international financial sanctions.	– General personal information (full name, address, ID number, etc.) – identity verification documents (Passport scan, proof of residence, etc.) – possible detailed financial information (if necessary) (source/origin of tradeable assets), personal data obtained by third parties or authorities (such as fraud prevention agencies) and/or publicly available sources (political parties registers, company registers, etc.) – Automated personal data such as Transaction data, Trading data, Profile data, Usage data and Technical data.	Obligation arising from law (GDPR Art. 6(1)-c))
To provide the Services, incl. to register an account and to carry out obligations arising from any transactions Data Subject enters into with Blocktrade, for example transfers, executions of buy and sell orders, execution of withdrawals and performing other Services on Platform and to provide information, products and Services requested by Data Subject	– Submitted Personal data such as general personal information, Contact data, Financial data, – Automated data such as Transaction data, Trading data, Profile data, Usage data and Technical data	To perform the Agreement (GDPR S.6 (1)-b))
To keep the Blocktrade Services up and running, incl. to administer Platform for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes; to notify Data Subject about changes to its Service and to keep the Platform safe and secure.	– Submitted Personal data such as general personal information, Contact data, Financial data, – Automated Personal data such as Transaction data, Trading data, Profile data, Usage data and Technical data	Blocktrade legitimate interest (GDPR Art. 6 (1)-f)) to ensure that content available in the Platform is presented in the most effective manner and to prevent possible abuses or fraud on Website, Platform or Services
To use data analytics to improve Website, Services, marketing, customer relationships and user-experiences	– Automated Personal data such as transaction data, Trading data, Profile data, Usage data and Technical data	Blocktrade legitimate interest (GDPR Art. 6 (1)-f)) to define types of customers for Blocktrade Services, to keep Platform updated and relevant, to develop Blocktrade business and to inform Blocktrade marketing strategy
To provide newsletters	– Submitted Personal data such as general personal information, Contact data,	Consent (GDPR Art. 6(1)-a))
To improve quality of Blocktrade Services and to make suggestions and recommendations to the User about Services or events that may be of interest to Use	– Submitted Personal data such as general contact data, – Automated Personal data such as Transaction data, Trading data, Profile data, Usage data, Technical data	Blocktrade legitimate interest (GDPR Art. 6 (1)-f)) to understand interests of Users and to provide them further development and improvement of Services

5. Marketing and Promotional offers

5.1. Blocktrade is striving to provide clear information of Personal data usage for marketing purposes and simple access to individual’s communication preferences management or opt-out from receiving any marketing communications from Blocktrade whenever Data Subject want.

5.2. Blocktrade provides clear choices to the Data Subject on his/her Personal data used for marketing and advertising purposes. Data Subject can always access personal communication preferences management page via e-mail ([email protected]) or support interface on the Platform.

5.3. Blocktrade may use Data Subject Personal data (such as Submitted Information and Automated Personal data) to form a view on what Data Subject may want or need, or what may be of interest to Data Subject. This is how Blocktrade decides which products, services and offers may be relevant for the Data Subject.

5.4. Data Subject will receive marketing communications from Blocktrade if Data Subject has signed up to and/or utilizes the Blocktrade Services and, in each case, User has not opted out of receiving marketing notifications.

6. Disclosure of personal data

6.1. Blocktrade may disclose Data Subject personal data to/for:

Other entities within the Blocktrade group of companies or any other entity that Blocktrade will buy-out or merge with;
Authorized third parties that provide services to Blocktrade, such as system hosting, management, and support; data analysis; facilitation of advertisements; data backup; and IT security and cloud storage services, payment intermediation services;
Relevant authorized third parties as part of a corporate transaction, such as a reorganization, merger, sale, joint venture, assignment, transfer, counsel or other disposition of all or any portion of Blocktrade’s business, assets, or stock;
Competent governmental and public authorities, in each case to comply with legal or regulatory obligations or requests;
Financial institutions, representative bodies (e.g. Unions, professional associations…), gov-erning bodies, or legal representative of the Company, in the context of a litigation;
Financial partners and institutions necessary for the performance of the Terms or operating the Platform, such as payment service providers, auditors, fraud detection providers, KYC service providers, customer service providers, operational service providers or any other rel-evant commercial partner;
Marketing, Advertisement and Commercial service providers for the performance of the Terms;
Public disclosure of anonymized statistical data;
Other authorized third parties as Blocktrade believe necessary or appropriate: (a) under consent of the Data Subject; (b) under applicable law or to comply with legal process; (c) to enforce terms and conditions applicable to Blocktrade Services; (d) to protect Blocktrade operations and Blocktrade affiliates; (e) to protect Blocktrade rights, privacy, safety, or property, and/or affiliates; and (f) to allow Blocktrade to pursue available remedies or limit damages that may sustain.

7. International transfers

7.1. Blocktrade will not transfer personal data outside the European Economic Area, unless it is necessary for the provision of Services. For example, Blocktrade cannot rule out the possibility that some of the service providers it uses may be located in countries where the European Commission has not assessed the level of data protection or considered it sufficient. Due to the lack of an adequate level of data protection, the security of personal data, including protection against any misuse, unauthorized access, disclosure, alteration or destruction, as guaranteed in the European Union, may not be guaranteed in these countries.

7.2. Blocktrade will ensure that appropriate safeguards are in place when the Personal Data of the Data Subject is transferred to countries outside the European Union or any jurisdiction subject to an adequacy decision by the European Commission (in accordance with article 45 of GDPR). For further details relating to the transfers described above and the adequate safeguards used with respect to such transfers, please contact Blocktrade at [email protected].

