Déclaration de confidentialité

Last Updated: 5 August 2026

For residents of the United States and US Territories, please refer to the US Privacy Notice.

For residents of Brazil, a Portuguese translation of this Privacy Notice is available here for ease of reference and understanding. While we have taken care to ensure consistency between versions, in the event of any discrepancies, the English version shall prevail.

1. Introduction

This privacy notice applies to the processing activities performed by Kraken to the personal data of its clients, prospective clients, individuals Kraken clients transact with, and users of Kraken’s products and services accessed through our websites, web and mobile applications, white-label, embedded, or API-based partner integrations, products that run on-chain (such as Kraken Verify), as well as website visitors.

Your privacy is of the utmost importance to us. It is our policy to safeguard the confidentiality of information and respect the privacy of individuals.

Please see below for information about how we manage personal data, and for information about your rights with respect to the processing of your personal data.

2. Definitions

The following terms are defined as follows:

2.1 “AML” means anti-money laundering.

2.2 “Digital Asset” means any digital representation of value that may be traded via Kraken’s services, excluding non-fungible tokens.

2.3 “Kraken”, “We”, “Us”, refers collectively to Payward, Inc. and its subsidiaries.

2.4 “Personal data” refers to any information relating to an identified or identifiable natural person, including names, identification numbers, location data, an online identifier, or to one or more factors specific to the physical, economic, cultural or social identity of a natural person.

2.5 “DeFi” means decentralised finance systems that run on blockchain technology and use smart contracts to enable peer-to-peer financial activities such as trading, lending, borrowing, earning interest, or providing liquidity.

3. Your Data Controller

Our products and services are provided through local operating entities that are part of the Kraken group of companies.

You are contracting with Kraken as specified in our Terms of Service (unless you are contracting for MIFID II financial instruments, including derivatives, with Payward Europe Digital Solutions (CY) Limited then these Terms of Service apply). The company you are contracting with is your Data Controller, and is responsible for the collection, use, disclosure, retention and protection of your personal data in accordance with our global privacy standards, this Privacy Notice, as well as any applicable national laws.

4. How do we protect personal data?

Kraken takes the security of personal data incredibly seriously. For additional information on our information security practices, please click here, and for general security information, click here.

5. Information we may collect about you

We obtain information about you in a number of ways through your use of our products and services, our websites, the account opening process, webinar sign-up forms, event subscribing, news and updates subscribing and from information provided in the course of on-going support service communications.

In order to open an account with us, you must first complete and submit a “create account” form. By completing this form, you are requested to disclose personal data in order to enable Kraken to assess your application and comply with applicable laws and regulations.

The minimum information required for entering into a contract governing your use of our products and services, and for enabling us to comply with our statutory obligations in respect of anti-money laundering and crime and fraud prevention, is "Biographical information and contact information", "Financial Information", "PEP information", and "Verification information" (each defined below). Without this information, we cannot commence, or continue to perform our services or provide our products to you.

The information that we collect from you is as follows:

• Full name, residential address and contact details (e.g. email address, telephone number etc.), date of birth, place of birth, gender, residency, citizenship (“Biographical information and contact information”);

• Bank account information, wallet addresses, credit and debit card details, details about your source of funds, assets and liabilities, information relating to economic and trade sanctions lists, and tax-related information such as tax identification numbers, tax residency status, or information required for withholding or reporting obligations. (“Financial and tax information”);

• Trading account balances, trading activity (such as whether you participate in Kraken's VIP program, and custodial activity) (“Trading information”);

• Information on whether you (or someone close to you) holds a prominent public function (“PEP information”);

• Verification information, which includes information necessary to verify your identity such as a passport, driver’s licence, selfie photos / videos, login credentials or Government-issued identity card, which may be processed using technologies that extract biometric data. It also includes the details that you use to log into your account (e.g passwords, Social Sign-In details) (“Verification information”);

• Information collected when you interact with our support service channels, including online chat, phone call, email, direct message or other communication means (“Support service communications”);

• Kraken Pay Service information, including Kraktag (Kraken Pay username), profile picture, email address, name, phone number, phone contacts (if enabled), display name, Kraken Pay Service transaction records, user generated content such as payment descriptions, comments and attachments (“Kraken Pay Service information”);

• Third-party payment information, including beneficiary details (such as name, bank account number, and sort code or routing number) you provide to initiate payments to external bank accounts, and sender details received from banking and payment networks in connection with payments you receive from external bank accounts ("Third-party payment information");

• Card information, including PAN (Primary Account Number), card expiry date, card issuer ID and transaction records (“Card information”);

