- The types of Personal Data we collect and how it may be used;
- How and why we may disclose your Personal Data to third parties;
- The cross-border transfer of your Personal Data within, particularly outside of the European Economic Area (“EEA”), as applicable;
- Your statutory rights concerning your Personal Data;
- The security measures we use to protect and prevent the loss, misuse or alteration of Personal Data; and
- Biokript’s retention of your Personal Data.
We collect the Personal Data which you provide directly to us or which we generate when you open an Account, perform any transactions on the Biokript Platform, or use other Biokript Services. This may include:
- Contact information, such as name, home address, email address and telephone number;
- Account information, such as username, password, Account settings and preferences;
- Financial information, such as occupation, bank account numbers, bank statement and trading information;
- Identity verification information, such as gender, ID number, tax number or images of your government-issued ID, passport, national ID card or driver’s We also use third-party authentication services that may collect biometric data as part of the account creation and identity verification process, and those entities may collect your biometric identifiers or information. Note: US residents may be asked to provide their social security numbers;
- Residence verification information, such as utility bill details or similar information;
- Demographic information, such as age, income, education, and employment status;
- Image in photo or video form (where required as part of our know-your-customer checks), which may also include biometric data processed during a video verification process;
- Records of our discussions, if you contact us or we contact you (including records of phone and video calls);
- Information regarding the way in which you use our Services, such as when you used our Services, and the specific Services you used and the Transactions you carried out; and
- Other information relating to communications with us, whether through the Biokript website or via e-mail, over the phone or via any other medium.
We also automatically collect certain computer, device and browsing information when you access/use the Biokript Platform or the Biokript Services. This information is aggregated to provide statistical data about our users’ browsing actions and patterns, and does not personally identify individuals. This information may include:
- Computer or mobile device information, including IP address, operating system, network system, browser type and settings;
- Geolocation information; and
- Website usage informatio
Finally, we may collect Personal Data from third-party partners and public sources, which include:
- Reputational information;
- Financial information; and
- Business activities of corporate customers.
We need to collect certain types of information for compliance with legal requirements relating to our anti-fraud/anti-money-laundering/counter-financing-of-terrorism/know-your-customer obligations. If this information is not provided, we may not be able to provide a Service for you. It is important to note that the Personal Data we collect when you create an Account will be retained for the mandatory retention period set forth by applicable law as it is necessary for us to maintain an exhaustive documentation of our operations as required from us as regulated financial sector professionals, even if your Account has not been successfully activated (e.g. if Account verification has not been completed) or no transaction has been made using it.
We use one or more third-party service providers, to assist us in better understanding the use of our Site. Our service provider(s) will place cookies on the hard drive of your computer and will receive information that we select that will educate us on such things as how visitors navigate around our Site, what products are browsed and general Transaction information. Our Service provider(s) will analyse this information and provide us with aggregate reports. The information and analysis provided by our Service provider(s) will be used to assist us in better understanding our visitors’ interests in our Site and how to better serve those interests. The information collected by our Service provider(s) may be linked to and combined with information that we collect about you while you are using the Platform. Our service provider(s) is/are contractually restricted from using the information they receive from our Site for any other purpose than to assist us.
We collect, use, disclose and / or otherwise process your Personal Data for a variety of reasons. We need some information to enter into and perform our contract to provide our Services to you – for example, your contact and payment details. Some information processing is required by law, including but not limited to, due to our anti-money laundering, counter-financing of terrorism and anti-fraud screening obligations. Where we process special categories of personal data (for example, your biometric data during the identity verification process), we may ask for your consent, but may also, as permitted by law, rely on substantial public interest (regulatory requirements, preventing fraud, terrorist financing and/or money laundering) or our right to establish, exercise or defend legal claims.
Some Personal Data is processed because you have given your consent, which can be withdrawn. We collect, use, disclose and/or process other Personal Data because we have legitimate business interests to do so, having taken into account your rights, interests and freedoms.
