Privacy Policy

This privacy policy (the "Policy") describes how DNZ BTO s.r.o., a company having its registered office at Václavské náměstí 2132/47, Nové Město, 110 00 Prague 1, Czech Republic, ID No.: 079 64 358, registered in the Commercial Register maintained by the Municipal Court in Prague under file C 310622 ("Controller" or "we"), processes the personal data of:

• users of the Littlebit mobile application operated by the Controller, and of other information society services provided by the Controller from time to time, including the websites https://www.littlebitapp.com/ and https://www.bitdca.com/ (together the "Services"), in connection with the operation of such Services;
• other individuals dealing with the Controller in the ordinary course of the Controller's business, including other cryptocurrency trades with the Controller; and
• candidates for new positions with the Controller in connection with the recruitment for such positions.

We provide this information under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR").

Controller

• The person responsible for your personal data – their Controller – is:
• DNZ BTO s.r.o., a company having its registered office at Václavské náměstí 2132/47, Nové Město, 110 00 Prague 1, Czech Republic, ID No.: 079 64 358, registered in the Commercial Register maintained by the Municipal Court in Prague under file C 310622.
• If you have questions regarding this Policy or wish to exercise any of the rights described in section 8 (Your Rights), you may reach us:
• • by email or by phone at the contact details listed on the Website;
  • by post or another delivery service at the Controller's registered office address; or
  • in any other manner specified elsewhere in this Policy or directly in the Service interface.

Personal Data

Categories of Personal Data

Taking into account all the ways you typically interact with us, we process the following categories ofpersonal data related to you:

Sources of Your Data

In general, the personal information we process comes from you or is derived from your use of the Services, as described in this Policy. In some cases, we may obtain your personal information from external sources, such as:

1. in the process of conducting AML/KYC checks while registering you for the Services or onboarding you as an investor, we may receive some of the AML Data (mostly in the form of results of such checks) from specialised AML/KYC service providers;
2. if you’re one of our investors/supporters, we may receive some of your registration information, investment details, orders and other Transaction Data from the brokers you’ve engaged with;
3. if you use any of the investing functionalities of our Services, we may receive Payment Credentials and Bank Account Data from card issuers, account information service providers and other payment service providers who assist us with processing payments, verifying your Payment Credentials or loading your bank account transaction history into our Services;
4. if you apply for a job with us, some of your Candidate Data may be collected from your LinkedIn account, recruitment agencies and websites, and your current or previous employers; and
5. if we need particular personal data related to you for the purpose of establishing, exercising or defending our rights against you, or for meeting a legal obligation, we can also obtain that piece of data from public registries, public authorities and any other external sources, as needed for the specific purpose.

Choosing Not to Share Your Data

In principle, you don’t need to share any of your personal data with us if you don’t want to. However, in some cases, a failure to do so will result in our inability to enter into a transaction with you, provide a service, or act upon your request. For example:

1. if providing certain data is necessary for the preparation or fulfilment of a contract between us, or for meeting a legal obligation which applies in connection with the subject matter of that contract, we won’t be able to enter into the contract. Of course, this also applies similarly to the provision of Services as such: for instance, you cannot use the ‘automatic investments’ functionality of our Littlebit application unless you give us read-access to your bank account;
2. if we are required to conduct identity, source of funds or other checks under anti-money laundering laws before transacting with you, we won’t be able to proceed unless you give us the necessary AML Data;
3. if you apply for a job with us and refuse to provide the requested Candidate Details through the designated online form or to an HR colleague, your application might be incomplete, and we won't be able to consider you for the role; and
4. if you wish to exercise one of the rights described in section ‎8 (Your Rights), we need to confirm your identity and fully understand the nature and scope of your request. If you don’t help us verify your identity or define your request, we might not be able to assist you.

PROCESSING PURPOSES

This section explains why we process your personal data (‘purposes of processing’) and what entitles us to do so (‘legal basis for processing’).

Provision of Services

Description

If you’re a user of our Services, we process your Identification Data, Contact Data, AML Data, User Data, Transaction Data, Payment Credentials, Bank Account Data and Communication Data for the purpose of providing you with the Services. This includes:

1. creating and maintaining your user account;
2. enabling you to execute cryptocurrency transactions (automated investments, custody of purchased cryptocurrency, withdrawals of cryptocurrency into user wallets, purchases of tokens, staking of tokens etc.);
3. providing customer and technical support and evaluating and handling your requests (e.g., complaints or exercises of privacy rights) and complaints made in connection with the Services; and
4. communicating with you regarding the above.

