Privacy Notice

Privacy Notice

Version of: 20-December-2024

The Privacy Notice is drawn up in English as well as other language versions. In case of any discrepancy the English language version prevails.

1. Introduction

Bitvavo offers an online platform, the Bitvavo Platform, where Digital Assets can be traded against other Digital Assets or E-Tokens, as well as ancillary services (the Services). The Services are accessible via our Website (bitvavo.com) and our mobile application.

This is our Privacy Notice. In this document we explain what kind of personal data we collect via our Services. Personal data means all information by which a person can be directly or indirectly identified and is a term under the General Data Protection Regulation (“GDPR”). We also explain what role we have in the processing of personal data, how long we retain personal data and what rights you have as a data subject.

Please read this Privacy Notice carefully. Please note that Privacy Notice utilizes certain terms that are defined in the User Agreement.

2. Questions about this Privacy Notice?

If you want to know more about this Privacy Notice or when you have questions or recommendations, please send an email to [email protected] or contact Bitvavo’s Data Protection Officer directly at [email protected]. Bitvavo will respond to your request as quickly as possible.

Contact details

3. Who is responsible for the processing of your personal data?

Bitvavo B.V. is responsible for the processing of your personal data as described in this Privacy Notice and acts as ‘controller’ under the GDPR, except when the processing of personal data described takes place in the context of the Lending Service (as further explained in the User Agreement). In such case, Bitvavo Custody B.V. qualifies as the controller.

This Privacy Notice also applies to the processing of personal data by Stichting Bitvavo Payments as controller (as further explained in paragraph 8).

4. Which personal data could be processed and from which sources?

Bitvavo may process your personal data if you:

1. are a visitor/user of our Website or Services;

2. are a user of our Services (a customer);

3. are (an authorized representative or UBO of) a customer (or their related family member or close business partner);

4. have a business relationship with Bitvavo;

5. are a person (not a customer of Bitvavo) that (a) has a Digital Asset wallet with a third party Digital Asset service provider and allows a transfer of a Digital Asset from that wallet to a Bitvavo Digital Asset Wallet or (b) is the intended recipient of such transfer; and/or

6. work at our service providers or other parties we deal with.

In paragraph 4.1 – 4.3 is described which data could be processed and from which source.

4.1 Information we collect from you automatically

We receive and store certain types of information automatically, such as whenever you visit our Website, interact with the Bitvavo Platform, or use other Services. This information helps us address customer support issues, provide you with a streamlined and personalized experience, improve the performance of the Bitvavo Platform, and protect your account against fraud by detecting unauthorized access. Information collected automatically includes:

1. Usage data: Information on how our Services are accessed and used, such as your IP-address, which pages you visit on the Website, on which links you click, when and for how long you use the Bitvavo Platform, and technical information (e.g. type of browser and operating system). Please read our Cookie Statement for more information on how we use cookies and similar technologies to collect this type of information about you: https://bitvavo.com/en/cookie-policy.

4.2 Information you provide to us

To establish an account and allow you access to our Services, we'll ask you to provide us with some important information about you. This information is either required by law (e.g. to verify your identity) or necessary to provide the requested Services (e.g. you will need to provide your bank account number if you'd like to link that to your Bitvavo account). Below you will find an overview of the personal data we generally collect from our (potential) customers and individuals related to our (potential) customers.

1. Registration data: First name, last name, email address, password, phone number, address, affiliate code (optional), and pin code.

2. Identification data: Government issued identity document such as passport, driver's license, national identity card or resident permit (“ID Document”) - including your full name, date of birth, gender, place of birth, nationality, place and date of the issuance of the document, data of expiry of the document, document type, document number, signature and your photo. In addition, we ask you to record a video clip of yourself with audio to verify your identity. In this context we process your facial images, voice and polygon mesh data. Please note that you must cover your social security number on your ID Document before providing it to us.

3. Personal data included in institutional information: proof of legal formation of a legal entity (e.g. articles of incorporation and company extract), additional legal documents (e.g. shareholder register, structure chart, corporate tax return and UBO statement – and personal identification (and institutional) information for all direct and indirect representatives, directors and material beneficial owners (if applicable).

4. Account information: Information about the purpose and intended nature of the business relationship you have with us.

5. Employment information: Profession, job title, office location, description of role, employment contract and/or annual income.

6. Financial information: Bank account information, transaction history, source of funds, source of wealth and/or tax identification number.

