Last Updated 16 April 2024
In this Policy, "we", "us" and "our" refers to Prex Spółka Z Ograniczoną Odpowiedzialnością (“Prex”). Prex is a company incorporated, and registered in the Register of Virtual Currency Activities, in Poland.
Prex is committed to protecting the privacy of our customers and stakeholders, and we take our data protection responsibilities with the utmost seriousness.
This Privacy Policy sets out what Personal Data we collect, how we process it and how long we generally retain it, along with details of your rights as a data subject.
To the extent that you are a customer or user of our services, this Privacy Policy applies together with any Terms of Use and other contractual documents, including but not limited to any agreements we may have with you. We reserve our right to issue separate policies in respect of other relevant stakeholders such as our employees, connected persons and/or our business partners.
To the extent that you are not a relevant stakeholder, customer or user of our services, but are using our website, this Privacy Policy also applies to you.
In this Policy, “Personal Data” means any information relating to you as an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an online identifier or to one or more factors specific to your physical, physiological, genetic, mental, economic, cultural or social identity.
For the avoidance of doubt, Personal Data does not include data from which you cannot be identified (which is referred to simply as data, non-personal data, anonymous data, or de-identified data).
In this Policy, “processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
This Privacy Policy is issued by Prex as data controller, and shall serve as a notice to you in your capacity as Data Subject.
1. Your Information and the Blockchain
Blockchain technology, also known as distributed ledger technology (or simply ‘DLT’), is at the core of our business. Blockchains are decentralized and made up of digitally recorded data in a chain of packages called ‘blocks’. The manner in which these blocks are linked is chronological, meaning that the data is very difficult to alter once recorded. Since the ledger may be distributed all over the world (across several ‘nodes’ which usually replicate the ledger) this means there is no single person making decisions or otherwise administering the system (such as an operator of a cloud computing system), and that there is no centralized place where it is located either.
Accordingly, by design, a blockchain’s records cannot be changed or deleted and is said to be ‘immutable’. This may affect your ability to exercise your rights such as your right to erasure (this being your ‘right to be forgotten’), the right to rectification of your data or your rights to object or restrict processing, of your personal data. Data on the blockchain cannot generally be erased or changed, although some smart contracts may be able to revoke certain access rights, and some content may be made invisible to others; however, it is not deleted.
In certain circumstances, in order to comply with our contractual obligations to you it may be necessary to write certain personal data, such as your cryptographic wallet address, onto one or more blockchains; this is done through a smart contract and requires you to execute such transactions using your cryptographic wallet’s private key.
In most cases ultimate decisions to (i) transact on the blockchain using your Ethereum/Bitcoin or other cryptocurrency wallet address, as well as (ii) share the public key relating to your Ethereum/Bitcoin or other cryptocurrency wallet address with anyone (including us) rests with you.
IF YOU WANT TO ENSURE YOUR PRIVACY RIGHTS ARE NOT AFFECTED IN ANY WAY, YOU SHOULD NOT TRANSACT ON BLOCKCHAINS AS CERTAIN RIGHTS WILL NOT BE FULLY AVAILABLE OR EXERCISABLE BY YOU OR US.
IN PARTICULAR THE BLOCKCHAIN IS AVAILABLE TO THE PUBLIC AND ANY PERSONAL DATA SHARED ON THE BLOCKCHAIN WILL BECOME PUBLICLY AVAILABLE.
Your information may also be written on other blockchains of the cryptocurrency which you use to purchase your digital currency (e.g. such as the Bitcoin blockchain where you chose to pay in Bitcoin).
2. Personal Information We Collect
We collect information about you when you:
- Use our mobile application;
- visit our website;
- contact us either through or web, mobile, or through other direct means of electronic communication including social media engagement;
- interact with us or our services including account creation;
- enter into a contract with us to use our services;
- use our services to enter into transactions (including but not limited to transactions on public blockchains);
- provide us instructions to us in relation to your account with us; and/or
- enter into any other relationship with us or interact with us or our services.
3. The type of information we collect
The personal information we collect will include your:
Name; address; email address; telephone number; date of birth; gender; nationality; identification number; employment details; financial details including salary and employer details; residential address; location; device information; cryptographic wallet address; biometric details (to the extent these are contained in your passport or other government issued identity document etc); electronic signature; and information about how you use our mobile application or our website.
We may also ask you to provide evidence of your identity such as asking for a copy of your passport, driving licence, proof of residence or income. This is deemed necessary to comply with our legal obligations under various anti-money laundering (AML) obligations, such as under the European Union’s 5th AML Directive and the Polish Act on Counteracting Money Laundering and Financing of Terrorism.
We may also automatically collect the following information when you visit our website or use our mobile application:
Your internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, mobile advertising and other unique identifiers, details about your browser, operating system or device, location information, Internet service provider, pages that you visit before, during and after using the Services, information about the links you click, and other information about how you use the Services. Information we collect may be associated with accounts and other devices.
