INTRODUCTION
This privacy policy explains how Blockmate (in the position of Data Controller) uses the Personal Data that is collected, used and shared once You access and use the Services (as defined below). Blockmate is committed to protect Your Personal Data and to respect Your privacy. By accessing and using the Services You agree to the data processing practices described in this Privacy Policy.
DEFINITIONS OF TERMS USED IN THIS PRIVACY POLICY
“Account Information” means information relating to Your Financial Asset Account.
"Account Information Service" means a service which enables to access, view or share (where relevant) Your Account Information.
“Account Servicing Payment Service Provider” means an entity which provides and maintains a Financial Asset Account for You.
"Applicable data privacy laws" means GDPR or any national or internationally binding data privacy laws or regulations that may be applicable at any time during the term of this Privacy Policy.
“Blockmate” means Blockmate j. s. a., a company incorporated and existing under the laws of the Slovak Republic, with its registered office at Černyševského 10, 851 01 Bratislava - mestská časť Petržalka, Slovak Republic, Company Identification No. (IČO): 54 114 772, registered in the Commercial Register maintained by the District Court Bratislava I, Section: Sja, Insert No.: 194/B.
“Blockmate Partner” means a third party, for example bank, credit institution or other service provider, which requires Your Account Information via Blockmate open-crypto API to provide You with its services.
"Data Controller" means the natural or legal entity/entities which determine(s) the purposes and means of the processing of Personal Data.
"Data Processor" means the legal entity processing Personal Data on behalf of the Data Controller(s).
"Financial Asset Account" means crypto exchange, custodial wallet, non-custodial wallet, non-fungible token service and/or blockchain account.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
"Services" means Blockmate Link.
"You" or “User” means You or the legal entity You represent.
WHEN THIS POLICY APPLIES?
This Privacy Policy applies when You access and use Blockmate’s Account Information Service on Blockmate’s website or via Blockmate’s Partner application, website or similar service.
When You access and use Account Information Service via Blockmate’s Partner application or website, the Blockmate’s Partner application or website will redirect You to an Account Information Service provided by Blockmate. This policy describes how Blockmate will use Your Personal Data when providing the Account Information Service.
This policy does not apply to services provided to You by Blockmate’s Partner. Such services may be subject to Blockmate’s Partner terms and conditions and privacy policies.
PERSONAL DATA, PROCESSING PURPOSES AND LEGAL BASIS
The provision of Account Information Service requires Blockmate to collect Your Account Information from Your Account Servicing Payment Service Provider You have selected. Blockmate collects Your Account Information to provide the Account Information Service to You (i.e. to fulfil contract between Blockmate and You). Collection of such information is always based on Your explicit consent.
Types of personal data we are Processing:
Following Personal Data which do not fall into the special category of Personal Data under Article 9 of GDPR:
Personal Data obtained from Your Account Servicing Payment Service Provider as part of Your Account Information in accordance with Your explicit consent (e.g. Your name and surname, list of Your crypto addresses and other financial information tied to Your Financial Asset Account and transaction history including, without limitation, history of deposits, purchases, transfers, swaps, staking and other transaction types tied to Your Financial Asset Account)
Purpose of Processing - Provision the Account Information Service to You
Lawful basis of Processing - Article 6 (1.) (b) of GDPR - Performance of the contract between You and Blockmate
Purpose of Processing - User identification in order to investigate any fraud, illegal activity or wrongdoing in connection with the Services; to conduct any due diligence required for us to provide Services to You
Lawful basis of Processing - To comply with our legal obligations (including KYC checks to comply with applicable AML laws)
Purpose of Processing - To improve, modify, enhance and further develop our Services, to anonymise or pseudonymise the Personal Data in order for it to be part of market study or analytics by us or a third party
Lawful basis of Processing - Article 6 (1.) (f) of GDPR - our legitimate interest in continuous improvement of our Services
Blockmate may also collect some information about You from Blockmate’s Partner which is necessary to provide You with the Account Information Service. In addition, Blockmate may perform data cleansing, transaction categorization, data enrichment and similar data processing activities on the retrieved Account Information where it is reasonably necessary for You to be able to receive the services provided by Blockmate Partner.
Provision of the respective Personal Data is a contractual requirement or requirement necessary to enter into a contract with You. If You do not furnish Your Personal Data in necessary extent, Blockmate will be unable to provide You with the Account Information Service.
