This Privacy and Data Protection Policy describes how the KairosX Group (which includes KairosX Corporation and its subsidiaries, affiliates, associated companies and jointly controlled entities) (collectively “KairosX”, “We” or “Our”) collects, processes, manages and safeguards personal data through the use of KairosX’s website and mobile application (“Website”), as well as the Services offered by KairosX. Unless otherwise defined herein, all abbreviations and definitions shall have the same meaning as ascribed to them in the Terms of Use of KairosX.
KairosX operates an interactive online platform for cryptocurrency enthusiasts that facilitates the investment in the Dual Currency Product (“KairosX Platform”).
KairosX puts in place strict requirements for our compliance and legal processes, security and technological platforms and personal data protection policies are maintained according to applicable laws. This includes requiring all Clients to undergo identity verification such as KYC measures, anti-money laundering and/or countering of financial terrorism screening implemented by KairosX (as may be amended, varied and/or supplemented from time to time). We are a responsible member of the trading community, and we will work with regulators and traders to provide innovative digital asset products and solutions globally.
This Privacy and Data Protection Policy applies to all Clients of the KairosX Platform (“Clients”) and all personal data collected by KairosX, operating in the capacity of a data principal or a data intermediary, from all (i) visitors to the KairosX Platform; (ii) persons who register their emails with KairosX; and (iii) Clients. For avoidance of doubt, this Privacy and Data Protection Policy does not apply to anonymised data, or information which cannot be used to identify any individual person.
The use of the KairosX Platform entails various types of personal data being provided for various purposes. Personal data refers to data, whether true or not, about an individual who can be identified from that data or from that data and other information to which the organisation has or is likely to have access, including information that can identify an individual by reference to an identifier such as a name, citizenship identity number, passport number, address, telephone number, email address, location data, online identifier, biometric data, financial information, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
By accessing the Website and creating a Client account with KairosX, Clients agree and consent to KairosX collecting, using, disclosing and sharing such personal data across all KairosX entities, and disclosing such personal data to relevant third-party service providers in accordance with the Privacy and Data Protection Policy. KairosX may also combine the collected personal data with other personal data in KairosX’s possession. If Clients use the Services across the various KairosX entities, KairosX will link personal data collected across the various KairosX entities to facilitate the Client’s use of the Services and for the purposes in paragraph 2.1 below.
1COLLECTION OF PERSONAL DATA
1.1The KairosX Platform may be browsed anonymously. However, Clients will have to create a Client account on the KairosX Platform in order to utilise the Services.
1.2Generally, KairosX may collect Clients’ personal data in the following circumstances:
(i)when the Client creates an account on the KairosX Platform;
(ii)when KairosX implements additional measures to authenticate Client identity;
(iii)when the Client uses the Services;
(iv)when the Client carries out transactions on the KairosX Platform; and
(v)when the Client submits personal data to KairosX for any other reason, including through any interactions whether directly through the KairosX Platform or via social media.
1.3Clients authorise KairosX to process and store such personal data for the purposes provided for in paragraph 2.1 below and if applicable, verify such credentials with the relevant social media network. KairosX may also, where necessary, collect personal data of Clients from credit agencies, law enforcement agencies, or government agencies and sources including publicly available information, referral programs or social media services, in accordance with the relevant authorisation procedures under Applicable Laws.
1.4If Clients provide KairosX with any personal data relating to a third-party, by submitting such information to KairosX, Clients represent to KairosX that they have obtained the consent of the third-party to provide KairosX with such personal data which may be collected, used and disclosed in accordance with this Privacy and Data Protection Policy.
1.5Clients shall ensure that all personal data submitted to KairosX is true, complete and accurate in all respects. Any omission or failure to do so, or any refusal to share required personal data in order to comply with legal requirements or contractual obligations, may prevent KairosX from fulfilling the purposes stated in paragraph 2.1.
1.6Clients acknowledge that all personal data submitted to KairosX is in compliance with all applicable laws relating to data protection including without limitation, the General Data Protection Regulation (EU) 2016/679 of 27 April 2016, Guidelines on Data Privacy and Data Protection 2021 issued by the Royal Monetary Authority of Bhutan as well as the common law and other relevant laws (“Applicable Laws”). If Clients are in doubt as to their rights in relation to their personal data, they should consult their solicitors or other professional advisors.
2USE OF PERSONAL DATA
2.1In general, KairosX collects and uses personal data for the following purposes:
(i)to process the Client's application for an account on the KairosX Platform;
(ii)to maintain the Client's account;
(iii)to verify the Client's identity;
(iv)to provide Clients with the Services;
(v)to collect information in order to comply with and enforce know-your-customer policies and regulations, anti-money laundering and countering the financing of terrorism laws and regulations, or any other Applicable Laws;
(vi)to handle disputes and conduct and facilitate investigations and proceedings;
(vii)for KairosX’s prudential and operational management (including risk management, audit, compliance, outsourcing of services, business and financial decision-making);
(viii)to ensure or enhance network and information security;
(ix)to personalise Client experience and respond to individual needs, including for testing, research, analysis and product development;
(x)to improve and receive feedback on the Services and the KairosX Platform;
(xi)to improve customer service and provide support services;
(xii)to process interest in investing in the Dual Currency Product; and
(xiii)to send periodic emails, including but not limited to news, updates and related information on the Services, the KairosX Platform or KairosX.
