Last updated 23 June 2020
This privacy notice applies to JMI Swiss Securities AG, which sometimes use trading names including Bit&Pay (together “Bit&Pay” or "we" or “our”).
This notice shows our commitment to protect your privacy rights and sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us. It applies to:
Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
Bit&Pay takes a ”layered approach” to explaining its privacy practices, as recommended by regulators. This means that we endeavour to initially provide you with the key privacy information in the form of this ”short form” privacy notice. To review our complete privacy notice, please see our Comprehensive Privacy Notice. Contact us details are provided at the end of this privacy notice, for feedback or any privacy enquiries you may have.
You may provide some information to us, for example when you enquire for or make an application for the Bit&Pay Services, register to use and/or use any Bit&Pay Services, by filling in forms on one of our websites, participating in one of our events or by corresponding with by us phone, e-mail, web chat or otherwise. We may collect some of it through automatic means, for example by using cookies when you visit our websites. Read our Cookie Statement to know more. We may also obtain data about you from third parties, like credit reference and fraud prevention agencies.
We use information we collect about you to provide you with the products we offer, to notify you about changes to our products and to improve our products. We also use this information to provide you with information about other products we or selected third parties offer which are similar to the ones you have used or enquired about or we think may be of interest to you. If you use one of our financial products, we will also use your information to assess your financial situation and to try to identify and prosecute possible frauds.
We will not disclose your personal data to anyone except as described in this notice. We may share your personal information with third parties to provide you with the products we offer, including service providers, credit reference agencies and financial institutions. We may also share your personal information with third parties to prevent crime and reduce risk, if required to do so by law, where we deem it appropriate to do so, to respond to legal process or to protect the rights or property of Bit&Pay, our customers or others.
The information Bit&Pay collects from you may be transferred to, stored at and processed by recipients located in destinations outside the European Economic Area ("EEA"). These countries may have data protection standards that are different to (and, in some cases, lower than) those in which you reside. We will take all steps necessary to ensure that the recipients will use and protect your information in the same secure way that we do.
If we have given you (or if you have chosen) a password, access code or any other secure means or access or authentication which enables you to access certain parts of our site, you are responsible for keeping this password confidential and complying with our instructions. You must not share your password or other login credentials with anyone, and you hereby authorise Bit&Pay to act upon instructions and information from any person that enters your credentials.
The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site, unless you are communicating with us through a secure channel provided by us. Once we have received your information, we will use strict procedures and security features in an effort to prevent unauthorised access.
Where applicable, you may have certain rights under data protection legislation, including the right to access, correct, update or delete your personal information; object to or restrict its processing; request to transfer certain of your personal information to another service provider (so called, data portability); or to revoke any consent you have given.
However, please note that there are exceptions to those rights. For the full explanation of the rights available, please refer to our Comprehensive Privacy Notice.
Automated decisions mean that a decision concerning you is made automatically on the basis of a computer determination (using software algorithms), without our human review.
For example, we use automated decisions to complete a credit assessment on you when you apply to financial services of Bit&Pay, or to carry out anti-fraud checks on the transactions you perform. However, if you are in the European Union, you have the right to object the automated decision and have it manually reviewed based also on information that you can provide. You can contact us at the details below to exercise your right.
Bit&Pay will process your personal information only when we have one of the following grounds:
Any changes we may make to our privacy notice in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to this privacy notice.
At Bit&Pay, we welcome all comments, queries and requests relating to our use of your information.
Our Data Protection Officer is the person in charge of ensuring our company adheres to this privacy notice. This person is also the main contact for our Data Protection Supervisory Authority. If you wish to exercise any of your rights or receive further information concerning JMI Swiss Securities AG (to which this notice applies), you should write to our Data Protection Offer (DPO) via the contact form on the Contact Us page of our website or at the address below:
Bit&Pay, Attention: Rue des Alpes 11, 1700 Fribourg, Switzerland
Last updated 23 June 2020
References to “you” or “your” in this privacy notice are to the individual who is accessing or applying to use the Bit&Pay Services (as defined below) either on your own account or on behalf of a business. This includes, in relation to a customer or prospective customer of Bit&Pay, any sole trader and any principals, including the managing and financial directors, any other directors and officers, shareholders, partners and beneficial owners of a customer, as well as any member of staff accessing or using the Bit&Pay Services on behalf of a customer.
This notice shows our commitment to protect your privacy rights and sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us. It applies to:
Together these are all referred to in this notice as “Bit&Pay Services”.
Please read the following carefully to understand our views and practices regarding your Personal Data and how we will treat it.
