Privacy Policy

This Privacy Policy explains how Breinrock Ltd and its affiliates ("Breinrock", "we", "us" or "our") process the personal data of users of Breinrock's website (the "Website") and any services or products made available through the Website (collectively, the "Services"). This Privacy Policy applies regardless of how you access or use the Services.

Breinrock Ltd is a company incorporated in Cyprus with registration number HE 390800, registered at Harmony House, Office 11, 1st Floor, 4 Thekla Lysiotis, 3030 Limassol, Cyprus. Depending on the region in which you reside and the Services provided to you, one of the following Breinrock affiliates is responsible for the collection and processing of your personal data:

• Canada: Breinrock Ltd, FINTRAC licence number M20573902 and Bank of Canada registration number REG-2270, a company incorporated under the laws of Canada and having its place of business at 100 King Street West Suite 5700, Toronto, permitted to act as money transfer business;
• United Kingdom: Breinrock UK, licence number FRN929896, a company incorporated under the laws of United Kingdom and having its place of business at 73 Mornington Street, London, NW1 7QE;
• Czech Republic: Breinrock S.R.O., licence number 043 86 329, a company registered in Czech Republic, and having its place of business at Lazarská 1718/3, Nové Město, 110 00 Prague 1;
• United Arab Emirates: Breinrock DIFC Tech Limited, DFSA licence number F007440, a company registered in UAE, and having its place of business at Emirates Financial Tower S2109, DIFC, Dubai.
• Switzerland: Helvetic Digital Finance AG, a company registered in Switzerland with address Bahnhofplatz, 6300 Zug, Switzerland, and a member of VQF with license number 101286.

Depending on the service you use and your country of residence, the relevant Breinrock affiliate identified above may act as the controller of your personal data ("data controller" or "controller"), either independently or together with Breinrock. Breinrock processes personal data in accordance with the data protection laws applicable to the relevant Breinrock entity, the services provided to you and the jurisdictions in which those services are offered. Personal data may be provided to us through email, telephone, chatbot, post, the Website, the Services or any other communication channel offered by Breinrock.

By using or navigating the Website and Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the processing activities described in this Privacy Policy, you should not use the Website or Services.

The Services are not intended for persons under 18. Persons under 18 cannot register on our platform or provide personal data through our Website, Services or social media accounts.

Contact

For privacy enquiries or to exercise your rights, contact: support@breinrock.com.

1. DATA PROTECTION PRINCIPLES

Personal data is any information about you that enables us to identify you or the beneficiary of your transaction with us, either directly or indirectly. Personal data covers information such as your name and contact details, but also information such as identification numbers, electronic location data, and other online identifiers.

We are committed to complying with applicable data protection laws and will ensure that personal data is:

• Used lawfully, fairly and in a transparent way;
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• Relevant to the purposes we have told you about and limited only to those purposes;
• Accurate and kept up to date;
• Kept only as long as necessary for the purposes we have told you about;
• Kept securely.

2. What personal data we collect about you

We only collect the most relevant, proportionate for each purpose and strictly necessary personal data from you in the course of our business when you access, visit or use our Services. We collect data that are:

• necessary to provide our services to you, such as when you sign-up and open an account with us, when we carry out the necessary know your customer ("KYC") checks, and when you use our Services;
• information necessary to verify your age and identity;
• information about your preferences and interests;
• information about your use of the Services;
• information about the device you are using.

The personal data that we collect, and process includes:

• Data that have to do with your identity and your personal and contact information, such as your first name, last name, username, title, date of birth, personal number/code, date and place of birth, nationality, registered address, correspondence address, details of the personal identity documents (such as passport, identity documents), workplace contact information, the company you work for, images and selfie, signature, tax identification number, tax residency, email address, mobile phone number and other contact details, occupation, PEP status, and other commercial and/or identification information, such as details of your transactions or other information that may be needed under anti-money laundering obligations.
• Data connected to your account with us, such as your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Payment information – such as details of any transactions carried out using any of the Services, bank account number, e-wallet information, details about payments and transfers made using the Services.
• Data that have to do with the technical aspects of your visit to, and use of, the Services, such as the IP address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices that you use to access and use the Services. This could also include your precise geolocation.

