Privacy Policy

Privacy Notice to Users

Last modified: 18.03.2019

Interpretation: “controller”, “processor”, “data subject”, “personal data” and “processing” shall have the meanings given to them under the European Union General Data Protection Regulation (GDPR). PrepayWay Systems Estonia OÜ (registry code: 14375086; address: Lõõtsa street 8, Tallinn 11415, e-mail: [email protected], hereinafter „the Token Generator“) is a data controller within the meaning of the GDPR and undertakes to hold any personal data provided by data subjects using the Website and/or entering into Token Sale Agreement, (hereinafter ”Users“) in accordance with the applicable EU and Estonian Data Protection Legislation. This privacy notice (hereinafter „Privacy Notice“) explains the manner in which the Token Generator collects, processes and maintains personal data from and about Users, including visits to and usage of its website www.prepayway.com (hereinafter „the Website“), as well as data collected while Users are entering into a Token Sale Agreement. Users should review this notice carefully as it contains information about the treatment of their personal data and their rights under the GDPR.

Definitions

Administrator - Token Generator and/or third party service provider contracted by Token Generator to handle KYC procedures in connection with the Token Sale.
Data subject – an identified or identifiable natural person;
Ecosystem - set of services provided by PrepayWay AG, owner of PrepayWay Systems Estonia OÜ, and other affiliates of PrepayWay AG and/or partners;
Personal data - any information relating to an identified or identifiable natural person;
Users – a person using the Website and/or a party to a Token Sale Agreement defined as „Purchaser“, concluded between thea person and Token Generator, defined as „Purchaser“;
Service Provider - PrepayWay AG or/and an affiliate of PrepayWay AG or PrepayWay AG partners;
Token Generator - PrepayWay Systems Estonia OÜ (registry code: 14375086);
Token Sale – aquisition of Tokens by User from Token Generator;
Token Sale Agreement – the agreement for the sale of tokens between User and Token Generator;
User Credentials – information requested by Token Generator from the User for KYC („know-your-customer“) purposes;
Website - www.prepayway.com;
White paper – non-binding PrepayWay white paper, which describes matters relating to InBit Tokens and the PrepayWay Ecosystem (as amended or supplemented from time to time);

Legal Person User:

Where Purchaser is a legal person, Purchaser represents and warrants that:

all personal data (including User Credentials) that is provided or made available to Token Generator has been collected, processed and transferred in accordance with the EU Data Protection Legislation;
in particular and without restriction that the consent of the data subjects to whom the personal data relates has been procured before their data was collected, processed, and/or disclosed as described herein;
that such personal data is adequate, relevant, and limited to what is necessary for the purposes described herein and is accurate and up-to-date.

Categories of Personal Data

In the course of its business, to comply with applicable “know your customer” (KYC) and “anti-money laundering” (AML) legislation, the Token Generator may collect, record, store, transfer and otherwise process information by which Purchasers may be directly or indirectly identified.
The categories of personal data fulfilment of the Token Sale Agreement, including KYC procedures, include:

Identifying information: Name, title, date of birth, age, gender, nationality, picture (e.g. passport / driver's licence), national identification number, usernames, email address, residential address, utility bills
Contact information: Postal address, telephone / mobile / fax number, email address;
Family information: Family structure, siblings, offspring;
Financial information: Source of wealth, personal assets, bank account numbers and income details, tax identification number, financial and investment qualification, shareholder reference number;
Transaction information: Payment details and other details of products and services purchased by the investor, sworn statements, power of attorney information;
Professional information: Job titles, employment history, employer details;
Marketing and communication information: Personal data contained in emails, data regard the investor's preferences in connection with marketing communications;
Special category data: Data obtained pursuant to the Token Generator's standard criminal record checks, political opinion and affiliation data obtained further to the Token Generator's standard AML and client due diligence checks.