“DPL” herein means data protection law applicable to Bit&Pay, including the Swiss Federal Act on Data Protection (CC 235.1 Federal Act of 19 June 1992 on Data Protection (FADP)) and the EU General Data Protection Regulation 2016/679, their successors or implementing texts. Personal Data" has the meaning set forth in DPL. This notice covers our use of your Personal Data arising from use of the Bit&Pay website (www.bitandpay.com) as well as registering / subscribing / buying / selling / using our products and services. If you have any questions or need any further clarity please get in touch. Contact details are set out below in the Contact Us section.
We collect Personal Data to provide you with our Services. When we require certain personal information from users it is because we are required by law to collect this information or it is relevant for specified purposes. Any information you provide to us that is not required is voluntary. You are free to choose whether to provide us with the types of personal information requested, but we may not be able to serve you as effectively or offer you all of our Services when you do choose not to share certain information with us.
We also automatically collect certain computer, device and browsing information when you access the Bit&Pay website or use Bit&Pay Services. This information is aggregated to provide statistical data about our users' browsing actions and patterns, and does not personally identify individuals. This information may include:
We also collect information through our applications. if you download or use mobile or desk top applications provided by Bit&Pay, we may receive information about your location and your device or the service you are using (including where a payment transaction takes place). Some devices allow applications to access real-time location-based information (for example GPS). Our mobile and desktop apps may collect such information from your mobile device or your computer at any time while you download or use our apps, if your device has real-time location data access enabled. Where required, we will always seek to notify you if it is our intent to collect real-time location information and, also where required by law, obtain your consent. We may use such information for regulatory purposes, our own due diligence checks, to better understand transaction patterns and to optimise your experience.
We may receive information about you from other sources and add it to our account information. For example, we work closely with, and receive information from, third parties like business partners, financial institutions, merchants, subcontractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference and fraud prevention agencies. Credit reference and fraud prevention agency use is further explained below. We may also review public comments and opinions made on social networking sites (e.g. Facebook and Twitter) to better understand our customers and our provision and development of the Bit&Pay Services.
Finally, we may collect Personal Data from third party partners and public sources, which include:
We need to collect certain types of information for compliance with legal requirements relating to our anti-fraud/anti-money laundering/counter financing of terrorism/know your customer obligations. If this information is not provided we will not be able to provide a service for you. Your Personal Data may also be processed if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defense of legal claims. We will not delete Personal Data if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved. We may perform behavioral tracking of a customer's activities on our Bit&Pay website or across different websites, or allow third-party data collection through our Bit&Pay Service.
It is important to note that the Personal Data we collect on you when you create an account will be retained for the mandatory retention period set forth by applicable law and as necessary for us to maintain an exhaustive documentation of our operations as required from us as regulated financial sector professionals, even if your account has not been successfully activated (e.g., if account verification has not been completed) or no transaction has been made using it.
Our privacy notice has incorporated elements from the General Data Protection Regulation (GDPR) as we act in accordance to its personal information processing rules within the European Economic Area (EEA). For individuals who reside in the European Economic Area (including the United Kingdom) (collectively “EEA Residents”), pursuant to Article 6 of the EU General Data Protection Regulation (GDPR) or any equivalent legislation (collectively “EEA Data Protection Law”), we process this personal information to comply with our legal obligations.
We use third party service provider(s), to assist us in better understanding the use of our website. Our service provider(s) will place cookies on the hard drive of your computer and will receive information that we select that will educate us on such things as how visitors navigate around our site, what products are browsed, and general Transaction information. Our service provider(s) analyses this information and provides us with aggregate reports. The information and analysis provided by our service provider(s) will be used to assist us in better understanding our visitors' interests in our website and how to better serve those interests. The information collected by our service provider(s) may be linked to and combined with information that we collect about you while you are using the Platform. Our service provider(s) is/are contractually restricted from using information they receive from our website other than to assist us.
If you want to avoid using cookies altogether, you can disable cookies in your browser. However, disabling cookies might make it impossible for you to use certain features or our website or services, such as logging on to your Bit&Pay Account or making transactions. Your use of our website or service with a browser that is configure to accept cookies constitutes an acceptance of our and third-party cookies.
For more information about cookies, the types of cookies we use and how we use them please see our Cookie Statement.
We collect and use your information for a variety of reasons. We need some information to enter into and perform our contract – for example your contact and payment details. Some information processing is required by law due to our anti-fraud screening obligations or in the public interest such as making sure we verify our customers' identities.
Some information is processed because you've given your consent to that, which can be withdrawn in your account preferences and settings. Other information we collect and use because we have legitimate business interests to so, having taken into account your rights, interests and freedoms.