We may use your Personal Data to:
- Create and administer your Account and generally for accounting, billing, maintenance of legal documentation and claim and dispute management. Related processing operations are necessary for the performance of a contract with you (or to take steps at your request prior to entering into a contract) and for compliance with legal obligations to which we are subject;
- Provide Services to you and process your Biokript transactions. Related processing operations are necessary for the performance of a contract with you and for compliance with legal obligations to which we are subject;
- Prevent fraud and other financial crimes. Related processing operations are necessary for compliance with legal obligations to which we are subject and for purposes of our legitimate interests (that is, developing and improving our anti-fraud system, preventing, detecting, investigating and prosecuting security threats, fraud, financial crimes, misconduct or other illegal or malicious activity and meeting our legal responsibilities);
- Personalise your Biokript Platform and Services experience. Related processing operations are necessary for purposes of our legitimate interests (that is, improving our Services);
- Analyse the Site and Biokript Platform usage and improve the Site and Biokript Platform offerings through surveys, research, planning and statistical analysis. Related processing operations are necessary for purposes of our legitimate interests (that is, improving and promoting our Services);
- Respond to your customer service requests and support needs. Related processing operations are necessary for the performance of a contract with you and for purposes of our legitimate interests (that is, improving our Services and offering you the best experience);
- Conduct internal operational and administrative processes, such as accounting, risk management, compliance and record keeping functions, staff training, quality control and any other purposes that are necessary for the performance of our contract with you. Related processing operations are necessary for purposes of our legitimate interests (that is, improving and promoting our Services, improving risk management practices and ensuring quality control); and
- Contact you about the Biokript Services. The email address you provide may be used to communicate information and updates related to your use of Biokript Services.
In the event we require to use your Personal Data for any other purposes, we will notify you and obtain your consent beforehand, unless we are required or permitted under Law to process your personal data without your consent.
We may make automated decisions on certain matters. For example, we may do this to decide whether we can provide our Services to you based on a credit check/risk profiling. Depending on the outcome of the credit check/risk profiling, a decision is reached automatically as to whether we are able to provide products or Services to you based on your credit worthiness.
If you disagree with the decision you are entitled to contest this by contacting us at the following email address:email@example.com
We may also occasionally communicate company news, updates, promotions and information relating to similar products and Services provided by Biokript. We may also administer a contest, promotion, giveaway. survey or another Site or Platform feature as is further explained on the Site. We shall only do this where you have given us your consent or otherwise where we are permitted to do so under Law, including in pursuit of our legitimate interests (that is, promoting our Services).
We may share Personal Data with third parties to help us with our marketing and promotional projects, or to help us with sending marketing communications.
If you want to opt out of receiving promotional and marketing emails, text messages, posts and other forms of communication from us (or our promotional partners), which you might receive in accordance with this section, you can choose one of the following ways:
- Log into your Account and update your profile in Account settings;
- Click “unsubscribe” at the bottom of an email we sent you; or
- Contact us at firstname.lastname@example.org and request to opt out.
If you do opt out of receiving promotional and marketing messages, we can still contact you regarding our business relationship with you, such as Account status and activity updates, survey requests in respect of products and Services we have provided to you after you have opted out, reservation confirmations or respond to your inquiries or complaints, and similar communications.
We may disclose your Personal Data to third parties and legal and regulatory authorities and transfer your Personal Data outside the EEA, as described below.
There are certain circumstances where we may transfer your Personal Data to employees, contractors and to other parties.
- We may use a third-party processor to process personal and formal identification data for the purpose of verifying the identity of our users by using ID document verification and facial biometrics technologies. The processor may collect your full name, nationality, date of birth, gender, social security number, tax ID number, email address, phone number, IP address, passport details, driver’s license details and national identity card details. Additionally, the processor may collect a photograph or video of you to perform a facial or liveness check.
