Privacy Policy

Data Protection Officer (DPO)

The operator appoints a Data Protection Officer (DPO) in accordance with internal regulatory requirements and industry best practices. The DPO monitors the compliance of the Operator’s activities with the requirements of applicable legislation in the field of personal data protection, advises the Operator on data processing issues, and interacts with regulatory authorities and Users on issues related to personal data. Contacts to the DPO are sent to the email address: dpo@stakrtrust.com with the subject “DPO / Data Protection”. The operator considers requests to the DPO within 30 calendar days. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Operator representative

In jurisdictions that require a local representative of the personal data operator, the Operator has the right to appoint authorized representatives in the manner prescribed by applicable law. The presence or absence of such a representative in a particular jurisdiction does not affect the overall scope of the parties' rights and obligations under this Policy. Users from jurisdictions that require the appointment of a representative have the right to contact the Operator directly using the contact information specified in the “Contacts” section of this Policy. The Operator is not responsible for the impossibility of fulfilling the User’s rights due to restrictions in the legislation of the User’s jurisdiction. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Registration details

When creating an account on the Platform, the Operator collects the following data: email address (which is a mandatory unique identifier for the account), mobile phone number (for the purposes of two-factor authentication and notifications), first and last name (or other name that the User provides as his own), password hash (the password is not stored in clear text), date of birth (to confirm compliance with age restrictions). The operator also records the date and time of account creation, the IP address from which registration was made, and other technical parameters of the session. Providing false data during registration is a violation of the User Agreement; The User bears full responsibility for the accuracy of the data provided and does not have the right to make claims against the Operator that arise as a result of providing false information. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Identity verification data (KYC)

In order to comply with anti-money laundering (AML) and customer identification (KYC) legislation, the Operator collects: copies of identification documents (passport, driver's license, national identity card), photographs of the face (selfie) in combination with an identity document (liveness check), proof of residential address (utility bills, bank statements not older than three months), identification number taxpayer or similar social security number (SSN) in cases provided for by applicable law, information about citizenship and country of tax residence. Passing KYC is a prerequisite for carrying out transactions exceeding the limits established by the Operator. Biometric data belongs to a special category of personal data and is processed solely on the basis of the User’s explicit consent and/or the contractual need to undergo mandatory identification in accordance with AML requirements. The processing of biometric data is transferred to specialized KYC providers (in particular, Sum&Substance, Jumio, Onfido or similar), acting as data processors in accordance with concluded contracts. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Transactional data

The Operator collects and stores a complete history of financial transactions performed by the User through the Platform, including: all deposits and account replenishment operations, indicating the amount, currency, time and method; all Withdraw operations indicating destination addresses, amounts and statuses; addresses of cryptocurrency wallets associated with the User’s account or specified as recipient addresses; history of trading operations, including orders, transactions, positions, commissions; data on staking, pharming and other operations with profitability. Transactional data is an integral part of the record of the User's transactions and cannot be deleted at the User's request to the extent that their storage is required by applicable law. The User has no right to challenge the fact of collection and storage of transaction data as a violation of confidentiality, since such collection is a legally established obligation of the Operator. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Technical data

Automatically, while using the Platform, the Operator collects the following technical data: the User’s IP address (both actual and determined through a proxy/VPN, if technically possible), the browser User-Agent string containing information about the device used, operating system and browser; data about the browser fingerprint - a unique combination of technical characteristics of the User’s device; cookies and web beacons data; device identifiers (Device ID); geolocation data with accuracy determined by the technical capabilities and settings of the User’s device; data on the time, duration and sequence of sessions on the Platform. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Communication data

The Operator collects and stores all communications between the User and the Platform, including: calls to customer support via any channels (email, online chat, ticket system), including message content, attachments and metadata; correspondence by email using the address support@stakrtrust.com and other addresses of the Operator; call recordings (if appropriate technical support is available) with mandatory prior notification; responses to surveys, reviews and complaints. The entire communication history can be used by the Operator to protect its legitimate interests in legal and other disputes arising with the User. The User, by sending a message to the Operator, agrees to store such a message for the period specified in the “Storage Periods” section of this Policy. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Financial data