Sources of Personal Data

The Token Generator collects personal data about Users mainly through the following sources:

information provided by User in writing (including any anti-money laundering, identification, and verification documentation), in person, by telephone (which may be recorded), electronically or by any other means;
transactions within the Ecosystem or undertaken during the Token Sale, including account balances, purchases, distributions, payments and withdrawals;
information captured on Token Generator's Website (www.PrepayWay.com), including registration information and any information captured via cookies, and
credit reference agencies and available public databases or sources, such as news outlets, websites and international sanctions lists.

The Token Generator collects information by running its Website, information provided thereto and in KYC communications, information sent by User's computer, mobile phone, or other access device and processes such information. When User visits the Website, the Token Generator collects information sent by User's computer, mobile phone, or other access device. This information may include User's IP address, device information including, but not limited to, identifier, name, and type, operating platform, mobile network information and standard web log information, such as browser type, and the pages User accessed on Token Generator's website. When User uses a location-enabled device with Token Generator's website, Token Generator may collect geographical location data or use various means to determine the location, such as sensor data from User's device that may, for instance, provide data on nearby cell towers and wi-fi access spots.

Purposes and Legal Bases

The Token Generator may process User's personal data for any one or more of the following purposes:

to comply with any applicable legal, tax or regulatory obligations on Token Generator and/or any of its delegates or service providers under any applicable laws including but not limited to anti-money laundering and counter-terrorism legislation, in particular to ensure identification of the User. If any such obligations derive from the laws of a non-European Economic Area country, Token Generator and/or any of its delegates or service providers may be obliged to comply with those obligations in connection with the provision of services to investors, provided such action is in compliance with EU/EEA legislation;
in order to enable Token Generator and Users to satisfy their contractual duties and obligations to each other;
to properly record, manage and administer User's purchase and any related accounts on an on-going basis;
to assist Service Provider in the development of the Ecosystem and the performance of the activities set out in the White Paper;
to conduct and perform technical analysis on the completion of the Token Sale;
to advise User of matters relative to its purchase of Tokens, including current values and changes to Token Generator documentation;
for any other legitimate business interests of Token Generator including for statistical analysis, direct marketing and market research purposes, where such interests are not overridden by the interests of User;
for risk management and control purposes relating to Token Generator or any entity in the same group;
to investigate and respond to any complaints about Token Generator and to help maintain service quality and train staff to deal with complaints and disputes; or
for any other specific purposes where Users have given their specific consent.

The legal bases for processing are the agreement with the User (including related to use of the website), legal obligations under EU and Estonian law, User’s specific consent (if given), and other legitimate interests.
Purchasers are required to provide their personal data for statutory and contractual purposes. It is clearly marked, which data is mandatory for different activities by the Purchaser. The Token Generator collects only statistical data from mere visits to its Website. However, personalized data has to be collected before a Token Sale Agreement can be concluded. Failure to provide the required personal data or an objection to processing may result in Token Generator being unable to permit, process, or release User's purchase and this may result in Token Generator terminating its relationship with User. Further, User's failure to provide accurate and complete information required for User's receipt of Tokens may result in delays, losses, costs, non-delivery of refunds or Tokens or other issues. User acknowledges that Token Generator may refuse to distribute Tokens to User and/or deny access to User's account until all requested and required information and/or documents are provided.
Token Generator will only use User's personal data for the purposes for which it was collected, unless Token Generator reasonably considers that the personal data needs to be used for another purpose and that purpose is compatible with the original purpose. If Token Generator needs to process personal data for an unrelated purpose, Token Generator will notify the User and explain the legal basis which allows or requires Token Generator to do so.