• Salary Match information, including salary deposit amounts, payment frequency and timing, payer/employer identity and sender details, detected payment patterns used for salary classification, ML scoring signals, reward history, tier assignment, cashback currency preferences, and employer tags shown in Address Book and Activity feeds (“Salary Match information”);

• Loyalty programme information, meaning information generated in connection with your participation in our loyalty programme, including points balances, tiers or levels, and a randomly generated display name used on leaderboards or in similar interfaces ("Loyalty programme information");

• AI interaction data such as the content of your interactions with our AI chat and assistant features, including the messages and instructions you provide and the responses, summaries and recommendations generated for you (“AI interaction data”);

• Recovery material, meaning the cryptographic key material you submit to our digital asset discovery and recovery service (Kraken Legacy), such as seed phrases, private keys, recovery files or hardware wallet backups ("Recovery material");

• On-chain interaction and attestation information, meaning information generated when you interact with DeFi products or services or when carrying out other on-chain activities via Kraken interfaces. This category may include DeFi transaction records, liquidity-provision data, wallet-verification status (e.g., whether a wallet is associated with a Kraken account), wallet addresses used for attestations or other on-chain interactions, and related metadata such as timestamps, transaction hashes, protocol, smart contract or vault identifiers, schema details, and other technical information recorded on public blockchains (“On-chain interaction and attestation information”);

• Other personal data or commercial and/or identification information – Information we, in our sole discretion, deem necessary to comply with our legal obligations under various AML obligations, such as under the European Union’s 5th AML Directive, the UK’s Money Laundering Regulations 2017, and the U.S. Bank Secrecy Act, and Australia’s Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (“Other information”).

Information we collect about you automatically:

• Browser information – Information that is automatically collected via analytics systems providers from your browser, including your IP address, domain name, any external page that referred you to us, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform (“Browser information”);

• Log information – Information that is generated by your use of Kraken-branded websites, applications, services, or tools operated by Kraken that is automatically collected and stored in our log records. This may include device information such as device identifier, device operating system and model, device storage, Media Access Control (MAC) address and Subscriber Identity Module (SIM) information, signals relating to user behaviour and device interaction, marketing identifier, battery usage, location information, network address, system activity and any internal and external information related to pages that you visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our Website or App (including date and time, page response times, download errors, length of visits to certain pages, page interaction information such as scrolling, clicks, and mouse-overs, and methods used to browse away from the page (“Log information”).

Information we receive about you from other sources.

We also receive information about you from third parties such as your payment providers, your social account providers Apple or Google if you use our social sign-in feature, service providers assisting with AML, fraud, and security compliance, and through publicly available sources. For example:

• The banks you use to transfer money to us will provide us with your basic personal data, such as your name and address, as well as your financial information such as your bank account details.

• When you make a payment using a debit card or a digital wallet (such as Apple Pay or Google Pay), including through a guest checkout flow where you do not have a Kraken account, we receive identity information from the digital wallet provider, the card acquirer, and the card network and issuing bank. This may include your name, billing address, telephone number, country, and card details.

• Your business partners may provide us with your name and address, as well as financial information.

• Where we partner with another exchange or platform that is transferring its clients to Kraken, that partner may provide us with a scrambled (hashed) version of your email address and an indication of your client tier with them, so that we can recognise you when you open an account and prioritise your onboarding and support.

• Our card-issuing partners provides us with card transaction details and fraud-risk signals so that we can show you your transactions, investigate disputes and comply with our regulatory obligations.

• Our payments and remittance partners may provide us with transaction details, beneficiary information and fraud-risk signals so that we can show you your transactions, investigate disputes and comply with our regulatory obligations.

• When you create or access your Kraken account using your Google Account or Apple Account via social sign-in, Kraken receives limited information from the provider necessary to authenticate you and operate your account, such as your name, email address (or, if you choose Apple’s “Hide My Email,” a private relay address), a provider-assigned user identifier, and authentication tokens. Kraken does not receive your Google or Apple passwords.

• When you interact with our services through a third-party platform, such as a messaging platform, we may receive information from that platform including the identifiers the platform assigns to you, your username or display name on the platform, profile information you have made available, conversation metadata, and the content of instructions you send to us through the platform.

• Advertising networks, analytics providers and search information providers may provide us with anonymised or de-identified information about you, such as confirming how you found our website.

• Our service providers may provide us with information relating to fraud, security, sanctions and AML and other risks, for example, confirmation of identity attributes, and information about any attributes linked to such matters.

• Credit reference agencies may provide us with your personal data during the credit referencing process.

