Data Privacy Notice
I. General information
SCRYPT Digital Investments AG(CHE-303.372.623), c/o SCRYPT Digital Trading AG, Dammstrasse 16, 6300 Zug, Switzerland (“SCRYPT”) and Scrypt Digital Trading AG (CHE-289.979.451),Dammstrasse 16, 6300 Zug Switzerland (“Scrypt Trading”) (also «we», «us»)appreciate you visiting our website or platform and your interest in the products and services we offer. Protecting your personal data is very important to us. In this Privacy Notice, we explain how we collect your personal data when you use our website or platform, obtain products or services from us, interact with us in relation with a contract, communicate with us or otherwise deal with us, what we do with your personal data, for what purposes and on what legal foundation we do so, and what rights you have on that basis. We use the word «data» here interchangeably with «personal data».
If you provide information to us about any person other than yourself, your employees, counterparties, your advisers or your suppliers, you must ensure that the data is accurate and that they understand how their information will be used, and that they have given their permission for you to disclose it to us and for you to allow us, and our outsourced service providers, to use it.
This Privacy Notice is aligned with the EU General Data Protection Regulation («GDPR») and the Swiss Data Protection Act(«DPA»). However, the application of these laws depends on each individual case.
II. Name and address of the responsible person
The responsible person for processing your data under this Privacy Notice («Controller») unless we tell you otherwise in an individual case is:
Regarding the processing of data related to the use of this website:
SCRYPT Digital Trading AG (CHE-289.979.451) and (jointly)
SCRYPT Digital Investments AG (CHE-303.372.623)
Dammstrasse 16
6300 Zug
These two legal entities act as joint-controllers regarding the processing of data related to the use of this website, their designated joint controller representative is Scrypt DigitalTrading AG that is entitled to act on behalf of the two legal entities mentioned above and is responsible for providing information to the data subjects in a complaint manner, and for processing and responding to the request submitted to any legal entity by a data subject or authority.
Regarding the processing of data related to the use of our services, the responsible person for processing your data is your respective contracting party, i.e. either SCRYPT Digital Trading AG or SCRYPT Digital Investments AG, acting as separate controller.
You may contact us regarding all data protection matters (no matter whether they are relating to the website or to our services etc.) and to exercise your rights at:
III. Categories of data we process
The processing of personal data is limited to data that is required to operate a functional website and/or platform and for the provision of content, products and services. The processing of personal data of our users is based on the purposes agreed or on a legal basis. We only collect personal data that is necessary to implement and process our tasks and services or if you provide data voluntarily. Depending on the reason and purpose of the processing, we process different data about you :
Technical data
When you use our website or other online offerings, we collect the IP address of your terminal device and other technical data in order to ensure the functionality and security of these offerings. This data includes logs with records of the use of our systems. We generally keep technical data for 6months. In order to ensure the functionality of these offerings, we may also assign an individual code to you or your device (for example as a cookie, see Section XIV). Technical data as such does not permit drawing conclusions about your identity. However, technical data may be linked with other categories of data (and potentially with your person) in relation with user accounts, registrations, access controls or the performance of a contract.
We use the word «data» here interchangeably with «personal data».
User data and registration data
Our services can only be used with a user account or a registration . Such data will be kept for 13 months from the date of the use of the services or the user account is closed.
Communication data
Our services can only be used with a user account or a registration . Such data will be kept for 13 months from the date of the use of the services or the user account is closed.
Master data
Master data is the basic data that we need, in addition to contract data (see below), for the performance of our contractual and other business relationships or for marketing and promotional purposes, such as name and contact details, and information about, for example, your role and function, your bank details, your date of birth, customer history, powers of attorney, signature authorisations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (for example as a contact person of the business partner), or because we wish to address you for our own purposes or for the purposes of a contractual partner (for example aspart of marketing and advertising, for invitations to events, for vouchers, newsletters, etc.). We receive master data from you (for example when you buy something on our website), from parties you work for, or from third parties such as contractual partners, associations and address brokers, and from public sources such as public registers or the internet (websites, social media, etc.). We generally keep master data for 10 years from the last exchange between us but at least from the end of the contract. This period may be longer if required for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons. For contacts used only for marketing and advertising, the period is usually much shorter, usually no more than 2 years from the last contact.
Contract data
We collect contract data in relation with the conclusion or performance of a contract, e.g. information about the products and the services provided or to be provided, as well as data from the period leading up to the conclusion of a contract, information required or used for performing a contract, and information about feedback (e.g. complaints, feedback about satisfaction, etc.). We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources (for example credit information providers)and from public sources. We generally keep this data for 10 years from the last contract activity but at least from the end of the contract. This period may be longer where necessary for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons.