During enhanced identity verification (Enhanced Due Diligence (EDD)) or if the User exceeds the established transaction limits, the Operator has the right to request additional financial information, including: information about sources of income and the origin of funds to be deposited on the Platform; documentary evidence of professional activities or sources of wealth; assessment of the level of financial risk assigned to the User in accordance with the Operator’s AML procedures (AML risk scoring); information about the tax residence and tax obligations of the User in accordance with the requirements of FATCA, CRS and other applicable international standards. The Operator independently determines the methodology for assessing the User’s risk and is not obliged to disclose the details of such methodology. Assigning a high level of risk is grounds for restricting or terminating access to the Platform’s services without incurring any liability for the Operator. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Behavioral data

The Operator collects and analyzes behavioral data of Users in order to improve the functionality of the Platform, personalize the user experience and ensure security. Behavioral data includes: navigation patterns on the Platform (sequence of page visits, time spent on each page, interface elements with which the User interacted); frequency and time parameters for logging into your account; patterns of transaction activity and their deviations from the historical norm; reaction to marketing notifications and offers (opening letters, clicking on links). Behavioral analytics is used, among other things, to identify suspicious activity and prevent fraud. The User assumes all risks associated with the fact that the analysis of behavioral data may lead to restriction of access to the Platform in the event of detection of anomalies classified by the security system as suspicious. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Execution of the service agreement

The main purpose of processing personal data is the execution of the contract between the Operator and the User, concluded through the User’s acceptance of the terms of the User Agreement and this Policy. Within the framework of this purpose, the data necessary for: creating and maintaining a User account is processed; execution of the User’s orders to carry out transactions with digital assets; calculation and collection of commissions and fees; providing access to the functionality of the Platform; technical support related to the use of services. Processing of data for this purpose is a necessary condition for the execution of the contract and cannot be limited or terminated by the User without simultaneous termination of the contract for the provision of services. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Compliance with legal obligations (AML/KYC/FATF/OFAC)

The operator processes personal data in order to comply with the requirements of applicable legislation in the field of anti-money laundering (AML), the financing of terrorism (CFT), customer identification (KYC), as well as in order to comply with the recommendations of the Financial Action Task Force (FATF), the requirements of the US Office of Foreign Assets Control (OFAC) and other international regulatory authorities. This purpose of processing is mandatory and cannot be limited or terminated at the request of the User, since failure to comply with these requirements entails criminal, administrative and civil liability for the Operator. The User is obliged to provide all information requested by the Operator for the purposes of AML/KYC compliance, and assumes all risks associated with the consequences of providing incomplete or false information, including account blocking and reporting suspicious activity to the competent authorities. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Ensuring Security and Fraud Prevention

The Operator processes personal data in order to ensure the security of the Platform, protect Users' assets and prevent fraudulent activities, unauthorized access, market manipulation and other abuses. Within the framework of this goal, the Operator has the right to monitor transactions in real time, use automated anomaly detection systems, and compare data with sanctions lists and databases of compromised persons. The Operator is not responsible for losses caused to the User as a result of fraudulent actions of third parties if the Operator has taken reasonable security measures. The User assumes all risks associated with the fact that the Operator's security measures may temporarily restrict access to the account if suspicious activity is detected. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Communication and notifications

The Operator processes Users' contact information to send notifications necessary to fulfill the contract and ensure security: notifications about completed transactions, changes in account status, verification codes for two-factor authentication, security warnings, changes in the terms of service, the User Agreement and this Policy. These notifications are sent without fail and cannot be completely disabled by the User, since they are an integral part of the provision of services. Service notifications should be distinguished from marketing communications, which are sent only with the appropriate consent of the User. Refusal to receive service notifications does not relieve the User from responsibility for the consequences arising from failure to receive such notification. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Analytics and service improvement

The Operator processes anonymized and aggregated data in order to analyze the functioning of the Platform, identify technical errors and vulnerabilities, optimize the user interface, develop new functions and services, and evaluate the effectiveness of marketing activities. Where possible, analytical processing is carried out using anonymized or pseudonymized data that does not allow direct identification of a specific User. The Operator does not guarantee that the analytics results will be used to improve services in the interests of a particular User; decisions on the development of the Platform are made by the Operator at its own discretion. The User assumes all risks associated with the fact that changes in the functionality of the Platform made on the basis of analytical data may affect his usual use of services. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Marketing communications