2.2The purposes listed in paragraph 2.1 above are not exhaustive and KairosX may collect and/or use personal data for additional purposes which Clients will be notified of, in accordance with the applicable terms and conditions. Further, these purposes may continue to apply even in situations where the relationship between KairosX and the Clients (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable KairosX to enforce its rights under any contract with the Clients).
2.3KairosX may engage or use any service providers (including, but not limited to, KYC solution provider(s)) (“Sub-Processor”) for the processing of personal data or permit any authorised third-party to process personal data. If KairosX appoints a Sub-Processor, KairosX will ensure that, prior to the processing taking place, there is a written contract in place between KairosX and the Sub-Processor that specifies the Sub-Processor's processing activities and imposes on the Sub-Processor the same terms as those imposed on KairosX in this Privacy and Data Protection Policy.
2.4Subject to the conditions set out in the GDPR, the Client has the right to request access to, rectification or erasure of, and restriction of or objection to the processing of, its personal data, as well as the right to data portability and the right to withdraw consent where processing is based on consent. The Client also has the right to lodge a complaint with the Commission Nationale pour la Protection des Données (“CNPD”) or any other competent supervisory authority.
3DISCLOSURE
3.1KairosX takes care to protect and safeguard Clients’ personal data. This includes measures to prevent personal data from getting lost or used or accessed in an unauthorised way. KairosX limits access to Client personal data to employees on a need-to-know basis. Those processing personal data will only do so in an authorised manner and are required to treat such information with confidentiality.
3.2KairosX also employs security measures to protect personal data, including:
(i)all personal data collected on the KairosX Platform shall be transmitted via Secure Socket Layer (SSL) technology and then encrypted into the gateway provider's database only to be accessible by those authorized with special access rights who are required to keep the personal data confidential; and
(ii)all personal data shall be encrypted on the server.
3.3Clients should be aware, however, that no method of transmission over the internet or method of electronic storage is completely secure. While security cannot be guaranteed and any transmission remains at the Client’s own risk, KairosX strives to protect the security of the Clients' information and is constantly reviewing and enhancing its information security measures.
3.4However, at times, Clients’ personal data will have to be accessed by, or shared with, persons who have a legitimate purpose for accessing it.
3.5Personal data may, in particular, be disclosed to:
(i)companies belonging to the same group as the Company;
(ii)service providers, subcontractors, business partners or other service providers involved in the provision of the Services;
(iii)financial institutions, payment service providers, custodians, liquidity providers, trading venues or other infrastructures involved in the provision of the Services;
(iv)providers involved in identity verification, compliance, anti-money laundering, fraud prevention, cybersecurity or blockchain analytics;
(v)auditors, professional advisers, lawyers, consultants or other service providers acting on behalf of the Company;
(vi)competent authorities, judicial authorities, administrative authorities, tax authorities, supervisory authorities or law enforcement agencies where such disclosure is required or permitted by Applicable Law or regulation;
(vii)any other person where such disclosure is necessary to protect the rights of the Company, the Client or third parties, or where such disclosure is authorised or required under Applicable Law or regulation.
4COOKIES AND THIRD-PARTY WEBSITES
4.1Cookies are small files that a website or service provider transfers to computer hard drives through a web browser that enables the website or service provider's systems to recognize the browser and record certain information. Cookies may have unique identifiers, and reside, among other places, on the Client’s computer or mobile device, in emails and on our web pages. Cookies may transmit personal data about Clients and their use of the Services, such as browser type, search preferences, IP address, data relating to advertisements that have been displayed or that Clients have clicked on, and the date and time of use. Cookies may be persistent or stored only during an individual session.
4.2KairosX uses cookies on the KairosX Platform to record Clients' usage patterns and trends and customize Client experience. KairosX may engage third-party service providers to assist in such purposes or allow third parties to use cookies on the KairosX Platform to collect the same type of personal data for the same purposes KairosX does for itself. KairosX does not have access to or control over the cookies these third-parties use. However, such third-party service providers may not disclose personal data obtained in the course of their engagement to any other parties. Additionally, KairosX may share non-personally identifiable personal data with third-parties.
4.3Depending on the type of phone and operating software that the Client is using, the Client may be granted the option to disable the use of mobile identifiers. Clients may also disable the processing of cookies on their web browsers but this may prevent Clients from maximising the Services provided by KairosX.
4.4KairosX shall not be responsible for the collection, use, disclosure and care of personal data by any third-party websites linked to the KairosX Platform.