Legal basis

The processing is necessary for the preparation or performance of our contract with you (i.e. the provision of the Service you request from us) (Article 6(1)(b) GDPR).

Clarifications regarding Bank Account Data

We recognise that processing of Bank Account Data may sound invasive. Therefore, please read the following additional information from us in respect of such processing:

• We process your Bank Account Access solely when you turn on and use the ‘automatic investments’ functionality of our Littlebit application, and exclusively for the purpose of operating it. Thanks to this functionality, you may automatically purchase Bitcoin from us in volumes dependent on the value of payments you make with your payment card. We need to be able to read the transaction history of your bank account in order to see what payments you’ve made and to calculate how much Bitcoin we should automatically sell to you.
• Thanks to a separate piece of EU legislation called PSD2, neither our AISP nor we may acquire read-access to your Bank Account Data unless you give us your consent. Your permission automatically expires after 90 days, or such other time as indicated when we ask for the permission. You can also revoke your permission at any time. Once we lose your permission, both we and our AISP will lose the access to your Bank Account Data.
• The reason we nevertheless say that we process your Bank Account Data due to it being necessary for the performance of our contract with you – rather than simply relying on your consent as a legal basis – is a technical one: the ‘automatic investments’ functionality is so central to the Littlebit application that using the app wouldn’t make much sense without the functionality. Therefore, treating your consent as ‘freely given’, and stating we rely on such consent in good faith would be neither fair to you, nor compliant with the GDPR.

Other Business

Description

If you’re our investor, customer, supplier or another business partner and are dealing with us in a context other than the interaction with Services, we may use your Identification Data, Contact Data, Transaction Data and Communication Data to communicate and do business with you (in accordance with any contract we might have, if applicable), and to administer our business relationship with you on an ongoing basis. This includes the preparation, negotiation and performance of our legal agreements with you or the organisation you represent, accepting or making payments from/to you, and the processing of any requests and queries you might have.

Legal basis

The processing is necessary for the preparation or fulfilment of our contract with you (Article 6(1)(b) GDPR), or, where no contract is in place and we are not negotiating one, because it is necessary for the proper operation and administration of our business, in which we have a legitimate interest (Article 6(1)(f) GDPR).

Compliance with Legal Obligations

Description

We process your Identification Data, Contact Data, AML Data, User Data, Transaction Data, Communication Data and other personal data to the extent necessary to comply with legal obligations. For illustration, this could be:

1. an obligation to demonstrate compliance with consumer protection requirements or pursuant to Act No. 89/2012 Coll., the Civil Code, and Act No. 634/2004 Coll., on Consumer Protection (in  which case mainly your User Data, Transaction Data and Communication Data will be used);
2. an obligation to document and implement or respond to your preferences, questions, objections, right exercises and other communications regarding the treatment of personal data in accordance with the GDPR, Act No. 127/2005 Coll., on Electronic Communications, and Act No. 480/2004 Coll., on Information Society Services (in which case mainly your User Data and Communication Data will be used);
3. an obligation to archive or present corporate, accounting and tax materials in accordance with Act No. 586/1992 Coll., on Income Tax, Act No.  235/2004 Coll., on Value Added Tax, Act No. 563/1991 Coll., on Accounting, and Act No. 499/2004 Coll., on Archiving (in which case mainly your User Data and Transaction Data will be used);
4. an obligation to conduct KYC/AML checks in accordance with Act No. 253/2008 Coll., on Measures against Money Laundering and Financing of Terrorism (in which case mainly your AML Data will be used); or
5. an obligation to disclose evidence or other documentation to public authorities.

Legal basis

The processing is necessary for the performance of our legal obligations (Article 6(1)(c) GDPR).

Protection of Legal Claims

Description

If (a) you are our customer or have a work or business relationship with us, (b) cause us or another person damage/harm, or (c) we enter into a legal dispute, we may store, share and further use your personal data for the purpose of establishing, exercising and defending our or another affected person’s rights against you.

Legal basis

The processing is necessary for the affected person’s legitimate interest in establishing, exercising and defending its rights against you (Article 6(1)(f) GDPR).

