Aviso de privacidad

Última actualización: 12 de marzo de 2024

1. Introducción

Este Aviso de privacidad se aplica a las actividades de tratamiento que Kraken lleva a cabo con los datos personales de sus clientes, sus clientes potenciales y los visitantes del sitio web. 

Su privacidad es un asunto de suma importancia para nosotros. Es nuestra política salvaguardar la confidencialidad de la información y respetar la privacidad de las personas. 

Consulte la información que aparece a continuación para saber cómo gestionamos los datos personales y para conocer sus derechos con respecto al tratamiento de sus datos personales.

2. Definiciones

Los términos que aparecen a continuación se definen de la siguiente manera:

2.1 “AML” son las siglas, en inglés, de prevención de blanqueo de capitales. 

2.2 “Activo digital” alude a cualquier representación digital de valor que pueda comercializarse a través de los servicios de Kraken, excluidos los tokens no fungibles.

2.3 “Kraken”, “nosotros” o “nuestro” alude colectivamente a Payward, Inc. y sus subsidiarias.

2.4 “Datos personales” alude a cualquier información relacionada con una persona física identificada o identificable. Esto incluye nombres, números de identificación, datos de ubicación, un identificador online o uno o más factores específicos de la identidad física, económica, cultural o social de una persona física.

3. Responsable del tratamiento de datos

Nuestros productos y servicios se ofrecen a través de entidades operativas locales que forman parte del grupo de empresas Kraken.

Su contratación se formaliza con Kraken, tal como se especifica en nuestros Términos de servicio. La empresa con la que tiene una relación contractual es responsable del tratamiento de sus datos, así como de la recopilación, el uso, la divulgación, la retención y la protección de sus datos personales de acuerdo con nuestras normas de privacidad a nivel mundial, este Aviso de privacidad y cualquier legislación nacional pertinente.

4. ¿Cómo protegemos los datos personales?

Kraken se toma increíblemente en serio la seguridad de los datos personales. Consulte este enlace para obtener más detalles sobre nuestras prácticas de seguridad de la información o haga clic aquí para obtener información general sobre seguridad.

5. Información que podemos recopilar sobre usted

Cuando usa nuestros productos y servicios, obtenemos información sobre usted de diversas formas; por ejemplo, a través de cualquiera de nuestros sitios web, al abrir una cuenta, con los formularios de registro en webinarios y con la suscripción a eventos, noticias y actualizaciones. También obtenemos información sobre usted a partir de la información que facilita durante las comunicaciones con el servicio de asistencia.

Para abrir una cuenta con nosotros, primero debe completar y enviar un formulario de “creación de cuenta” en el que aporte la información solicitada. Al completar este formulario, se le pide que comparta datos personales para que Kraken pueda evaluar su solicitud y cumplir con las leyes y los reglamentos pertinentes.

La información mínima requerida para celebrar un contrato que rige el uso de nuestros productos y servicios, y para permitirnos cumplir con nuestras obligaciones estatutarias con respecto a la prevención de blanqueo de capitales, de delitos y fraudes, es información biográfica y datos de contacto, información de verificación, información de personas con responsabilidad pública o PEP (definida más adelante) e información financiera. Sin esta información, no podemos comenzar ni continuar prestando nuestros servicios ni proporcionándole nuestros productos.

La información que recopilamos sobre usted es la siguiente:

• Nombre completo, dirección residencial y datos de contacto (por ejemplo, dirección de email, número de teléfono, etc.), fecha y lugar de nacimiento, sexo, ciudadanía (“información biográfica y datos de contacto”).
• Información de cuentas bancarias, direcciones de monederos, detalles de tarjetas de crédito, detalles sobre su fuente de fondos, activos y pasivos, e información relacionada con listas de sanciones económicas y comerciales (“información financiera”).
• Balances de cuentas de trading, actividad de trading (por ejemplo, si participa en el programa VIP de Kraken y contrata su servicio de custodia), sus consultas y nuestras respuestas (“información de trading”).
• Información sobre si usted (o alguien cercano a usted) desempeña una función pública destacada (“información de personas con responsabilidad pública o PEP”).
• Información de verificación, que incluye información necesaria para verificar su identidad, como pasaporte, carnet de conducir, fotografías/vídeos de su rostro, credenciales de inicio de sesión o documento de Identidad expedido por el Gobierno (“información de verificación”).
• Otros datos personales o información comercial o identificativa: cualquier información que, a nuestra entera discreción, consideremos necesaria para cumplir con nuestras obligaciones jurídicas de prevención de blanqueo de capitales, como la V Directiva de la Unión Europea en materia de prevención de blanqueo de capitales (AML) y la Ley de Secreto Bancario (BSA) de EE.UU. (“Otra información”).