We may use your Personal Information to:
Automated decisions mean that a decision concerning you is made automatically on the basis of a computer determination (using software algorithms), without our human review. We may make automated decisions on certain matters. For example, we may do this to decide whether we can provide our services to you based on a credit check/risk profiling. Depending on the outcome of the credit check/risk profiling, a decision will be reached automatically as to whether we are able to provide products or services to you based on your credit worthiness.
If you disagree with the decision you are entitled to contest this by contacting us at following email address: [email protected]
We may also occasionally communicate company news, updates, promotions and related information relating to similar products and services provided by Bit&Pay. We may also administer a contest, promotion, survey or other site features as will be more explained on the website. We shall only do this where you have given us your consent or otherwise where we are permitted to do so under the DPL in pursuit of our legitimate interests (that is, promoting our services).
We may share Personal Data with third parties to help us with our marketing and promotional projects, or sending marketing communications.
If you want to opt out of receiving promotional and marketing emails, text messages, post and other forms of communications from us (or our promotional partners) in relation to which you might receive in accordance with this section, you can best opt out by using one of the following ways:
If you do opt out of receiving promotional and marketing messages, we can still contact you regarding our business relationship with you, such as account status and activity updates, survey requests in respect of products and services we have provided to you after you reserve from us, reservation confirmations or respond to your inquiries or complaints, and similar communications.
We may disclose your Personal Data to third parties and legal and regulatory authorities, and transfer your Personal Data outside the Switzlerland and the EEA, as described below.
There are certain circumstances where we may transfer your Personal Data to employees, contractors and to other parties.
Your Personal Data may be transferred to other third party organisations in certain scenarios:
Your Personal Data may be shared if it is made anonymous and aggregated, as in such circumstances the information will cease to be Personal Data.
Your information will not be sold, exchanged, or shared with any third parties without your consent, except to provide Bit&Pay Services or as required by law.
The third-party service providers of Bit&Pay are contractually bound to protect and use such information only for the purposes for which it was disclosed, except as otherwise required or permitted by law. We ensure that such third parties will be bound by terms complying with DPL.
Specifically, Your Personal Data may be transferred to the following third party organisations in certain scenarios:
GlobalPass analyses ID documents, and other AML-KYC related documents and information to assist us in satisfying our KYC obligations. Globalpass processes and stores data in ISO 27001-certified datacentres worldwide. Learn more about how GlobalPass processes data.
When you top-up through the Platform by wire transfer or credit card, your Personal Data is shared with Bitnuk AG where Quantum Coins are purchased. Bitnuk AG processes and stores data in ISO 27001-certified datacentres worldwide. Learn more about how Bitnuk processes data.
When you hold, buy, sell or transfer cryptocurrency through the Platform, your Personal Data is shared with Bitnuk AG. Bitnuk AG processes and stores data in ISO 27001-certified datacentres worldwide. Learn more about how Bitnuk processes data.
When you hold, buy, sell or transfer cryptocurrency through the Platform, your Personal Data is shared with Bank Frick. Bank Frick processes and stores data in ISO 27001-certified datacentres worldwide. Learn more about how Bank Frick processes data.
When you apply for a debit card through the Platform, Your Personal Data is shared with UAB Creditco for the approval process. UAB Creditco is an official Lithuanian representative of Wirecard Card Solutions Limited. UAB Creditco processes and stores data in ISO 27001-certified datacentres worldwide. Learn more about how UAB Creditco processes data.
Bit&Pay may be required by law to pass information about you to regulatory authorities and law enforcement bodies worldwide, or we may otherwise determine that it is appropriate or necessary to do so. Such disclosures may also include requests from governmental or public authorities, or with commercial organizations with whom you may have had dealings and whom are seeking to mitigate fraud risk, or for the purposes of litigation or legal process, national security or where we deem it in the national or public interest or otherwise lawful to do so. As such, we may share your Personal Data with law enforcement, data protection authorities, government officials, and other authorities when:
We store and process your Personal Data in data centers around the world, wherever Bit&Pay facilities or service providers are located. As such, we may transfer your Personal Data outside of Switzerland and the European Union. Some of the countries to which your Personal Data may be transferred for these purposes that are located outside the EU do not benefit from an adequacy decision issued by the EU Commission regarding protection afforded to Personal Data in that country. Details of these specific countries can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en. Such transfers are undertaken in accordance with our legal and regulatory obligations and appropriate safeguards under DPL will be implemented, such as standard data protection clauses with data recipients or processors approved by competent authorities. A copy may be requested at the address set out in the Contact Us section.