• We may read and store data that is written on a blockchain, other publicly available ledgers, or is otherwise in the public domain.

6. Our legal justification for processing personal data

7. Disclosure of your personal data

As part of the processing activities described above, Kraken may share your personal data within the Kraken company group and with carefully selected third parties. We only disclose data for legitimate purposes and when it is lawful to do so, and we require each recipient to process the data in line with applicable data protection laws.

Kraken engages third party service providers and business partners for operational support in areas including, but not limited to: administrative, financial, legal, tax, payment card issuance and processing, compliance, insurance, IT, debt-recovery, marketing, analytics, DeFi, artificial intelligence and research.

Depending on your jurisdiction, we may disclose your personal data to telecommunication providers or mobile network operators for the purpose of identity verification. Please note no mobile information will be shared with third parties for their marketing or promotional purposes. Kraken may also disclose your personal data to banking and payments partners for the purpose of investigating and responding to potential sanctions violations and crime including fraud and money laundering.

Where you sign up for Kraken using a referral link or code from another Kraken user, we may share with the referring user your first name and the first initial of your surname, together with the status of defined onboarding and activity milestones relevant to the referral programme (for example, whether you have completed identity verification, added a payment method, made a deposit, or placed a trade). This is so that referrals can be transparently attributed, any applicable rewards correctly paid out, and the referring user can see the progress of the people they have invited. We do not share the value or detail of your transactions with the referring user. Separately, we operate a business affiliate programme with commercial partners, such as publishers and content creators, who earn commissions for referring new users to Kraken. Where you sign up after following an affiliate link from one of these partners, we may share pseudonymised and aggregated information with the partner to operate and measure the performance of the programme and calculate and pay commissions.

We use third-party artificial intelligence service providers to support our personalised content, recommendations and AI chat and assistant features. We share only what is needed to provide these features, and do not share direct identifiers such as your name, contact details or identity-verification information. These providers act only on our instructions and do not use your conversations or profile data for their own purposes, including to train their own artificial intelligence models.

In connection with your participation in our Ink Points loyalty programme, we may display your rank and score alongside a randomly generated display name on leaderboards or in similar interfaces. The display name is system-generated from random words and is designed so that other clients cannot identify you from it.

With your consent, Kraken may disclose your name and email to Trustpilot to enable you to leave a review of Kraken without having to create a full Trustpilot account.

In connection with Kraken’s global operations and our compliance with applicable law across the jurisdictions where Kraken operates, we may disclose your personal data regarding your use of Kraken services and our platform to governmental, regulatory, or law enforcement authorities, including those outside the jurisdiction where you reside to the extent that Kraken is required to make such disclosures. Such disclosures will only be made in accordance with applicable laws (including, without limitation, regulations administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”, which includes the Specially Designated Nationals “ SDN ” List and other non-SDN restricted or blocked parties lists) and/or anti-money laundering and/or economic sanctions laws and regulations made by the governments of the European Union, the United Kingdom, Canada and any other applicable national, regional, provincial, state, municipal or local laws and regulations as amended from time to time) that apply to you or Kraken, as well as in response to court orders or other lawful requests made by such authorities in those jurisdictions.

Kraken may also disclose your data in the event of a prospective merger, acquisition, or sale of all or part of our business or assets.

In certain circumstances, third parties to whom we disclose your personal data, may act as independent data controllers for specific processing activities. For example, our card-issuing partners act as independent controllers when processing card information for fraud prevention and AML checks as well as to comply with their other regulatory obligations. Other business partners may act as independent controllers where they enable access to specific services, including DeFi, on-chain services, and payment or remittance services. In some cases, other Kraken group companies may act as independent controllers for specific processing activities when providing certain products or services.

If Kraken discloses your personal data to service providers and business partners, in order to perform the services requested by clients or to comply with our legal and regulatory obligations, such providers and partners may store your personal data within their own systems. We require them to protect the confidentiality of this personal data, and comply with all relevant privacy and data protection laws.

On-chain attestations are publicly available and may be accessed by third parties via blockchain explorers and APIs. Kraken does not control or restrict third-party access to on-chain attestation data.

8. Where we store your personal data

Client data, including account, transactional, and KYC information, is primarily hosted within European and UK data centres. To support our operations we use a network of computers, servers, other infrastructure and information technology, and third-party service providers. We and our third-party service providers and business partners store and process your personal data in the European Union, Australia, the United Kingdom, the United States of America and elsewhere in the world. Courts, law enforcement, regulators and security agencies of these jurisdictions may be able to use legal processes to access your personal data. Additionally, we may be required by law to disclose your personal information to regulators or other authorities in these jurisdictions where such disclosure is mandated by applicable law.