In addition, we may automatically collect data regarding your use of our services, such as the types of content you interact with and the frequency and duration of your activities. We may combine your information with information that other people provide when they use our Services, including information about you when they tag you.
We, as well as third parties that provide content, advertising, or other functionality on the Services, may use cookies, pixel tags, local storage, and other technologies to automatically collect information through the Services. Technologies are essentially small data files placed on your computer, tablet, mobile phone, or other devices that allow us and our partners to record certain pieces of information whenever you visit or interact with our Services.
We may also use Google Analytics and other service providers to collect information regarding visitor behavior and visitor demographics on our Services. For more information about Google Analytics, please visit http://www.google.com/policies/privacy/partners. You can opt out of Google’s collection and processing of data generated by your use of the Services by going to http://tools.google.com/dlpage/gaoptout.
We may obtain information about you from other sources, including through third party services and organizations to supplement information provided by you. For example, if you access our services through a third-party application, such as an app store, a third-party login service, or a social networking site, we may collect information about you from that third-party application that you have made public via your privacy settings. Information we collect through these services may include your name, your user identification number, your user name, location, gender, birth date, email, profile picture, and your contacts stored in that service. This supplemental information allows us to verify information that you have provided to us and to enhance our ability to provide you with information about our business, products, and Services.
4. Information written on the blockchain
When you enter into a transaction using our services for the deposit or withdrawal of digital currency the following information is written onto the blockchain:
- the cryptographic wallet address from which you send us digital currency or to which you send digital currency to;
- the amount of the digital currency involved in the transaction(s); and/or
- the cryptographic wallet address linked to your account on our platform which holds the digital currency.
5. Purpose and legal basis for the use of your personal information
We use personal information about you in connection with the following purposes:
Provision of services and management:
- to provide you with the information, products and services that you have requested from us;
- to complete any transaction you are undertaking with us;
- to perform a contractual obligation we have to you ; and/or
- to meet a legal or regulatory obligation.
In order to provide you with our services, we will need to first onboard you as a client. As part of onboarding, verification of your identity is necessary to meet our various “know your customer” legal or regulatory obligations. Verification of your identity will involve, amongst other things, collection of your biometric data (such facial scan data extracted from your selfie, video, and/or your government issued identity document). By agreeing to our Privacy Policy you understand that you are giving us explicit consent for the processing of your biometric data for the purposes of meeting our legal or regulatory obligations.
Service improvements:
It is in our legitimate interests:
- to ensure that content from our site and app is presented in the most effective manner for you;
- to administer our site & app and for internal business administration and operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
- to notify you about changes to our service; and/or
- as part of our efforts to keep our site safe and secure.
Direct Marketing:
- to provide you with information about other services we offer that are similar to those that you already have or have enquired about; and/or
- to provide you with other marketing material such as our Newsletter.
By agreeing to our Privacy Policy you understand that you are giving us explicit consent for the processing of your personal data for direct marketing purposes. If you do not want your personal information to be used for marketing purposes, please contact us using our contact information as set out in the section titled “Contact and further information” below.
6. How we share your Information
Why and when we share your information
We may share your Personal Data with third parties (including entities of the wider group of companies to which we belong) if we believe that sharing your Personal Data is in accordance with, or required by, any contractual relationship with you or us, applicable law, regulation or legal process.
We may also be required by law or by a Court to disclose certain information about you or any engagement we may have with you to relevant regulatory, law enforcement and/or other competent authorities. We will disclose information about you to public, regulatory and/or other competent authorities to the extent we are obliged to do so according to the law. We may also need to share your information in order to enforce or apply our legal rights.
In addition, your Personal Data may also be shared and processed by us and/or other members of the of the wider group of companies to which we belong, our affiliates, agents, vendors, consultants or suppliers, as well as any other third party service providers who are performing certain services on our behalf (for example, outsourced service providers, external Counsel, financial institutions, etc.). Such third parties will have access to your Personal Data solely for the purposes of performing the services specified in the applicable engagement, or to comply with applicable laws and not for any other purpose. These third partied are not permitted to use your personal information for their own purposes, and rather can only process in accordance with our instructions. We require these third parties to undertake security measures consistent with the protections specified in this Privacy Policy and applicable law.
In addition, we may transfer your personal information to a third party as part of a sale of some, or all, of our business and assets or as part of any business restructuring or reorganisation, or if we are under a duty to disclose or share your personal data in order to comply with any legal obligation. However, we will take steps to ensure that your privacy rights continue to be protected.
Transferring your information outside of the European Economic Area
Sometimes our business partners, third party service providers, agents, subcontractors and other associated organisations may be located outside of the European Economic Area (EEA). The EEA includes the European Union countries as well as Iceland, Liechtenstein and Norway. Transfers outside of the EEA are sometimes referred to as ‘third country transfers’.
