Privacy Notice

Last Updated: June 16, 2023

1. Introduction

This privacy notice applies to the processing activities performed by Kraken to the personal data of its clients, prospective clients, and website visitors. 

Your privacy is of the utmost importance to us. It is our policy to safeguard the confidentiality of information and respect the privacy of individuals. 

Please see below for information about how we manage personal data, and for information about your rights with respect to the processing of your personal data.

 

2. Definitions

The following terms are defined as follows:

2.1 “AML” means anti-money laundering. 

2.2 “Digital Asset” means any digital representation of value that may be traded via Kraken’s services, excluding non-fungible tokens.

2.3 “Kraken”, “We”, “Us”, refers collectively to Payward, Inc. and its subsidiaries.

2.4 “Personal data” refers to any information relating to an identified or identifiable natural person, including names, identification numbers, location data, an online identifier, or to one or more factors specific to the physical, economic, cultural or social identity of a natural person.

2.5 “VASP Services” means exchange between digital assets and fiat currencies; exchange between one or more forms of digital assets; transfer of digital assets, that is to say, conduct a transaction on behalf of another person that moves a digital asset from one digital asset address or account to another; and act as a custodian wallet provider.

 

3. Your Data Controller

Our products and services are provided through local operating entities that are part of the Kraken group of companies.

You are contracting with one Kraken group company as specified in Section 18 Full Details of Data Controllers.

 

4. How do we protect personal data?

Kraken takes the security of personal data incredibly seriously. Please see here for further detail about our information security practices, and here for general security information.

 

5. Information we may collect about you

We obtain information about you in a number of ways through your use of our products and services, including through any of our websites, the account opening process, webinar sign-up forms, event subscribing, news and updates subscribing and from information provided in the course of on-going support service communications. In order to open an account with us, you must first complete and submit a “create account” form to us by completing the required information. By completing this form, you are requested to disclose personal data in order to enable Kraken to assess your application and comply with the relevant laws and regulations.

The information that we collect from you is as follows:

• Full name, residential address and contact details (e.g. email address, telephone number etc.), date of birth, place of birth, gender, citizenship (“Biographical information and contact information”);
• Bank account information, wallet addresses, credit card details, details about your source of funds, assets and liabilities, and information relating to economic and trade sanctions lists (“Financial information”);
• Trading account balances, trading activity, your inquiries and our responses (“Trading information”);
• Information on whether you (or someone close to you) holds a prominent public function (“PEP information”);
• Verification information, which includes information necessary to verify your identity such as a passport, driver’s licence, selfie photos / videos, login credentials or Government-issued identity card (“Verification information”);
• Other personal data or commercial and/or identification information – Information we, in our sole discretion, deem necessary to comply with our legal obligations under various AML obligations, such as under the European Union’s 5th AML Directive and the U.S. Bank Secrecy Act (“Other information”).

Information we collect about you automatically:

• Browser information – Information that is automatically collected via analytics systems providers from your browser, including your IP address and/or domain name and any external page that referred you to us, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform (“Browser information”);
• Log information – Information that is generated by your use of Kraken-branded websites, applications, services, or tools operated by Kraken that is automatically collected and stored in our server logs. This may include, but is not limited to, device-specific information, location information, system activity and any internal and external information related to pages that you visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our Website or App (including date and time, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page (“Log information”).
  • The provision of personal data is necessary for entering into the contract governing your use of our products and services. The minimum information required to be provided is biographical information and contact information, verification information, and financial information. Without this information, we cannot commence, or continue to perform our services or provide our products to you. 

  • It is a statutory requirement to provide certain information in order for us to comply with our legal obligations in respect of anti-money laundering and crime and fraud prevention. At a minimum, this includes biographical information and contact information, financial information and verification information. Without this information, we cannot meet our legal obligations under anti-money laundering and crime and fraud prevention laws.

Information we receive about you from other sources.

We also receive information about you from third parties such as your payment providers and through publicly available sources. For example:

• The banks you use to transfer money to us will provide us with your basic personal data, such as your name and address, as well as your financial information such as your bank account details;
• Your business partners may provide us with your name and address, as well as financial information;
• Advertising networks, analytics providers and search information providers may provide us with anonymized or de-identified information about you, such as confirming how you found our website. 
• Credit reference agencies may provide us with your personal data during the credit referencing process.

 

6. Our legal justification for processing personal data

7. Disclosure of your personal data

As part of processing your personal data for the purposes set out above, Kraken may disclose your personal data to any members of the Kraken company group, and to third parties. For example, Kraken may disclose your personal data to any of our service providers and business partners, for business or other legitimate purposes, such as specialist advisors who have been contracted to provide us with administrative, financial, legal, tax, compliance, insurance, IT, debt-recovery, analytics, research or other services.

If Kraken discloses your personal data to service providers and business partners, in order to perform the services requested by clients or to comply with our legal and regulatory obligations, such providers and partners may store your personal data within their own systems. We require them to protect the confidentiality of this personal data, and comply with all relevant privacy and data protection laws.