3. How We Collect Your Data

We collect your data in various ways. These include the following:

• We may collect information that you provide directly.
  Typically, this will happen when you register or sign-up with us, where you create an account with us, when you fill in any application form, when you subscribe to our newsletter, when you participate in surveys, when you send us an email, when you sign a contract with us.
• We may collect information about you automatically.
  When you use our Services, including when you interact with our Website without logging in your account, we will automatically collect technical-related data about you, your equipment, browsing actions and patterns.
  
  Every time you use or access the Services, and our Website, data is collected. This data is stored in log files on the server and can include, the temporary storage of data and log files. The IP address is temporarily stored in the system as it is necessary to provide website access to your computer or other device. The IP address is retained while that website is being accessed. These log files are stored to ensure website functionality, optimize the content of our Website, and ensure the security of our IT system.
  
  Typically, automatic collection of data will happen when you browse and use our Services and Website, social media pages (usually with the use of cookies and other similar tracking technologies).
  
  We also use cookies and similar technologies operated by Google (Google Analytics and Google Ads) to measure how our Website is used and how our advertising performs. Where you are visiting from the European Economic Area, the United Kingdom or Switzerland, these technologies are not activated and no related cookies are placed until you give your consent through the cookie banner shown on your first visit. To determine whether your consent is required, we derive your country from your IP address when you request a page and record only the outcome ("consent required" or "not required") in a temporary cookie that expires after 12 hours and contains no identifier. See "Cookies and consent" in section 9 and our Cookie Policy.
• We may acquire information about you from third parties.
  We do this where we are permitted by law. This may be the information provided by our partners, marketing agencies, your public profile information on social media platforms such as LinkedIn, Facebook, Twitter and Instagram. We may associate the information we receive about you from yourself, public and commercial sources with other information we receive from you or about you.

These are the typical ways in which we collect information about you. We may collect information about you in other cases that are not covered by this Privacy Policy or using other methods not covered by this Policy. If this happens, we will inform you additionally.

4. How we use your personal data and basis for such use.

Purposes for which we will use your personal data

We will use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• When we have your consent,
• Where we need to perform the contract, we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

Purposes and Bases for Processing

In general, we may use your personal data to carry out, provide, fix, and improve our Services, develop new Services, and market our Services.

Below, we explain the ways we plan to use your personal data and the grounds we rely on. We may rely on more than one ground to use your data. You can contact us any time to ask for more details on the grounds we are relying on to use your data.

We reserve the right to offer you supplemental documents to this Privacy Policy that will describe the ways in which we process your personal data, other than as described above in the table.

Change of Purpose

We will use your personal data for the purposes for which we collect it or where we reasonably consider that we need to use it for another reason only if this reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. How long we keep your personal data

We retain personal data for as long as necessary to provide the requested Services, comply with legal, accounting and reporting requirements, resolve disputes and enforce agreements. Retention depends on applicable obligations, the nature and sensitivity of the data, risk of harm, processing purposes and whether those purposes can be achieved by other means.

Retention periods vary depending on the purpose of processing and the legal requirements applicable to the relevant Breinrock entity. Where personal data is processed to comply with legal or regulatory obligations, it may be retained for the period required by applicable law following the end of the business relationship or completion of the relevant transaction. Where no legal retention obligation applies, you may withdraw your consent or object to the processing, and the relevant personal data will generally no longer be retained or processed for those purposes unless another legal basis applies. Personal data may also be retained where necessary for legal, regulatory or dispute-resolution purposes.

6. Who We Share Your Personal Data With

We may disclose your information to our employees, agents, and Affiliates where necessary for their functions and subject to confidentiality and access controls.

