Kraken U.S. Privacy Notice - Payward Interactive, Inc. d.b.a. Kraken - Last updated 10 July 2024

The following Kraken Privacy Notice, and GLBA Notice and Disclosure applies to you if you are an individual who resides in the United States and US Territories, and uses the services or websites of Payward Interactive, Inc. (d/b/a Kraken). For residents of the United States, the terms in this Privacy Notice take precedence over the terms in Kraken’s Global Privacy Notice available here.

Important information about procedures: To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account.

What this means for you: When you open an account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see your driver’s license or other identifying documents

Introduction

As part of our daily business operations, we collect personal information from our clients and prospective clients in order to provide them with our products, related support and services (collectively, “Services”), and to ensure that we can meet their needs when providing these products and services, as well as when providing them with any respective information. When you visit our website, social media pages, or other online properties (collectively “Sites”), we may also collect and use certain information about you.

Your privacy is of utmost importance to us, and it is our policy to safeguard and respect the confidentiality of information and the privacy of individuals. This Privacy Notice explains how Kraken collects, uses, and manages the personal information we receive from you, or via a third party, in connection with our provision of services to you or which we collect from your use of our services and/or our website. The Privacy Notice also informs you of your rights with respect to the processing of your personal information and the choices you can make about what information you share.

The Privacy Notice applies to all products and services offered or provided by Kraken to U.S. clients, potential U.S. clients, and U.S. website visitors (including any services, terms, or communications that reference, display, or link to this Privacy Notice), except where a particular product, service, or jurisdiction has a separate privacy notice. The personal information we collect, use, and disclose will vary based on how you interact with Kraken, our products, and our websites. We have done our utmost to make this notice comprehensive and understandable, but appreciate that it is complex, so please contact [email protected] if you have questions.

Certain individuals may be provided with additional privacy notices as described below:

• Kraken Clients – When you sign up for an account with us, we may collect and use your information to facilitate the provision of services pursuant to our GLBA Notice, as applicable. Federal law requires us to provide notice to certain customers to explain what personal information we collect, how we disclose it, and how consumers may limit information sharing. These privacy practices are subject to our GLBA Notice, which we strongly suggest you review.

• Notice to California Residents – If you are a resident of California, please see our California Consumer Privacy Statement for additional relevant information.
• You may have other privacy protections under applicable state laws. To the extent these state laws apply, we will comply with them when we disclose information about you. Please see our State Specific Privacy Statement for more information on whether you have additional rights or protections under other state privacy laws.

Key Terms Used Throughout This Notice

The following terms are defined as follows:

“Kraken Account” means a user-accessible account offered via Payward Interactive, Inc..

“We”, “Our”, and “Us” refers to Payward Interactive, Inc. d/b/a Kraken.

“Personal information” or “personal data” refers to any information relating to you, as an identified or identifiable natural person, including your name, an identification number, location data, or an online identifier or to one or more factors specific to the physical, economic, cultural, or social identity of you as a natural person. 

“User” and “You” refers to our clients, prospective clients, and individuals who visit our Site or use our Services.

"Biometric data" means data generated by automatic measurements of an individual's biological characteristics, such as a facial geometry or other unique biological patterns or characteristics that are used to identify a specific individual.

"Identified or identifiable natural person" means a person who can be readily identified, directly or indirectly.

Information we may collect about you

Categories Of Personal Data Kraken May Collect About You

• Identifiers: identifiers such as a real name, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, Social Security number, driver’s license number, passport number, and other similar identifiers;
• Customer and Payment Information: Signature, physical characteristics or description, state identification card number, education, bank account number, credit card number, debit card number, on-chain transactions, and other financial information;
• Protected Classifications: characteristics of protected classifications under State or federal law, such as race, color, national origin, age, sex, gender, marital status, citizenship status, and military and veteran status;
• Commercial Information: commercial information, including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies;
• Biometric Data;
• Online Activity: Internet and other electronic network activity information, including, but not limited to information regarding your interaction with websites, applications, or advertisements;
• Geolocation Data;
• Sensory Information: audio, visual, and similar information;
• Employment Information: professional or employment-related information; 
• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, behavior, and attitudes.

Purposes For Processing Personal Data

• To comply with laws and regulations that Kraken maybe subject to;
• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services;
• Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;
• Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction;
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
• Debugging to identify and repair errors that impair existing intended functionality;
• Undertaking internal research for technological development and demonstration; and/or
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

We may also, from time-to-time, use personal information provided by you through your use of the services and/or through client surveys to help us improve our products and services. It is our legitimate interest to use your personal information in this way to try to ensure the highest standards when providing you with our products and services and to continue to be a market leader within the cryptocurrency financial service industry. 

