Last Updated: 23rd May 2023
In this Policy, “Xapo”, "we", "us" and "our" collectively refers to Xapo Bank, Xapo VASP and Xapo Limited.
For the avoidance of doubt, Personal Data does not include data from which you cannot be identified (which is referred to simply as data, non-Personal Data, anonymous data, or de-identified data).
IDENTITY AND THE CONTACT DETAILS OF THE CONTROLLER
For the purposes of the Gibraltar General Data Protection Regulation (Gibraltar GDPR), Gibraltar’s data protection law consisting of both the Gibraltar GDPR and the Data Protection Act 2004 (the “DPA”), Xapo is the data controller and responsible for the Personal Data that we collect or that you provide to us.
You can also contact us :
- In writing, at the following postal address: Xapo. Units 1/1, 1/2 and 1/A-1 Casemates Square, Gibraltar, GX11 1AA
By email at: [email protected]
Full name of legal entity: Xapo Limited where neither registration nor licence is required.
Xapo Limited encompasses:
- Xapo Bank Limited, a ‘credit institution’ regulated by the Gibraltar Financial Services Commission under the Financial Services Act 2019 with permission number 23171; and
- Xapo VASP Limited, a ‘distributed ledger technology provider’ regulated by the Gibraltar Financial Services Commission under the Financial Services Act 2019 with permission number FSC1359B.
CONTACT DETAILS OF THE DATA PROTECTION OFFICER
DETAILS ABOUT PERSONAL DATA PROCESSING ACTIVITIES
2. COLLECTING YOUR PERSONAL DATA
2.1 CATEGORIES OF DATA
* The automatic exchange of financial account information between tax authorities shall apply to all our customers, excluding the Xapo customers only making use of our "E-Money" services unless informed otherwise. Nonetheless, all of our customers, including those only making use of our "E-Money" services are subject to applicable laws and regulations which may require us to disclose their information where we are legally required to do so.
** The GPS Location data processing by Xapo shall be mandatory for these purposes or activities for all our customers, excluding the Xapo users only making use of our "E Money" services unless informed otherwise.
2.2. SOURCES OF DATA
INFORMATION THAT WE COLLECT AUTOMATICALLY
We use Personal Data that we collect automatically through cookies and action tags. We also use the information to help diagnose technical and service problems, administer the Site, and identify visitors to the Site.
Action Tags: We may use action tags to identify some of the pages that you visit and how you use the content on those pages. Action tags collect and transmit this data in a manner that identifies you if you have registered with our website (and are logged into) our Android or iOS Mobile apps. We also may use action tags in our emails to determine whether an email was opened or whether it was forwarded to someone else. When you use our Android or iOS Mobile apps, we may use action tags where you are accessing websites from links in our Android or iOS Mobile apps. These may identify the pages that you visit and how you use the content on those pages.
We use third party analysis tools to collect data about your device and internet connection. That information includes, but is not limited to, the IP address of your computer and/or internet service provider, geolocation, when you access our online services, our Android or iOS Mobile apps, the Internet address of websites from which you link to our online services and from which you came to before landing on our online services, the browser that you are using and your movements on our online services. All of this information is used internally for the purposes of understanding how our online services are being used and to improve them. We also use the data collected via cookies to track the popularity of our online services.
We also use third party analysis tools to collect data about your use of our Android and iOS Mobile apps. The information collected identifies the types and timing of actions you take within our Android and iOS Mobile apps, including installation, registration, uploading, and certain types of navigating. All of this information is used internally for the purpose of understanding how our Android and iOS Mobile apps are being used and improving them. Clicking on those links or enabling those connections allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. We accept no responsibility for the actions of these third-party websites. When you leave our online services, we encourage you to read the privacy statements of every Website you visit.
INFORMATION THAT WE OBTAIN FROM THIRD PARTIES AND PUBLICLY AVAILABLE SOURCES
Please find a description in a table format of the information obtained from third parties in Addendum 1.