7. Transaction information: Information about the transactions you make through our Services, such as your name, your bank account number, the amount, the type of transaction (e.g. deposit or withdrawal), the name of the recipient, the Digital Asset wallet address of the recipient and the corresponding timestamps of these transactions.

8. Correspondence: Survey responses, information provided to our support team, and other information that you might voluntarily share with us.

As we add new features and Services and applicable laws and regulations might change, you may be asked to provide additional information. In such case, we will inform you about the purposes and legal grounds for such additional processing separately and/or via an update of this Privacy Notice.

4.3 Information generated by us

We may generate information about you, for example based on information you provided to us. The categories of (personal) data may include:

1. Risk and fraud related information: Behavioral pattern information, risk profiles, risk categories, transaction profile information, transaction patterns information and internal suspicious transaction reports or intelligence, derived from information about the transactions you make on our Services - such as the type of transaction (e.g. buy transaction and/or sell transaction), the amount, the type of virtual currency, the counterparty – and other personal data we have of you, hit / no hit information on Politically Exposed Persons (PEPs) and sanction lists – and/or notices to designated authorities including reports/notifications to FIU.

2. Whistleblowing reports and fraud reports: We may receive your personal data if they have been necessarily included in whistleblowing reports from Bitvavo staff members or in fraud reports from relevant payment institutions and payments service providers, law enforcement agencies and financial intelligence units (FIUs). We may draw conclusions from such personal data regarding your risk classification and include such conclusions in our systems.

4.4 Information collected/received from third parties

From time to time, we may obtain information about you from third party sources as required or permitted by applicable laws and regulations. These sources may include:

1. Public databases: We obtain information from public databases such as company registers, beneficial owner (or similar) registers, Google (Maps), and other (reliable and independent) sources. We may also receive such public information via third party service providers such as Comply Advantage (adverse media checks) and LexisNexis (information on politically exposed persons (PEPs), sanctions and blacklists).

2. Blockchain data: We may analyze public blockchain data and obtain information about your transactions from blockchain analysis providers such as Chainalysis.

3. Digital Asset transfer information: If you (a) have a Digital Asset wallet with a third party Digital Asset service provider and allow a transfer of a Digital Asset from that wallet to a Bitvavo Digital Asset Wallet (an originator) or (b) are the intended recipient of such transfer (a beneficiary), we may receive information about you from the respective third party Digital Asset service provider. This is required by Regulation (EU) 2023/1113 (the Transfer of Funds Regulation) for the purposes of the prevention of money laundering and terrorism financing. If you are an originator, such information may include your name, address, ID Document number, Digital Asset wallet address, official identifier (if available), and date and place of birth or your customer identification number at the third party Digital Assets service provider you are a customer of. If you are a beneficiary, such information may include your name, Digital Asset wallet address, and official identifier (if available). We may receive this information via a third party service provider such as Notabene.

5. For what purposes are your personal data processed?

We may use your personal data for the following purposes:

1. To comply with laws and regulations; Most of our Services are subject to laws and regulations requiring us to collect, use, and store your personal data in certain ways. For example, Bitvavo must identify and verify customers using our Services in order to comply with anti-money laundering laws such as the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft) and the Transfer of Funds Regulation. In order to verify your identity remotely, we match your photo with your identification. When you provide us with your identification, you must cover your social security number. We retain your photo to check if you are a PEP and to verify your identity when you request withdrawal of digital assets.

2. To enforce the terms in the User Agreement and other agreements with you; Bitvavo handles sensitive information, such as your identification and financial data, so it is very important for us and our customers that we actively monitor, investigate, prevent, and mitigate any potentially prohibited or illegal activities, and/or prevent and detect violations of the User Agreement or agreements for other Services.

3. To prevent fraud, misuse of services, or money laundering; Bitvavo processes personal data that are not strictly required by law, but nevertheless are necessary to protect the legitimate interest to (i) guarantee the safety and integrity of the digital currency sector, (ii) to prevent and actively combat (attempts to commit) criminal offenses and (iii) to assist in combating fraud and other types of abuse. We also process personal data of existing customers to determine potential risk factors for new customers.

4. To provide the Services; We process your personal data to provide the Services to you. For example, when you want to store funds on our platform, we require certain information such as your identification, contact information, and payment information. We cannot provide you with Services without such information.

