1. Introduction

This document (hereinafter – PP) constitutes a policy in regard to the gathering, storing, processing and transferring of user/client personal data for the purposes of proper and full provision of our Services to them.

It is an integral part of the Terms and conditions of Key Funding product (PaaS) of Cryptology Key OÜ (hereinafter – T&C). All terms used in the T&C have the same meaning in this PP.

Here are the core provisions of this document related to the issues at hands, and how we address them:

• we do understand all of the processes related to the personal data we ask you to provide explicitly, and those that we collect about you through the operation of our services;
• we store personal data only for the limited amount of time, in no case longer than we need to keep it, or up to the moment when cease of storage is required by law;
• we ensure that you control what information on our website is shared publicly, or kept private, indexed by search engines, and permanently deleted;
• we construct our activities in a such manner, which ensures full transparency of all of our processes related to your personal data.

We have a person whose role puts him/her in charge of the privacy matters – data privacy officer (DPO), whom you can reach in order to ask any question in regard to your personal data, or other related matters via this email dpo@cryptology.company.

2. Our role and activities related to the personal data

We are the data controller in relation to your personal data for the purposes of this PP.

This PP applies to the data which we collect from you when you are using either (a) our website, or (b) any of our services available on or through our website. For the purposes of convenience, we will cumulatively refer to (a) and (b) as Services.

We deem personal data as an information which can directly, or indirectly via publicly available open-source intelligence instruments, refer to you as a natural person, and we shall protect such according to the standards envisaged by the applicable law.

This PP shall, to the extent possible with such written instrument, explain to you all of our processes related to your personal data (collection, use, storage, share/transfer) with the choices that you have with respect to such information.

We, of course, understand that you can have additional question in regard to the aforementioned, and we encourage you to contact us in case of need.

We can gather your personal data directly from you, or our partners, through bargains (agreements), or other legal arrangements you have with us or our partners on behalf of us, in order to fulfill the obligations provisioned by such bargains.

Your permission and consent can be collected by us directly, or we may receive your personal data from third parties to whom you have given explicit consent to pass this information to us.

3. Data we collect about you

If you visit our website, we may automatically collect information about you, such as (a) technical information, (b) IP addresses, (c) information about the type of device you have used to connect to our website, or (d) how you interact with our website, but not only (for more information refer to our CP).

Types of personal data we collect from you are:

• residency country;
• email;
• first name and last name (not mandatory, to your discretion);
• phone number;
• residence address (at some point of our cooperation).

Purposes of the collection are, but not limited to:

• verification of the user;
• prevention of fraudulent use and resale of user’s accounts;
• tax implications and VAT purposes;
• prevention of usage in countries other than the intended market;
• contact or communication with you;
• provision of marketing and promotional materials;
• billing/invoice issuance;
• prevention of fraudulent use and resale of accounts;
• customer support.

4. Reasons to collect personal data

We collect information for some or all of the following reasons:

(i) to provide you the Services – after you have ordered and purchased them through our website;

(ii) to provide you information on our existing Services within the reasonable amount of time after you concluded bargain with us;

(iii) to provide you additional information about Services you have purchased from us, or related products or services of our partners/affiliates;

(iv) to fulfill our obligations on provision of services to you in accordance with our bargain;

(v) for legal reasons (e.g., conclusion of the bargain with us);

(vi) to provide information to you about our future Services – if you have explicitly consented to receive it.

5. Legal grounds of our activities in regard to your personal data

The legal grounds to collect personal data from you are as follows:

(a) a legal reason to collect the information – envisaged by the applicable law or our bargain;

(b) your explicit unambiguous consent to do so for a specific purpose (e.g., Services provision or newsletters).

The legal grounds to process your personal data are as follows:

(a) we have a duly concluded bargain with you (constructive or else);

(b) you have explicitly given us permission to do so;

(c) we must provide services to you because you have ordered and purchased them;

(d) you have explicitly asked us to do so;

(e) to comply with the applicable law.

6. Methods of giving your personal data to us

You may give us information about you with your consent by either:

(a) filling in a form or e-mailing us;

(b) completing an order on our website;

(c) posting reviews and feedbacks on our website (if applicable);

(d) contacting us through the designated messengers (if such option is provided to you).

Such information may be personal, financial, educational, or related to your order.

You may give us information for legal reasons, such as to enter into a bargain with us – when you are purchasing our Services.

7. Information we receive from other sources

We may receive information about you if you use any other website we operate, any other services we provide, or from our business partners/affiliates, entitled to collect information on our behalf.

We also work with third parties (e.g., business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies, background checking agencies) and may receive information about you from them as part of the service we provide you, or for other legal reasons.

We may collect and store files you upload, download, or access with our website (e.g., homework assignments). Please do not share with us the files you are not permitted to use. Please do not upload or share with us the files that contain your personal data, or personal data of third parties without respective permission – we may not guarantee that such personal information will be secured.

8. Share of personal data collected

We may share your personal data with third parties, either because you have consented to allow us to do so or for other legal reasons. For example, we may share your personal information with:

(a) our marketing people in order to provide you with promotional materials after you have registered at our website;

(b) our group companies, which means our subsidiaries, or our ultimate holding company and its subsidiaries;

(c) subcontractors and third parties for the purpose of fulfilment of our respective agreements, which we hold with them or that we hold with you;

(d) with third parties because you have given consent.

