BasisPoint

BASISPOINT PRIVACY POLICY

1. Introduction

This Privacy Policy explains how BasisPoint (“BasisPoint”, “we”, “us” or “our”) collects, uses, stores, shares and otherwise processes personal data when you:

The websites, applications, software, APIs, content and related services covered by this Privacy Policy are collectively referred to as the “Platform”.

“Personal data” means information that identifies you or can reasonably be linked to you. It may also be described as personal information under applicable law.

By using the Platform, you acknowledge that your personal data will be handled as described in this Privacy Policy.

This Privacy Policy does not form part of the BasisPoint Terms of Use.

2. Who is responsible for your personal data

BasisPoint is responsible for determining why and how personal data collected through the generally available Platform is processed.

Depending on the context, BasisPoint may act as:

Where we process personal data on behalf of an organisational customer, the customer may be primarily responsible for providing you with information about that processing and responding to your data-protection requests.

Questions about this Privacy Policy or our processing of personal data may be submitted through the contact details or support channels displayed on the Platform.

3. Personal data we collect

The personal data we collect depends on how you interact with the Platform and which features you use.

3.1 Account and identity information

We may collect:

We do not ordinarily have access to your complete password where authentication is managed securely by us or by an authentication provider.

3.2 Business and professional information

Where you use the Platform in a professional or institutional capacity, we may collect:

3.3 Subscription and payment information

If you purchase a subscription or paid service, we may collect:

Payment information may be collected and processed directly by a third-party payment provider. We may not receive or store your complete payment-card number or security code.

3.4 Connected-account and integration information

If you connect an exchange, wallet, protocol, blockchain address, API credential or other third-party account, we may collect or access:

The information available to us depends on the permissions you grant.

You should use read-only permissions where execution, withdrawal or transfer permissions are not required.

We will not ask you to provide private keys or wallet seed phrases. You should never disclose a private key or seed phrase through the Platform, through a support message or to anyone claiming to represent BasisPoint.

3.5 Research, strategy and portfolio information

When you use research, analytics, backtesting, portfolio, treasury, strategy or agent-assisted features, we may collect:

This information may reveal your trading, investment, research or commercial interests.

You are responsible for ensuring that you have authority to provide information relating to another person, organisation, account or portfolio.

3.6 Communications and support information

We may collect information when you:

This may include:

3.7 Device, usage and technical information

When you access the Platform, we may automatically collect:

We may use this information to operate, secure, analyse and improve the Platform.

3.8 Cookies and similar technologies

We may use cookies, local storage, software development kits, pixels, tags and similar technologies to:

More information may be provided through our cookie notice or cookie-preference tool.

Where required by applicable law, we will ask for consent before using non-essential cookies or similar technologies.

You can manage available choices through the cookie-preference tool and through your browser or device settings. Blocking certain technologies may affect Platform functionality.

3.9 Public blockchain information

Blockchain networks generally make certain information publicly available. This may include:

We may obtain this information directly from public blockchains, blockchain nodes, explorers, analytics providers or protocols.

Public blockchain records may remain permanently available on the relevant network. We cannot alter or delete data recorded on a public blockchain.

3.10 Information from third parties

We may receive personal data from:

The information received depends on the relevant third party, your settings and the permissions you provide.

3.11 Information we derive

We may derive information from the data available to us, including:

Derived information will be treated as personal data where it identifies or can reasonably be linked to an individual.

3.12 Sensitive personal data

The Platform is not intended for the collection of highly sensitive personal data, such as:

unless a specific feature expressly requests that information and appropriate notices and safeguards are provided.

You should not submit sensitive personal data through general Platform fields, prompts or support channels.

4. How we use personal data

We may use personal data for the following purposes.

4.1 Providing the Platform

We may process personal data to:

4.2 Operating connected accounts

Where you connect a third-party account, we may process information to:

We will process connected-account information only to the extent reasonably necessary to provide the relevant functionality, comply with law and protect the Platform.

4.3 Personalising the Platform

We may use personal data to:

4.4 Communicating with you

We may use personal data to:

Operational and security communications may be sent even where you have opted out of marketing communications.

4.5 Improving and developing the Platform

We may use personal data to:

Where reasonably possible, we use aggregated, de-identified or pseudonymised information for these purposes.