Marketing communications are sent to Users only with their prior explicit consent (opt-in principle), expressed by actively confirming their desire to receive advertising materials. Marketing communications may include: information about new products and services of the Platform, special offers and promotions, educational content in the field of cryptocurrencies and digital assets. Consent to receive marketing communications can be revoked by the User at any time by clicking on the unsubscribe link in any marketing email or sending a corresponding request to support@stakrtrust.com. Withdraw of consent to receive marketing communications does not affect the User’s receipt of mandatory service notifications and does not entail any consequences for access to the Platform’s services. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Data subject consent

In cases where there is no other legal basis for the processing of personal data, the Operator processes the data based on the consent of the User. Consent is considered received from the moment the User takes active actions indicating acceptance of the terms of this Policy (registering an account, continuing to use the Platform after reading the Policy). The user has the right to revoke this consent at any time; however, such revocation does not constitute grounds for termination of data processing carried out on other legal grounds (performance of a contract, compliance with legal obligations, legitimate interest). The Company reserves the right to terminate the provision of services to the User who has withdrawn consent to the processing of personal data, if without such processing the execution of the contract becomes impossible. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Execution of the contract

A significant part of personal data is processed on the basis of the need to fulfill a contract for the provision of services to which the User is a party, or in order to take measures at the request of the User before concluding such an agreement. This legal basis covers the processing of all data without which the provision of Platform services is technically or legally impossible, including account data, transaction data and KYC verification data. Data processing on the basis of a contract cannot be limited by the User without terminating use of the Platform services, since such a restriction makes the execution of the contract impossible. The Operator is not responsible for the impossibility of providing services resulting from the User’s restriction of the processing of data necessary for the execution of the contract. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Compliance with legal obligations

The Operator processes personal data to the extent that such processing is necessary to comply with the legal obligations imposed on the Operator by applicable law. Such obligations include, in particular: obligations to identify customers and monitor transactions in accordance with AML legislation, obligations to store data for specified periods, obligations to disclose information at the request of competent authorities. Data processing in fulfillment of legal obligations is carried out by the Operator regardless of the User’s consent and cannot be limited or terminated at the User’s request. The User acknowledges and accepts that the Operator is obliged to comply with the requirements of the competent authorities for the disclosure of data without prior notification to the User in cases provided for by applicable law. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Legitimate interest of the Operator

The Operator has the right to process personal data on the basis of legitimate interest in cases where such interest is not outweighed by the interests, rights and freedoms of the User. The Operator's legitimate interests include, in particular: ensuring the security of the Platform and preventing fraud, improving the quality of services and developing new products, protecting against illegal claims and legal claims, market research and analysis of the competitive environment. When assessing the balance of interests, the Operator proceeds from a reasonable expectation of privacy on the part of Users and takes measures to minimize interference in the privacy of Users. The user has the right to object to the processing of his data on the basis of legitimate interest; the procedure for exercising this right is described in the “User Rights” section of this Policy. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Protection of vital interests

In exceptional cases, the Operator has the right to process personal data in order to protect the vital interests of the User or other individual. This legal basis applies in situations where data processing is necessary to prevent an immediate threat to life or safety and where other legal grounds are not available. This basis is used by the Operator in extremely rare and justified cases, and its use does not create an obligation for the Operator to notify the User before taking the necessary actions. The operator is not responsible for the consequences of data processing on this basis if such processing was carried out in good faith in order to protect life or health. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

KYC verification providers

To carry out procedures for verifying the identity of Users, the Operator engages specialized providers of KYC/AML services, including, but not limited to: Sum&Substance, Jumio, Onfido and their analogues. During verification, the User's personal data, including copies of documents and biometric data, are transferred to the specified providers for processing in accordance with their own privacy policies. The User assumes all risks associated with the processing of his data by verification providers, and acknowledges that the Operator does not control the internal security and confidentiality practices of data providers. The operator selects verification providers based on their reputation and compliance with international standards, but does not provide guarantees regarding their actions. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Payment processors

