EEA/UK (GDPR) Privacy Notice

Last Updated: December 15, 2023

1. APPLICABILITY OF THE GDPR PRIVACY NOTICE

This Privacy Notice (“Notice”) applies to Individuals that are located within the European Economic Area (EEA) and the United Kingdom (UK), and supplements Cy Creek Bank’s Online Privacy Notice (available on our Cy Creek Bank Privacy Center page). We adopt this Notice to comply with the General Data Protection Regulation (“GDPR”). The GDPR defines Personal Data as any information relating to an identified or identifiable natural person (“Data Subject”).

2. LEGAL BASIS FOR PROCESSING PERSONAL DATA

If you are located in the EEA or the UK, we only process your Personal Data for specific reasons and when we have a valid legal basis for processing under applicable data protection laws.

The legal bases on which we rely on to process your Personal Data, as appropriate, are set out below:

Necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract;
Necessary for compliance with a legal obligation or regulatory obligation;
Necessary for us to realize a justified and legitimate interest considering your privacy and other fundamental rights and interests. This may include:
~running an effective operation of the Cy Creek Bank services and administering related services,

~operating our services,
~protecting the security of our systems, detecting or preventing fraud,
~marketing, market research and business development,
~internal group administrative purposes;
With your consent.

Where applicable, wherever we rely on the consent legal basis, you may withdraw such consent at any time, without affecting the lawfulness of processing based on consent before such withdrawal.

3. PERSONAL DATA WE COLLECT

Personal Data is data relating to an identified or identifiable Individual. Sensitive Personal Data (or “Sensitive Personal Information”) is data that reveals a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in trade unions, genetic data, biometric data, and data concerning health, sex life or sexual orientation. We collect Personal and Sensitive Personal Data from you in several ways when you use our services as described below. For more information, please see our Online Privacy Notice (available on our Cy Creek Bank Privacy Center page).

Directly from Individuals: We collect information when Individuals use our website or mobile application or register with us. We will also collect information when Individuals place an order, subscribe to our marketing activities, respond to a survey, or to report on our Clients’ financial information. This information includes names, email addresses, phone numbers, and other demographic and contact information.‍
From Third Parties: We collect information from third parties including an Individual’s company and from those who validate identity. Examples of these collection methods include referrals from other Cy Creek Bank users, integration of cryptocurrency service providers, and third-party sign-in credentials. (e.g., Google).‍
From Individuals Passively: We use third party tools to collect information from Individuals when visiting our website and mobile application. Using cookies and other tracking technologies, we will automatically collect:

~unique device identification numbers
~device type
~operating system version
~browser type and version
~pages viewed
~links clicked
~IP address
~date and time of visit
~number of times you return to our website
~geolocation data (GPS-based information)
~motion tracking (e.g., number of steps taken, heart rate)
~Wi-Fi connectivity

For information on how to manage your cookies preferences, please see our Online Privacy Notice (available on our Cy Creek Bank Privacy Center page).

‍Security and Authentication: We collect certain information to protect our users’ information, and to verify an Individual’s identity. This involves collecting biometric data, such as voiceprints, video and photographic footage, geolocation data, and motion tracking information (see above). These are the only type of Sensitive Personal Data we collect, and we will not collect this information without obtaining your consent first.
‍Combining Information: We combine information received from third parties with information already stored. We will also combine information from an Individual’s profile with information submitted from surveys.

4. HOW WE USE YOUR PERSONAL DATA

We use the Personal Data we have about you for the purpose for which it was collected or provided to us (as stated at the point of collection). Your Personal Data will be used to: provide our services, communicate with you, market and improve our services, conduct surveys, comply with the GDPR and other applicable laws, protect our assets, perform other purposes with your consent, and create de-identified or aggregate information. For more information about how we use your Personal Data, please see our Online Privacy Notice (available on our Cy Creek Bank Privacy Center page).

5. PERSONAL DATA RETENTION & STORAGE

Cy Creek Bank only keeps or processes Personal Data for as long as necessary to carry out its business and legal purposes. Personal Data is deleted or anonymized when no longer required for the purposes for which it was collected, in accordance with our Record Retention Policy and Media Sanitization Policy. The specific periods for which we keep information about you vary depending on the nature of the information, why we need it, and whether the Personal Data is de-identified. We also consider the minimum necessary retention period prescribed by applicable laws, recommended by industry standards, and stated in contracts and other legal obligations. Additionally, you may request deletion of your Personal Data consistent with Section 7 “Individual Rights” below.

We may be legally required to retain your Personal Data to:

~comply with legal obligations;
~resolve disputes; and
~enforce rights.

Storage: We may use data hosting service providers in Canada. to store information we have about you, and we use reasonable technical measures to secure your information.

6. PERSONAL DATA SHARED WITH THIRD PARTIES

We share information we have about you with third parties, service providers, and Cy Creek Bank affiliates who assist us with administering our services and advertising on third party platforms. We at times partner with other companies to offer products or services jointly; we may share your Personal Data in order to facilitate that offering.