We may also disclose your information to third parties, such as:

• Service Providers who provide services to us as we request them, such as IT and system administration services, cloud storage service providers, fraud detection, customer support, remote ID verification providers, strong customer authentication, e-signature providers,
• Companies that assist in payment transactions such as financial institutions, like banks, payment service providers like electronic money and payment institutions, international payment service organizations like SWIFT and TARGET 2.
• Relevant business partners, like banking partners and intermediaries, international payments services providers, as well as card manufacturing/personalisation and delivery companies, fraud and risk mitigation service providers.
• Professional advisers including lawyers, auditors, and insurers who provide relevant services,
• Governmental agencies or entities, regulatory authorities, or other persons in line with applicable rules, orders, subpoenas, official requests, or similar processes as either required or permitted by applicable law.
• Google (Google Ireland Limited for users in the European Economic Area, the United Kingdom and Switzerland; Google LLC elsewhere), which provides Google Analytics for website measurement, Google Ads for advertising measurement and personalisation, and Google reCAPTCHA to protect our online forms from abuse. Google processes this data as described at policies.google.com/technologies/partner-sites. Where you are in the European Economic Area, the United Kingdom or Switzerland, no data is shared with Google for analytics or advertising purposes unless you have consented through our cookie banner.

Please note the following:

• This list is non-exhaustive and there may be other examples where we need to share with other parties in order to provide our Services as effectively as we can.
• We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Where a recipient processes personal data as an independent controller in accordance with applicable law, that recipient will process personal data in accordance with its own privacy notice and legal obligations.

7. How We Protect Your Personal Data

We use a variety of technical and organisational measures to help protect your personal data from unauthorised access, use, disclosure, alteration or destruction consistent with the applicable data protection laws. We have also implemented appropriate information security policies, rules and technical measures to secure your personal data collected by us. Your personal data is saved in an encrypted form.

All of our partners, employees, consultants, workers and data processors (i.e. those who process your personal data on our behalf), who have access to, and are associated with the processing of personal data, are obliged to respect the confidentiality of such personal data, keep it secure and protect it.

8. Which Countries We Transfer Your Personal Data To

In order to provide our Services, we may need to transfer your personal data to locations outside of your jurisdiction of residence. For any such transfers, we will implement appropriate measures to ensure that your personal data remains protected and secure in accordance with applicable data protection laws.

For any transfers of data outside the European Economic Area (EEA), we only transfer personal data outside the EEA where we implement the appropriate measures to ensure a level of protection that is equivalent to that of the EU. To that end, we rely on either of the following measures:

• We transfer data to a jurisdiction that is recognised by the European Commission as applying adequate data protection standards,
• The data recipient has signed an agreement based on the Standard Contractual Clauses, or where the data recipient is a group company, the binding corporate rules apply, subject to any applicable additional safeguarding measures, if necessary, or
• Any other ground recognised at EU level as proper for third country transfers.

Data collected through Google Analytics, Google Ads and Google reCAPTCHA may be processed by Google LLC in the United States. Such transfers are covered by Google LLC's certification under the EU–US Data Privacy Framework (including the UK Extension) and the Swiss–US Data Privacy Framework and, where applicable, by the Standard Contractual Clauses.

9. Direct Marketing

We may sometimes contact you (by email, SMS text, letter or phone) in order to provide targeted marketing about our Services. Such marketing communications will only be sent to you if you gave your consent (when you registered for our Services or at another point) and you have not withdrawn such consent or if there is another basis to send such communications to you (for example, in certain circumstances, we may send marketing communications solely about our Services to existing customers using contact details we have obtained directly from the customer during the course of registration or the provision of our Services to them, provided they have not previously unsubscribed from such communications).

You have the right to object where we are processing your personal data for direct marketing purposes. This means you can opt-out from receiving direct marketing from us at any time.

How to Stop Receiving Marketing Messages from Us

You can ask us to stop sending you marketing material and messages any time. You can use any of the following methods:

• By following the unsubscribe or opt-out links in any marketing email or marketing message, or
• By adjusting your marketing preferences where we provide relevant links in your account, or
• By contacting us at any time at support@breinrock.com or via any other means of communication (including social media messages).

Where you opt out of receiving marketing messages, you will not stop receiving service communications, such as updates regarding the Services you use.