Cookies

If you use our Services, we’ll store small files called ‘cookies’ on your device and read them as you continue interacting with the Services. You may encounter the following types of cookies in our Services:

1. Strictly necessary cookies. These cookies are necessary for the Websites to work properly and cannot be turned off unless you do so in your browser settings.
2. Personalisation cookies. Personalisation/preference cookies allow the Websites to remember certain choices you make (such as your preferred language version) and as a result provide personalised features. They will only be used if you accept them proactively.
3. Analytical cookies. Analytical/statistical cookies collect data about how you visit, navigate and interact with the Websites so that we can get to know our audience or improve the Websites gradually. The Google Analytics service is a good example of this type of cookies. These cookies will only be used if you accept them proactively.
4. Marketing. Marketing cookies are used to deliver advertisements which are relevant to you and your interests. They are also used to limit the number of times you see an advertisement and to help measure the effectiveness of our or others’ advertising campaigns. Information extracted from marketing cookies may be shared with third parties, such as social network operators or advertising agencies. These cookies will only be used if you accept them proactively.

Please refer to the cookie settings of our Services to learn more about the specific cookies we set. You can use such settings to adjust your cookie preferences; this doesn’t apply to strictly necessary cookies, which are set automatically and cannot be disabled.

If you’d like to avoid cookies altogether, you can restrict or prohibit their storage in the settings of your browser. This is how to do it on the most prominent browsers:

Google Chrome

Microsoft Edge

Microsoft Internet Explorer

Safari

Mozilla Firefox

Opera

You can opt out of Google Analytics tracking completely here.

Persons with access to your data

We may engage the following individuals and organisations in processing your personal data for the purposes described above:

1. companies controlling, controlled by, or under the control of the same person as, the Controller (together with the Controller, the “Group”);
2. professional advisors (e.g. lawyers, business/management/marketing consultants, tax and accounting advisors and auditors) which provide services to the Group;
3. brokers helping the Controller onboard new investors and process their investments;
4. AML/KYC experts assisting the Controller with conducting statutory checks, in particular iDenfy;
5. banks and other payment services providers used by the Controller to process payments or verify bank accounts;
6. licensed account information service providers (AISPs) engaged by the Controller to enable secure access to Bank Account Data. Presently, our AISP is GoCardless SAS, company registration No. 834422180, legal address 7 Rue de Madrid, 75008 Paris, France. This AISP is a separate controller of your personal data, please find its end-user terms of service here and its privacy policies here;
7. providers of software and other technical infrastructure (e.g. cloud and hosting services);
8. providers of analytical or ad targeting services (mainly Google via the Google Analytics service and Facebook via its marketing cookies);
9. other providers of ordinary, foreseeable services necessary for the proper operation of our business;
10. persons directly or indirectly acquiring or investing in our business, and their representatives;
11. public authorities (e.g. courts, the police, regulatory authorities and various state bodies) where so required by law or where this is necessary for the achievement of legitimate aims; and
12. any such other individuals or organisations which you permit or instruct us to give your personal data to.

Data export

We may transfer some of your personal data outside of the European Economic Area where the GDPR doesn’t apply. This will typically (but not exclusively) be:

1. the United Kingdom, which has been determined by the European Commission to ensure an adequate level of protection of personal data (a so-called ‘adequacy decision’); or
2. the United States, in which case we will leverage the EU-U.S. Data Privacy Framework, use the standard contractual clauses (SCCs) adopted or approved by the European Commission or other safeguards accepted by the GDPR.

In any event, we will only export your personal data outside of the European Economic Area either (a) if the territory in question is subject to an adequacy decision (see above) or (b) if appropriate safeguards are in place in accordance with the GDPR (e.g. export based on SCCs adopted by the European Commission) and your data subject rights and effective legal remedies are preserved.

Retention Period of personal data

As a general rule, we store your data until they are no longer necessary for the achievement of the purposes we process them for. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the data, the potential risk of harm from its unauthorised disclosure or other processing, the purposes for which we process the data and whether we can achieve those purposes through other means, as well as the applicable legal, regulatory, tax, accounting or other requirements. Once we no longer need your data, we will either erase (destroy) it, anonymise it, or, if this is not possible, then we will securely archive your data and isolate it from any further use until deletion is possible.