HOW DOES BLOCKMATE COLLECT YOUR DATA?
From Blockmate Partner
The initial collection of Your personal data is done through a Blockmate Partner's service where Blockmate obtains the information required for it to provide the Account Information Service to you. The data refers to basic identity information (such as Your name and surname).
From You
Blockmate also collects some information directly from You. This includes information that is needed for communication with Your Account Servicing Payment Service Provider and also certain identity and address information that Blockmate might need for the performance of the Account Information Service. Blockmate may also collect other information directly from you that is required for it to fulfil our legal obligations.
From Your Account Servicing Payment Service Provider
The provision of the Account Information Service requires Blockmate to collect information from Your Account Servicing Payment Service Provider regarding Your crypto accounts, account transactions and other financial information. Please note that Blockmate does not collect this type of information without Your explicit consent.
From providers of identification solutions etc.
Finally, we may collect and verify basic identity information from suppliers of digital signature solutions (for example BankID) or similar. We may also collect information necessary for us to fulfil our legal obligations (such as anti-money laundering rules) from external parties.
FOR HOW LONG DOES BLOCKMATE STORE YOUR DATA?
In general, Blockmate only keeps Your Personal Data for the time necessary to fulfil the purpose of collection or further Processing, namely providing the required Services. Many types of Personal Data are in general deleted within one year from when Blockmate has fulfilled its obligations in relation to the Service, however some data may be kept longer (e.g. the data that is required for commencing a legal dispute or protecting Blockmate's rights in a legal dispute).
To determine data retention periods Blockmate takes into account:
- our legal obligations under applicable law;
- our contractual obligations and rights;
- our legitimate interests;
- potential disputes, necessity to be able to investigate any fraud, illegal activity or wrongdoing in connection with the Services;
However, some data may be kept for a longer period when it is necessary to fulfill Blockmate’s legal obligations, for example the applicable anti-money laundering laws.
WHAT ARE YOUR DATA PROTECTION RIGHTS?
Blockmate would like to make sure You are fully aware of Your data protection rights. Every User of the Account Information Service is entitled to the following:
Right of access
You have the right to obtain from Blockmate a confirmation whether it does, or does not process Your Personal Data. If Blockmate does, You have the right to be provided with access to such Personal Data as well as information about the type of your Personal Data Blockmate processes, for what purpose(s), to whom were your Personal Data disclosed, from what source Blockmate has obtained the data (unless obtained from You), whether they were transferred to a foreign country, period of their archiving, as well as how to request rectification, deletion or restriction on the Processing of Your Personal Data, the right to object to such Processing and the right to file a complaint to the relevant supervisory authority.
Right to rectification
Blockmate really cares that it processes only correct and complete Personal Data. If, however, You discover or believe that this is not the case, You have the right to request that Blockmate either rectifies, or updates your Personal Data.
Right restriction of Processing
You have also the right to request that Blockmate restricts Processing of Your personal data, as long as one of the following reasons are concerned:
- if You believe that Your Personal Data processed by Blockmate are incorrect, until their accuracy is verified;
- Processing of Your Personal Data is unlawful and You chose to request restriction of their Processing rather than their erasure;
- Blockmate no longer needs Your Personal Data for their Processing; however, You may still need those data to evidence, enforce and defend Your legal claims;
- if You object to the Processing of Your Personal Data, until it is established whether legitimate reasons for their Processing overrides your legitimate interests.
If your objection is successful and processing of your personal data is to be restricted, Blockmate will inform You in advance if restriction on Processing is lifted.
Right to erasure (Right to be forgotten)
You have the right to request that Blockmate erases Personal Data concerning You processed by it, provided that no exemption stipulated by law applies, and that one of the following conditions is satisfied:
- the data are no longer needed for the purposes for which they have been collected;
- You withdraw Your consent to processing of Personal Data and, at the same time, there is no legal basis backing their Processing;
- You raise an objection to the Processing of Your Personal Data backed by one of our legitimate interests and, at the same time, there are no overriding legitimate interests backing their continuing Processing, or You raise an objection to their Processing for direct marketing purposes;
- Personal Data were processed unlawfully.
Also, Blockmate will inform other recipients of your Personal Data that You have exercised your right of erasure. Accordingly, those additional recipients should erase all references/links to your Personal Data if this is feasible, having regard to the available technology and the costs of implementation of those steps.
