PERSONAL DATA PROCESSING POLICY

GENERAL PROVISIONS

1. This document defines the Tiger Trade Capital AG, a company registered at Bahnhofstrasse 8B, 6340 Baar, Switzerland, (“Data Controller”) policy with respect to processing of personal data which the Data Controller collects using the Internet and contains information on personal data protection requirements implemented (“Policy”).
2. The Policy applies to personal data which the Data Controller may receive from the user (“you”) when you use the Data Controller's website at [coin.tiger.trade] (“Site”).
3. By using the Site and submitting your email address, you provide your personal data to the Data Controller and agree to the Data Controller’s processing of the same in accordance with the procedures set forth in this Policy. By accepting or continuing to use the Site, you agree to the terms and conditions of this Policy.
4. Please feel free to contact the Data Controller any time with any questions regarding your personal data processing or to request that your personal data be modified (updated, supplemented, or revised), or to revoke your consent to the personal data processing within the scope and for the purposes referred to in the Policy. In any such case, please send your request in any form by email at: support@tiger.trade. Your request should be sent from your email address submitted through the Site.

DEFINITIONS

5. Below are the main terms used in this Policy (and such terms may be used in either singular or plural form, as the case may be).
   • “PD Laws” mean any applicable regulations and laws governing the protection of personal data, including the General Data Protection Regulation (GDPR);
   • “personal data confidentiality” means the obligation of any persons accessing personal data not to distribute the same without the personal data subject's consent, unless the PD Laws provide for other processing grounds;
   • “Data Controller” means Tiger Trade Capital AG with its office at: Bahnhofstrasse 8B, 6340 Baar, Switzerland, which arranges for and conducts personal data processing and defines purposes of the personal data processing, the scope of personal data to be processed, and actions/operations to be carried out with personal data;
   • “personal data processing” means any action/operation or a set of actions/operations with personal data carried out with or without the use of any automation tools; a list of actions carried out by the Data Controller with your personal data is given below;
   • “personal data” means any information directly or indirectly related to an identified or identifiable individual (personal data subject), i.e. information that directly identifies you (such as your name or email address) and information that does not identify you directly, but may be used in one way or another for identification (e.g. your mobile device details); for the purposes of this Policy, personal data means personal data that you may transfer actively;
   • “Site User” mean any individual using the Site and submitting the email to the Data Controller through the Site.
6. The Data Controller shall provide unrestricted access to this Policy by posting its current version in the Privacy Policy section on the Site, and a hard copy of the same shall be kept in the Data Controller’s office and may be provided to you at your request or otherwise under the PD Laws.
7. This Policy shall be revised or, if required, updated when the Data Controller’s data processing procedures are modified, or the PD Laws are amended.

DATA CONTROLLER’S PERSONAL DATA PROCESSING PRINCIPLES, TERMS, AND CONDITIONS

8. The Data Controller will process your personal data in accordance with the procedures stipulated by the PD Laws on a fair and lawful basis.
9. The Data Controller will process your personal data strictly for the purposes defined in this Policy and such processing will be limited to the attainment of such specific, pre-defined, and lawful purposes. The Data Controller undertakes not to allow any personal data processing that is inconsistent with the purposes for which such data is collected as listed in this Policy. The personal data that the Data Controller collects on the Site is not excessive relative to the declared purposes for which the same is processed.
10. The Data Controller will store your personal data in a form that makes it possible to identify you as a personal data subject for no longer than the purposes of personal data processing require unless the PD Laws require otherwise. Unless the PD Laws require otherwise, the Data Controller will destroy your personal data once the purposes of processing are achieved (e.g., you no longer use the Site and is not interested in marketing updates) in accordance with the procedures stipulated by clause 33 of this Policy, or if processing of your personal data for such purposes is no longer necessary

LEGAL REASONS FOR DATA CONTROLLER’S PERSONAL DATA PROCESSING

11. The Data Controller will process your personal data solely and exclusively subject to there being legal reasons under the PD Laws, and such legal reasons are as follows:
    • your consent for personal data processing with respect to marketing activities between the Data Controller and you (such as e-mail correspondence about Tiger.Trade products, news, or other marketing information);
    • compliance with applicable laws, including, without limitation, those that assign the Data Controller’s functions, powers, and duties;
    • exercise of rights and legitimate interests of the Data Controller or third parties in compliance with the PD Laws (provided, however, that the Data Controller does not violate personal data subjects’ rights and freedoms).