5ACCESS TO AND CORRECTION OF PERSONAL DATA, WITHDRAWAL OF CONSENT
5.1In accordance with Applicable Laws, Clients are entitled to:
(i)ask about the processing of the Client’s personal data, including to be provided with a copy of such personal data;
(ii)request the correction, update and/or (in some cases) deletion of the Client’s personal data;
(iii)in some cases, request the restriction of the processing of the Client’s personal data, or object to that processing;
(iv)withdraw consent to the processing of the Client’s personal data (where KairosX is processing the Client’s personal data based on the Client’s consent);
(v)request receipt or transmission to another organisation, in a machine-readable form, of the Client’s personal data that was provided to KairosX where KairosX is using the Client’s personal data based on consent or performance of a contract; and
(vi)complain to the relevant data privacy authority if the Client’s data privacy rights are violated, or if the Client has suffered as a result of unlawful processing of the Client’s personal data.
5.2If the Client wishes to make a request to exercise its rights as above, the Client can contact KairosX’s Data Protection Officer at bt-dpo@kairosx.com. KairosX will screen and verify all requests beforehand and may require the Client to provide supporting information or documentation to corroborate the request. Once verified, KairosX will give effect to the Client’s request within the timelines prescribed by Applicable Laws. Alternatively, Clients may also review, correct, amend or delete any part of their personal data by logging into their accounts via the KairosX Platform.
5.3Please note that a reasonable fee may be charged for an access request. KairosX shall inform the Clients of the Fees before processing the request.
5.4For the avoidance of doubt, where any deletion of personal data may result in loss of data integrity and auditable records, KairosX may elect not to comply with such request if it conflicts with KairosX’s obligation to comply with Applicable Laws or for the establishment, exercise or defence of legal claims.
5.5Where the Client is given the option to share the Client’s personal data with KairosX, the Client may always choose not to do so. If KairosX has requested the Client’s consent to processing and the Client later chooses to withdraw it, KairosX will respect that choice in accordance with its legal obligations. However, choosing not to share the Client’s personal data with KairosX or withdrawing consent to the use of it may prevent KairosX from fulfilling the purposes stated in paragraph 2.1, or may result in the Client not being able to make use of the Services. Even after the Client has chosen to withdraw consent, KairosX shall remain able to continue to process the Client’s personal data to the extent required or otherwise permitted by Applicable Laws.
6TRANSFER OF PERSONAL DATA OUTSIDE OF BHUTAN
6.1Clients consent to the transfer of their personal data to countries outside of Bhutan. Where KairosX transfers personal data out of Bhutan, KairosX shall comply with such legal and regulatory obligations in relation to the personal data, including having a lawful basis (such as Clients’ consent or other basis under Applicable Laws) for transferring the personal data and putting appropriate safeguards in place to ensure an adequate level of protection for the personal data. KairosX shall also take steps to ensure that Clients' personal data continues to receive a standard of protection that is at least comparable to that provided under this Privacy and Data Protection Policy.
7COMPLAINTS UNDER THE EUROPEAN GENERAL DATA PROTECTION REGULATIONS AS APPLICABLE TO PERSONAL DATA OF EU PERSONS
7.1KairosX may collect personal data from individuals and institutions located within the European Economic Area, and KairosX is responsible for ensuring that it uses such personal data in accordance with the General Data Protection Regulation (EU) 2016/679.
8RETENTION OF PERSONAL DATA
8.1KairosX may retain Clients' personal data for as long as it is necessary to fulfil the purposes stated in paragraph 2.1, or as required or permitted by Applicable Laws.
8.2In particular, the Company may retain certain data for the periods required under Applicable Laws and regulations relating to payment services, Crypto-Asset Services, anti-money laundering and counter-terrorist financing, taxation, accounting, fraud prevention, dispute management or the protection of its rights and legitimate interests.
8.3KairosX shall cease to retain Clients' personal data, or remove the means by which the data can be associated with the Clients, as soon as it is reasonable to assume that such retention no longer serves the purposes stated in paragraph 2.1, and are no longer necessary for legal or business purposes.
9CHANGES TO PRIVACY AND DATA PROTECTION POLICY
9.1KairosX may modify, update or amend the terms in this Privacy and Data Protection Policy at any time. Such amendments shall be notified to Clients through the KairosX Platform and/or other appropriate means. The updated version will be posted on the KairosX Platform. It is the Client’s responsibility to review this Privacy and Data Protection Policy regularly. The Client’s continued use of the KairosX Platform or the Services, purchase of products from KairosX, or continued communication or engagement with KairosX following the modifications, updates or amendments to this Privacy and Data Protection Policy, whether or not reviewed by the Client, shall constitute the Client’s agreement to be bound by such amendments.
10FEEDBACK
10.1Clients may contact KairosX at bt-dpo@kairosx.com if there are any questions or feedback regarding the Privacy and Data Protection Policy.
11EFFECT OF POLICY
11.1This Privacy and Data Protection Policy applies in conjunction with and not in substitution of any other policies, notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of the Client's personal data by KairosX.
12GOVERNING LAW AND JURISDICTION
12.1The Privacy and Data Protection Policy shall be governed by and in accordance with the laws of Bhutan.