External Transfers / Processors

Token Generator may share User's personal data with third parties in order to complete the Token Sale, to reveal or suppress fraud, to fix technical bugs, or to eliminate security problems. Token Generator will disclose User's personal data to its affiliates, subsidiaries and third-party service providers only in so far as is necessary to complete the Token Sale.
The Token Generator is using third party service providers for know-your- customer (KYC) procedures which are required by law to combat terrorism financing, tax evasion and money laundering. The Token Generator can access any data collected by the third party service providers due to Token Sale Agreement.
Where processing is carried out on behalf of Token Generator, Token Generator shall engage a data processor (such as the Administrator) which provides sufficient guarantees and implements appropriate technical and organizational security measures in a manner that such processing meets the requirements of the EU and Estonian Data Protection Legislation, and ensures the protection of the rights of Users. The Token Generator will enter into a written contract with the data processor which will set out the data processor's specific mandatory obligations as laid down in the GDPR, including to process personal data only in accordance with documented instructions from the Token Generator.
The Token Generator will not transfer personal data to a country outside of the EEA where data protection laws may be different from the requirements under the GDPR unless:

that country ensures an adequate level of data protection (such as Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the US (limited to the Privacy Shield framework), or
appropriate safeguards such as the model clauses (which are standardised contractual clauses, approved by the European Commission) are in place, or

Token Generator relies on one of the derogations provided for under GDPR, for example where User has clearly consented to such transfer.

Marketing

User acknowledges and agrees that he or she or it may receive commercial electronic messages and advertising materials from Token Generator, Service Providers, Administrator or third parties by order of Token Generator on the e- mail address and the mobile phone number provided to Token Generator or Administrator.

Retention

The Token Generator will not keep personal data for longer than is necessary for the purpose(s) for which it was collected. In determining appropriate retention periods, Token Generator shall have regard to any applicable statutes of limitation and any statutory obligations to retain information, including anti-money laundering, counter-terrorism, and tax legislation. Token Generator will take all reasonable steps to destroy or erase the data from its systems when they are no longer required.

User Rights

Users have the following rights:

to access their personal data;
to correct personal data where it is inaccurate or incomplete;
to restrict under certain circumstances the further processing of their personal data;
to ask for erasure of their personal data when it is no longer needed and under certain other circumstances;
to object to the use of their personal data (including for direct marketing purposes);
to ask for personal data portability under certain circumstances.

User may exercise its rights by writing to Token Generator at the following e-mail address: [email protected]
There are also situations where Token Generator can refuse to comply with a request to restrict further processing (for example, where it is subject to a legal obligation to process the data). Where the processing is based on consent, the withdrawal of consent shall not affect the lawfulness of any prior processing based on consent received or processing for other reasons and based on other grounds where this is permitted under applicable law. Token Generator may also refuse User access to personal data should it have doubts as to validity, authenticity and genuineness of the documents provided by User.

Automated Decision Making

Token Generator does not envisage that any decisions will be taken about User using fully automated means, however Token Generator will notify User in writing if this position changes.

Governing Law and Complaints

This Privacy Policy and obligations arising from or related to it are governed by the laws of the Republic of Estonia.
Any and all disputes arising from or related to personal data protection will be settled by the parties by way of negotiations. Failing agreement, User shall have the right to lodge a complaint with the supervisory authority Estonian Data Protection Inspectorate, Väike-Ameerika 19, 10129 Tallinn, Estonia, or address a claim to court.
In case the dispute between the parties is to be resolved in judicial proceedings, the parties agree to refer the dispute to Harju County Court in accordance with the legislation in force in the Republic of Estonia.
The above mentioned does not exclude consumers from their rights regarding jurisdiction.

Cookies:

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.
When User accesses the Website, Token Generator or third party service providers on behalf of Token Generator may place small data files called cookies on User's computer or other device. Token Generator uses these technologies to recognize Users as a user; to customize the Website and for advertising; to measure promotional effectiveness, to collect information about User’s computer or other access device to comply with applicable law, and to mitigate risk, help prevent fraud and promote trust and safety.
Token Generator uses cookies that are needed to ensure the proper functioning of the Website, as well as Google analytics cookies.
It is possible to reject cookies from your browsers (different browsers have different options). Blocking all cookies may affect the usage of the Website.

Change to Privacy Notice

This privacy notice may be changed from time to time, and will be updated in due course to comply with further requirements (if any) under the GDPR.