 

8. Where we store your personal data

Our operations are supported by a network of computers, servers, other infrastructure and information technology, and third-party service providers. We and our third-party service providers and business partners store and process your personal data in the European Union, Japan, the United Kingdom, the United States of America and elsewhere in the world. Courts, law enforcement and security agencies of these jurisdictions may be able to use legal processes to access your personal data.

 

9. For UK & EEA clients: Transfers of personal  data outside of the European Economic Area (EEA) and the United Kingdom (UK)

We may transfer your personal data outside the EEA and UK to other Kraken group companies, service providers and business partners. Transfers outside of the EEA or the UK (as appropriate) shall be in accordance with lawful transfer mechanisms. If personal data is transferred to a country which has been found by the European Commission to have an essentially equivalent standard of data protection to the EEA, then Kraken may rely on an ‘adequacy decision’ to transfer that personal data. See here for a list of countries with adequacy decisions. If personal data is transferred from the EEA or UK to the US, we may rely on standard contractual clauses. 

 

10. Privacy when using digital assets and blockchains

Your use of digital assets may be recorded on a public blockchain. Public blockchains are distributed ledgers, intended to immutably record transactions across wide networks of computer systems. Many blockchains are open to forensic analysis which can lead to re-identification of transacting individuals and the revelation of personal data, especially when blockchain data is combined with other data.

As blockchains are decentralized or third-party networks which are not controlled or operated by Kraken, we are not able to erase, modify, or alter personal data on such networks.

 

11. Data retention

When personal data is no longer necessary for the purposes for which it may lawfully be processed, we will remove any details that will identify you, or we will securely destroy the relevant records. We may need to maintain records for a significant period of time after you cease being our client for legal or regulatory reasons, for example when we need to retain information to help manage a dispute or legal claim. Additionally, we are subject to certain anti-money laundering laws which may require us to retain the following for a period (e.g., 5 years) after our business relationship with you has ended:
 

• A copy of the records we used in order to comply with our client due diligence obligations;
• Supporting evidence and records of transactions with you, and your relationship with us.

If you have opted out of receiving marketing communications we will hold your details on our suppression list so that we know you do not want to receive these communications.

We may keep your personal data for longer than 5 years if we cannot delete it for legal, regulatory, or technical reasons.

 

12. Cookies

When you use our products and services or visit our websites, we may place tiny data files called cookies, flash cookies, pixel tags, or other tracking tools (herein, “Cookies”) on your computer or other devices used when engaging with us. We use cookies to help us recognize you as a customer, collect information about your use of our products and services, to better customize our services and content for you, and to collect information about your computer or other access devices to ensure our compliance with our U.S. Bank Secrecy Act and AML obligations.

 

13. Your rights regarding your personal data

The rights that are available to you in relation to the personal data we process are outlined below. You may request to exercise these rights subject to any limitations provided for under applicable data protection laws. 

Access

You can ask us to confirm whether we are processing your personal data and, if so, what information we process and to provide you with a copy of that information.

Rectification

It is important to us that your personal data is up to date. We will take all reasonable steps to make sure that your personal data remains accurate, complete and up-to-date. Please inform us if your personal data changes. If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have disclosed your personal data to others, we will let them know about the rectification where possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

You may inform us at any time that your personal details have changed by emailing us at [email protected]. Subject to applicable law, Kraken will change your personal data in accordance with your instructions. To proceed with such requests, in some cases we may need supporting documents from you as proof i.e. personal data that we are required to keep for regulatory or other legal purposes.

Erasure

You can ask us to delete or remove your personal data in certain circumstances. Such requests may be subject to any retention limits we are required to comply with in accordance with applicable laws and regulations. If we have disclosed your personal data to others, we will let them know about the erasure request where possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

Processing restrictions

You can ask us to block or suppress the processing of your personal data in certain circumstances such as if you contest the accuracy of that personal data or object to us processing it. It will not stop us from storing your personal data. If we have disclosed your personal data to others, we will let them know about the restriction of processing if possible. If you ask us, and if possible and lawful to do so, we will also inform you with whom we have shared your personal data.

Data portability

In certain circumstances you may have the right to obtain personal data you have provided to us, in a structured, commonly used and machine-readable format, and to re-use it elsewhere or ask us to transfer this to a third party of your choice, where technically feasible.

Objection

You can ask us to stop processing your personal data, and we will do so, if we are:

• Relying on our own or someone else’s legitimate interests to process your personal data except if we can demonstrate compelling legal grounds for the processing or for the establishment, exercise or defence of legal claims;
• Processing your personal data for direct marketing; or
• Processing your personal data for research unless we reasonably believe such processing is necessary for the performance of a task carried out for reasons of public interest (such as by a regulatory or enforcement agency).