2.3. LEGAL BASES FOR PROCESSING YOU PERSONAL DATA
We will only use your Personal Data when the law allows us to. Most commonly, we will use your Personal Data under the following circumstances:
When you give us your consent, for example, to access your contacts on your phone or allow us to have access to your location. You have the right to withdraw your consent at any time. To withdraw your consent just go to the Privacy Settings in our Android or iOS Mobile app or contact us at [email protected]
When we need to execute a contract you have entered into with us by accepting applicable terms and conditions or specific related terms relating to other services offered by us.
Where we need to collect Personal Data under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform our services under the contract we have or are trying to enter into with you (for example, to provide you with any of our services). In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.
Legal or regulatory obligation
When we need to collect Personal Data by law. If you fail to provide that data when requested, we will not be able to perform our services under the contract with you (for example, to provide you with any of our products or services). In this case, we will have to cancel a product or service you have with us and we will notify you at that time.
For information about how we process your personal data with respect to Anti-Money Laundering purposes, please see the AML Notice available at: AML/KYC Privacy Notice.
Legitimate Interest means the broader stake that Xapo has in the processing or the benefit that we derive from the processing of your Personal Data. For examples, please refer to the table at paragraph 2.1.
Where we rely on legitimate interests, we make sure that we consider and balance any potential impact on you and your rights before we process your Personal Data for our legitimate interests.
We have set out a description of all the ways we plan to use your Personal Data, and the legal basis we rely on to do so, which you can find in the table at paragraph 2.1. This table also shows how we have identified what our legitimate interests are. Note that we may process your Personal Data for multiple legal reasons.
We are committed to providing you with choices regarding certain Personal Data uses, particularly around marketing and advertising. We will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to receive 3rd party marketing communications at any time by contacting us.
Promotional Offers From Us
We may use your identity, contact, technical, usage and profile data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and offers may be relevant for you (we call this marketing).
You can expect to receive marketing communications from us if you have requested information or purchased services from us and you have not opted out of receiving that marketing.
Lookalike Advertising on Third Party Sites
When we share your personal information with Advertising Partners (as described at paragraph 2.1), we may also ask the Advertising Partner to find other people that share similar interests and behaviours to you, and to show our advertising to those people when they use Social Media Platforms.
This is based on personal information that you have provided to a Third party Site through your use of said Third Party Site (which may include Third Party Sites of the Advertising Partner). According to their terms and conditions, you have agreed to be subject to profiling activities, carried out exclusively by them. This personal information might include demographic data (such as your age or gender) and interest-based data (things that you like). No personal information is shared with us.
To the extent we are a controller of this personal information, we consider it is in our legitimate interest to use this personal data in this way to increase the effectiveness of our advertising by displaying our ads on individuals who share similar interests and characteristics to our customer base.
Using tools made available by Advertising Partners
Our Prospective Members
Advertising Partners may provide tools that we can use to deliver our advertisements to people who we think are more likely to be interested in our products and services.
For example, an Advertising Partner may have determined that you are a ‘crypto-enthusiast’ using data that they have collected about you through your use of Third Party Sites (which may include Third Party Sites of the Advertising Partner). If we want to display a crypto-related product advertisement to other crypto-enthusiasts, the Advertising Partners that we work with may allow us to show our advertisement to you using selection tools that they make available. The personal information that is used for this is not shared with us.
To the extent we are a controller of this personal information, we consider it is in our legitimate interest to use this personal data in this way to ensure our advertising is relevant to those receiving it.
Change of purpose
We will only use your Personal Data for the purposes for which we collected it. We will delete it after fulfilling the intended purpose or after expiration of the respective storage periods.
3. THIRD PARTY LINKS
Please read Addendum 2 for a more exhaustive list regarding the categories of service providers we use.
