Privacy Policy for the Websites of Etherisc Gmbh
Total Page:16
File Type:pdf, Size:1020Kb
Privacy Policy for the websites of Etherisc GmbH Data protection With this privacy policy we would like to inform you about how we process personal data. We are aware of the importance of the processing of personal data for the user and, accordingly, comply with all relevant legal requirements. The protection of your privacy is of utmost importance to us. That is why it is a matter of course for us to comply with the legal provisions on data protection. 1. Collection, processing and use of personal information 1.1 Personal data Personal data is all information about personal and factual circumstances of a particular or identifiable person. For web page visitors it includes web analytics data, which is collected by the use of Cookies: - Cookie IDs - IP address - Country - operating system - when and which pages were opened - how long a user stayed on pages - browser version - browser language For newsletter subscription it includes: - name and - email address When we registered users for the Token Generating event, it includes: - first name - last name - Email - contact information - identity documents information which is used for Know your Customer procedure (KYC) - occupation, industry, annual income, origin of money, trading volume are used for Know your Customer procedure for certified investors. For request or proposal of the product idea: - Email 1.2 Legal basis The processing of your data is done on the following legal bases: - With regard to data that you specify in forms etc., with your consent, Art. 6 para. 1 lit. a) GDPR - in relation to the services you use, to carry out a contract with you (in particular, Token Generating event), Art. 6 (1) lit. b) GDPR - moreover, in particular for statistical data and online identifiers, on the basis of legitimate interests, Art. 6 (1) lit. f) GDPR (see below). Legitimate interests As a company, we often have to process personal data in order to carry out tasks within the scope of our business activities. The processing of personal data in this context is not necessarily a legal obligation or a means of fulfilling the terms of a contract with an individual. In such cases, data processing may be justified by "legitimate interests". With an aim to enhance our productivity and improve our collaboration—under our legitimate interest—we may use your personal data (e.g., pseudonymous identifiers (cookie IDs, hashed user identifiers, hashed transaction identifiers) to provide information relevant to you. 1.3 Storage time We store your data, - if you have consented to the processing at the latest until you revoke your consent (for the purpose of sending a newsletter, we renovate your consent once a year); - if we need the data for the Token Generating Event registration (5 years); - for processing customer support requests (5 years); - analytics for improving the landing page (12 month). 1.4 Uses Personal data is collected by us only and only to the extent and for the purpose for which you provide us with the data. We only use and store your personal data as part of our services for the following purposes, if you have expressly given us your consent or under the legal basis of legitimate interest: 1. Whitelisting of contributors prior to the Token Generating Event (TGE). The TGE has been finished 23rd July 2018 and we only store your data collected during the TGE; 2. Customer support; 3. Sending newsletters with updates about the Decentralized Insurance Protocol Development; 4. Improve the current user experience, simplify it and make the landing page more informative. 1.5 Processing overview Etherisc GmbH provided a service for registering within the TGE of the “Decentralized Insurance Foundation”. In this context, Etherisc performed an own KYC procedure or/and used service providers which offer a service for verifying identity documents (in particular passports, ID cards, driving licenses) and matching these to an individual. The TGE registration is finished 23rd July 2018. After this date Etherisc GmbH doesn’t collect the registration data but stores it. Transfer of information to the third parties IDnow GmbH and KYC Spider Etherisc GmbH has commissioned IDnow GmbH (https://go.idnow.de/privacy/en) to provide KYC services and KYC Spider AG to provide AML services in order to meet legal requirements (e.g. money laundering legislation, road traffic legislation) or to provide assurances of the identity of the end user. IDnow acts either as a contract data processor in accordance with §11 of the German Federal Data Protection Act (BDSG) resp. article 28 GDPR on the instructions of the customer or is itself the responsible body. KYC Spider acts as a contract data processor in accordance with article 10a Swiss Data Protection Act resp. article 28 GDPR. Parts of the data collected by Etherisc GmbH and IDNow GmbH was used to perform Anti-money-laundering checks by KYC Spider in Switzerland, especially e-mail address, first