Automated decision-making and profiling

If we have made a decision about you based solely on an automated process (e.g. through automatic profiling) that affects your ability to access our products and services or has another significant effect on you, you can request not to be subject to such a decision unless we can demonstrate to you that such decision is necessary for entering into, or the performance of, a contract between you and us. Even if a decision is necessary for entering into or performing a contract, you may contest the decision and require human intervention. We may not be able to offer our products or services to you, if we agree to such a request (i.e. end our relationship with you).

Complaints

You have the right to complain to a competent data protection authority. Contact details are set out in Section 17 below. We ask that you first contact [email protected] to give us an opportunity to address any concerns. 

Withdraw consent

You have the right to withdraw consent to processing based on consent at any time. Note this will not affect the lawfulness of processing based on consent prior to the withdrawal of consent or on grounds where consent is not required. 

 

14. Changes to this privacy notice

Our privacy notice is reviewed regularly in light of new regulations, technologies, and any changes to our business operations. Any personal data we process will be governed by our most recent privacy notice. We will update the “Last updated” date accordingly at the beginning of this privacy notice. Please review this privacy notice from time to time. We will announce any material changes to this privacy notice on our website. 

 

15. Our products and services are not available to children

Our products and services are not directed to persons under the age of 18 (herein, “Children”, “Child”) and we do not knowingly collect personal data from children. If we learn that we have inadvertently processed personal data from a child, we will take legally permissible measures to remove that data from our records. Kraken will require the child user to close his or her account and will not allow the use of our products and services. If you are a parent or guardian of a child, and you become aware that a child has provided personal data to us, please contact us at [email protected].

 

16. Contact information

Any questions, complaints, comments and requests regarding this privacy notice are welcome and should be addressed to [email protected]. You can also contact our Data Protection Officer at [email protected]. 

 

17. Data Protection Authorities

If you are not satisfied with our response to your complaint, you have the right to submit a complaint to a competent data protection authority. You can contact the appropriate data protection authority using the details below:

For residents of Australia:

Office of the Australian Privacy Commissioner
GPO Box 5218,
Sydney, NSW 2001, Australia

For residents of Canada:

Office of the Privacy Commissioner of Canada
30, Victoria Street
Gatineau, QC K1A 1H3, Canada

For residents of the United Kingdom:

The Information Commissioner’s Office
Wycliffe House, Water Ln
Wilmslow SK9 5AF, UK

For residents of the European Economic Area:

You may complain to your local supervisory authority or to our lead supervisory authority the Irish Data Protection Commission:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

For residents of Japan:

Personal Information Protection Commission
Kasumigaseki Common Gate West Tower 32nd Floor,
3-2-1, Kasumigaseki, Chiyoda-ku,
Tokyo, 100-0013, Japan

For clients of Kraken Futures (Singapore):

Personal Data Protection Commission
10 Pasir Panjang Road,
#03-01 Mapletree Business City Singapore 117438

 

18. Full details of Data Controllers 

You are contracting with one Kraken group company, as follows:

• If you reside in Australia, you are contracting with Bit Trade Pty Limited, Unit 610, 478 George Street, Sydney, NSW 2000, Australia. 
• If you reside in Canada, you are contracting with Payward Canada Inc., 1100-1959 Upper Water Street, Halifax, NS B3J 3N2, Canada. 
• If you reside in the UK, you are contracting with Payward Ltd., 6th Floor, One London Wall, London, EC2Y 5EB, United Kingdom. 
• If you reside in the United States, you are contracting with Payward Ventures, Inc., 100 Pine St Suite 1250, Office 6, PMB A188, San Francisco, CA 94111, USA. 
• If you reside in Italy you are contracting with Payward Europe Solutions Limited, 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, operating through its Italian Branch, Payward Europe Solutions Limited, Italian Branch, 21 Via San Marco, Milan, MI, 20121, Italy (for VASP Services). For all other clients located in the European Economic Area you are contracting with Payward International Markets Limited, Trinity Chambers, PO BOX 4301, Road Town, Tortola, British Virgin Islands. 
• If you reside in the rest of the world (other than Japan, in which case, you have been provided with a separate privacy notice that is applicable to you), you are contracting with Payward Trading Ltd., c/o SHRM Trustees (BVI) Limited, Trinity Chambers, Ora et Labora Building, Road Town, Tortola, VG1110, British Virgin Islands. 
• If you are a client of Kraken Futures, you are contracting with either Payward Brokers Pte. Ltd., or Payward Global Trading Pte. Ltd., 8 Tomasello Boulevard, #15-04, Suntec Tower Three, Singapore 038988. 
• The company you are contracting with is your Data Controller, and is responsible for the collection, use, disclosure, retention and protection of your personal data in accordance with our global privacy standards, this Privacy Notice, as well as any applicable national laws. We process and retain your personal data on our servers in multiple data center locations, including the European Union, Japan, Australia, the United Kingdom, the United States of America and elsewhere in the world.