Información que recopilamos sobre usted automáticamente:

• Datos del navegador: información que se recopila automáticamente a través de los proveedores de sistemas de análisis de su navegador, incluida la dirección IP, el nombre del dominio, cualquier página externa que le haya remitido a nuestro sitio, la información de inicio de sesión, el tipo de navegador y la versión, la configuración de la zona horaria, los tipos de complementos del navegador y sus versiones, el sistema operativo y la plataforma (“Datos del navegador”).
• Información de registro: información generada por su uso de sitios web de la marca Kraken, aplicaciones, servicios o herramientas operados por Kraken, que se recopila y almacena automáticamente en nuestros registros. Esto puede incluir información del dispositivo, como el ID, el sistema operativo y el modelo; el almacenamiento del dispositivo; la dirección de control de acceso al medio (MAC) y la información del módulo de identificación del abonado (SIM); señales relacionadas con el comportamiento del usuario y la interacción con el dispositivo; identificador de marketing; uso de la batería; información de ubicación; dirección de red; actividad del sistema, y cualquier información interna y externa relacionada con las páginas que visita, incluido el flujo de clics completo de los localizadores uniformes de recursos (URL) hacia, a través de y desde nuestro sitio web o nuestra aplicación (incluida la fecha y hora; los tiempos de respuesta de la página; errores de descarga; duración de las visitas a determinadas páginas; información de interacción con la página, como desplazamiento, clics y movimientos del mouse, y métodos empleados para navegar fuera de la página) (“información de registro”).

Información que recibimos sobre usted de otras fuentes.

También recibimos información sobre usted de terceros, como sus proveedores de pagos, nuestros proveedores de servicios que ayudan con cuestiones de prevención de blanqueo de capitales, lucha contra el fraude y cumplimiento de seguridad, y a través de fuentes disponibles públicamente. Por ejemplo:

• Los bancos que use para transferirnos dinero nos proporcionarán datos personales básicos sobre usted, como su nombre y su dirección, así como información de carácter financiero sobre usted, como los datos de su cuenta bancaria.
• Sus socios comerciales pueden facilitarnos su nombre y su dirección, así como información de carácter financiero.
• Las redes publicitarias, los proveedores de análisis y los proveedores de información de búsqueda pueden brindarnos información anonimizada o anónima sobre usted, como confirmar cómo encontró nuestro sitio web. 
• Nuestros proveedores de servicios pueden proporcionarnos información relacionada con fraudes, medidas de seguridad, sanciones, prevención de blanqueo de capitales y otros riesgos; por ejemplo, confirmación de atributos de identidad e información sobre cualquier atributo vinculado a dichos asuntos. 
• Las agencias de referencia crediticia pueden proporcionarnos sus datos personales durante el proceso de referencia crediticia.

6. Nuestro fundamento jurídico para el tratamiento de datos personales

7. Disclosure of your personal data

As part of the processing activities described above, Kraken may share your personal data within the Kraken company group and with carefully selected third parties. We only disclose data for legitimate purposes and when it is lawful to do so, and we require each recipient to process the data in line with applicable data protection laws.

Kraken engages third party service providers and business partners for operational support in areas including, but not limited to: administrative, financial, legal, tax, payment card issuance and processing, compliance, insurance, IT, debt-recovery, marketing, analytics, DeFi, artificial intelligence and research.

Depending on your jurisdiction, we may disclose your personal data to telecommunication providers or mobile network operators for the purpose of identity verification. Please note no mobile information will be shared with third parties for their marketing or promotional purposes. Kraken may also disclose your personal data to banking and payments partners for the purpose of investigating and responding to potential sanctions violations and crime including fraud and money laundering.