5. To provide service communications; We send administrative or account-related information to you to keep you updated about our Services, inform you of relevant security issues or updates, deposits and withdrawals, staking rewards, or provide other important information. Without such communications, you may not be aware of important developments relating to your account that may affect how you can use our Services. You may not opt out of receiving critical service communications, such as emails or mobile notifications sent for legal or security purposes.

6. To provide customer service; We process your personal data when you contact us to resolve any questions, disputes, collect fees, or to troubleshoot problems. Without processing your personal data for such purposes, we cannot respond to your requests and ensure your uninterrupted use of the Services.

7. For research and development purposes; We process your personal data to better understand the way you use and interact with the Services. In addition, we use such information to customize, measure, and improve the Services and the content and layout of our Website and applications, and to develop new services. Without such processing, we cannot ensure your continued enjoyment of our Services.

8. To engage in marketing activities; Based on your communication preferences, we may send you marketing communications (e.g. emails or mobile notifications) to inform you about our products and services; to deliver targeted marketing; and to provide you with promotional offers and to wish you a happy birthday. Our marketing activities will be conducted based on your customer profile, including your account and trading data.

9. To set alerts; Based on your account settings you can set an alert to be notified about price changes, new products, transactions, or other information as configured by you. We will send this notification, depending on your account settings, by email or a push notification in the app.

10. For accountability purposes; Bitvavo retains personal data insofar necessary to protect the legitimate interest to (i) maintain a proper administration and (ii) to substantiate potential legal claims. Bitvavo therefore needs to keep records of registration, identification, transactions, withdrawals of funds, access logs and important correspondence.

The following chart summarizes how we use the categories of personal data we collect from customers:

*For this purpose, we process your first name, email, date of birth and country.

6. Legal Bases for Processing your Information

Bitvavo only processes your personal data for a specified purpose and based on a legal ground, such as your consent or when necessary for the execution of an agreement with you, to comply with a legal obligation or to protect a legitimate interest.

Please note:

1. If you provided Bitvavo your consent for any processing of your personal data, you always have the right to withdraw your consent at any moment by emailing us at: [email protected]. Please note withdrawal of your consent does not affect the lawfulness of the processing of your personal data before such withdrawal.

2. If we send you targeted marketing messages based on legitimate interest, we always offer you the opportunity to unsubscribe. If you wish to unsubscribe, you can do so (i) on our Website by changing your preferences under the ‘settings’ tab or (ii) in every marketing email we send you, by clicking ‘unsubscribe’.

Special categories of personal data

Part of your identification data qualifies as biometric data. We process such data as this is necessary for our legal identification and authentication purposes. In addition, we may process personal data related to criminal offences and/or personal data revealing political opinions to assess your request to become our customer and to meet our legal obligations under anti-money laundering laws such as the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft).

7. Does Bitvavo make use of automated decision making including profiling?

Bitvavo uses software to verify and read out your ID Document and check whether the photo on your ID Document matches your video. In addition, Bitvavo uses software to verify your bank account (by checking whether the name of the bank account and the name on your ID Document match). If no issues are identified in such a process, the ID Document is automatically approved. ID Documents of minors are automatically disapproved, as minors are not allowed to use our Services under the User Agreement. All other disapprovals are always reviewed manually first by Bitvavo’s customer onboarding team. If your ID Document or bank account has been disapproved, you can request (another) manual review, express your point of view and/or contest such a decision by contacting Bitvavo’s support team at: [email protected].

Bitvavo also monitors on an ongoing basis whether any new information would affect your risk profile, transaction profile and/or risk category and whether your behavior and (if applicable) transactions are in line with the information Bitvavo has about you and your risk classification. In this respect, Bitvavo is using software which is automatically updating your risk profile, transaction profile and/or risk category based on your behavior and might result in soft stops (i.e. transaction will be executed but manually reviewed afterwards by the compliance team) and hard stops (i.e. transaction will only be executed after manual review and approval by the compliance team) of transactions. In addition, an update of your risk profile might result in our compliance team performing additional or more frequent reviews of your account details, such as your transactions and background information. If your transaction has been stopped, you can request (another) manual review, explain your transaction and/or appeal the stop, by contacting Bitvavo’s compliance team at: [email protected].

8. Who may receive your personal data?

Bitvavo only provides access to your personal data to Bitvavo personnel that need to have access to your personal data to perform their tasks and duties. Bitvavo ensures personnel are legally required to keep your personal data confidential.

