Where we engage third parties to process your Personal Data on our behalf, we do so under a data processing agreement (DPA) in accordance with Article 28 GDPR. These processors are contractually obliged to:

Act only on our documented instructions,
Implement appropriate technical and organizational security measures, and
Refrain from disclosing your data to other third parties unless legally required.

Please note that not all recipients qualify as data processors. In some cases, parties process your Personal Data as independent Controllers under Article 4(7) GDPR. This applies, for instance, to financial institutions (e.g., fiat on-ramp providers) that are independently required to retain certain information for compliance with financial or anti-money laundering laws. In such cases, Processing is carried out based on their own legal grounds under Article 6 GDPR, and no processing agreement under Article 28 GDPR is required.

In specific situations, data may be processed under a joint controllership arrangement pursuant to Article 26 GDPR, where two or more parties jointly determine the purposes and means of Processing. In such cases, we enter into a binding agreement which transparently allocates the respective responsibilities - especially concerning the exercise of Data Subject rights and information obligations under Article 13 and 14 GDPR. The essence of this agreement is available upon request.

Disclosures to public authorities, courts or regulators are strictly based on a legal obligation under Article 6(1)(c) GDPR. Such entities act as independent Controllers.

In the context of corporate transactions (e.g. mergers or acquisitions), potential acquirers may process Personal Data as separate Controllers, depending on the stage and structure of the transaction.

প্রথমে বিশ্বাস। তারপর বাণিজ্য।