- We may also share your Personal Data with certain contractors or service providers that may process your Personal Data for us.Examples include marketing or advertising agencies, IT specialists, database providers, backup and disaster recovery specialists, email providers or outsourced call centres. Our suppliers and Service providers are required to meet our standards on processing information and security. The information we provide them, including your Personal Data, will only be provided in relation to the performance of their function; and
- We may also share your Personal Data with certain other third parties. We will do this either when we receive your consent or because we need them to see your Personal Data to provide products or services to you. These include our banking and payments providers, credit reference agencies, anti-fraud or anti-money laundering/counter-financing-of-terrorism databases, screening agencies and other partners we do business with.
Your Personal Data may be transferred to other third-party organisations in certain scenarios in pursuit of our legitimate interests (that is, facilitating corporate transactions, protecting our rights and property and the rights, property and safety of others, resolving disputes, and complying with any applicable legal obligations to which we are subject):
- If we are discussing selling or transferring a part or all of our business your Personal Data may be transferred to prospective purchasers under suitable confidentiality terms;
- If we are reorganised or sold, your Personal Data may be transferred to a buyer who can continue to provide our services to you;
- If we are required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority – for example law enforcement; and
- If we are defending a legal claim, your Personal Data may be transferred as required in relation to defending such claim.
Your Personal Data may be shared if it is made anonymous and aggregated, as in such circumstances the information will cease to be Personal Data.
Biokript’s third-party Service providers are contractually bound to protect and use your Personal Data only for the purposes for which it was disclosed, except as otherwise required or permitted by law. We ensure that such third parties will be bound by terms complying with Law.
We may share your Personal Data with law enforcement, data protection authorities, government officials and other authorities when:
- Compelled by court order or other legal procedure;
- Disclosure is necessary to report suspected illegal activity; or
- Disclosure without your consent is otherwise required or permitted under Law.
We store and process your Personal Data in data centres around the world, where Biokript facilities or service providers are located. As such, we may carry out cross-border transfers of your Personal Data outside of the European Union.
We may transfer your Personal Data outside of the European Union or outside of your country of origin. Some of the countries to which your Personal Data may be transferred to for these purposes that are located outside the EU do not benefit from the adequacy decision issued by the EU Commission regarding protection afforded to Personal Data in that country. Details of these specific countries can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en. Such transfers are undertaken in accordance with our legal and regulatory obligations, and appropriate safeguards under applicable Law will be implemented, such as standard data protection clauses, with data recipients or processors approved by competent authorities. A description of appropriate safeguards may be requested at the address set out in the Contact Us section.
You have certain rights concerning your Personal Data under Law, as mentioned below, and can exercise them by contacting us at email@example.com. Please note that these rights may differ depending on the applicable law.
Once a request is received Biokript will answer without undue delay and, in any case, within one month. If the complexity or number of requests received does not allow Biokript to answer to the particular request within the time frame, Biokript is entitled to extend that period for up to two extra months by informing you about such delay within the initial period.
Access: Subject to applicable law, you are entitled to ask us if we are processing your Personal Data and, if we are, you can request access to your Personal Data. This enables you to receive a copy of the Personal Data we hold about you and certain other information about it to check that we are processing it lawfully. We process a large quantity of information and can thus request, under certain circumstances and in accordance with applicable law, that before your Personal Data is delivered, you shall confirm your identity and specify the information or processing activities to which your request relates. There are certain circumstances where we may refuse, or we are required to deny, an access request; for example, we may be required to deny an access request where the Personal Data subject of such request could reveal Personal Data about another individual.
Correction: Subject to applicable Law, you are entitled to request that any incomplete or inaccurate Personal Data we hold about you is corrected. There are certain circumstances where we may refuse a correction request; for example, we may refuse a correction request in respect of a document related to an ongoing prosecution.
Erasure: you are entitled to ask us to delete or remove Personal Data in certain circumstances. There are also certain circumstances where we may refuse a request for erasure; for example, we may refuse an erasure request where the Personal Data is required for compliance with law or in connection with claims.
Restriction: Subject to applicable Law, you are entitled to ask us to suspend the processing of certain parts of your Personal Data; for example, if you want us to establish its accuracy or disclose the reason for processing it. There are certain circumstances whereby we may require reasonable notice before we suspend processing your Personal Data pursuant to your request. Transfer: Subject to applicable Law, you may request the transfer of a certain part of your Personal Data to another party.
