1. General provisions

1.1. This Policy sets out how the operator processes personal data and describes the personal data protection requirements it implements.

1.2. The Policy is publicly available and is published on the Internet for review by anyone.

1.3. The purpose of this Policy is to protect the rights and freedoms of individuals when their personal data is processed, including the right to privacy and to personal and family confidentiality.

1.4. All employees of the operator who process personal data must read and comply with this Policy.

1.5. Clicking the consent button in the window containing the Privacy Policy, or ticking the corresponding checkbox, constitutes the user's unconditional acceptance of the terms of this Policy.

2. Key terms

The following key terms are used in this Policy:

personal data — any information relating to a directly or indirectly identified individual (the data subject), including identification, financial, payment, account and other information;
personal data made public by the data subject — data to which the data subject has given unrestricted access by giving consent;
operator — a person who, alone or jointly with others, organises and/or carries out the processing of personal data;
processing of personal data — any operation or set of operations performed on personal data, including collection, recording, storage, use, transfer, blocking, deletion and destruction;
automated processing — processing of personal data by means of computer equipment;
dissemination of personal data, disclosure, blocking, destruction, anonymisation — are used in the meanings established by applicable personal data protection law;
personal data information system — a set of databases and the technologies that process them;
cross-border transfer of personal data — transfer of data to the territory of a foreign state;
mobile application, personal account, login and password, user, website — are used in the meanings given in this Policy and in the operator's offer.

3. Processing of personal data on getbit.exchange

3.1. The operator processes the personal data of users of the website getbit.exchange.

3.2. The personal data processed includes, among other things:

e-mail address;
phone number;
exchange history;
account identifiers;
API keys;
bank card number;
passport details (including photos or scanned copies);
information on verification status;
correspondence with technical support;
other data required for the operation of the service.

3.3. Data is processed for the following purposes:

creating and maintaining an account;
carrying out exchange operations;
providing the software features of the service;
calculating and recording cashback;
providing technical support and informing users.

3.4. Users are verified through third-party services. The operator receives only information on whether verification has been completed and has no access to the data transferred to those third parties.

3.5. Biometric personal data is not processed.

3.6. Personal data is not transferred across borders to countries that do not provide adequate protection.

3.7. The operator does not process information about users' place of residence, location or citizenship.

3.8. Personal data is stored in accordance with the requirements of applicable law.

4. Website and mobile application identifiers

4.1. Data is collected in two ways:

data provided by the user;
information collected automatically.

4.2. The user provides data by completing forms on the website and in the mobile application, or by sending e-mails to the operator.

4.3. Information collected automatically includes:

data on the use of website sections;
search queries;
statistical and analytical information.

4.4. Cookies, web beacons and other analytics tools are used to collect data automatically.

4.5. Cookies are used for the proper operation of the website and to analyse user activity. The user may restrict the use of cookies in their browser settings.

4.6. Web beacons are used to assess the effectiveness of website pages and e-mail messages.

5. Rights and obligations of the operator and data subjects

5.1. The operator undertakes not to disclose personal data to third parties without the consent of the data subject, except as provided by law.

5.2. The operator explains to the data subject the legal consequences of refusing to provide personal data where providing it is mandatory.

5.3. The data subject has the rights provided for by applicable personal data protection law, including the right to protection and to appeal against the operator's actions.

5.4. The operator does not make decisions affecting the rights of the data subject solely on the basis of automated processing without grounds provided for by law.

6. Updating, correcting, deleting and destroying personal data

6.1. The data subject may demand that their personal data be clarified, blocked or destroyed in the cases provided for by law.

6.2. If the data is confirmed to be inaccurate, the operator updates it.

6.3. If unlawful processing is detected, the operator stops processing the data.

6.4. Personal data is destroyed once the purposes of processing have been achieved or consent has been withdrawn, unless there are other lawful grounds for processing.

7. Handling requests from data subjects and authorised bodies

7.1. The data subject has the right to receive the information provided for by applicable personal data protection law.

7.2. Requests are considered within 10 business days; this period may be extended by no more than 5 business days.

7.3. The operator may refuse to provide information in the cases expressly provided for by applicable law.

7.4. Information is provided in the same form as the request.

8. Personal data protection requirements implemented

8.1. The operator takes legal, organisational and technical measures to protect personal data, including:

appointing a responsible person;
developing internal regulations;
using encryption;
access control and logging of actions;
preventing security incidents and eliminating their consequences.

8.2. The level of protection is determined taking into account current security threats.

8.3. The operator cooperates with state systems for detecting and preventing computer attacks in the established manner.

9. Final provisions

9.1. This Policy is an internal regulation and is publicly available.

9.2. The Policy may be revised in the following cases:

changes in legislation;
receipt of orders from authorised bodies;
changes in the purposes, periods or technologies of data processing;
reorganisation of the operator;
other grounds requiring the document to be updated.

9.3. The Policy takes effect from the moment it is published on the website getbit.exchange.

Personal Data Processing Policy