When the User carries out operations to replenish an account or withdraw funds using traditional payment instruments (bank cards, bank transfers, etc.), the personal data necessary for making the payment is transferred to the relevant payment processors, payment systems and partner banks. The transfer of data to payment processors is a technically necessary condition for making payments and is carried out without the possibility of restriction by the User. Each payment processor processes data in accordance with its own privacy policy and security standards (including PCI DSS). The Operator is not responsible for delays, failures or security breaches caused by payment processors. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Analytical services

For the purpose of analyzing the use of the Platform, the Operator uses third-party services, including Google Analytics, Mixpanel and similar tools. These services may collect technical data about the User’s interaction with the Platform through their own cookies and tracking mechanisms. The processing of data by analytics services is subject to their own privacy terms: Google Analytics - Google Privacy Policy, Mixpanel - Mixpanel Privacy Policy. The user has the right to refuse the collection of analytical data by disabling the corresponding cookies through the browser settings or using the official tracking opt-out tools provided by these services, but assumes all risks associated with the potential deterioration of the functionality of the Platform. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Cloud infrastructure providers

The Platform infrastructure is hosted on the servers of cloud computing providers, including Amazon Web Services (AWS), Google Cloud Platform and their analogues. These providers carry out technical processing of data as data processors acting on the instructions of the Operator. Cloud infrastructure providers have their own international security certificates (ISO 27001, SOC 2 and similar), however, the Operator does not guarantee absolute protection of data when storing and transmitting it in the cloud environment. Servers may be located in different jurisdictions; data processing in a specific jurisdiction is determined by the configuration of the Operator’s cloud infrastructure. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Law Enforcement and Regulatory Agencies

The Operator is obliged to disclose Users' personal data to government agencies, law enforcement agencies, courts and regulators upon legal request, order or court order from a competent authority. Such disclosure will be made without prior notice to the User in cases where applicable law prohibits such notification or where notification would interfere with an investigation. The Operator has the right to independently initiate the transfer of data to the competent authorities in cases where the Operator believes in good faith that the User’s activities are related to the commission of a criminal offense or violation of applicable law. The User assumes all risks associated with the transfer of his data to the competent authorities in cases established by law, and has no right to make claims against the Operator for such disclosure. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Business reorganization and transfer

In the event of a merger, acquisition, reorganization, bankruptcy, sale of assets or other corporate restructuring of the Operator, personal data of Users may be transferred to the successor of the Operator or the acquirer of the relevant assets. Such transfer is an integral part of the Company's business assets. The user has the right to request the deletion of his data after such transfer, to the extent permitted by applicable AML legislation, by sending a request to the new data controller. The legal successor of the Operator assumes obligations to process data in accordance with this Policy or notifies Users of the intention to change the terms of data processing, providing a reasonable period for refusal. Operator will make reasonable efforts to notify Users of significant changes in the management of their data due to corporate restructuring. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Protection Mechanisms

To ensure an adequate level of protection during cross-border data transfer, the Operator uses the following protection mechanisms: concluding agreements with data recipients containing provisions for the protection of personal data similar to the Standard Contractual Clauses of the European Union; assessing the adequacy of the level of data protection in the recipient country; application of technical security measures (encryption) during data transmission; inclusion of data processing terms in agreements with service providers. These mechanisms apply to the extent that they are available and practicable, taking into account the nature of the particular data transfer. The Operator does not guarantee that data protection mechanisms in third countries will provide a level of protection identical to that provided by the GDPR or other applicable legislation. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Risks

The User acknowledges and assumes all risks associated with the cross-border transfer of personal data, including: the risk of non-compliance of the legislation of the recipient country with the data protection standards of the User's country; the risk of access by government authorities of third countries to the transferred data in accordance with the laws of these countries; the risk of different interpretations of data subject rights in different jurisdictions. The operator takes reasonable measures to minimize these risks, but is not responsible for the consequences that arise due to the specific legislation of the countries in which the data recipients are located. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Processing jurisdictions

Users’ personal data can be processed in any country in the world where servers of cloud infrastructure providers are located (in particular, in the USA, European Union countries, Singapore, Japan and other jurisdictions), where the offices and personnel of the Operator and its affiliates are located, where KYC verification providers and payment processors are located. The exhaustive list of countries in which data can be processed is not fixed and is determined by the configuration of the Operator’s infrastructure and the service providers it uses. The user has the right to send a request for information about specific countries in which his data is processed at support@stakrtrust.com. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Cookie management