Behavioural and preference data
Depending on our relationship with you, we try to get to know you better and to tailor our products, services and offers to you. For this purpose, we collect and process data about your behaviour and preferences. We do so by evaluating information about your behaviour and we may also supplement this information with third-party information, including from public sources.Based on this data, we can for example determine the likelihood that you will use certain services or behave in a certain way. The data processed for this purpose is already known to us (for example where and when you use our services), or we collect it by recording your behaviour (for example how you navigate our website. We anonymise or delete this data when it is no longer relevant for the purposes pursued, which may be – depending on the nature of the data – between 2-3 weeks and 24 months (for product and service preferences).This period may be longer as for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons. We describe how tracking works on our website and platform in Sections XIV et seq.
Other data
We also collect data from you in other situations. For example, data that may relate to you (such as files, evidence, etc.) is processed in relation with administrative or judicial proceedings. We may also collect data for health protection (for example as part of health protection concepts). We may obtain or create photos, videos and sound recordings in which you may be identifiable (for example at events, with security cameras, etc.). We may also collect data about who enters certain buildings, and when or who has access rights (including in relation with access controls, based on registration data or lists of visitors, etc.), who participates in events or campaigns, e.g.competitions and who uses our infrastructure and systems and when. The retention period for this data depends on the processing purpose and is limited to what is necessary. This ranges from one or two days for many of the security cameras, to usually a few weeks in case of data for contact tracing and visitor data that is usually kept for 3 months, to several years or longer for reports about events with images.
Much of the data set out in this Section is provided to us by you, e.g. through forms, in relation with communication with us, in relation with contracts, when you use the website or platform, etc. You are not obliged or required to disclose data to us except in individual cases, for example within the framework of binding health protection concepts (legal obligations). If you wish to enter into contracts with us or use our services, you must also provide us with certain data, in particular master data, contract data and registration data, as part of your contractual obligation under the relevant contract. When using our website or platform, the processing of technical data cannot be avoided. If you wish to gain access to certain systems or buildings, you must also provide us with registration data.
However, in the case of behavioural and preference data, you have the option of objecting or not giving consent.
As far as it is not unlawful we also collect data from public sources (for example debt collection registers, land registers, commercial registers, the media, or the internet including social media) or receive data from other companies within our group, from public authorities and from other third parties (such as credit agencies, address brokers, associations, contractual partners, internet analytics services, etc.).
And preference data, you have the option of objecting or not giving consent.
IV. Purposes of the processing
We process your data for the purposes explained below. Further information is set out in Sections XIV et seq for online services. These purposes and their objectives represent interests of us and potentially of third parties. You can find further information on the legal basis of our processing in Section V.
Communication
We process your data for communication purposes, in order to communicate with you, in particular, when you contact us in order, to respond to your queries or when you exercise your rights. For this purpose, we use in particular communication data, master data and registration data to enable us to communicate with you and provide our services or respond to requests. We keep this data to document our communication with you, for training purposes and quality assurance.
Performance of a contract
We process your data for entering into a contract with you, perform and administer it. In particular, we process communication data, master data, registration data and contract data about you. This might include data about third parties, e.g. if you order products or services for the benefit of a third party. This also includes data about potential customers, that we receive from communication with you, on a trade fair or any other business event. As regards the conclusion of a contact, we use this data to assess your creditworthiness and to open up a business relationship with you. Administering and performing the contract with your might involve third parties, such as logistic companies, advertising service providers, banks, insurance companies or credit information providers in order to provide our products and services to you.
Marketing and relationship management
We process your data for marketing and relationship management purposes. For example, we send personalised newsletters for products and services from us and, if applicable from selected third parties (e.g.advertising partners). Marketing and relationship management might include contacting you via e-mail, telephone or other channels for which we have contact information from you. We and, if applicable, selected third parties, only display personalised content or advertising based on your usage behaviour or send e-mails for marketing purposes (e.g. newsletter) if and to the extent you give your consent to us if required under applicable law. You can object to such marketing activities or withdraw your consent at any time (please seeSection XI and XII).
As regards relationship management, we use a customer relationship management system («CRM») to store and process your data as described in this Privacy Notice (e.g. about contact persons, products and services provided to you, interactions, interests, marketing measures, newsletters, invitations to events and other information). In order to provide you with the best products and services and to use our resources as effectively as possible we use the CRM together with the company group.