4. INFORMATION WE SHARE; DATA TRANSFERS
We do not sell or otherwise disclose Personal Data that you provide to us or that we collect on this website, our online services, or our Android and iOS Mobile apps, except as described here:
- Companies in the Xapo group where it is necessary for the performance of a contract and these entities are used by us to assist in the provision of our services to you. Companies in the Xapo group will be acting as joint controllers in order to provide our services;
- Service providers we use to provide customer benefits such as Airport Lounge access and Wifi access;
- Marketing materials from third parties if you have provided consent;
- If required, professional advisers such as lawyers, banks, auditors and insurers providing such services;
- Regulators and other authorities who require reporting of processing activities under certain circumstances;
- If required, or where we believe it is required by applicable laws or legal process;
- To protect the rights, property and safety of Xapo, our users and the public, including, for example, in connection with court proceedings, to detect or prevent criminal activity, fraud, material misrepresentation, or to establish our rights or defend against legal actions;
- Gathering your rating of the App which is processed through a third party service provider.
Xapo is headquartered in Gibraltar. However, due to the nature of our global offering, we have operations throughout the world, including but not limited to, North America, South America and Asia. We transfer your data to countries outside the European Economic Area (“third countries”) to the extent that is necessary in order to perform our services and comply with our legal obligations..
Whenever we transfer your Personal Data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- Where we use certain service providers, we will use contract language approved by the European Commission which gives Personal Data the same protection it has in Europe.
- Where we use providers based in the US, we will transfer data to them making use of Standard Contractual Clauses that require them to provide similar protection to Personal Data shared between Gibraltar and the US.
Further details on these provisions can be obtained by contacting at [email protected]
The Categories of Providers Table provides information on the type of third party recipient (i.e. by reference to the activities it carries out), the industry and the location of the recipients.
5. SECURITY MEASURES AND DATA BREACHES
We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have taken precautions to ensure the security of your data. The Personal Data you have entered on HTML pages (contact forms) and that is stored by us, shall be transmitted to Xapo in encrypted form (TLS - Transport Layer Security) via the public data network, and stored and processed at Xapo.
In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties on a need to know basis. This means contractors, agents, and third parties are instructed about these measures under the provisions made within a service agreement signed with them. At the same time, employees are informed about access controls via the Acceptable Use Policy. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality and a duty to comply with data protection procedures.
We utilise dedicated best-in-class security tools and intuitive cyber intelligence to monitor market activity and predict potential issues. Furthermore, we hold no personal data at our secure physical headquarters, located at One Grand Casemates Square, Gibraltar, thus greatly reducing likelihood of a Personal Data breach.
Nonetheless, we have put in place a Data Breach Procedure to deal with any suspected or actual Personal Data breach. According to the Gibraltar GDPR and DPA 2004, we are obliged to inform you about a data breach, whenever it may put at risk your rights and freedoms. At the same time, we fulfil our notification obligations to the Gibraltar Regulatory Authority, as prescribed in law.
Nonetheless, we acknowledge that the notification obligations we have as a data controller established in Gibraltar do not exempt us from similar obligations across different jurisdictions. For any derogations, please refer to our Derogations Section.
6. PROTECTION OF MINORS
Xapo does not knowingly collect or solicit Personal Data from anyone under the age of 18. If you are under 18, please do not attempt to register for our services or send any Personal Data about yourself to us. If Xapo acknowledges underage persons registered on the platform against the T&Cs rules, it reserves the right to close that account and inform the person accordingly.
7. DATA RETENTION
We retain information about you in our databases for as long as your account is active, or as is reasonably needed to fulfil the purposes we collected it for and to provide our services, and as required by applicable laws. Our retention and use of your information will be as necessary to comply with our legal, regulatory, tax, accounting, or reporting obligations and requirements, to resolve disputes, or complaints, and to enforce our agreements. Any derogation from the Retention Policy will be based on legal grounds and will be explicitly mentioned.