Right to data portability
You have the right to obtain Your Personal Data processed by Blockmate in a structured, commonly used and machine-readable format. You may transfer those data also to third persons and, on your request, Blockmate will transfer your data directly to a processor of your choice, provided that this is technically feasible.
Right to object
In connection with the Processing of Personal Data based on Blockmate's legitimate interest, You have the right to object to the Processing of Your Personal Data. If Your privacy interests outweigh the interests of Blockmate in Processing certain Personal Data, we will stop Processing such data.
If You make a request, Blockmate will answer You within one month. If You would like to exercise any of these rights, please contact us at our email address: dpo@blockmate.io.
In case of requests that are manifestly unfounded or excessive, in particular because of their repetitive character, Blockmate is entitled to charge a reasonable administrative fee. In such cases You will be notified thereof beforehand.
RECIPIENTS OF PERSONAL DATA AND TRANSFERS
Your Personal Data may be accessed and processed only by authorized Blockmate employees in connection with provision of Account Information Service. All authorized employees are under confidentiality obligation with a legitimate need to process Personal Data for the Processing purposes stated in this Privacy Policy.
When Blockmate’s Partner redirects You to Blockmate’s Account Information Service and You agree to the Terms and Conditions of Blockmate’s Account Information Service, Your Account Information will be transferred to Blockmate’s Partner on Your own initiative if You have requested Blockmate to do so. In such cases, the Blockmate’s Partner becomes responsible for the Personal Data as a Data Controller immediately after the data transfer. Please be informed that in some cases Blockmate’s Partner may be located outside of the European Economic Area / European Union and Your Personal Data may be at a higher data protection risk due to the absence of an adequacy decision and appropriate safeguards in the respective country. If Blockmate’s Partner is located outside of the European Economic Area / European Union, we rely on Your explicit consent and the necessity for the performance of a contract between You and Blockmate for such data transfer (Article 49, section 1 (a) and (b) of the GDPR). Blockmate’s Partner will be identified in the consent window, which will always be presented before You use the Account Information Service.
We have also engaged a few suppliers and vendors as Data Processors to help us provide You Services, e.g. cloud service providers, client relations management service providers, email service providers, payment processors etc. Blockmate will be responsible for the correct Processing of Your Personal Data according to Blockmate’s instructions given to such Data Processors and Applicable data privacy laws.
Your Personal Data may be disclosed if it is required by a competent authority, the Applicable data privacy laws and other applicable laws in order to fulfill Blockmate's legal obligations.
Your Personal Data will not be transferred or stored in countries outside of the European Economic Area / European Union unless legal grounds for such transfer exist and there is an adequate level of data protection.
AUTOMATED DECISION-MAKING
Blockmate does not make any decisions based solely on automated processing of Personal Data that would have any legal effects whatsoever, or that would affect You in any significant way.
SECURITY MEASURES
In order to protect Your Personal Data, Blockmate has put in place a number of technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the Processing and the nature of the Personal Data being processed. Organisational measures include restricting access to the Personal Data solely to authorised persons bound by confidentiality obligation with a legitimate need to process Personal Data for the Processing purposes stated in this policy.
CHANGES TO OUR PRIVACY POLICY
Blockmate keeps this Privacy Policy under regular review and places any updates on this web page. Blockmate will inform You about substantial changes to this Privacy Policy via Blockmate’s website, via email or other means of electronic communication. Blockmate has the right to change this Privacy Policy solely at any time.
HOW TO CONTACT BLOCKMATE?
If You have any questions concerning this Privacy Policy, the Personal Data Blockmate processes about You, or You would like to exercise one of Your data protection rights, please do not hesitate to contact us at our email address: dpo@blockmate.io.
HOW TO CONTACT THE APPROPRIATE AUTHORITY?
Should You wish to report a complaint or if You feel that Blockmate has not addressed Your concern in a satisfactory manner, You may contact the respective supervisory authority - Office for Personal Data Protection of the Slovak republic (Úrad na ochranu osobných údajov Slovenskej republiky) at:
Address: Hraničná 12, 820 07 Bratislava 27, Slovak republic
E-mail: statny.dozor@pdp.gov.sk
Phone: + 421 2 32 31 32 14