The user has the right to manage cookies through the settings of his browser: most modern browsers allow you to view, block or delete cookies. To manage cookies: in Google Chrome - Settings → Privacy and Security → Cookies; in Mozilla Firefox - Settings → Privacy and security → Cookies and site data; in Safari - Settings → Privacy → Manage website data. Changing your browser's cookie settings may affect the functionality of the Platform; The user assumes all risks associated with limiting the use of cookies. Blocking essential cookies makes using the Platform technically impossible. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Do Not Track

The Platform recognizes “Do Not Track” (DNT) signals transmitted by Users’ browsers, however, the Operator cannot guarantee that all third-party analytical and marketing services used on the Platform process such signals in accordance with the User’s expectations. In the absence of a uniform industry standard for processing DNT signals, the Operator processes the DNT request as a User preference, but does not provide legally binding guarantees that all components of the Platform will comply with it. Users who are seriously concerned about online tracking are advised to use specialized browser extensions to block trackers. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

How to exercise your rights

To exercise any of the above rights, the User must: send a written request to the email address support@stakrtrust.com with the subject line “Data Subject Request”; indicate in the appeal the specific right that the User wishes to exercise and the necessary information; attach a copy of an identity document to identify the applicant. Appeals can also be sent to the Operator's postal address: Suite 237, Griffith Corporate Centre, Beachmont, Kingstown, St. Vincent and the Grenadines. The operator considers applications strictly subject to proper identification of the applicant; anonymous requests will not be considered. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Response time

The operator considers requests for the exercise of the rights of data subjects within 30 (thirty) calendar days from the date of receipt of the request and successful identification of the applicant. In cases where the request is particularly complex or the number of simultaneously received requests is large, the consideration period may be extended by another 60 (sixty) calendar days; in such case, the User will be notified of the extension of the period, indicating the reasons, within the initial thirty-day period. The Operator is not responsible for violation of review deadlines caused by the actions of the User himself (failure to provide documents, false identification, etc.). For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Identification

Before executing any request to exercise the rights of a data subject, the Operator is obliged to verify the identity of the applicant in order to avoid unauthorized access to data of third parties. Identity verification is carried out by: providing the applicant with data that matches the account data (email, phone number); providing a copy of an identity document; undergoing additional verification procedures at the discretion of the Operator. The operator has the right to refuse to consider a request if the provided data is insufficient to uniquely identify the applicant. All costs associated with identification are borne by the applicant. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Exceptions

The rights of data subjects are subject to limitations under applicable law, particularly in relation to financial and digital asset services. The rights to erasure, restriction of processing and portability do not apply to data: the processing of which is mandatory due to AML/KYC laws; which are necessary to prevent fraud and financial crime; the storage of which is prescribed by tax legislation; which are necessary to protect the rights and legitimate interests of the Operator in legal proceedings. The User accepts that the exercise of his rights in the field of personal data cannot be used as a tool for evading legal obligations or limiting the legal activities of the Operator in the field of financial compliance. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Data encryption

All data transferred between the User’s device and the Platform servers is protected using the TLS version 1.3 (Transport Layer Security) protocol, which provides reliable connection encryption and server authentication. Personal data stored in the Operator’s databases is encrypted using the AES-256 algorithm (Advanced Encryption Standard with a key length of 256 bits) - one of the most secure symmetric encryption algorithms. Cryptographic keys are stored in secure vaults that are separate from encrypted data, and access to which is limited to authorized personnel. The user assumes the risk that developments in computing technology (in particular quantum computing) may in the future reduce the level of protection provided by these encryption algorithms. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Access Control

Access to personal data of Users within the organization is granted exclusively to employees and contractors who need such access to perform their job duties, in accordance with the principle of least necessary privileges (least privilege). All employees with access to personal data undergo mandatory training on data processing and sign non-disclosure agreements. Mandatory multi-factor authentication (MFA) is used to access systems containing personal data. Access to particularly sensitive data (KYC documents, financial data) is further limited and logged for audit purposes. For terminated employees, access to data is immediately terminated. It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