While retention requirements vary by jurisdiction, please find a full description in a table format of all the general retention periods of your Personal Data and the specific legal basis we must comply with. We have also identified what our legitimate interests are where appropriate. Note that we may retain your Personal Data for more than one lawful basis depending on the specific purpose for which we are using your data. Although the table provides our general retention periods stipulated for different categories of Personal Data and/or different processing purposes, in certain circumstances, your information may be retained for longer periods due to the inherent nature of distributed ledger technology.
In some circumstances we will anonymize your Personal Data (so that it can no longer be associated with you) for research or statistical purposes. When information is anonymized, it ceases to be Personal Data and we may use it without further notice to you.
9. YOUR RIGHTS AND CHOICE
Right to Information
Right to request access
You also have a right to access information we hold about you. We will endeavour to provide you with details of your Personal Data that we hold or process and to provide this data in the format you request. To protect your Personal Data, we follow established disclosure procedures, which may require us to request proof of identity from you prior to providing such information. You can exercise this right at any time by contacting us using the details found below.
Right to rectification
You have the right to have any inaccurate Personal Data about you rectified and to have any incomplete Personal Data about you completed.
Right to erasure (right to be ‘forgotten’)
You have the general right to request the erasure of your Personal Data in the following circumstances:
- the Personal Data is no longer necessary for the purpose for which it was collected;
- you withdraw your consent to processing and no other legal justification for processing applies;
- you object to the processing activity, when the latter was based on the legal grounds of legitimate interest or public interest;
- you object to the processing activity, when the latter had the purpose of direct marketing;
- we unlawfully processed your Personal Data; and
- erasure is required to comply with a legal obligation that applies to us.
We will proceed to comply with an erasure request without undue delay and to such extent we are able to do so, unless continued retention is necessary for:
- Exercising the right of freedom of expression and information
- Complying with a legal obligation under EU or other applicable law;
- Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
- The establishment, exercise, or defense of legal claims.
Please be aware that by doing so, we will need to close your Xapo account and this action is not reversible and by requesting us to erase your data we are not able to provide Xapo services to you any longer. However, this will not affect the lawfulness of any processing carried out before you requested erasure of your data.
However, exercising this right does not necessarily mean all personal data about you will be deleted, although we will make all reasonable effort to do so. For example, when interacting with the blockchain, we may not be able to ensure that your Personal Data is deleted.
Right to restrict processing
You have a right to request to restrict processing of your Personal Data, such as where:
- you contest the accuracy of the Personal Data;
- you objected to a processing activity based on legitimate interest, while the verification of conditions is carried out;
- if you believe processing is unlawful, you may request, instead of requesting erasure, that we restrict the use of unlawfully processed Personal Data;
- we no longer need to process your Personal Data but need to retain your information for the establishment, exercise, or defense of legal claims or regulatory requirements.
Depending on the type of processing you request to restrict, please be aware that by doing so, we may need to close your Xapo account and this action is not reversible and by requesting us to stop processing your data we are not able to provide Xapo services to you any longer. However, this will not affect the lawfulness of any processing carried out before you requested to restrict processing.
Right to data portability
Where the legal basis for our processing is your consent, or the processing is necessary for the performance of a contract to which you are party of, or in order to take steps at your request prior to entering into a contract, you have a right to receive the Personal Data you provided to us in a structured, commonly used and machine-readable format.
Right to object to direct marketing (‘opting out’)
You have a choice about whether or not you wish to receive information from us.
We will not contact you for marketing purposes unless you have an existing business relationship with us to offer you similar services, and we rely on our legitimate interests as the lawful basis for processing;
On each and every marketing communication, we will always provide an option for you to exercise your right to object to the processing of your Personal Data for marketing purposes (known as ‘opting-out’) by clicking on the ‘unsubscribe’ button on our marketing emails or choosing a similar opt-out option on any forms we use to collect your Personal Data.