There are other reasons for share of your personal data with the third parties, namely:

• if all of our substantial assets will be sold to the third party (statutory merger), where personal data held by us about the customers is one of the transferred assets;
• if we are required to comply with our legal obligations (in certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements);
• if it is requested by a governing body in scope of its authority on legally sound uncontested basis
• to enforce or apply our T&C, or other legally binding bargains;
• to protect our rights, property, or safety of our customers or other persons;
• if purpose of sharing is prevention of fraud or reduction of our credit risk.

9. Aggregated data

We may, from time to time, provide third parties with the data aggregated.

This means that your personal data, which may identify you a certain natural person, has been removed from the aggregated one.

Data provided to third parties in such case does not constitute personal data, but a statistic only, or similar.

But, nevertheless, you have the right to object in regard to such transfer.

10. Territory of storage and processing of personal data

We primarily store and process your personal data in the EU/European Economic Area (EEA).

If you are from the EU (meaning, resident), by accepting this PP, you give us the right to store your personal data in the EEA. We assure you that all your data is encrypted in a secure way and no unauthorized persons may access them.

For the EU Citizens, please note, that there are reasons due to which your data may be processed outside the EEA, such as (but not limited) to (a) order fulfillment, (b) payment processing, (c) technical support services, (d) client care management.

If your personal data cannot be processed within the territory EEA, we shall (a) comply with all data protection principles, (b) where possible, choose a country that is on the list of the EU Commissions’ countries that provide adequate protection for the rights and freedoms of data subjects, and (c) make sure we have assessed the adequacy of protections in all other cases.

11. Access to personal data

Where we have provided you (or where you have chosen) a password that grants you access to certain parts of our website, namely your account – you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

12. Transmission and storage of your personal data

Considering that transmission of information via the internet is not completely secure, we cannot guarantee the security of your data as it is transmitted and stored.

We shall use best practice to ensure your data is encrypted to the standard required in the GDPR to protect your personal data.

13. Timeframe of personal data storage

We will not store your Personal Data for longer than (a) required by the applicable law, (b) a valid reason for kipping it exhausts, or (c) until you request us to stop using and delete it.

We may keep just enough of your Personal Data to ensure that we comply with your requests not to use your personal information or comply with your right to erasure (meaning, that we must keep your request to be erased even if it includes your personal data until such time as you are no longer our customer, or for tax purposes, etc.).

14. Refusal to provide personal data

In case if you choose not to provide your personal data to us, we shall refuse to provide our Services to you because lack of your personal data will constitute inability to enter into legally binding bargain with you under the applicable law.

15. Your rights in regard to personal data

Due to the provisions of the applicable law and the nature of the privacy rights you possess in regard to your personal data, you have certain rights in regard to such subject matter, and our efforts to uphold them, as follows:

• the right to be informed – we are publishing this PP to keep you informed as to what we do with your personal information, and our DPO is opened to your questions in regard to the handling of your personal data;
• the right to access personal data – you have the right to access your information via contacting our DPO on such;
• the right to rectification of the personal data – if the information we hold about you is inaccurate or incomplete, you have the right to ask us to rectify it via contacting our DPO;
• the right to erasure of the personal data – this is sometimes called ‘the right to be forgotten’, meaning that if you want us to erase all your personal data and we do not have any legal reason to continue to process and hold it, you can do that via contacting our DPO on such;
• the right to restrict processing of the personal data – you have the right to ask us to restrict how we process your data, meaning that we are permitted to store the data but not further process it, you can do that via contacting our DPO on such;
• the right to object – you have the right to object to us processing your data even if it is based on our legitimate interests, such as the exercise of official authority, direct marketing (including data aggregation), and processing for purposeless statistics, and you can do that via contacting our DPO on such;
• the right to withdraw consent – if you have given us your consent to process your data but have changed your mind later, you have the right to withdraw your consent at any time, you can do that via contacting our DPO on such;
• the right to complain to the governing body in sphere of privacy – you have the right to complain to the relevant governing body in sphere of DP in your respective country if you feel that we have not responded to your requests to solve a problem.

16. Links to the third-party websites

From time to time, our website may contain links to and from websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites may have their own rules/policies in regard to handling the matters of personal data, and that we do not accept any responsibility/liability for any such.

Please, make sure to get familiar with such rules/policies, where available, before you submit any personal data to these websites.

17. Age limitations

To the extent prohibited by applicable law, we do not allow the use of our Services and websites by anyone younger than the age of full legal capacity (which is, in case of the most jurisdictions, 18 years). If you learn that anyone younger than such age has unlawfully provided us with personal data, please contact us and we will take steps to delete such information.

18. Changes to this PP

We may change this PP from time to time due to the necessity to keep up with the updates in applicable law and industry standards, or due to the changes to our business.

We will post the changes to this page and encourage you to review them to stay informed. If we make changes that materially alter your privacy rights, we will provide additional notice, such as via email or through the website. If you disagree with the changes to this PP, you should cease usage of our website, delete your account, or take any other step necessary to alienate yourself to us.

19. Applicable law

The laws that govern personal data in EU is REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing General Data Protection Regulation (GDPR).

20. Our contact details

You may get in touch with us via several methods:

(a) send us an email to the following address dpo@cryptology.company with the subject matter of your concern (any of the aforementioned or else);

(b) contact your manager via a relevant messaging system (WhatsApp, Signal, Telegram) with the relevant request;

and we shall return to you promptly.

Cryptology Key OÜ

Register number: 17062904,

VAT number EE102796018,

Registered office: Tornimäe tn 7-36,

Kesklinna linnaosa, Tallinn, 10145, Estonia

‍