This may include:

• To tailor specific communications and promotions according to your preferences;
• To provide you with access to the services;
• To serve the functions of the Sites;
• To manage everyday business needs, such as administering and improving the Sites;
• To analyze the performance and functioning of the Sites;
• To analyze how you use the Sites and to perform other market research;
• For internal operations, including troubleshooting, testing, and analytics; and
• To assist us in developing new products and improving our Services.

Kraken may also use or disclose de-identified information that is not reasonably likely to identify you for commercially legitimate business purposes. 

Sharing Of Personal Data With Third Parties

We may share your Personal Data with third parties under the following circumstances:  

• To comply with laws and regulations that Kraken maybe subject to;
• When we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connections with an investigation or suspected or actual illegal activity;
• If necessary to protect the vital interests of a person;
• If there is a duty to disclose; 
• If our legitimate business interests require disclosure; 
• To protect our property, services, and legal rights;
• To enforce our Terms of Service; 
• To prevent fraud against Kraken, our affiliates, business partners, or authorized users;
• To support auditing, compliance, and corporate governance functions; or
• At your request or with your consent or to those described elsewhere in this notice. . 

Kraken will make such disclosures on a “need-to-know” basis, unless otherwise instructed by a regulatory authority. Under such circumstances, Kraken will notify the third party regarding the confidential nature of any such information. Kraken will not disclose your confidential information to a third party, except: 

• We are required to do so by law or legal process;
• To the extent that we are required or permitted to do so pursuant to any applicable laws, rules, or regulations; 
• To law enforcement authorities or other government officials, as necessary.

Categories Of Third Parties With Which Data Is Shared

As part of using your personal information for the purposes set out above, Kraken may disclose your personal information to the following:

• Any member of Kraken, which means that any of our affiliates and subsidiaries may receive such information;
• Any of our service providers, specialist advisors, and business partners who need access to perform their services for/with Kraken, these services may include but are not limited to administrative, financial, commercial, legal, tax, compliance, insurance, IT, debt-recovery, marketing, analytics, research, or other advisory services.

If Kraken discloses your personal information to service providers and business partners in order to perform the services requested by clients, such providers and partners may store your personal information within their own systems in order to comply with their legal and other obligations. These third parties are not authorized by us to use or disclose the information, except as necessary to perform services on our behalf or comply with legal requirements. These third parties have no independent rights to the data.

Kraken requires service providers and business partners who process personal information to acknowledge the confidentiality of this information and undertake to respect any client’s right to privacy and comply with all relevant privacy and data protection laws.

Selling Or Sharing Of Personal Information

Kraken does not sell personal data to any third parties for monetary consideration and has not done so in the preceding 12 months. We do not sell personal information.

Biometrics Policy

By using Kraken’s services, accepting our privacy notice, and/or accepting our terms of service, you give your written consent to the collection, processing, usage, and storage of your Biometric Data. 

You release in favor of Kraken any claims related to collection, processing, usage, and storage your Biometric Data. This includes any past or prior claims as well as any claims that may arise in the future related to your use of Kraken’s services

Biometric Data Collection

Kraken collects, uses, stores, and processes Biometric Data to verify or confirm your identity, both when you initially open or verify your Kraken account and at any point thereafter as deemed necessary by Kraken or required by law or regulation. This includes comparing “selfie” photos that you submit to other forms of identification, such as a driver’s license or passport or similar identification document.  

Biometric Data means any data generated from electronic measurements or scans of an individual's biological characteristics, such as facial geometry, or other unique biological patterns or characteristics that can be used to identify a specific individual.

Retention Schedule

In circumstances where we retain Biometric Data, we will permanently destroy an individual's Biometric Data once the purpose for collecting or obtaining such Biometric Data is satisfied, as determined by us, but no later than a maximum of three years of collection, unless further retention is required for account security, regulatory compliance or otherwise required by law.

Biometric Data Security

We shall use a reasonable standard of care to store, transmit and protect from disclosure any Biometric Data collected.

Biometric Data Disclosures

We may disclose an individual's Biometric Data to third-party vendors and/or licensors in order to facilitate the provision of our products and services. This includes third-party identity verification services. Those products and services requiring Biometric Data processing shall include future products and services that Kraken may choose to provide after the initial collection of Biometric Data.

We do not further disclose Biometric Data unless:

• The individual or the individual's legally authorized representative consents to the disclosure;
• The disclosure is required by applicable law or regulation; or
• The disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

We do not sell, lease, trade, or otherwise profit from Biometric Data.

Children's Personal Information And Online Privacy (COPPA)

The Children's Online Privacy Protection Act (COPPA) is intended to provide parents increased control over what information is collected from their children online and how such information is used. The law applies to websites and services directed to, and which knowingly collect information from, children under the age of 13. 