Therefore, please be aware that your ability to opt-out from receiving marketing and promotional materials does not change our right to contact you regarding your use of our online services and Android or iOS Mobile apps or as part of a contractual relationship we may have with you.
Right not to be subject to automated decision making
It is our interest to protect data subjects that engage with us against undesired automated data processing. This right can be exercised whenever the processing activity is based solely on automated decision-making (ADM) activities that produce legal or similarly significant effects, as Article 22 of the GDPR details.
The reasons for using ADM processes are covered in the following table:
In case you do not agree with the above described processing activities, we cannot offer you the experience of high standard financial security. This means we are not able to either open your account or maintain it.
Please note that the law prescribes this right cannot be exercised when:
- the processing activity is undertaken for the conclusion or performance of a contract with you,
- we are subject to legal obligations, or
- explicit consent has been expressed
Moreover, we avoid processing sensitive data by ADM means. However, if this becomes a necessary step for purposes such as onboarding or vetting, sensitive data is only processed under the legal grounds of explicit consent or substantial public interest.
Also, whenever such processing relies upon explicit consent or contractual obligations, you can further exercise your rights to express your point of view, to request human intervention and contest the decision.
Right to withdraw consent
Where the legal basis for processing your Personal Data is your consent, you have the right to withdraw that consent at any time by contacting us using the details found below. Please be aware that by doing so, we will need to close your Xapo account and this action is not reversible and by requesting us to stop processing your data we are not able to provide Xapo services to you any longer. However, this will not affect the lawfulness of any processing carried out before you withdrew your consent.
You can exercise any of the above rights free of charge by contacting us at [email protected].
Most of the above rights are subject to limitations and exceptions. We will provide reasons if we are unable to comply with any request for the exercise of your rights.
Right to lodge a complaint with a relevant supervisory authority
If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved to your satisfaction, without prejudice to any other administrative or judicial remedy, you are entitled to make a complaint to the Information Commissioner under the Gibraltar Data Protection Act 2004 (i.e. the Chief Executive Officer of the Gibraltar Regulatory Authority), which is presently the Gibraltar Regulatory Authority (GRA). You may contact the GRA on the below details:
Gibraltar Information Commissioner
Gibraltar Regulatory Authority
2nd Floor, Eurotowers 4
1 Europort Road
Email: [email protected]
Phone: (+350) 200 74636
Fax: (+350) 200 72166
You also have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, place of work, or the place where you allege an infringement of one or more of your rights has taken place, if that is based in the European Economic Area.
We would, however, appreciate the chance to deal with your concerns before you approach the Gibraltar Regulatory Authority or supervisory authority in the country of your legal residence, place of work, or the place where you allege an infringement of one or more of our rights has taken place so please contact us in the first instance at [email protected] or [email protected]
It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your relationship with us.
ADDENDUM 1 - DATA OBTAINED FROM THIRD PARTIES
Whenever we obtain personal data from third parties, we refer to the following categories:
- Technical Data (e.g. IP address)
- Identity and Contact Data (e.g. name and phone number)
- Financial and Transaction Data (e.g. credit card details, transaction number)
- Job applicant data (all data included in the application sent to us)
ADDENDUM 2 - CATEGORIES OF PROVIDERS
ADDENDUM 3 -RETENTION PERIOD TABLE
ADDENDUM 4 - AML KYC PRIVACY NOTICE
We will process your identifying data and profile data within operations such as identification (Know your Customer, also known as KYC) and profiling (Customer Due Diligence, also known as CDD) for the purposes of the execution of our Anti Money Laundering (also known as AML) and Counter Terrorism Financing (also known as CTF) customer identification and verification process obligations.
When Xapo asks for CDD, what this refers to is proof of address and proof of identification. This along with information gathered at the application stage paints a picture of any customer (KYC). Without KYC, Xapo may unknowingly become involved with illicit activities and therefore subject to reputational, operational and legal risks, which can result in significant financial cost, or eventual winding up of the institution. KYC is most closely associated with the fight against money-laundering.