Product/service improvement and innovation
We process your data for market research and to improve our products and services (including our website and platform).
Safety or security reasons
We process your data to protect our IT and other infrastructure(e.g. buildings). For example, we process data for monitoring, analysis and testing of our networks and IT infrastructures including access controls. We might also use surveillance systems, e.g. cameras for security purposes. In such a case, we will inform you at the relevant locations separately.
Compliance with law
We process your data to comply with legal requirements, e.g. health security concepts, money laundering and terrorist financing, tax obligations etc. and we might have to request further information from you to comply with such requirements («Know Your Customer») or as otherwise required by law and legal authorities.
Risk management, corporate governance and business development
We process your data as part of our risk management and corporate government in order to protect us from criminal or abusive activity. As part of our business development, we might sell businesses, parts of businesses or companies to others or acquire them from others or enter into partnerships and this might result in the exchange and processing of data based on your consent, if necessary.
V. Legal basis for processing your data
Your consent
Where we asked for your consent (e.g. for receiving newsletters and for personalised content or advertising based on your usage behaviour or for processing sensitive data), we process your data based on such consent. You may withdraw your consent at any time with effect for the future by providing us written notice (e-mail sufficient), see our contact details in Section II. If you like to withdraw your consent for online tracking, please see Section XIV. Withdrawal of your consent does not affect the lawfulness of the processing that we have carried out prior to your withdrawal, nor does it affect the processing of your data based on other processing grounds. Where we did not ask for your consent, we process your data on other legal grounds, such as
- contractual obligation
- a legal obligation
- a vital interest of the data subject or of another natural person
- to perform a public task
- a legitimate interest, which includes compliance with applicable law and the marketing of our products and services, the interest in better understanding our markets and in managing and further developing our company, including its operations, safely and efficiently.
VI. On-Chain Data and Metadata
By using our platform you acknowledge that your personal data is stored on publicly searchable blockchains and neither we, nor any third party, has any power to delete such data published by its users to the blockchain. You hereby release and indemnify us of any data privacy liability associated with data that are published on the blockchain by using our platform.
Wallet Address and Transaction History
No entity, including us, is capable of modifying or deleting data that is stored on the blockchain. The details of transactions are public information and stored on such blockchains in association with wallet addresses. If your account is ever deleted, the transaction history on the blockchain remains.
VII. Disclosure of data to third parties and social plug-ins
In order to perform our contracts, fulfill our legal obligations, protect our legitimate interest and the other purposes and legal grounds set out above, we may disclose your data to third parties, in particular to the following categories of recipients:
Service providers
We may share your information with service providers and business partners around the world with whom we collaborate to fulfil the above purposes (e.g. IT provider, shipping companies, advertising service provider, security companies, banks, insurance companies, telecommunication companies, credit information agencies, address verification provider, KYC-provider, custody solution providers, brokers and exchanges, lawyers) or who we engage to process personal data for any of the purposes listed above on our behalf and in accordance with our instructions only.
Contractual partners including customers
In case required under the respective contract we share your data with other contractual partners. If we sell or buy any business or assets, we may disclose your data to the prospective seller or buyer of such business or assets to whom we assignor novate any of our rights and obligations.
Legal Authorities
If legally obliged or entitled to make disclosures or if it appears necessary to protect our interests, we may disclose your data to courts, law enforcement authorities, regulators, government officials or other legal authorities inSwitzerland or abroad, e.g. in criminal investigations and legal proceedings including alternative dispute resolution.
Social Plug-ins
We do not use social media plug-ins on our website. If our website contains icons of social media providers (e.g. LinkedIn, Twitter), we use these only as passive links to the websites of the respective social media platforms.
Our Appearance on Social Networks
We are present on the following social media platforms: Twitter, LinkedIn and collect data about you as described in Section IV and below. We receive this data from you and the platforms, when you enter into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence).
At the same time, the platforms evaluate your use of our online presence and link this data with other data about you known to the platforms (e.g. about your behaviour and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes(e.g. to personalise advertising) and to control their platform (e.g. which content they show to you). This also happens, if you do not have a profile on the social media platform.
We process this data for the purposes described in Section IV, in particular for communication, marketing purposes and market research. You will find information on the legal basis in Section V.
We would like to point out that you use our presence on social media platforms and their functions on your own responsibility. This applies, in particular to the use of interactive functions (e.g. commenting, sharing, rating).