Processors

Bitvavo has instructed third parties to process personal data on our behalf if such is necessary for third parties to perform their tasks and duties. Such third parties qualify as "Processors". Bitvavo signs appropriate data processing agreements with all Processors. Through these data processing agreements, the Processors provide at least the same level of security as provided by Bitvavo and guarantee the confidentiality of your personal data. Bitvavo nevertheless remains fully responsible for these processing operations and will therefore take all reasonable technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration and unauthorised disclosure or access.

Bitvavo has instructed the following categories of Processors to process personal data:

1. Hosting service providers, including Amazon Web Services which is located in Luxembourg;

2. Customer support software providers, including Zendesk which is located in the United States;

3. ID Document & facial biometrics verification software providers, including Onfido which is located in the United Kingdom;

4. Customer screening service providers, including Comply Advantage which is located in the United Kingdom;

5. Customer engagement software providers, including Braze which is located in the United States.

6. Customer relationship software providers, including Pipedrive which is located in Estonia.

7. Chatbot software providers, including Freeday which is located in the Netherlands;

8. Software providers for analyzing customer reviews, including Lumoa which is located in Finland;

9. Business accounting software providers, including NetSuite which is located in the United Kingdom.

Controllers

Bitvavo may share your personal data with third parties who process personal data for their own purposes (and do not qualify as Processors but as “Controllers”) in limited circumstances:

1. Stichting Bitvavo Payments (in the Netherlands) functions as a bankruptcy remote vehicle for safeguarding funds of users of the Services. For this purpose, your name and bank account number is shared with and processed by Stichting Bitvavo Payments.

2. Bitvavo shares your personal data if and to the extent this is required to be able to fulfill applicable (European or Dutch) rules and regulations, including assisting Financial Intelligence Units (FIU) or (other) competent supervisory authorities, law enforcement authorities or if necessary to assist in combating fraud and other types of abuse to the extent permitted by law.

3. Bitvavo shares your personal data with Tintel: our payment provider which is located in the Netherlands. Tintel’s privacy statement, available at https://www.pay.nl/en/privacy, describes its collection and use of personal data.

4. Bitvavo uses Google Maps to verify the validity of your address. Google may use and retain this data to provide and improve Google products and services, subject to the Google Privacy Policy available at https://www.google.com/policies/privacy/.

5. We are legally obliged to include (some of) your personal data in our financial administration, which has to be shared with the national tax authority. The tax authority will process these personal data in accordance with its own privacy policies.

6. If Bitvavo is the subject of a sale, merger, or other transaction, we may also share your personal data with the organization that is (planning) to acquire Bitvavo.

7. We share your transaction hash ID with Chainalysis so that Chainalysis can enable us to analyze public blockchain data and obtain information about your transactions to ensure you are not engaged in illegal or prohibited activity under the User Agreement. Chainalysis is located in the United States.

8. If (a) you are a customer at Bitvavo, and you allow a transfer of a Digital Asset from your Bitvavo Digital Asset Wallet to a Digital Asset wallet at a third party Digital Asset service provider (an originator) or (b) are the intended recipient of such transfer (a beneficiary), we share information about you with the respective third party Digital Asset service provider. This is required by Regulation (EU) 2023/1113 (the Transfer of Funds Regulation) for the purposes of the prevention of money laundering and terrorism financing. If you are an originator, such information includes your name, address, ID Document number, Bitvavo Digital Asset wallet address, official identifier (if available), and date and place of birth or your customer identification number. If you are a beneficiary, such information includes your name, Digital Asset wallet address, and official identifier (if available). We may send this information to the third party Digital Asset service provider using a third party service provider such as Notabene.

Your personal data may also be shared after requesting and obtaining your (explicit) consent.

9. Does Bitvavo transfer personal data to recipients outside the European Economic Area?

We may transfer personal data to parties outside the European Economic Area, if one of our Processors or Controllers is established outside the European Economic Area (see paragraph 8 above). In this context, Bitvavo takes the following safeguards to ensure that personal data is adequately protected in accordance with EU law:

1. Bitvavo transfers personal data to a party outside the European Economic Area if the European Commission has decided that the relevant country where that party is located ensures an adequate level of protection (“Adequacy Decision”). For transfers of personal data to a party in the United States, Bitvavo also requires that such a party participates in the EU-U.S. Data Privacy Framework.