Security Audits

The operator conducts regular security checks of its systems and data processing processes, including periodic penetration tests (pentests) conducted by independent information security specialists. Internal security audits are carried out at least once a year; Based on their results, vulnerabilities are identified and plans to eliminate them are developed. The operator monitors system and software updates and applies security patches within a reasonable time after their release. The results of security audits are confidential information and are not publicly disclosed; The operator has the right to provide summary information upon the relevant request of the regulator. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Security Incident Response

The Operator has documented security incident response procedures to detect, contain, investigate and resolve data security breaches. In the event of a security breach that may cause harm to the rights and freedoms of Users, the Operator notifies about it in the manner and within the time limits provided for by applicable law. If technically possible, the Operator shall notify the Users directly affected by the incident without unreasonable delay. The incident notification contains information about the nature of the incident, the categories and volume of data believed to be affected, and the mitigation measures taken and planned. The Operator is not responsible for security incidents resulting from the actions or inaction of the User himself. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Third parties

The Operator is not responsible for the actions or inactions of third parties to whom Users’ personal data was legally transferred in accordance with this Policy, including KYC verification providers, payment processors, analytical services and cloud providers. The actions of the competent government authorities regarding the use of data received from the Operator upon legal request cannot be the basis for filing claims against the Operator. The Operator takes reasonable contractual measures to oblige third parties to comply with appropriate data protection standards, but is not responsible for violations committed by third parties contrary to such contractual obligations. The User acknowledges that the implementation of requirements for third parties is the exclusive competence of the User himself. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

User's fault

Under no circumstances is the Operator liable for the loss, compromise or unauthorized use of the User’s personal data or assets resulting from: the User’s transfer of account data (password, two-factor authentication keys, seed phrases) to third parties; the User's use of unreliable devices, unprotected networks or software containing malicious code; the User's response to phishing emails or visits to fraudulent sites; failure by the User to comply with the Operator’s safety recommendations. The user assumes full and unconditional responsibility for all consequences of careless handling of account data and other identification data. None of the clauses in this Policy establishes any obligations of the Operator to compensate for damage caused by the fault of the User himself. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Force majeure

The operator is released from any liability for non-fulfillment or improper fulfillment of obligations for the processing and protection of personal data, if such non-fulfillment is caused by circumstances of force majeure (force majeure): natural disasters, wars and armed conflicts, declaration of a state of emergency, actions of government bodies, malfunctions of the global Internet infrastructure, massive state-level cyber attacks (APT attacks), pandemics and other circumstances under investigation. beyond the reasonable control of the Operator. In the event of force majeure circumstances, the Operator will make reasonable efforts to minimize the consequences for Users, but is not responsible for damage caused as a result of such circumstances. The user assumes all risks associated with the occurrence of force majeure. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Limit of liability

The Operator's aggregate liability to the User for any and all claims related to the processing of personal data is limited to the maximum extent permitted by applicable law. In those jurisdictions where monetary limits of liability are permissible, the Operator's aggregate liability for all claims by the User arising out of this Policy may not exceed the amount of fees actually paid by the User to the Operator in the last 12 months prior to the occurrence of the claim. This limitation applies to the extent permitted by applicable law and does not infringe upon the inalienable rights of consumers. This limitation applies regardless of the legal theory on which the claim is based (contract, tort, statutory violation, etc.). It is hereby separately stipulated that the corresponding processing is carried out in the context of the functioning of StakrTrust as Liquidity Bank and, therefore, should be interpreted broadly in terms of the permissible security-, compliance- and reserve-protection actions of the platform, but restrictively in terms of the emergence of independent claims by the user to the platform.

No guarantees

The Platform and all related services are provided “as is” and “as available”, without warranties of any kind, either express or implied, including, but not limited to, the implied warranties of merchantability, fitness for a particular purpose, continuity of performance and non-infringement of third party rights. The Operator does not guarantee that the Platform will operate without errors, interruptions or delays; that the results of using the Platform will meet the User’s expectations; that the Platform will be compatible with the User’s software and hardware. The User assumes the full risk of using the Platform and is solely responsible for the consequences of such use. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Compensation for losses