Our products and services are not directed to persons under the age of 18, hereinafter “Children” or “Child,” and we do not knowingly collect personal information from Children. If we learn that we have inadvertently gathered personal information from a Child, we will take legally permissible measures to remove that information from our records. Kraken will require the user to close his or her account and will not allow the use of our products and services. 

If you are a parent or guardian of a Child, and you become aware that a Child has provided personal information to us, please contact us at [email protected] and you may request to exercise your applicable access, rectification, cancellation, and/or objection rights. If you are under the age of 18, please do not provide any personal information through the Sites or Services.

For additional information on COPPA protections refer to the Federal Trade Commission's website. 

GLBA Notice And Disclosure

What Does Kraken Do With Your Personal Information?

Financial companies choose how they disclose your personal information. Federal law gives consumers the right to limit some but not all disclosures. Federal law also requires us to tell you how we collect, disclose, and protect your personal information. Please read this notice carefully to understand what we do.

All financial companies need to disclose customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can disclose their customers’ personal information; the reasons Kraken chooses to disclose, and whether you can limit this disclosure.

Kraken takes the security of personal data incredibly seriously. Please see here for further detail about our information security practices, and here for general security information.

Kraken collects your personal information, for example, when you:

• Interact with support, Kraken website or we communicate with you;
• Apply for any Kraken product or service; 
• Open an account; 
• Make deposits or withdrawals from your account;
• Give us your income information;
• Provide employment information or your employment history; 
• Give us your contact information;
• Show your government-issued ID or your driver's license.

We also collect your personal information from third parties, such as credit bureaus, affiliates, or other companies that provide services to Kraken (e.g. KYC service providers).

Federal law gives you the right to restrict the sharing of your personal information in the following specific situations:

• Sharing your creditworthiness information with our affiliates for their everyday business purposes.
• Allowing our affiliates to use your personal information for marketing purposes.
• Sharing your personal information with non-affiliated companies for their marketing purposes.

State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law

California Consumer Privacy Notice

This California Privacy Notice (“California Notice”) is for California residents, and describes how Kraken collects, uses, and discloses your personal information. The information on this notice provides details on how we respond to and implement processes to uphold California State laws. 

Any terms defined in the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020) (“CCPA”) have the same meaning when used in this California Notice. The CCPA does not apply to personal information we collect as part of our current or former client relationship with you pursuant to other privacy laws such as the federal Gramm-Leach-Bliley and Fair Credit Reporting Acts, and the California Financial Information Privacy Act. For more information about what information is exempt from disclosure, see the section titled ‘Exemptions’ below. 

Definitions

“Personal information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. This information may also be referred to in this California Notice as “personal data.”

“Shine the Light” and “Eraser” Laws: Residents of the State of California may request a list of all third parties to which we have disclosed certain personal information during the preceding year for those third parties’ direct marketing purposes.

“Customers” are defined as individuals who access or use our services.

Sources Of Personal Information

We gather various types of personal information from our customers from a range of sources, such as:

• information you give us when you sign up for, or otherwise use, our Services;
• information we receive from our affiliates and third parties; 
• Information that is in the public domain;
• information we collect automatically through cookies and similar technologies (see our Cookie Policy for more information on this type of information).

Purpose For Collection And Disclosure Of Personal Information 

We’ve collected and disclosed the below categories of personal information to create, develop, operate, deliver, and improve our services; to communicate with you; to comply with applicable laws and regulations; to ensure the safety, security and integrity of our Services; and for business and commercial purposes. Kraken does not collect, use, or disclose sensitive personal information for purposes other than those specified in this Notice, to provide the Services, or as permitted under applicable law. Kraken does not sell personal information. For more information about how Kraken may use your personal information, please refer to other potentially applicable notices, such as the Global Privacy Notice.

Collection And Disclosure Of Personal Information  

In the past 12 months, we’ve collected the below categories of personal information, and disclosed the specific types of personal information below with the following categories of third parties:

Collection and Disclosure of Sensitive Personal Information

In the past 12 months, we’ve collected and disclosed the following categories of sensitive personal information, with the following categories of third parties:

Selling or Sharing of Personal Information

In the past 12 months, we may have shared identifiers with third party analytics providers, advertising partners, and ad networks for analytics and advertising purposes. Kraken does not sell your personal information.

Rights

As a California resident, you may have the rights listed below in relation to personal information that we have collected about you. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

Right to Know 

You have a right to request the following information about our collection, use and disclosure of your personal information over the prior 12 months, and ask that we provide you with a copy of the following: 

• Categories of personal information we have collected, sold, or shared about you; 
• Specific pieces of personal information we collected about you;
• Categories of sources from which we collect personal information; 
• The business or commercial purpose for collecting, selling, or sharing the personal information;
• Categories of third parties with whom we disclose that personal information;
• Categories of personal information disclosed about you for a business purpose;  
• Categories of personal information that each recipient received.