Specific proof of address, proof of Identification, source of funds and/or AML-CTF questionnaires that aimed at to fulfil KYC and CDD obligations are compulsory to Xapo users and the failure to be replied might lead (in extreme cases) in the blocking of their accounts or the refusal of services.
In response to the scale and effect of money laundering, the European Union has passed Directives designed to combat money laundering and terrorism. These Directives, together with national regulations as read below, form the cornerstone of our AML/CTF obligations, establish the legal basis for us to process this data and outline the offences and penalties for failing to comply.
- Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market;
- Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing;
- Council Decision of 17 October 2000 concerning arrangements for cooperation between financial intelligence units of the Member States in respect of exchanging information (2000/642/JHA);
- Crime Proceeds of Crime Act 2015;
- Terrorism Act 2018;
- Drug Trafficking Offences Act 1995;
ANTI-MONEY LAUNDERING (AML) POLICIES
Our AML policy is designed to prevent money laundering by meeting the European standards on combating money laundering and terrorism financing, including the need to have adequate systems and controls in place to mitigate the risk of the firm being used to facilitate financial crime. Our AML policy sets out the minimum standards which must be complied with and includes:
- Appointing a Money Laundering Reporting Officer (MLRO) who has a sufficient level of seniority and independence, and who has responsibility for oversight of compliance with the relevant legislation, regulations, rules and industry guidance;
- Establishing and maintaining a Risk-Based Approach (RBA) to the assessment and management of money laundering and terrorist financing risks faced by the firm. The requirement to provide CDD related data throughout an RBA that will always take into account different factors such as the status of the client, the nature of the transactions, the financial product or the financial flows involved;
- Establishing and maintaining risk-based Customer Due Diligence (CDD), identification, verification and Know Your Customer (KYC) procedures, including enhanced due diligence for customers presenting a higher risk, such as Politically Exposed Persons (PEPs);
- Establishing and maintaining risk-based systems and procedures for the monitoring of on-going customer activity;
- Establishing procedures for reporting suspicious activity internally and to the relevant law enforcement authorities as appropriate;
- Maintaining appropriate records for the minimum prescribed periods;
- Providing training for and raising awareness among all relevant employees.
As a regulated financial institution, Xapo has specific requirements regarding AML systems and procedures. This reflects senior management’s desire to prevent money laundering.
Xapo is prohibited from transacting with individuals, companies and countries that are on prescribed sanctions lists. Xapo will therefore screen against United Nations, European Union, UK Treasury and US Office of Foreign Assets Control (OFAC) sanctions lists in all jurisdictions in which we operate.
AUTOMATED DECISION MAKING
We use semi-automated processes which includes, but is not limited to, screening Know-Your-Customer (KYC) and Anti-Money Laundering (AML) data you provide to us in order to assess whether or not we are legally able to allow you to use our services.
All automated screenings matches are manually reviewed by Xapo compliance analysts. The analyst will review the triage cases to determine if they should be cleared or escalated to the MLRO.
THIRD PARTIES AML-KYC
Where processing of personal data is carried out on behalf of Xapo by a third party provider, we conclude a separate contract with the processor with respect to this processing. This contract ensures compliance with European data protection regulations and defines sufficient guarantees for the implementation of appropriate technical and organisational measures, which ensure the protection of your rights.
ADDENDUM 5 - COUNTRY-SPECIFIC DEROGATIONS
SECTION 1 - SOUTH AFRICA DEROGATIONS
SECTION 2 - HONG KONG DEROGATIONS
Section 3 - Singapore Derogations
Inaddition to the previous sections, in case the Singapore Data Protection LAw [Personal Data Protection Act 2012 (No. 26 of 2012)] applies, the following differences are to be noted:
SECTION 4 - BRAZIL DEROGATIONS
In addition to the previous sections, in case the Brazilian General Personal Data Protection Law (LGPD) applies, the following differences are to be noted.