The individual data processing activities and their scope differ depending on the social media provider. For details about the collection and storage of your personal data and about the type, scope and purpose of its use by the social media provider, please refer to the privacy policy of the social media provider:
ADDRESS
Link to Privacy Policy
LinkedIn Ireland Unlimited Company,
Wilton Place, Dublin 2, Ireland
https://www.linkedin.com/legal/privacy-policy
Twitter Inc. 1355 Market Street, Suite 900,
San Francisco, CA 94103, USA
https://twitter.com/en/privacy
The data collected about you in this context is processed by the platforms and may be transferred to countries outside the European Union, in particular the USA, which is considered not to provide adequate data protection from a Swiss/EU perspective. Therefore, we have agreed to so-called standard data protection clauses (SCCs) with the social media providers in order to ensure compliance with an appropriate level of data protection in third countries.
We do not know how the social media platforms use the data from your visit to our account and interaction with our posts for their own purposes, how long this data is stored and whether data is passed on to third parties. The data processing may differ depending on whether you are registered and logged in to the social network or visit the site as a non-registered and/or non-logged-in user. When you access a post or the account, the IP address assigned to your terminal device is transmitted to the provider of the social media platform. If you are currently logged in as a user, a cookie on your end device can be used to track how you have moved around the network. Buttons embedded in websites enable the platforms to record your visits to these website pages and assign them to your respective profile. Based on this data, content or advertising can be offered tailored to you. If you wish to avoid this, you should log out or deactivate the "stay logged in" function, delete the cookies on your device and restart your browser.
To exercise your data subject rights, you can contact both, us or the provider of the social media platform. To the extent that one party is not responsible for responding or must obtain the information from the other party, we or the provider will then forward your request to the respective partner. Please contact the provider of the social media platform directly for questions about profiling, processing of your data when using the website. For questions about the processing of your interaction with us on our site, write to the contact details provided by us above.
For further information on the purpose and scope of data collection and processing by the social media platform, please review the privacy notices of these social media platforms, where you will also receive further information about your rights and about setting options for protecting your privacy.
VIII. Transfer of data abroad
As we have explained in Sections VI and VII, we disclose data to other parties, not all of them located in Switzerland. Your data may be processed in the EuropeanEconomic Area (EEA) and in exceptional circumstances also in countries outside the EEA and around the world, which includes countries that do not provide the same level of data protection as Switzerland or the EEA and are not recognised as providing an adequate level of data protection. We only transfer data to these countries when it is necessary for the performance of a contract or for the exercise or defence of legal claims, or if such transfer is based on your explicit consent or subject to safeguards that assure the protection of your data, such as the European Commission approved standard contractual clauses.
IX. How long we keep your personal data
We only process your data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of complying with legal retention requirements and where required to assert or defend against legal claims, until the end of the relevant retention period or until the claims in question have been settled. Upon expiry of the applicable retention period we will securely destroy your data in accordance with applicable laws and regulations.
X. Security of your personal data
We take appropriate organisational and technical security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.
XI. Your Rights
You have various rights in relation with our processing of your personal data, depending on the applicable data protection law:
Right of access
You have the right to request a copy of the personal data that we hold about you. There are exceptions to this right, so that access may be denied if, for example, making the in-formation available to you would reveal personal data about another person, or if we are legally prevented from disclosing such information.
Right to rectification
We aim to keep your personal data accurate, current, and complete. We encourage you to contact us to let us know if any of your personal data is not accurate or changes, so that we can keep your personal data up-to-date.
Right to erasure
You have the right to require us to erase your personal data when the personal data is no longer necessary for the purposes for which it was collected, or when, among other things, your personal data have been unlawfully processed.
Right to restriction
You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Right to data portability
You have the right to ask that we transfer the personal information you gave us to another controller or to you, in certain circumstances.
Right to withdraw consent
Where we process data based on your consent, you have the right to withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing.
Complaints
If you believe that your data protection rights might have been breached, please let us know our contact the applicable supervisory authority.
XII. Right to object
Under applicable data protection law you have the right to object at any time to the processing of personal data pertaining to you under certain circumstances, in particular where your data is processed in the public interest, on the basis of a balance of interests or for direct marketing purposes.
If you like to exercise the above mentioned rights, please contact us at info@scrypt.swiss or the contact details provided under Section II unless otherwise specified or agreed. Please note that we need to identify you to prevent misuse, e.g. by means of a copy of your ID card or passport, unless identification is not possible otherwise.
XIII. Newsletter
If you subscribe to one of our newsletters offered, you may cancel the subscription at any time by using the option to unsubscribe contained in the newsletter.