2. Bitvavo transfers personal data to party located in a country for which the European Commission did not provide an Adequacy Decision - and for the United States if that party does not participate in the EU-U.S. Data Privacy Framework - only if that party provides additional safeguards, such as Standard Contractual Clauses (based on Article 46(2)(d) GDPR).

You may contact us if you wish to receive more information or a copy of the safeguards we take in this scope where necessary.

If you want to consult any safeguards that Bitvavo has in place to protect your personal data if we transfer your personal data outside the EEA, please contact us via: [email protected].

10. Your rights

If your personal data is processed, you have privacy rights and, of course, Bitvavo respects these. More specifically, you have the right of access, deletion and rectification of personal data, objection to processing of personal data, restriction of processing of personal data and the right of data portability. You can exercise your right by contacting [email protected]. We may ask you to provide further information in order to determine your identity first, to ensure that no one else is trying to execute your privacy rights.

Bitvavo will respond to your request as quickly as possible, although this can take up to one month. If more time is required to complete your request, Bitvavo will let you know how much longer is needed and the reasons for the delay.

The above rights are not always absolute, and sometimes we may have pressing interests or a legal obligation to deny your request. In such case, we will explain to you our reason for denying your request.

11. Complaints

If you believe that Bitvavo has processed your personal data unlawfully or if you are not satisfied with Bitvavo’s response to your request, you can send your complaint to [email protected]. Bitvavo will respond to your complaint as quickly as possible. You may also directly contact our Data Protection Officer via [email protected].

You are always entitled to file a complaint with a data protection supervisory authority if you believe that we are not processing your personal data in accordance with the GDPR. For Bitvavo, the leading supervisory authority where you may file a complaint is:

Autoriteit Persoonsgegevens

Website: https://www.autoriteitpersoonsgegevens.nl

12. For how long will Bitvavo keep your personal data?

Bitvavo will not keep your personal data longer than the mandatory statutory retention period or, if such a mandatory statutory retention period does not apply, no longer than is strictly necessary to achieve the purposes for which your personal data were collected or processed.

Criteria for data retention

Bitvavo retains personal data processed to execute any agreement with you as long as the term of such agreement. Bitvavo retains personal data processed to comply with a legal obligation, as long as such legal obligation applies to Bitvavo. Bitvavo retains personal data processed to protect any legitimate interest (as described in this Privacy Notice) for as long as necessary to achieve such protection. If Bitvavo has asked for your (explicit) consent for any processing of your personal data, Bitvavo retains your personal data until you withdraw your (explicit) consent or until your (explicit) consent can be deemed expired and you have not renewed such (explicit) consent.

In addition to the legal obligations already mentioned in this Privacy Notice, Bitvavo has the following legal obligations to (keep) retaining personal data:

1. Personal data to the extent relevant for tax purposes (pursuant to Article 52 of the Dutch General Tax Act): 7 years after the latest relevant calendar year;

2. Personal data to the extent relevant to comply with Article 33(3) of the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft): 5 years after the business relationship has been ended;

3. Personal data to the extent relevant to comply with Article 34 of the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft): 5 years after Bitvavo submitted a notification to the FIU.

13. Updating the Privacy Notice

Bitvavo may update this Privacy Notice. Any update of the Privacy Notice will apply after announcing the update on our Website or any other official communication channel. If the change to the Privacy Notice concerns a fundamental change to the nature of the processing (e.g. a new category of sensitive data processed) or if the change may be relevant to and impact upon you, Bitvavo will inform you of changes to the Privacy Notice, explicitly and effectively, well in advance of the change actually taking effect.

14. Contact and questions about this Privacy Notice?

If you want to know more about Bitvavo’s Privacy Notice or have any questions or recommendations, please send an email to [email protected] or contact Bitvavo’s Data Protection Officer directly at [email protected]. Bitvavo will respond to your request as quickly as possible.

Contact details

Bitvavo B.V. ⁠

Keizersgracht 281, 1016 ED 

Amsterdam, The Netherlands 

E: [email protected]. ⁠

W: bitvavo.com. ⁠

Chamber of Commerce number: 68743424.

Bitvavo Custody B.V. ⁠

Keizersgracht 281, 1016 ED

Amsterdam, The Netherlands

E: [email protected].

W: bitvavo.com.

Chamber of Commerce number: 80118844.

Stichting Bitvavo Payments

Keizersgracht 281, 1016 ED

Amsterdam, The Netherlands

E: [email protected].

W: bitvavo.com.

Chamber of Commerce number: 69228922.