Where you sign up for Kraken using a referral link or code from another Kraken user, we may share with the referring user your first name and the first initial of your surname, together with the status of defined onboarding and activity milestones relevant to the referral programme (for example, whether you have completed identity verification, added a payment method, made a deposit, or placed a trade). This is so that referrals can be transparently attributed, any applicable rewards correctly paid out, and the referring user can see the progress of the people they have invited. We do not share the value or detail of your transactions with the referring user. Separately, we operate a business affiliate programme with commercial partners, such as publishers and content creators, who earn commissions for referring new users to Kraken. Where you sign up after following an affiliate link from one of these partners, we may share pseudonymised and aggregated information with the partner to operate and measure the performance of the programme and calculate and pay commissions.

We use third-party artificial intelligence service providers to support our personalised content, recommendations and AI chat and assistant features. We share only what is needed to provide these features, and do not share direct identifiers such as your name, contact details or identity-verification information. These providers act only on our instructions and do not use your conversations or profile data for their own purposes, including to train their own artificial intelligence models.

In connection with your participation in our Ink Points loyalty programme, we may display your rank and score alongside a randomly generated display name on leaderboards or in similar interfaces. The display name is system-generated from random words and is designed so that other clients cannot identify you from it.

With your consent, Kraken may disclose your name and email to Trustpilot to enable you to leave a review of Kraken without having to create a full Trustpilot account.

In connection with Kraken’s global operations and our compliance with applicable law across the jurisdictions where Kraken operates, we may disclose your personal data regarding your use of Kraken services and our platform to governmental, regulatory, or law enforcement authorities, including those outside the jurisdiction where you reside to the extent that Kraken is required to make such disclosures. Such disclosures will only be made in accordance with applicable laws (including, without limitation, regulations administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”, which includes the Specially Designated Nationals “ SDN ” List and other non-SDN restricted or blocked parties lists) and/or anti-money laundering and/or economic sanctions laws and regulations made by the governments of the European Union, the United Kingdom, Canada and any other applicable national, regional, provincial, state, municipal or local laws and regulations as amended from time to time) that apply to you or Kraken, as well as in response to court orders or other lawful requests made by such authorities in those jurisdictions.

Kraken may also disclose your data in the event of a prospective merger, acquisition, or sale of all or part of our business or assets.

In certain circumstances, third parties to whom we disclose your personal data, may act as independent data controllers for specific processing activities. For example, our card-issuing partners act as independent controllers when processing card information for fraud prevention and AML checks as well as to comply with their other regulatory obligations. Other business partners may act as independent controllers where they enable access to specific services, including DeFi, on-chain services, and payment or remittance services. In some cases, other Kraken group companies may act as independent controllers for specific processing activities when providing certain products or services.

If Kraken discloses your personal data to service providers and business partners, in order to perform the services requested by clients or to comply with our legal and regulatory obligations, such providers and partners may store your personal data within their own systems. We require them to protect the confidentiality of this personal data, and comply with all relevant privacy and data protection laws.

On-chain attestations are publicly available and may be accessed by third parties via blockchain explorers and APIs. Kraken does not control or restrict third-party access to on-chain attestation data.

8. Where we store your personal data

Client data, including account, transactional, and KYC information, is primarily hosted within European and UK data centres. To support our operations we use a network of computers, servers, other infrastructure and information technology, and third-party service providers. We and our third-party service providers and business partners store and process your personal data in the European Union, Australia, the United Kingdom, the United States of America and elsewhere in the world. Courts, law enforcement, regulators and security agencies of these jurisdictions may be able to use legal processes to access your personal data. Additionally, we may be required by law to disclose your personal information to regulators or other authorities in these jurisdictions where such disclosure is mandated by applicable law.

9. International transfers of personal data

We may transfer your personal data outside your home jurisdiction to other Kraken group companies, service providers and business partners. Transfers outside of your home jurisdiction are done in accordance with lawful transfer mechanisms.

For example, for transfers from the EEA and the UK, we rely on adequacy decisions where available. An adequacy decision means that the destination country has been recognised as providing an essentially equivalent standard of data protection to the originating jurisdiction and has therefore been “whitelisted”. The European Commission has whitelisted countries as shown here and the UK Government has whitelisted countries as shown here. Where adequacy decisions are not available, we may rely on mechanisms such as consent, legal or regulatory obligations, execution of agreement, or on contractual safeguards including the European Commission’s Standard Contractual Clauses (SCCs), or the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. Further information about these mechanisms can be obtained using the contact details in Section 16.