The User agrees to fully defend, indemnify and hold harmless the Operator, its affiliates, directors, employees, agents and successors from any claims, demands, liabilities, damages, costs and expenses (including reasonable legal fees) arising from: the User's violation of this Policy or the User Agreement; the User providing false, inaccurate or misleading data; illegal activities of the User using the Platform; violation by the User of the rights of third parties, including intellectual property rights and data protection rights. Your indemnification obligation will apply to the maximum extent permitted by applicable law and will survive any termination of your use of the Platform. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Notice of Changes

The Operator reserves the right to unilaterally change this Policy at any time. In case of making significant changes affecting the rights of Users, the Operator notifies about this at least 30 (thirty) calendar days before the changes come into force by: posting a notice on the main page of the Platform; sending a notification letter to the email address specified in the User’s account. In case of minor technical or editorial changes that do not affect the essence of the rights of Users, the Operator has the right to make them without prior notice indicating a new effective date. The Operator is not responsible if the User does not receive notification of changes due to an invalid email address or other circumstances depending on the User. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Continued use

The User's continued use of the Platform after the date of entry into force of the new version of the Policy constitutes unconditional acceptance of all changes made. If the User does not agree with the changes, he is obliged to stop using the Platform before the date they come into force and notify the Operator about the closure of the account. Use of the Platform after the date of entry into force of the new version of the Policy deprives the User of the right to plead ignorance of the changes as a basis for exemption from liability or making claims against the Operator. The Operator recommends that Users regularly check the current version of the Policy on the Platform. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

Version history

Previous versions of the Privacy Policy are available upon request to support@stakrtrust.com. The Operator stores an archive of revisions of the Policy and provides them to Users within 30 (thirty) days from the date of receipt of the relevant request. The date of each revision is recorded in the title of the document and is the starting point for determining the applicable revision in the event of a dispute. The parties are guided by the version of the Policy that was in effect on the date of the controversial action or event. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.

Email

For all questions related to this Privacy Policy, the processing of personal data, the exercise of the rights of data subjects and other privacy issues, the User has the right to contact the Operator at the email address: support@stakrtrust.com. When contacting, it is recommended to indicate the nature of the request in the subject line of the letter (for example: “Data subject request”, “Question regarding the Privacy Policy”, “DPO request”). The Operator makes reasonable efforts to respond to requests within 30 (thirty) calendar days; on issues requiring additional study, the response period may be extended by notifying the applicant.

Postal address

To send written requests that require official documentary recording, or in cases where sending a request by email is not possible, the User has the right to use the Operator's postal address: StakrTrust Ltd., Suite 237, Griffith Corporate Centre, Beachmont, Kingstown, St. Vincent and the Grenadines. When sending a postal request, it is recommended to use an item with return receipt requested. The operator is not responsible for the delay or loss of postal items caused by the work of postal services.

Response time

The standard period for consideration of User requests related to the processing of personal data is 30 (thirty) calendar days from the date of receipt of the request and successful identification of the applicant. The consideration period may be extended by another 60 (sixty) calendar days in cases where this is due to the complexity of the request or the volume of received applications; the User will be notified of such extension within the initial thirty day period. The time frame for consideration of urgent requests related to security incidents is determined taking into account the circumstances of the specific incident. The Operator is not responsible for violation of review deadlines due to the User’s failure to provide the necessary documents for identification. The User further agrees that in an environment of digital assets, backup liquidity and multi-layered compliance, the relevant measures cannot be interpreted narrowly, literally or in isolation from the overall protective logic of the platform, including the need for AML/KYC, fraud prevention, incident response and subsequent defensive documentation.

DPO/GDPR

For questions related to compliance with the requirements of the GDPR or other applicable data protection regulations, including requests for the exercise of rights provided for by the GDPR, Users have the right to contact the Data Protection Officer of the Operator by sending an application to the address: support@stakrtrust.com with the mark “DPO / GDPR request”. The DPO is an independent official responsible for monitoring the compliance of the Operator's activities with the requirements of data protection legislation. Appeals to the DPO are treated confidentially; The Operator does not permit retaliation against Users who have submitted bona fide complaints or requests to the DPO. For the avoidance of doubt, the user confirms that the described processes cover not only the formally specified actions, but also any related, derivative, technically necessary, analytically justified and security-oriented operations with data, logs, wallet signals and account-related artifacts that the platform deems relevant.