name, last name, place of residence, and date of birth. This data is then matched against a collection of international Anti-money-laundering databases. If no risk is found, the registration was completed. The data is deleted by KYC Spider after 90 days at the latest. All the data collected by IDnow is used solely for the purposes of verifying identity documents and/or identifying the user and for fulfilling AML requirements. Processing of your personal data beyond the purpose for which the legal permission is granted will only be carried out with the explicit consent of the user. The data is transmitted to Etherisc GmbH and will be deleted on the IDnow servers after 90 days at the latest, unless Etherisc GmbH has previously issued a deletion request. On the basis of statutory retention periods (e.g. in the context of the Money Laundering Act), the data can be stored by Etherisc GmbH or the “Decentralized Insurance Foundation” for the duration of the business relationship between Etherisc GmbH or the “Decentralized Insurance Foundation” and end-user and for up to five years after its termination. Bity SA (Bity.com) Etherisc GmbH has commissioned Bity AG (Bity.com) to provide KYC and AML services in order to meet legal requirements (e.g. money laundering legislation) or to provide assurances of the identity of the contributor. Bity AG acts as a contract data processor in accordance with OBA-FINMA (GwV-FINMA). Bity AG processed personal data for the certified investors only. Bity.com Verification process For verifying the identity of a certified investor and fulfilling KYC/AML requirements, the following steps and associated data processing were performed by Bity.com: The certified investor received a set of electronic forms in PDF format, filled them manually and uploaded to Bity.com electronic platform using the secure upload URL https://bity.com/dashboard/secureupload. The data collected and recorded by Bity.com was vary depending on the type of identity document and the specific situation of the Contributor. For passports and ID cards, the first and last names, place and date of birth in particular were recorded. For verification in order to comply with the Anti Money Laundering Act , the issuing authority, ID number, nationality, and for ID cards, the address of the contributor, were also recorded. Bity.com stores the images of the ID documents together with the contributor data. Parts of the data collected by Bity.com were used to perform Anti-money-laundering checks, especially e-mail address, first name, last name, place of residence, occupation, industry, annual income, origin of money, trading volume, and date of birth. This data was then matched against a collection of international Anti-money-laundering databases. All the data collected by Bity.com were used solely for the purposes of verifying identity documents and/or identifying the contributor and for fulfilling AML requirements. Before each verification process, the certified investor was informed by Bity.com or Etherisc GmbH about the data to be collected by Bity.com and transmitted to Etherisc GmbH. This information can be found in the applicable Bity.com terms and conditions of business. The data is transmitted to Etherisc GmbH. On the basis of statutory retention periods (e.g. in the context of the Anti-Money-Laundering Act), the data can be stored by Etherisc GmbH or the “Decentralized Insurance Foundation” for the duration of the business relationship between Etherisc GmbH or the “Decentralized Insurance Foundation” and contributor and for up to 5 years after its termination. Cleverreach GmbH & Co. KG If you subscribe to our newsletter, we use Cleverreach GmbH & Co. KG (https://www.cleverreach.com/) services to sending messages. You can unsubscribe newsletter at any time by following the unsubscribe link in any email we send. Google Task Manager When you contact us by email we use Gmail software (https://www.google.com/policies/privacy/) to respond to you. We work with Google Ireland Ltd and do not pass your data outside the EU. Zendesk Inc. When you send a support request by using “Support” button on our website, you communicate with the software provided by Zendesk Inc. (https://www.zendesk.com/). Zendesk Inc. our partner in customer support. This company is US based and is a subject of the Privacy Shield Framework (the detailed information is available by this link https://www.zendesk.com/company/customers-partners/privacy-policy/) Altoros Americas LLC Altoros Americas LLC (https://altoros.com/) is our software development partner based in Belarus. Altoros Americas LLC is responsible for support and maintenance of website software and infrastructure. Headquartered in the USA, Altoros Americas LLC is an international company with offices in Norway, Finland, Argentina (there is adequacy decision of the European Commission), and Belarus. Belarus may not have equivalent privacy and data protection laws as the laws of many of the countries where our customers and users are based.