10. Privacy when using digital assets and blockchains

Your use of digital assets, including DeFi products or services, may be recorded on a public blockchain. Public blockchains are distributed ledgers, intended to immutably record transactions across wide networks of computer systems. Many blockchains are open to forensic analysis which can lead to re-identification of transacting individuals and the revelation of personal data, especially when blockchain data is combined with other data.

As blockchains are decentralised or third-party networks which are not controlled or operated by Kraken, we are not able to erase, modify, or alter personal data on such networks.

By using Kraken Verify, you acknowledge that your attestations will be recorded on a public blockchain. These attestations are immutable and cannot be modified or deleted. Additionally, linking an attestation to a Kraken-verified wallet may allow third parties to infer that the wallet owner has undergone Kraken’s identity verification process.

11. Data retention

We retain personal data as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to establish, exercise, or defend legal claims. When personal data is no longer necessary for the purposes for which it may lawfully be processed, we will remove any details that will identify you, or we will securely destroy the relevant records. For legal and regulatory reasons we may need to maintain records for a significant period of time after you cease being our client, for example, when we need to retain information to help manage a dispute or legal claim. Additionally, we are subject to certain anti-money laundering laws which may require us to retain the following for a period (e.g., 5 years) after our business relationship with you has ended:

• A copy of the records we used in order to comply with our client due diligence obligations;

• Supporting evidence and records of transactions with you, and your relationship with us.

If you have opted out of receiving marketing communications, we will keep your information on our suppression list to ensure that you do not receive these messages.

You may unlink social sign-in in your Google or Apple settings. If you revoke access, you may need to add another sign-in method (for example, create a Kraken password) to continue accessing your account. Revoking access does not automatically delete information we already maintain about your Kraken account.

Recovery material, such as seed phrases, private keys, recovery files or hardware wallet backups submitted to our digital asset discovery and recovery service (Kraken Legacy), is held only for the duration of the discovery scan and any recovery you initiate, after which it is permanently purged. We retain only the resulting action log (wallet addresses and transaction records) to comply with our legal obligations.

We may keep your personal data for longer than 5 years if we cannot delete it for legal, regulatory, or technical reasons.

Kraken retains on-chain interaction and attestation information for operational, security and integrity purposes. Off-chain data generated through these interactions is stored only as long as necessary to prevent fraud, spam and abuse, ensure platform integrity, and support the services you use. On-chain data recorded on a public blockchain is immutable and cannot be modified or deleted by Kraken.

12. Cookies

Cookies are small text files that provide information regarding the device used by a visitor. Click on Cookie Settings in the footer of this page for additional detail on the types of cookies and similar technologies this website uses and why, and to adjust your Cookie Settings. Cookie information does not usually directly identify you, but it can give you a more personalised web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies and similar technologies although doing so may impact website functionality.

13. Your rights regarding your personal data

The rights that are available to you in relation to the personal data we process are outlined below. You may request to exercise these rights subject to any limitations provided for under applicable data protection laws.

Confirmation and access

You can ask us to confirm whether we are processing your personal data and, if so, what information we process. Should you wish to obtain a copy of that information, please submit your request by using our contact form.

Rectification

It is important to us that your personal data is up to date. We will take all reasonable steps to make sure that your personal data remains accurate, complete and up-to-date. Please inform us if your personal data changes. If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have disclosed your personal data to others, we will let them know about the rectification where possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

You may inform us at any time if your personal details have changed by using our contact form. Subject to applicable law, Kraken will update your personal data in accordance with your instructions. To proceed with such requests, in some cases we may need supporting documents from you as proof, i.e. personal data that we are required to keep for regulatory or other legal purposes.

Erasure

You can ask us to delete, remove, block or anonymise your personal data in certain circumstances. Such requests may be subject to any retention limits we are required to comply with in accordance with applicable laws and regulations. If we have disclosed your personal data to others, we will let them know about the erasure request where possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

On-chain attestations cannot be modified or deleted once published. Users should carefully consider the implications before submitting an attestation.