To give you a more exact idea, the following are some of the more specific principles we follow:

1. if you’ve ever created a user account with us, we will retain all User Data and Transaction Data associated with such account over the entire lifetime of the account plus ten years;
2. if you’ve ever granted us access to your Bank Account Data, we will erase such data once our access has expired or been revoked;
3. if we process a certain piece of personal data based on your consent and you withdraw such consent or the consent expires, we’ll erase the data after such withdrawal or expiration unless this Policy states we may process the data for a different purpose, on a different legal basis;
4. if we are required by law to retain a certain piece of personal data (see e.g. Act No. 586/1992 Coll., on Income Tax, Act No. 235/2004 Coll., on Value Added Tax, Act No. 563/1991 Coll., on Accounting, Act No. 499/2004 Coll., on Archiving or Act No. 253/2008 Coll., on Measures Countering Money Laundering and Financing of Terrorism), we’ll keep the data for as long as the law prescribes, irrespective of any default retention period; and
5. if we find ourselves in a dispute with you, we’ll keep personal data needed to establish, exercise or defend our rights in such dispute (see section ‎3.7 (Protection of Legal Claims)) at least until such time the dispute has been concluded and we no longer owe each other anything, irrespective of any default retention period.

In some cases, you have the right to demand that we erase your personal data – see section ‎8.4 (Right to Erasure).

Your rights

General

1. In order to retain control over your personal data, you have a multitude of rights at your disposal. Such rights are summarised further in this section, but note this summary is simplified and you should read the GDPR or obtain independent legal advice to obtain a full picture.
2. If you wish to exercise one of your rights or want to raise another request or query in connection with your personal data, please reach out using one of the means set out in section ‎1.2.
3. We’ll respond to your request and let you know what steps we’ve decided to take in relation to it as soon as possible, and no later than one month from the time we’ve received a clear, complete request from you and have verified your identity. Particularly complicated requests might exceptionally take us up to two more months to process – we’ll let you know if this happens to be the case.

Right of Access

You may at any time request confirmation as to whether we process personal data concerning you and, if so, for what purposes, to what extent, to whom they are disclosed, for how long we will process them, whether you have the right to rectification, erasure, restriction of processing or objection or to file a formal complaint, where we have obtained the personal data and whether automated decision-making, including profiling, occurs on the basis of the processing of your personal data. In addition, you have the right to obtain a copy of your personal data, the first provision of which is free of charge (we may charge a reasonable administrative fee for the provision of further copies).

Right to Rectification

You can ask us to correct or complete your personal data at any time if it is inaccurate or incomplete.

Right to Erasure (‘Right to Be Forgotten’)

You can ask us to erase your personal data if:

1. it is no longer necessary for the purposes for which it was collected or otherwise processed;
2. it is processed based on your consent, you withdraw such consent and no other legal basis for processing is available;
3. you object to the processing and there are no overriding legitimate grounds for the processing;
4. its processing is unlawful; or
5. we are required to do so by law.

Please note that the right to erasure is not absolute (unconditional); for example, we may not be able to delete your data if we need to retain it in order to establish, exercise or defend legal claims, or if an important public interest prevents erasure.

Right to Restriction of Processing

Where one of the following circumstances applies, you can ask us to pause (‘suspend’) processing your personal data with the exception of storage, and to only use them for establishing, exercising or defending legal claims or for purposes with which you give consent:

1. you challenge the accuracy of the processed data (in which case we’ll restrict its processing until we verify accuracy);
2. processing of the data is unlawful and you don’t want us to erase it;
3. we no longer need the data for the purposes for which it was collected or otherwise processed; or
4. you have objected to the processing and there are no overriding legitimate grounds for the processing (in which case we’ll restrict its processing pending our assessment of the legitimate grounds).

Right to Object

You have the right to object to the processing of personal data that we process for direct marketing purposes (see e.g. section ‎3.6 (Marketing)) or for processing based on our or others’ legitimate interests. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes; in other cases, we’ll stop the processing activity if your own interests outweigh our interests in continuing the processing.

Right to Data Portability

You have the right to obtain personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, as well as the right to transfer this data to another controller if the processing of this data is based on consent or a concluded contract and this processing is automatic.

Right to Lodge a Complaint

While we will always appreciate if you contact us first in case of any requests regarding the processing of personal data, you always have the right to file a complaint to the supervisory authority. In our case this is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) at Pplk. Sochora 727, Holešovice, 170 00 Prague 7, Czech Republic (www.uoou.cz).

Final Provisions

1. This Policy becomes effective on the date first written above.
2. We may make changes to this Policy at any time, in which case we’ll publish a new version of it on our Services.
3. This Policy is governed by Czech law.