Objection: Subject to applicable Law, where we are processing your Personal Data based on a legitimate interest (or that of a third party) you may challenge this. However, we may be entitled to continue processing your Personal Data based on our legitimate interests or where this is relevant to legal claims or where processing is otherwise required or permitted under applicable Law. You also have the right to object where we are processing your Personal Data for direct marketing purposes. There are certain circumstances whereby we may require reasonable notice before we cease processing your Personal Data pursuant to your objection.
Automated decisions: Subject to applicable Law, you may contest any automated decision made about you where this has a legally or similarly significant effect and ask for it to be reconsidered.
Where you have given consent to a particular processing, you have the right to withdraw such consent by email at firstname.lastname@example.org. Note that such withdrawal will only be effective for the future and that, according to applicable Law, it does not affect the lawfulness of processing based on consent given before such withdrawal and it does not affect any legal consequences arising from such withdrawal. For example, if we are prevented from processing your Personal Data due to your withdrawal of consent, you might be unable to access or use the Biokript Platform or the Biokript Services (or parts thereof) if such access or use requires us to process your Personal Data.
You also have a right to lodge a complaint with a supervisory authority regarding our privacy practices or our processing of your Personal Data. In particular: (a) if you reside in the European Union, you can lodge a complaint with the supervisory authority in the Member State of the European Union where you are habitually resident, where we are based or where an alleged infringement of Data Protection Law has taken place; (b) in the UK, you can make a complaint to the Information Commissioner’s Office (Tel: 0044 1625 545 700 or at www.ico.org.uk); (c) in Luxembourg, you can make a complaint to the Luxembourg data protection authority (Commission nationale pour la protection des données, Tel: 00352 26 10 60 1 or at www.cnpd.public.lu); (d) in the British Virgin Islands, you may lodge a complaint with the BVI Information Commissioner (+1(284) 468-3701 email@example.com ).
In this section, we provide additional information to California
residents about how we handle their Personal Data, as required under
California privacy laws, including the California Consumer Privacy Act
("CCPA"). This section does not address or apply to our handling of
publicly available information lawfully made available by state or
federal government records or other personal information that is
exempt under the CCPA.
While our collection, use and disclosure of Personal Data varies based upon our relationship and interactions with you, in this section we describe, generally, how we have collected and disclosed personal information about consumers in the prior 12 months.
Sources of Personal Information. As further described in the Personal Data We Collect section above, we may collect Personal Data from the following sources:
- directly from the individual
- advertising networks
- data analytics providers
- social networks
- internet service providers
- operating systems and platforms
- government entities
- business customers/clients
Categories of Personal Data Collected and Disclosed. In the table below, we identify the categories of Personal Data
(defined as "personal information" under the CCPA) we have collected
and disclosed for a business purpose, as defined by the CCPA, as well
as the categories of third parties to whom we may disclose such
Personal Data. For more information about the business and commercial
purposes for which we may disclose, as defined by the CCPA, Personal
Data, please see the How We Use Your Personal Data and Disclosing and Transferring Personal Datasections above.
Right to Request Disclosure. You have the right to request, free of charge, that we disclose information about our collection and use of your Personal Data over the past twelve (12) months, including:
- The categories of Personal Data we collect about you;
- What Personal Data we collect, use, or disclose about you;
- The categories of sources of the Personal Data we collect about you;
- Our business or commercial purpose for collecting the Personal Data;
- For each category of Personal Data, the categories of third parties with whom it was disclosed; and
- The specific pieces of Personal Data we collect about you.
For more information on how to request information about our collection, use, and disclosure of your Personal Data, please see the Submitting CCPA Requests section below.
Right to Request Deletion. You have the right to request the deletion of your Personal Data that we collected. For more information on how to request deletion, please see the Submitting CCPA Requests below. Once we receive your request and verify your identity, we will review your request to see if an exception allowing us to retain the information applies. We will delete or de-identify Personal Data not subject to an applicable exception from our records and will direct our service providers to take similar action.