Processing restrictions

You can ask us to block or suppress the processing of your personal data in certain circumstances such as if you contest the accuracy of that personal data or object to us processing it. It will not stop us from storing your personal data. If we have disclosed your personal data to others, we will let them know about the restriction of processing if possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

Data portability

In certain circumstances you may have the right to obtain personal data you have provided to us, in a structured, commonly used and machine-readable format, and to re-use it elsewhere or ask us to transfer this to a third party of your choice, where technically feasible.

Objection

You can ask us to stop processing your personal data, and we will do so, if we are:

• Relying on our own or someone else’s legitimate interests to process your personal data except if we can demonstrate compelling legal grounds for the processing or for the establishment, exercise or defence of legal claims;

• Processing your personal data for direct marketing; or

• Processing your personal data for research unless we reasonably believe such processing is necessary for the performance of a task carried out for reasons of public interest (such as by a regulatory or enforcement agency).

Automated decision-making

If we have made a decision about you based solely on an automated process that affects your ability to access our products and services or has another significant effect on you, you can request not to be subject to such a decision unless we can demonstrate to you that such decision is necessary for entering into, or the performance of, a contract between you and us. Even if a decision is necessary for entering into or performing a contract, you may contest the decision and require human intervention. We may not be able to offer our products or services to you, if we agree to such a request (i.e. end our relationship with you).

Complaints

You have the right to complain to a competent data protection authority. Contact details are set out in Section 17 below. We ask that you first reach out, by using our contact form, to give us an opportunity to address any concerns. We will promptly acknowledge receipt, review and investigate the matter, and aim to provide you a response within 30 days.

Withdraw consent

You have the right to withdraw consent to processing based on consent at any time. Note this will not affect the lawfulness of processing based on consent prior to the withdrawal of consent or on grounds where consent is not required.

14. Changes to this privacy notice

Our privacy notice is reviewed regularly in light of new regulations, technologies, and any changes to our business operations. Any personal data we process will be governed by our most recent privacy notice. We will update the “Last updated” date accordingly at the beginning of this privacy notice. Please review this privacy notice from time to time. We will announce any material changes to this privacy notice on our website.

15. Our products and services are not available to children

Our products and services are not directed to persons under the age of 18 (herein, “Children”, “Child”) and we do not knowingly collect personal data from children. If we learn that we have inadvertently processed personal data from a child, we will take legally permissible measures to remove that data from our records. Kraken will require the child user to close his or her account and will not allow the use of our products and services. If you are a parent or guardian of a child, and you become aware that a child has provided personal data to us, please reach out by using our contact form.

16. Contact information

Any questions, complaints, comments and requests regarding this privacy notice are welcome and should be submitted using our contact form. You can also contact our Data Protection Officer by using our contact form.

17. Data Protection Authorities

If you are not satisfied with our response to your complaint, you have the right to submit a complaint to a competent data protection authority. Examples of relevant data protection authorities are listed below:

For residents of Australia:

Office of the Australian Privacy Commissioner
GPO Box 5218,
Sydney, NSW 2001, Australia

For residents of Bermuda:

The Office of the Privacy Commissioner
4th Floor Maxwell Roberts Building
1 Church Street
Hamilton, HM11
Bermuda

For residents of Brazil:

The Brazilian Data Protection Authority (ANPD)
Setor Comercial Norte - SCN, Quadra 6, Conjunto "A", Edifício Venâncio 3000, Bloco "A", 9º andar,
CEP 70.716-900
Brasília – DF
+55 61 2017-3338
Brazil

For residents of Canada:

Office of the Privacy Commissioner of Canada
30, Victoria Street
Gatineau, QC K1A 1H3, Canada

For residents of the United Kingdom:

The Information Commissioner’s Office
Wycliffe House, Water Ln
Wilmslow SK9 5AF, UK

For residents of the European Economic Area:

You may complain to your local supervisory authority or to our lead supervisory authority the Irish Data Protection Commission:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

For clients of Payward Europe Digital Solutions (CY) Limited (For MIFID2 financial instruments, including derivatives)

The Office of the Commissioner for Data Protection (Cyprus)

Office address:
Kypranoros 15, Nicosia 1061, Cyprus

Postal address:
P.O.Box 23378, 1682 Nicosia, Cyprus