8. IT Security

8.1. Blocktrade shall implements and maintains appropriate technical and organisational security measures to protect Personal Data against a Personal Data Breach.

8.2. All information provide to Blocktrade is stored on its secure servers, encrypted at rest. Any payment transactions carried out by Blocktrade or its authorized third-party provider of payment processing services will be encrypted in transit. Where Blocktrade have given Data Subject (or where Data Subject has chosen) a password that enables an access to certain parts of Blocktrade Platform, Data Subject is responsible for keeping this password confidential. Data Subject may not share a password with anyone.

8.3. Unfortunately, the transmission of information via the internet and/or blockchain protocol is not completely secure. Although Blocktrade will do its best to protect Data Subject personal data, Blocktrade cannot guarantee the security of data transmitted to the Platform; any transmission is at Data Subject’s own risk. Once Blocktrade has received Data Subject information, Blocktrade will use strict procedures and security features to try to prevent unauthorized access, alteration or destruction of the data.

8.4. Certain Services include public reviews, social networking, chat room or forum features. Data Subject understands that by disclosing any personal data therein, such personal data will become public to the other Users. Thus, Blocktrade recommends not to provide any personal information therein.

9. Retaining Personal Data

9.1. Blocktrade will not retain personal data for longer than is necessary for the purpose of processing the personal data or under applicable law. Data retention periods may vary depending on the category of the personal data.

9.2. Data Subject understands and agrees that uninstalling the App from the smart device will not automatically delete their account and the personal data contained therein. In order to delete a User account, the Data Subject must make a corresponding request to Blocktrade via Platform.

10. Rights of Data Subject

10.1. Upon processing of their personal data, the Data Subject has all the rights arising from the legislation applicable to the Data Subject, including the following rights:

The right of access: Data Subject has the right at any time to ask whether or not Blocktrade is storing personal data about them and to receive information about what personal data Blocktrade processes about the Data Subject.
The right to have personal data rectified: Data Subject the right request Blocktrade to clarify or correct their personal data if it is insufficient, incomplete or incorrect.
The right to request the deletion of personal data:  Data Subject has the right to request deletion of personal data where there is no good reason for Blocktrade continuing to process it. Data Subject also has the right to ask deletion of personal data where Data Subject has successfully exercised his/her right to object to processing (see below), where Blocktrade may have processed information unlawfully or where Blocktrade is required to erase personal data to comply with local law.
The right to object: Data Subject has the right to object to the processing of their personal data by Blocktrade, for example if the use of the personal data is based on Blocktrade’s legitimate interest.
The right to restrict processing: Data Subject has the right to request that Blocktrade restricts the processing of their personal data under applicable law, for example if Blocktrade no longer needs the Data Subject’s personal data for processing purposes or if the Data Subject has objected to the processing of personal data.
The right to data portability: Data Subject shall have the right to obtain from Blocktrade personal data provided by himself/herself to Blocktrade and processed with the consent of the Data Subject or for the performance of an Agreement signed with the Data Subject in writing or in a publicly available electronic format and, if technically possible, to require Blocktrade to transfer such data to a third party.
The right to withdraw the consent given for the processing of personal data: If the processing of personal data is based on the consent given by the Data Subject, the Data Subject has the right to withdraw the consent given to Blocktrade at any time. However, this will not affect the lawfulness of any processing carried out before the withdrawal of consent.
The right to file a complaint: To file a complaint with the Data Protection relevant Authority or a court in case of violation of the rights.

10.2. Data Subject’s rights regarding the processing of personal data listed in this Section are not absolute. In certain cases, the rights of other data Subjects or Blocktrade’s legal obligations may limit the Data Subject’s rights.

10.3. In order to exercise the rights associated with the processing of personal data or to submit applications, the Data Subject must contact Blocktrade (contact details can be found under section “Contact”).

11. Policy review

11.1. Blocktrade reserves the right to unilaterally supplement and/or amend this Policy, from time to time. When updating this Policy, Blocktrade will notify the Data Subject of the new Policy via email or the Platform. If the new Policy refers to the processing of the Data Subject’s personal data for a new purpose that requires the Data Subject’s consent, Blocktrade will not process the Data Subject’s personal data for such new purpose until Blocktrade has obtained the Data Subject’s consent to such processing.

11.2. Blocktrade engages into make everything possible to inform the User in due time so that he/she can either consent or close the account before the terms of this Privacy Policy changes.

12. Contact

12.1. If Data Subject has any questions about this Policy, including any data subjects requests to exercise data protection related rights, please contact DPO via his direct e-mail address [email protected].

12.2. The Data Subject also has the right to apply to the CNPD (Commission Nationale pour la Protection des Données) to resolve a complaint.

14. Miscellaneous

14.1. No fee usually required. Data Subject request for access (or to exercise any of the other rights) is not subject to a fee, unless the request is clearly unfounded, repetitive or excessive. Alternatively, Blocktrade may refuse to comply with Data Subject request in these circumstances.

14.2. Time limit to respond. Blocktrade tries to respond to all legitimate requests within one month. Occasionally it may take up to two more months if Data Subject request is particularly complex or Data Subject has made numerous requests. In this case, Blocktrade will notify Data Subject about the expected time of reply.

14.3. Provision of personal data is a precondition for receiving the Services. Disclosure of personal data to Blocktrade is voluntary. However, Blocktrade may not be able to provide Services to the Data Subject if the Data Subject refuses to provide personal data. For example, Blocktrade cannot provide Services to the Data Subject, if Data Subject fails to provide data and documentations necessary for identity verification.