XIV. Cookies
We use cookies on our website and platform and may allow certain third parties to do so as well. Cookies are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website or platform.
However, depending on the purpose of these cookies, we may ask for your express prior consent before they are used. You can access your current settings by clicking on the «Change Your Cookies» - button below and you can withdraw your consent under the same link at any time (https://www.scrypt.swiss/cookies). You can also set your browser to block or deceive certain types of cookies or alternative technologies, or to delete existing cookies. You can also add software to your browser that blocks certain third-party tracking. You can find more information on the help pages of your browser (usually with the keyword «Privacy») or on the websites of the third parties set out in our Consent Management Tool below.
Necessary cookies
Necessary cookies are necessary for the functioning of the website or platform or for certain features. They make the use of our website and platform more pleasant for you.For example, they help make a website or platform usable by enabling basic functions such as page navigation and access to secure areas of the website or platform. They also ensure that you can move between pages without losing information that was entered in a form and that you stay logged in. These cookies exist temporarily only («session cookies»). The session cookies are automatically deleted after leaving our pages. If you block them, the website or platform may not work properly. Other cookies are necessary for the server to store options or information (which you have entered) beyond a session (i.e. a visit to the website) if you use this function (for example language settings, consents, automatic login functionality, etc.). These cookies have an expiration date of up to 12 months. The legal basis for such cookies is our legitimate interest according to provide you with all functions of our website and platform. A list of necessary Cookies is provided in our ConsentManagement Tool below.
Performance Cookies
In order to optimise our website and related offers and to better adapt them to the needs of the users, we use cookies to record and analyze the use of our website, potentially beyond one session. We use third-party analytics services for this purpose that are listed below (see Section XV «Tracking Tools»). For example, we analyze which page a user accesses most often and whether error messages are displayed. These cookies do not store any information beyond this. They are used exclusively to increase user-friendliness and to tailor websites and platform more specifically to the user. Before we use such cookies, we ask for your express prior consent. You can withdraw consent at any time through the cookie settings. Performance cookies also have an expiration date of up to 12 months. Details can be found on the websites of the third-party providers specified in our ConsentManagement Tool below.
Marketing Cookies
We and our advertising partners have an interest in targeting advertising as precisely as possible, i.e. only showing it to those we wish to address. We have listed our advertising partners below. For this purpose, we and our advertising partners – if you consent – use cookies that can record the content that has been accessed or the contracts that have been concluded. This allows us to optimize our content (see Section XV «Tracking Tools») and us and our advertising partners to display advertisements that we think will interest you on our website or platform, but also on other websites that display advertisements from us or our advertising partners. If you consent to the use of these cookies, you will be shown related advertisements. If you do not consent to them, you will not see less advertisements, but simply any other advertisement. You can withdraw con-sent at anytime through the cookie settings. Marketing cookies have an expiration period of a few days to 12 months, depending on the circumstances. Details can be found on the websites of the third-party providers specified in our Consent Management Tool below.
You can change your cookie settings at any time under the link provided below:
Consent Management Tool: https://www.scrypt.swiss/cookies
XV. Tracking Tools
Based on your consent we use tracking tools to ensure a tailored design and the continuous optimisation of our website and platform. We also use the following tracking tools to statistically record the use of our website and platform and evaluate it for the purpose of optimising the content we show you:
Google Analytics:
Google Ireland (based in Ireland) is our provider of “Google Analytics” and acts as our processor. Google Ireland relies on Google LLLC (based in the USA) as a processor for its services (both “Google”). Google uses performance cookies(see above) to track the behavior of visitors to our website (duration, frequency of pages viewed, geographic origin of access, etc.) and compiles reports for us on the use of our website on this basis. We have configured the service so that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the US and thus cannot be traced. We have turned off the "Data Forwarding" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these persons. If you consent to the use of Google Analytics, you explicitly agree to such processing, which also includes the transfer of personal data (in particular usage data for the website and app, device in-formation and individual IDs) to the US and other countries not offering adequate data protection from a Swiss/EU perspective.Information on the data protection of Google Analytics can be found here https://support.google.com/analytics/answer/6004245 and if you have a Google account, you can find further details on processing by Google here https://policies.google.com/technologies/partner-sites?hl=de.
XVI. Updating and changing this Privacy Notice
Due to continuous development of our website and platform and the contents thereof, changes in law or regulatory requirements, we might need to change this privacy notice from time to time. Our current privacy notice can be found at our website and platform can be saved and printed out by you.