We do not use private customer data to train general-purpose artificial-intelligence models unless this is disclosed to you or separately agreed.

4.6 Security, fraud prevention and misuse detection

We may process personal data to:

4.7 Compliance and legal purposes

We may process personal data to:

4.8 Marketing

Subject to applicable law and your preferences, we may use contact and engagement information to:

You can unsubscribe from marketing emails by using the unsubscribe link in the relevant message or by contacting us.

Opting out of marketing does not prevent us from sending operational, billing, contractual or security communications.

4.9 Business transactions

We may process and disclose personal data in connection with:

Where appropriate, recipients will be required to protect the information and use it only for the relevant transaction.

5. Legal bases for processing

Where applicable data-protection law requires us to identify a legal basis, we may rely on one or more of the following:

5.1 Performance of a contract

We may process personal data where necessary to:

5.2 Legitimate interests

We may process personal data where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights.

These interests may include:

Where required, we assess whether the processing is necessary and proportionate and whether your interests or rights override the relevant legitimate interest.

5.3 Consent

We may rely on consent for activities including:

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

5.4 Compliance with legal obligations

We may process personal data where necessary to comply with laws, court orders, regulatory obligations, tax requirements, accounting rules or lawful requests.

5.5 Protection of rights and safety

Where recognised by applicable law, we may process information where necessary to protect the vital interests, safety, property or legal rights of an individual, BasisPoint or another organisation.

5.6 Other lawful bases

We may rely on another legal basis where permitted by applicable law. Where required, we will provide additional information about that basis.

6. When we share personal data

We do not disclose personal data except as described in this Privacy Policy, at your direction or as otherwise permitted by law.

6.1 Service providers

We may share personal data with service providers that support:

Service providers are permitted to process personal data only for agreed purposes and subject to appropriate contractual and confidentiality obligations.

6.2 Connected services

Where you direct us to connect the Platform to an exchange, wallet, protocol, communication service or other third party, we may share information necessary to:

Your use of the third-party service is also governed by its own terms and privacy policy.

6.3 Organisational customers and administrators

If you use the Platform through an organisation, we may share information with that organisation and its authorised administrators, including:

Organisational administrators may be able to access, restrict, export or delete information associated with the organisation’s workspace.

6.4 Professional advisers

We may share information with lawyers, accountants, auditors, insurers, consultants and other professional advisers where reasonably necessary to obtain advice, protect our interests or comply with obligations.

6.5 Authorities and legal recipients

We may disclose personal data where we reasonably believe disclosure is necessary to:

6.6 Business transaction recipients

Personal data may be disclosed to prospective or actual investors, purchasers, sellers, lenders, advisers or transaction counterparties in connection with a corporate or business transaction.

6.7 With your direction or consent

We may share information with another person where you direct us to do so or provide consent.

7. Sale and targeted advertising

We do not sell personal data for money.

We do not use personal data for cross-context behavioural advertising unless this is disclosed through the Platform and any consent or opt-out mechanism required by applicable law is provided.

If our practices change, we will update this Privacy Policy and provide any required choices before applying the change to your personal data.

8. Aggregated and de-identified information

We may aggregate or de-identify information so that it no longer reasonably identifies an individual.

We may use and disclose aggregated or de-identified information for:

We will not attempt to re-identify information that has been properly de-identified, except where necessary to test or validate the de-identification process or where otherwise permitted by law.

9. Artificial intelligence and automated processing

The Platform may use artificial intelligence, machine learning, statistical models and automated systems to:

Automated analytical outputs may be based partly on personal data, such as your account settings, connected-account information, saved preferences or prompts.

Unless we expressly state otherwise, we do not use automated processing to make decisions about you that produce legal or similarly significant effects without appropriate human involvement.

Where applicable law provides rights concerning solely automated decision-making, you may contact us to request information, human review or another available remedy.

10. International data transfers

The Platform may be accessed globally, and our service providers, infrastructure and personnel may be located in different countries.

As a result, personal data may be transferred to, stored in or accessed from a country other than the country in which you are located.

Data-protection laws may differ between countries.

Where required by applicable law, we use recognised safeguards for international transfers, which may include:

You may contact us for further information about safeguards relevant to your personal data.

11. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

The appropriate retention period depends on factors including:

Account information may generally be retained while your account remains active and for a reasonable period after closure.