You have many rights concerning your Personal Data under DPL as mentioned below, and can exercise them by emailing us at [email protected]
Access: you are entitled to ask us if we are processing your information and, if we are, you can request access to your Personal Data. This enables you to receive a copy of the Personal Data we hold about you and certain other information about it to check that we are lawfully processing it. We process a large quantity of information, and can thus request, in accordance with the DPL, that before the information is delivered, you specify the information or processing activities to which your request relates.
Correction: you are entitled to request that any incomplete or inaccurate Personal Data we hold about you is corrected.
Erasure: you are entitled to ask us to delete or remove Personal Data in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the Personal Data is required for compliance with law or in connection with claims.
Restriction: you are entitled to ask us to suspend the processing of certain of your Personal Data about you, for example if you want us to establish its accuracy or the reason for processing it.
Transfer: you may request the transfer of certain of your Personal Data to another party.
Objection: where we are processing your Personal Data based on a legitimate interests (or those of a third party) you may challenge this. However we may be entitled to continue processing your information based on our legitimate interests or where this is relevant to legal claims. You also have the right to object where we are processing your Personal Data for direct marketing purposes.
Automated decisions: you may contest any automated decision made about you where this has a legal or similar significant effect and ask for it to be reconsidered.
You also have a right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you reside, in Switzerland where we are based, or where an alleged infringement of Data Protection law has taken place. In Switzerland, you can make a complaint to The Federal Data Protection and Information Commissioner (FDPIC), which is the competent authority for data processing by federal bodies and private persons, including enterprises. As far as data processing by cantonal or communal authorities is concerned, the supervision is up to the cantonal and communal data protection commissioners. You can find all contact information here: privatim.ch/de/privatim
Please consider that, depending on the country from where you use the Bit&Pay Services, not all the above rights may be available to you. Also, there might be cases where these rights cannot be enforced: for example, you cannot object to us using your information when it is required by the law, or to manage a complaint; similarly you cannot ask us to delete your information if you want to continue using the Bit&Pay Services.
We use a variety of security measures to ensure the confidentiality of your Personal Data, and to protect your Personal Data from loss, theft, unauthorised access, misuse, alteration or destruction. These security measures include, but are not limited to:
All financially sensitive and/or credit information is transmitted via SSL technology and encrypted in our database. Only authorised Bit&Pay personnel are permitted access to your Personal Data, and these personnel are required to treat the information as highly confidential. The security measures will be reviewed regularly in light of new and relevant legal and technical developments.
You are responsible for keeping your account passcode, membership numbers and pin numbers safe and secure. Do not share those with anyone. If there is an unauthorised use or any other breach of security involving your information, you must notify us below as soon as possible.
Please note, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your information transmitted to our site, unless you are communicating with us through a secure channel that we have provided. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.
While you use the Bit&Pay Services, we will retain your personal information as long as necessary to provide you with the services of your choice. That would generally mean we retain your personal information as long as you are our customer and for a period of time afterwards. When our relationship with you ends, we still need to retain certain of your personal information for a time that depends on the legal and regulatory requirements of the country where you are located. For example, we will retain your information for the time allowed by the local laws to start a legal claim (so called “statute of limitation”), or for as long as we are ordered pursuant to on an order from the courts, or by law enforcement agencies or our regulators. In accordance with our record keeping obligations, we will retain Account and other Personal Data for at least five years (and some up to ten years, as required by applicable law) after an Account is closed.
DPL means data protection law applicable to Bit&Pay, including the Swiss Data Protection Act, draft of September 2017, its successors or implementing texts as well as equivalent legislation, which is applies to the processing of Personal Data by Bit&Pay.
Personal Data. Information that identifies an individual, such as name, address, e-mail address, trading information, and banking details. Personal Data does not include anonymised and/or aggregated data that does not identify a specific user;
Service(s). The technological platform, functional rules and market managed by Bit&Pay to permit Sellers and Buyers to perform purchase and sale transactions of Bitcoins and/or other Cryptocurrencies.
Transaction. Includes the following:
This notice is global in scope, but is not intended to override any legal rights or prohibitions in any territory where such rights or prohibitions prevail. In such event, the rights and obligations set out in this notice will apply, subject only to amendment under any applicable local law having precedence.
JMI Swiss Securities AG
Attn: Data Protection Officer
Rue des Alpes 11
You may also contact us at: +41449746020
You can also complain about our processing of your personal information to the relevant data protection authority. You can complain in the EU member state where you live or work, or in the place where the alleged breach of data protection law has taken place. In Switzerland, The Federal Data Protection and Information Commissioner (FDPIC) is the competent authority for data processing by federal bodies and private persons, including enterprises. As far as data processing by cantonal or communal authorities is concerned, the supervision is up to the cantonal and communal data protection commissioners.