9. International transfers of personal data

We may transfer your personal data outside your home jurisdiction to other Kraken group companies, service providers and business partners. Transfers outside of your home jurisdiction are done in accordance with lawful transfer mechanisms.

For example, for transfers from the EEA and the UK, we rely on adequacy decisions where available. An adequacy decision means that the destination country has been recognised as providing an essentially equivalent standard of data protection to the originating jurisdiction and has therefore been “whitelisted”. The European Commission has whitelisted countries as shown here and the UK Government has whitelisted countries as shown here. Where adequacy decisions are not available, we may rely on mechanisms such as consent, legal or regulatory obligations, execution of agreement, or on contractual safeguards including the European Commission’s Standard Contractual Clauses (SCCs), or the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. Further information about these mechanisms can be obtained using the contact details in Section 16.

10. Privacy when using digital assets and blockchains

Your use of digital assets, including DeFi products or services, may be recorded on a public blockchain. Public blockchains are distributed ledgers, intended to immutably record transactions across wide networks of computer systems. Many blockchains are open to forensic analysis which can lead to re-identification of transacting individuals and the revelation of personal data, especially when blockchain data is combined with other data.

As blockchains are decentralised or third-party networks which are not controlled or operated by Kraken, we are not able to erase, modify, or alter personal data on such networks.

By using Kraken Verify, you acknowledge that your attestations will be recorded on a public blockchain. These attestations are immutable and cannot be modified or deleted. Additionally, linking an attestation to a Kraken-verified wallet may allow third parties to infer that the wallet owner has undergone Kraken’s identity verification process.

11. Data retention

We retain personal data as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to establish, exercise, or defend legal claims. When personal data is no longer necessary for the purposes for which it may lawfully be processed, we will remove any details that will identify you, or we will securely destroy the relevant records. For legal and regulatory reasons we may need to maintain records for a significant period of time after you cease being our client, for example, when we need to retain information to help manage a dispute or legal claim. Additionally, we are subject to certain anti-money laundering laws which may require us to retain the following for a period (e.g., 5 years) after our business relationship with you has ended:

• A copy of the records we used in order to comply with our client due diligence obligations;

• Supporting evidence and records of transactions with you, and your relationship with us.

If you have opted out of receiving marketing communications, we will keep your information on our suppression list to ensure that you do not receive these messages.

You may unlink social sign-in in your Google or Apple settings. If you revoke access, you may need to add another sign-in method (for example, create a Kraken password) to continue accessing your account. Revoking access does not automatically delete information we already maintain about your Kraken account.

Recovery material, such as seed phrases, private keys, recovery files or hardware wallet backups submitted to our digital asset discovery and recovery service (Kraken Legacy), is held only for the duration of the discovery scan and any recovery you initiate, after which it is permanently purged. We retain only the resulting action log (wallet addresses and transaction records) to comply with our legal obligations.

We may keep your personal data for longer than 5 years if we cannot delete it for legal, regulatory, or technical reasons.

Kraken retains on-chain interaction and attestation information for operational, security and integrity purposes. Off-chain data generated through these interactions is stored only as long as necessary to prevent fraud, spam and abuse, ensure platform integrity, and support the services you use. On-chain data recorded on a public blockchain is immutable and cannot be modified or deleted by Kraken.

12. Cookies

Cookies are small text files that provide information regarding the device used by a visitor. Click on Cookie Settings in the footer of this page for additional detail on the types of cookies and similar technologies this website uses and why, and to adjust your Cookie Settings. Cookie information does not usually directly identify you, but it can give you a more personalised web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies and similar technologies although doing so may impact website functionality.

13. Your rights regarding your personal data

The rights that are available to you in relation to the personal data we process are outlined below. You may request to exercise these rights subject to any limitations provided for under applicable data protection laws.

Confirmation and access

You can ask us to confirm whether we are processing your personal data and, if so, what information we process. Should you wish to obtain a copy of that information, please submit your request by using our contact form.

Rectification

It is important to us that your personal data is up to date. We will take all reasonable steps to make sure that your personal data remains accurate, complete and up-to-date. Please inform us if your personal data changes. If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have disclosed your personal data to others, we will let them know about the rectification where possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

You may inform us at any time if your personal details have changed by using our contact form. Subject to applicable law, Kraken will update your personal data in accordance with your instructions. To proceed with such requests, in some cases we may need supporting documents from you as proof, i.e. personal data that we are required to keep for regulatory or other legal purposes.