Billing, transaction and contractual records may be retained for longer periods where required for legal, tax, audit or accounting purposes.

Security records and technical logs may be retained for a period appropriate to investigate incidents, maintain Platform integrity and prevent abuse.

Backup copies may remain for a limited period after information is removed from active systems.

We may retain aggregated or properly de-identified information indefinitely where it no longer identifies you.

Public blockchain information may remain permanently available through the relevant blockchain and cannot be erased or modified by us.

12. Data security

We use administrative, technical and organisational measures designed to protect personal data against:

Measures may include:

No method of transmission, storage or processing is completely secure. We cannot guarantee absolute security.

You are responsible for:

Do not send private keys, seed phrases or unnecessary confidential information through the Platform or support channels.

13. Data incidents

If we identify a personal-data incident, we may take steps to:

Communications concerning an incident may be sent using the contact information associated with your account.

14. Your privacy rights

Depending on your location and applicable law, you may have some or all of the following rights:

These rights are not absolute. A request may be refused or limited where permitted by law, including where processing is necessary to:

Right to object

Where applicable, you may object to processing based on legitimate interests.

You may object to direct marketing at any time. Where you object to direct marketing, we will stop using your personal data for that purpose.

15. Exercising your rights

You may submit a privacy request through the contact details or support channels displayed on the Platform.

Your request should describe:

We may need to verify your identity before completing a request. We will request only information reasonably necessary for verification.

You may be permitted to use an authorised agent. We may request evidence of the agent’s authority and may ask you to verify your identity directly.

We will respond within the period required by applicable law.

We ordinarily do not charge for a privacy request. We may charge a reasonable fee or refuse a request where permitted by law, including where it is manifestly unfounded, excessive or repetitive.

16. Account controls

Where available, you may review or update certain information through your account settings.

You may also be able to:

Disconnecting an integration prevents future collection through that integration but does not necessarily delete information previously collected.

Account deletion may not remove information that we are required or permitted to retain.

17. Marketing preferences

You may unsubscribe from marketing emails by selecting the unsubscribe link included in the message.

You may also manage available preferences through your account or contact us.

We may retain limited information about an opt-out request to ensure that your preference is respected.

You may continue to receive non-promotional communications relating to:

18. Cookies and preference controls

Where available, you can manage non-essential cookies through the cookie-preference tool displayed on the Platform.

Browser and device controls may also allow you to:

Cookie controls may be device- and browser-specific. You may need to repeat your choices when you use a different browser or device or after deleting cookies.

Strictly necessary technologies may remain active because they are required for security, authentication, preference management or core Platform functionality.

19. Children

The Platform is not directed to children or intended for use by anyone under 18 years of age.

We do not knowingly collect personal data from children through the Platform.

If you believe that a child has provided personal data to us, contact us so that we can investigate and take appropriate action.

20. Third-party services and websites

The Platform may contain links to or integrations with exchanges, wallets, protocols, blockchain networks, payment providers and other third-party services.

This Privacy Policy does not govern the privacy practices of those third parties.

Third parties may independently collect, use and disclose personal data under their own privacy policies and terms.

We encourage you to review the relevant third-party policies before using or connecting a third-party service.

21. Public and shared content

Certain features may allow you to share reports, links, dashboards, configurations or other content.

Information you choose to make public or share with another person may be viewed, copied or redistributed by others.

You should not include personal, confidential or commercially sensitive information in publicly accessible content unless you are authorised and prepared for that information to be disclosed.

22. Changes in purpose

We will generally use personal data only for the purposes for which it was collected or for compatible purposes.

If we intend to use personal data for a materially different purpose, we will provide additional information and, where required, obtain consent before beginning the new processing.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

The updated version will be posted on the Platform with a revised effective date.

Where a change is material, we may provide additional notice through the Platform, by email or through another appropriate communication channel.

We encourage you to review this Privacy Policy periodically.

24. Complaints

You may contact us if you have a question or complaint about how we process personal data.

Depending on your location, you may also have the right to complain to the privacy or data-protection authority responsible for your jurisdiction.

We encourage you to contact us first so that we have an opportunity to address the concern directly.

25. Contact

Questions, complaints, privacy requests and requests for further information may be submitted through the contact or support channels displayed on the Platform.