You do not need to create an account with us to exercise your deletion rights. We will only use Personal Data provided in a deletion request to review and comply with the request.
Right to Request Opt-Out of the Sale of Your Personal Data. The right to request opt-out of the sale of your Personal Data is not relevant do to the face we do not sell the Personal Data of consumers.
Right of Non-Discrimination. You have the right to be free from discriminatory adverse treatment for exercising these rights. We will not discriminate against you for exercising any of your CCPA rights.
Requests to Know or Delete. To exercise your rights to know or delete described above, you may submit a request by contacting us through the Contact Us section below.
Verification of Requests. Only you, or an individual legally authorized to act on your behalf, may make a request to know, delete, or opt-out related to your Personal Data. To designate an authorized agent, please contact us by using the contact information in the Contact Us section below.
You may only submit a request to know twice within a 12-month period. Your request to know or delete must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data, or that the requestor is your authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We may request information from you in order to verify your identity. Additionally, we may require that authorized agents provide proof of their authorization. We cannot respond your request or provide you with Personal Data if we are unable to verify your identity, your authority to make a request on behalf of another person, or if we cannot confirm that the Personal Data relates to you. In general, we will verify your request and your identity by matching the information you provided with the information we have in our records.
You do not need to create an account with us to submit a request to know, or to submit a request to delete your Personal Data.
We will only use Personal Data provided in the request to verify the
requestor's identity or authority to make it.
We use a variety of security measures to ensure the confidentiality of your Personal Data, and to protect your Personal Data from (a) loss, (b) theft, (c) unauthorised access, processing alteration or destruction, (d) misuse or (e) other similar risks. These security measures include, but are not limited to:
- Password protected directories and databases;
- Secure Sockets Layered (SSL) technology to ensure that your Personal Data is fully encrypted and sent across the Internet securely; and
- PCI Scanning to actively protect our servers from hackers and other vulnerabilities.
All financially sensitive and/or credit information is transmitted via SSL technology and encrypted in our database. Only authorised Biokript personnel are permitted access to your Personal Data, and these personnel are required to treat your Personal Data as highly confidential. The security measures will be reviewed regularly in light of new and relevant legal and technical developments.
You are responsible for keeping your Account passcode, membership numbers and PIN numbers safe and secure. Do not share those with anyone. If there is an unauthorised use or any other breach of security involving your information, you must notify us as soon as possible (see the Contact Us section below).
- How long you have been a Biokript member;
- Whether there are contractual or legal obligations that exist that require us to retain Personal Data for a certain period of time;
- Whether there is any ongoing legal or financial claim that relates to your relationship with us;
- Whether any applicable law, statute or regulation allows for a specific retention period; and
- What the expectation for retention was at the time Personal Data was provided to us.
In accordance with our record-keeping obligations, we will retain Account and other Personal Data at all times while your Account exists and we reserve the right to retain your Personal Data after your Account is closed (a) for as long as it is necessary to fulfil the purpose for which it was collected; (b) for at least five years (in some cases up to ten years, as required by applicable law) after an Account is closed; or (c) for as long as retention is required or permitted by applicable DP Law.
“Biokript Platform” means hardware and software technologies, including the Biokript website (www.Biokript.com) or any other websites, the Biokript mobile app and other Biokript platforms or applications, used by Biokript to provide the Biokript Service as set out in our
“Include”, “includes”, “including”, “for example” and “such as” will be interpreted to be followed by “without limitation”.
“Personal Data” means information that identifies an individual or
from which an individual may be identified, or other information
defined as "personal information," "personal data," or "personally
identifiable information" under DP Law. Personal Data does not include
anonymised, de-identified and/or aggregated data that does not
identify a specific user;
“Processing” means the carrying out of any operation or set of operations in relation to Personal Data, including collecting, using, disclosing, recording, holding, organising, adapting, altering, retrieving, combining, transmitting, transferring, erasing or destroying personal data, and “process” and “processed” will be construed accordingly.