We share your personal data with these third parties outside of the EEA where we have a legal basis for doing so such as to provide you with our services or because we ourselves use service providers outside of the EEA in order to operate our business. If we transfer your information outside of the EEA to third parties we will take steps to ensure that your privacy rights continue to be protected as outlined in this Policy. This may require us to take certain additional steps to ensure that appropriate safeguards are in place if that third country is not deemed by the European Commission to offer an adequate level of protection for your privacy rights, which may include use of contractual safeguards to allow you to be able to enforce your rights and ensure these are preserved. In certain circumstances, we may need to ask you for your explicit consent to such third country transfers, and will always do so in writing and giving you full information about why we need your consent and your right to withdraw that consent at any time (together with the consequences of withdrawal).
However, when interacting with the blockchain, as explained above in this Policy, the blockchain is a global decentralized public network and accordingly any personal data written onto the blockchain may be transferred and stored across the globe.
7. Automated decision-making
We do not use automated-decision making methods (including profiling), save that we may risk profile our clients in compliance with applicable anti-money laundering legislation. This means decisions are not made solely by robots or computers, and therefore not ‘automated’. However our compliance processes involve certain automated decision-making tools or software (whether through third-party vendor software or otherwise) to help determine if a transaction or customer account presents fraud or legal risk.
8. How long do we keep your information
We retain your information only for as long as is necessary for the purposes for which we process the information as set out in this Policy. Records can be held on a variety of media (physical or electronic) formats.
In addition, we may retain your personal data for a period of time where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person or where we have a legitimate interest to do so.
9. Security Measures
We have appropriate security measures to prevent your information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have taken substantial precautions to ensure the security of your data. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality and a duty to comply with data protection procedures. We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so
10. Your Data Rights
In accordance with applicable law, you may have the right to:
Right Information and access
You have a right to be informed about the processing of your Personal Data (and if you did not give it to us, information as to the source) and this Policy intends to provide the information.
Right to rectification
You have the right to have any inaccurate personal information about you rectified and to have any incomplete personal information about you completed. You may also request that we restrict the processing of that information.
The accuracy of your information is important to us. If you do not want us to use your Personal Data in the manner set out in this Policy, or need to advise us of any changes to your personal information, or would like any more information about the way in which we collect and use your Personal Data, please contact us using our contact information as set out in the section titled “Contact and further information” below.
Right to erasure (right to be ‘forgotten’)
You have the general right to request the erasure of your personal information in the following circumstances:
- the personal information is no longer necessary for the purpose for which it was collected;
- you withdraw your consent to consent based processing and no other legal justification for processing applies;
- you object to processing for direct marketing purposes;
- we unlawfully processed your personal information; and
- erasure is required to comply with a legal obligation that applies to us.
We will proceed to comply with an erasure request without delay and to such extent we are able to do so, unless continued retention is necessary for:
- exercising the right of freedom of expression and information;
- complying with a legal obligation under EU or other applicable law;
- the performance of a task carried out in the public interest;
- archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, under certain circumstances; and/or
- the establishment, exercise, or defence of legal claims.
However, when interacting with the blockchain we may not be able to ensure that your personal data is deleted. This is because the blockchain is a public decentralized network and blockchain technology does not generally allow for data to be deleted and your right to erasure may not be able to be fully enforced. In these circumstances we will only be able to ensure that all personal data that is held by us is permanently deleted.
Right to restrict processing and right to object to processing
You have a right to restrict processing of your personal information, such as where:
- you contest the accuracy of the personal information;
- where processing is unlawful you may request, instead of requesting erasure, that we restrict the use of the unlawfully processed personal information;
- we no longer need to process your personal information but need to retain your information for the establishment, exercise, or defence of legal claims.
You also have the right to object to processing of your personal information under certain circumstances, such as where the processing is based on your consent and you withdraw that consent. This may impact the services we can provide and we will explain this to you if you decide to exercise this right.
However, when interacting with the blockchain, as it is a public decentralized network, we will likely not be able to prevent external parties from processing any personal data which has been written onto the blockchain. In these circumstances we will use our reasonable endeavours to ensure that all processing of personal data held by us is restricted, notwithstanding this, your right to restrict to processing may not be able to be fully enforced.
If you would like to exercise any of these rights, please log into your account or contact us using our contact information as set out in the section titled “Contact and further information” below. We will process such requests in accordance with applicable laws. To protect your privacy, we will take steps to verify your identity before fulfilling your request.
Right to lodge a complaint with a relevant supervisory authority
You also have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, place of work, or the place where you allege an infringement of one or more of our rights has taken place, if that is based in the EEA or the UK.
11. Changes to Our Privacy Policy
We may revise this Privacy Policy from time to time in our sole discretion. If there are any material changes to this Privacy Policy, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use the Services after the new Privacy Policy takes effect.
12. Contact and further information
If you would like a copy of the Personal Data or wish to exercise any of your Data Subject Rights as set out in this Notice, or if you have any questions regarding this Notice or generally about the way we handle your Personal Data please contact [email protected].