Twice within a twelve month period, you have the right to request the personal information we have collected, used, disclosed, and sold about you during the past 12 months.

Right to Correct

You have a right to request that we correct inaccurate personal information maintained about you. 

Right to Delete

You have a right to request that we delete personal information, subject to certain exceptions. 

Right to Opt out of Selling or Sharing

You have the right to direct a business that sells or shares personal information about you to third parties to stop doing so. Kraken does not sell personal information.   

Right to Non-Discrimination

We will not discriminate against you for exercising any of these rights

Right to Portability

You have the right to receive this information in a format, where feasible, that is portable, usable, and allows you to transmit the personal information without impediment.

Other Rights That May Be Available in Some Circumstances

Right against automated decision making

A prohibition against a business making decisions about a consumer based solely on automated processing.

Private right of action

The right for a consumer to seek civil damages from a business for violations of a statute.

Other California Privacy Rights

The California “Shine the Light” law gives residents of California the right under certain circumstances to request information from us regarding the manner in which we share certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes.

Exemptions

Please note that certain types of personal information collected or maintained by a covered business are exempt from the CCPA. For example, a covered business has limited obligations, or in some cases, no obligations, under the CCPA with regard to the following types of personal information:

• Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations, or pursuant to the California Financial Information Privacy Act (Division 1.4 commencing with Section 4050 of the California Financial Code)
• Medical information governed by the Confidentiality of Medical Information Act or protected health information that is collected by a covered entity or business associate pursuant to the Health Insurance Portability and Accountability Act of 1996.

Please note that the description of the CCPA set forth in this California Notice is a summary of only certain aspects of the CCPA and is not and should not be considered a complete description of the CCPA. In addition to what is described above, the CCPA includes other exemptions that apply to particular types of personal information and particular businesses, as well as additional situations where a covered business is not required to honor a consumer’s request to delete the consumer’s personal information.

Other State Privacy Rights 

Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and  Virginia provide (now or in the future) their state residents with certain rights, which may include some or all of the following depending on your location:

• Confirm whether we process their personal information.
• Access and delete certain personal information.
• Correct inaccuracies in their personal information, taking into account the information's nature processing purpose (excluding Iowa and Utah).
• Data portability.
• Opt-out of personal data processing for:
  • targeted advertising (excluding Iowa);
  • sales; or
  • profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
• Either limit (opt-out of) or require consent to process sensitive personal data.

The exact scope of these rights may vary by state, please contact [email protected] if you have any questions. 

Exercising Rights

To exercise your rights described above, please submit a request to us by:

By email, at [email protected]

By phone, at  (888) 871- 2573

Only you or an agent who is authorized to act on your behalf (and registered with the California Secretary of State, if you are a California resident) may make a Request.

• You may only make two Requests within a 12-month period. 
• Each Request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. 
• We will make every effort to verify your identity using your email address, but we may request additional information. If an authorized representative is making the request on your behalf, we require documentation showing that the representative has such authority. Describe your Request with sufficient detail that allows us to properly evaluate and respond to it.
• We will not respond to your request or provide you with personal information if we are unable to verify your identity, or to verify the authority for the person making the request as your agent. 
• We will use personal information provided in a verifiable consumer Request to verify your identity or authority to make the Request, and not for any other purpose.

To appeal a decision regarding a consumer rights request, please use the same contact details as above.

Verified Request 

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. We may require you to provide any of the following information: your name, date of birth, the last four digits of your Social Security number, the email and physical addresses associated with your Kraken account, one or more recent transactions, and the last four digits of one or more of the cards associated with your account. 

If you have never had an account with us and you request access to or deletion of your personal information, there is likely no reasonable method by which we can verify your identity to the level of certainty required. The reason for this is that Kraken does not maintain information about non-account holders in a way that is linked to named actual persons (and historically has not linked IP addresses, device identifiers or other information collected by automated means to named actual persons). 

In addition, if you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

For questions or concerns about our privacy notices and practices, please contact us as described in the Exercising Rights section above. 

Response Timing And Format

We will respond to a verifiable consumer request within 45 days of its receipt.  If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.  If you have an account with us, we will deliver our written response to that account.  If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.  

Kraken will not charge a fee to process or respond to your verifiable consumer request, but reserves the right to request a fee if the request is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Changes To The Privacy Notice

You may request a copy of this Privacy Notice from us using the contact details set out above. Where changes to this Privacy Notice will have a fundamental impact on the nature of our processing of your personal data or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise any rights you may have under applicable law (e.g., to object to the processing).

We reserve the right to make changes to our Privacy Notice at any time consistent with applicable local laws. Such changes, as long as they do not have a fundamental impact on the nature of our processing of your personal data or, otherwise, have a substantial impact on you, will be posted on this page. We encourage you to review the web site and the Privacy Notice periodically for any updates or changes.