Erasure

You can ask us to delete, remove, block or anonymise your personal data in certain circumstances. Such requests may be subject to any retention limits we are required to comply with in accordance with applicable laws and regulations. If we have disclosed your personal data to others, we will let them know about the erasure request where possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

On-chain attestations cannot be modified or deleted once published. Users should carefully consider the implications before submitting an attestation.

Processing restrictions

You can ask us to block or suppress the processing of your personal data in certain circumstances such as if you contest the accuracy of that personal data or object to us processing it. It will not stop us from storing your personal data. If we have disclosed your personal data to others, we will let them know about the restriction of processing if possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

Data portability

In certain circumstances you may have the right to obtain personal data you have provided to us, in a structured, commonly used and machine-readable format, and to re-use it elsewhere or ask us to transfer this to a third party of your choice, where technically feasible.

Objection

You can ask us to stop processing your personal data, and we will do so, if we are:

• Relying on our own or someone else’s legitimate interests to process your personal data except if we can demonstrate compelling legal grounds for the processing or for the establishment, exercise or defence of legal claims;

• Processing your personal data for direct marketing; or

• Processing your personal data for research unless we reasonably believe such processing is necessary for the performance of a task carried out for reasons of public interest (such as by a regulatory or enforcement agency).

Automated decision-making

If we have made a decision about you based solely on an automated process that affects your ability to access our products and services or has another significant effect on you, you can request not to be subject to such a decision unless we can demonstrate to you that such decision is necessary for entering into, or the performance of, a contract between you and us. Even if a decision is necessary for entering into or performing a contract, you may contest the decision and require human intervention. We may not be able to offer our products or services to you, if we agree to such a request (i.e. end our relationship with you).

Complaints

You have the right to complain to a competent data protection authority. Contact details are set out in Section 17 below. We ask that you first reach out, by using our contact form, to give us an opportunity to address any concerns. We will promptly acknowledge receipt, review and investigate the matter, and aim to provide you a response within 30 days.

Withdraw consent

You have the right to withdraw consent to processing based on consent at any time. Note this will not affect the lawfulness of processing based on consent prior to the withdrawal of consent or on grounds where consent is not required.

14. Changes to this privacy notice

Our privacy notice is reviewed regularly in light of new regulations, technologies, and any changes to our business operations. Any personal data we process will be governed by our most recent privacy notice. We will update the “Last updated” date accordingly at the beginning of this privacy notice. Please review this privacy notice from time to time. We will announce any material changes to this privacy notice on our website.

15. Our products and services are not available to children

Our products and services are not directed to persons under the age of 18 (herein, “Children”, “Child”) and we do not knowingly collect personal data from children. If we learn that we have inadvertently processed personal data from a child, we will take legally permissible measures to remove that data from our records. Kraken will require the child user to close his or her account and will not allow the use of our products and services. If you are a parent or guardian of a child, and you become aware that a child has provided personal data to us, please reach out by using our contact form.

16. Contact information

Any questions, complaints, comments and requests regarding this privacy notice are welcome and should be submitted using our contact form. You can also contact our Data Protection Officer by using our contact form.

17. Data Protection Authorities

If you are not satisfied with our response to your complaint, you have the right to submit a complaint to a competent data protection authority. Examples of relevant data protection authorities are listed below:

For residents of Australia:

Office of the Australian Privacy Commissioner
GPO Box 5218,
Sydney, NSW 2001, Australia

For residents of Bermuda:

The Office of the Privacy Commissioner
4th Floor Maxwell Roberts Building
1 Church Street
Hamilton, HM11
Bermuda

For residents of Brazil:

The Brazilian Data Protection Authority (ANPD)
Setor Comercial Norte - SCN, Quadra 6, Conjunto "A", Edifício Venâncio 3000, Bloco "A", 9º andar,
CEP 70.716-900
Brasília – DF
+55 61 2017-3338
Brazil

For residents of Canada:

Office of the Privacy Commissioner of Canada
30, Victoria Street
Gatineau, QC K1A 1H3, Canada

For residents of the United Kingdom:

The Information Commissioner’s Office
Wycliffe House, Water Ln
Wilmslow SK9 5AF, UK

For residents of the European Economic Area:

You may complain to your local supervisory authority or to our lead supervisory authority the Irish Data Protection Commission:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

For clients of Payward Europe Digital Solutions (CY) Limited (For MIFID2 financial instruments, including derivatives)

The Office of the Commissioner for Data Protection (Cyprus)

Office address:
Kypranoros 15, Nicosia 1061, Cyprus

Postal address:
P.O.Box 23378, 1682 Nicosia, Cyprus