You should note that we are opposed to third-party spam mail activities and do not participate in such mailings, nor do we release or authorise the use of your personal data to third parties for such purposes.

Cookies and consent

We use three categories of cookies and similar technologies on our Website:

• Strictly necessary — required for the Website to function, to protect it and our online forms from abuse, and to remember your cookie choice. These are always active and do not require consent. They include a cookie (br_consent_region, 12 hours) that records only whether cookie consent is required in your region, and a record of your consent choice stored in your browser's local storage.
• Analytics — Google Analytics, used to measure which pages are visited and how the Website is used so that we can improve it. Accepting analytics does not enable advertising.
• Advertising — Google Ads, used to measure the performance of our advertising campaigns and to personalise the advertising you see on other websites.

If you are in the European Economic Area, the United Kingdom or Switzerland, analytics and advertising cookies are switched off by default. On your first visit you will see a banner where you can "Accept all", "Reject all" or "Manage preferences" to choose each category individually. Nothing non-essential is stored until you make a choice, and no option is pre-selected. Where we ask for your consent, that consent is the legal basis for the analytics and advertising processing described in section 4.

If you are visiting from elsewhere, analytics and advertising cookies are enabled by default, in accordance with the laws applicable there, and you will not see a banner. You can switch either category off at any time as described below.

Changing or withdrawing your choice. You can review, change or withdraw your consent at any time by selecting "Cookie settings" in the footer of any page. If you switch a category off, we immediately instruct Google to stop measurement for that category and delete the related Google cookies from your browser. Withdrawal does not affect the lawfulness of any processing carried out before it. Your choice is stored in your browser, so you may be asked again if you clear your browser data, use a different browser or device, or if we materially change how we use cookies.

You can also set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our Services may become inaccessible or not function properly.

For more information about the cookies we use, see our Cookie Policy.

10. Profiling

We do not carry out any automated decision-making about you where this has a legal or similar significant effect, including profiling. In case we carry out any such profiling, we will let you know. Please note that you have the right not to be subject to profiling, and you can exercise this right by contacting us in writing at support@breinrock.com.

11. Your Rights Regarding Your Personal Data

You have the following rights in relation to the personal data we hold about you. Please note that some of these rights will only apply in certain circumstances and some of them may be limited where we have an overriding interest or legal obligation to continue to process the data or where data may be exempt from disclosure due to reasons of confidentiality obligations.

• Access: you are entitled to ask us if we are processing your data and, if we are, you can request access to your personal data. This enables you to receive a copy of the personal data we hold about you and certain other information about it;
• Correction: you are entitled to request that any incomplete or inaccurate personal data we hold about you is corrected;
• Erasure: you are entitled to ask us to delete or remove personal data in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims;
• Restriction: you are entitled to ask us to suspend the processing of certain of your personal data about you, for example if you want us to establish its accuracy or the reason for processing it;
• Transfer: you may ask us to help you request the transfer certain of your personal data to another party;
• Objection: where we are processing your personal data based on legitimate interests (or those of a third party) and you may challenge this. However, we may be entitled to continue processing your information. You also have the right to object where we are processing your personal data for direct marketing purposes;
• Automated decisions: you may contest any automated decision made about you where this has a legal or similar significant effect and ask for it to be reconsidered.
• Consent: where we are processing personal data with consent, you can withdraw your consent at any time. For cookies, use "Cookie settings" in the footer of the Website.

If you want to exercise any of these rights, please contact us at support@breinrock.com. Please note that you also have a right to lodge a complaint with your local supervisory authority.

12. Links to Third-Party Websites

Our Services may include links to third-party websites, plug-ins (such as social media plug-ins) and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy policy of every website you visit.

13. Changes to This Policy

We may make changes to this Privacy Policy from time to time. To ensure that you are always aware of how we use your personal data we will update this Privacy Policy from time to time to reflect any changes to our use of your personal data. We may also make changes as required to comply with changes in applicable law or regulatory requirements. Where it is practicable, we will notify you by email of any significant changes. However, we encourage you to review this Privacy Policy periodically to be informed of how we use your personal data.