Any third parties that we share your Personal Data with are limited by law and by contract in their ability to use your Personal Data. Cy Creek Bank requires third party service providers acting on our behalf or with whom we share your information to provide appropriate security measures in accordance with industry standards and in compliance with this Policy, their privacy and security obligations, and any other appropriate confidentiality and security measures. However, we are not responsible for the privacy and data security practices of third parties outside of Personal Data we receive from or transfer to them. For additional information, please see our Online Privacy Notice (available on our Cy Creek Bank Privacy Center page).

7. INDIVIDUAL RIGHTS

Cy Creek Bank would like to make sure you are fully aware of all of your data protection rights. Every user in the EEA or UK is entitled to the following:

The right to access: You have the right to request copies of your Personal Data from Cy Creek Bank.

The right to be informed: You have a right to be informed about the collection and use of your Personal Data.

The right to rectification: You have the right to request that Cy Creek Bank corrects any information you believe is inaccurate. You also have the right to request that we complete any information you believe is incomplete.

The right to erasure: You have the right to request that Cy Creek Bank erases your Personal Data, under certain circumstances.

The right to restrict processing: You have the right to request that Cy Creek Bank restricts the processing of your Personal Data, under certain circumstances.

The right to object to processing: You have the right to object to Cy Creek Bank’s processing of your Personal Data, under certain circumstances.

The right to data portability: You have the right to request that Cy Creek Bank transfer its data on you to another organization, or directly to you, under certain conditions.

The right not to be subject to a decision based solely on automated processing: You have a right not to be subject to a decision when it is based on automated processing and it produces an adverse legal effect (or a similarly significant effect).

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email: privacy@go2cycreek.com.

8. COOKIES AND OTHER TRACKING TECHNOLOGIES

Cookies are small text files that are stored through the browser on your computer or mobile device. Cookies and other trackers serve a variety of functions; they help you navigate between website pages efficiently and may improve the user experience on a website. Cookies vary in duration (they can be “persistent” or “session-based”), and by whom they are served (“first party” cookies are directly from us; “third party” cookies are from other parties on our behalf).

Cy Creek Bank and our service providers use cookies and similar technologies on our website and mobile application to collect information about your browsing activities over time and across different website pages. At Cy Creek Bank, we use these tools to:

Administer our services
Analyze services usage and trends
Track how you were referred to our website
Improve the services functionality
Perform analytics and marketing integration
Deliver advertisements and other marketing offers

We will require you to opt in to each type of tracking device (categorized by their purpose) before they collect your Personal Data.

For further information please review Cy Creek Bank’s Cookie Notice (available at Section 4 of the Online Privacy Notice, on our Cy Creek Bank Privacy Center page).

9. DATA TRANSFER

Cy Creek Bank is a company based in the Canada (CA). We use data hosting service providers in Canada. to host the information we collect from or about you. When we transfer your Personal Data outside of the EEA or the CA, we will do so in accordance with the GDPR using a valid cross-border transfer mechanism. To the extent required by applicable law, we will protect the cross-border transfer of your Personal Data through the use of applicable legal adequacy mechanisms. We generally use approved Standard Contractual Clauses to ensure the Personal Data is adequately protected when it is transferred outside the EEA or the UK to countries without an adequate level of data protection.

Please contact us via email at legal@go2cycreek.com if you would like more information about cross-border transfers or to obtain a copy of the Standard Contractual Clauses. We also transfer your Personal Data to third parties as described above in Section 6, “Personal Data Shared with Third Parties”.

10. PRIVACY POLICIES OF OTHER WEBSITES

The Cy Creek Bank website and mobile application contain links to other websites. Our privacy notice applies only to our website and mobile application, so if you click on a link to another website, you should review their privacy notice.

11. CHANGES TO THIS NOTICE

We may change or update this Online Notice in the future. When we do, we will post the revised version on our website. This notice was last updated and became effective on the date posted at the top of this page.

12. CONTACTING SUPERVISORY AUTHORITY

Should you wish to report a complaint or if you feel that Cy Creek Bank has not addressed your concerns to your satisfaction or you have other concerns regarding our processing of your Personal Data, you may contact our EU supervisory authority, the Comissão Nacional de Protecção de Dados (“CNPD”).

Email: geral@cnpd.pt Address: CNPD - Comissão Nacional de Protecção de Dados Av. D. Carlos I, 134, 1º 1200-651 Lisboa

13. CONTACT US

If you have any questions about this policy or our privacy practices please contact us. You can write to us at privacy@go2cycreek.com.

Cy Creek Bank does not provide legal, tax, or investment advice. Cy Creek Bank is not engaged in the business of the offer, sales, or trading of securities and is not registered with the SEC. Cy Creek Bank does not provide legal, tax, or investment advice.

Holdings of cryptocurrencies and other digital assets are speculative and involve a substantial degree of risk, including the risk of complete loss. There can be no assurance that any cryptocurrency, token, coin, or other crypto asset will be viable, liquid, or solvent. No Cy Creek Bank communication is intended to imply that any digital asset services are low-risk or risk-free. Cy Creek Bank endeavors to provide accurate information on this website, but cannot guarantee all content is correct, complete, or updated.

Digital assets held in custody are not guaranteed by Cy Creek Bank and are not subject to the insurance protections of the Federal Deposit Insurance Corporation ("FDIC") or the Securities Investor Protection Corporation ("SIPC").