KuCoin EU Tomorrowland Privacy Statement

 
1. What is this privacy statement about?
This privacy statement explains how KuCoin EU Exchange GmbH processes your personal data in connection with the KuCoin KuCard activation at Tomorrowland: the staffed KuCoin collection point on the festival site, where you open a form by scanning a QR code in order to register for the KuCard waitlist. It supplements our general privacy policy and applies specifically to this activation.

2. Who is responsible for your data?
Two parties are each separately responsible for their own part. They are not joint controllers.
  • KuCoin — KuCoin EU Exchange GmbH, a company incorporated under the laws of Austria, with registered office at Am Grünen Prater 2/3. Stock, 1020 Vienna, Austria, registered in the Austrian company register (Firmenbuch) under number FN 641084x. KuCoin is a partner of Tomorrowland and acts as a separate data controller for the use of your data for its own marketing regarding the KuCard and its own products and services. What KuCoin does with it is set out in KuCoin’s privacy policy: [https://www.kucoin.com/en-eu/support/47185419968074].
  • Tomorrowland — WEAREONE.world BV, a private limited liability company under Belgian law, with registered office at Kattendijkdok-Westkaai 12, 2000 Antwerp, Belgium, registered with the Crossroads Bank for Enterprises under enterprise number 0867.239.782.
KuCoin collects your data via the form and decides — only with your consent — to disclose it to Tomorrowland.

3. What data do we process, and for what purpose?
You enter your data yourself on the form: first name, surname, email address and country. We also record the time of your registration, and whether and when you gave consent.
We use this data for two purposes: (1) to make the activation work — enabling your registration for the KuCard waitlist; and (2) if you consent to this, disclosing your data to KuCoin so that KuCoin can add you to the KuCard waitlist and email you its own offers.

4. On what legal basis?
  • Sharing with Tomorrowland — your consent (art. 6(1)(a) GDPR). You are entirely free not to tick the box (art. 7(4) GDPR); if you do not tick it, we disclose nothing to Tomorrowland and you can simply close the form.
  • The activation itself — processing what you enter, in order to operate the form and to keep proof of your consent, takes place on the basis of the legitimate interest of KuCoin EU in carrying out the activation correctly and in being able to demonstrate its lawfulness (art. 6(1)(f) and art. 5(2) GDPR).

5. With whom do we share your data?
If you give consent, we disclose the data listed above directly to Tomorrowland, so that Tomorrowland can contact you directly. KuCoin uses that data as a separate data controller for its own marketing and limits itself to what is necessary for this purpose.
You give this consent specifically for the KuCoin KuCard activation.
This activation is for adults only (18+). Minors cannot take part; this is checked on the form before the consent moment.
We only disclose your data if you live in one of the countries covered by this activation: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden. If you live in another country, the disclosure does not take place.
For the form, we work with a service provider that delivers this service on our behalf (processor). It processes your data only in accordance with our instructions and not for its own purposes.

6. Do we transfer data outside the EEA?
KuCoin receives and processes your data within the European Economic Area (EEA). KuCoin (KuCoin EU Exchange GmbH) is established in Austria, and therefore within the EEA; the receipt and processing of this data take place within the EEA, so that the disclosure by KuCoin to Tomorrowland is a transfer within the EEA. If KuCoin or Tomorrowland nevertheless processes data outside the EEA, it does so under its own responsibility and with the safeguards described in the general KuCoin privacy statement — such as an adequacy decision, the European Commission’s standard contractual clauses or another legally permitted mechanism.

7. How long do we keep your data?
KuCoin keeps the proof of your consent and the list of disclosed data no longer than necessary, in accordance with the retention principles in the general KuCoin privacy policy. In concrete terms, we disclose your data to KuCoin within 20 days of collection and erase the transfer list within 30 days of collection. If you withdraw your consent, we keep it no longer than necessary to be able to demonstrate the lawfulness of the earlier processing.
How long KuCoin keeps your data for its own marketing is set out in KuCoin’s privacy statement.

8. What are your rights?
You have the rights described in the general KuCoin privacy policy: access, rectification, erasure, restriction, objection (including free-of-charge objection to direct marketing) and portability. You exercise these rights by email via privacy@kucoin.eu or marketing@kucoin.eu.
If you gave consent for the disclosure to KuCoin, you can withdraw it at any time, free of charge (art. 7(3) GDPR): via the unsubscribe link in every KuCoin email, directly with KuCoin via marketing@kucoin.eu. This withdrawal concerns only your activation consent. Withdrawal does not affect the lawfulness of the processing carried out before the withdrawal.

9. Complaint to the supervisory authority
If you are not satisfied with how we handle your data, please let us know via privacy@kucoin.eu. You also have the right to lodge a complaint with a competent supervisory authority (Austrian Data Protection Authority) dsb@dsb.gv.at.

10. Changes to this statement
We may amend this statement when the activation or the applicable regulations require it. This version is dated 15 July 2026.