PROCESSED PERSONAL DATA SCOPE AND PURPOSES

12. This Policy describes procedures used by the Data Controller to process personal data of the Site Users.
13. When submitting e-mail on the Site, the Site Users share the following personal data to the Data Controller:
    • email address; and
    • Site usage data.
14. The Data Controller will use personal data shared by the Site Users for the following purpose:
    • to keep the Site Users updated on the Data Controller’s news and for other marketing interactions with the Site Users.
15. Also, if you contact the Data Controller using the contact form on the Site or, in accordance with clause 4 of this Policy, the Data Controller will also process personal data you share, which may include your name, email address, telephone number, message subject and body, and other data shared by you. The Data Controller will use such data to process your query (e.g., to respond to your questions or requests, e.g., to send you requested documents or information).
16. The Data Controller processes your personal data as summarized below:

    Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest
    to keep the Site Users updated on the Data Controller’s news and other marketing interactions with the Site Users	(a) email address (b) Site usage data	your consent for the processing of your personal data

PERSONAL DATA PROCESSING PROCEDURES, TERMS, AND CONDITIONS

17. This Policy applies to collection, recording, classification, capture, storage, revision (updating, modification), retrieval, use, transfer (sharing, accessing), cross-border transfer, blocking, deletion, and destruction of personal data collected by the Data Controller on the Site. The course of your personal data is you. We do not collect personal data about you from a third-party.
18. The Data Controller processes your personal data automatically without making any decisions that have any legal implications or otherwise affect your rights and legitimate interests based solely on personal data automated processing.
19. The Data Controller will ensure that databases used for collection, recording, classification, capture, storage, revision (updating, modification) and retrieval of personal data are in compliance with the applicable PD Laws.
20. The Data Controller will keep your personal data collected on the Site confidential.
21. The Data Controller may delegate the processing of your personal data to a third party, subject to the PD Laws.
22. The Data Controller will transfer your personal data collected on the Site in the following events:
    • you have authorized such transfer;
    • such transfer is required to achieve any purposes of an international treaty or a law, or to fulfill and discharge any functions, powers, and duties of the Data Controller under applicable laws;
    • such transfer is required to perform an agreement to which you are party.
23. The Data Controller will provide personal data collected on the Site, provided that the Data Controller has entered into an agreement with the recipient of personal data under which such third party receiving personal data from the Data Controller undertakes to keep personal data confidential and to adhere to the personal data processing principles and rules defined by the PD Laws and agreement with the Data Controller.
24. The Data Controller will provide personal data (including by cross-border transfer to countries that do or do not provide an adequate level of protection of personal data subjects’ rights) to the following third parties:
    • affiliates of the Data Controller;
    • third-party vendors of such services as website hosting and administration, data analytics, infrastructure maintenance, IT services, services delivered by email or regular mail, audit services, and other services, if such data is needed for such persons to be able to provide the same;
    • in the event of restructuring, merger, sale, creation of a joint venture, or winding up of the Data Controller, transfer of its assets or shares in full or in part (including in connection with bankruptcy or court proceedings)
25. The Data Controller will provide personal data collected on the Site within the scope which the Data Controller may in its discretion deem necessary or appropriate:
    • pursuant to requirements of the laws applicable to the Data Controller;
    • to protect the Data Controller’s and its affiliates’ business;
    • in response to requests from the government authorities;
    • to facilitate any court proceedings;
    • to protect your rights and rights of the Data Controller, confidentiality, security, or property and/ or rights, confidentiality, security, or property of the Data Controller and its affiliates.
26. Access to personal data collected on the Site will be granted to the Data Controller’s authorized personnel in connection with and solely and exclusively for the purposes of fulfilling their job duties, with a list of positions of such authorized personnel to be approved by the Data Controller’s CEO. Such authorized personnel are informed of the applicable law provisions, including personal data protection requirements stipulated by the PD Laws, and of the documents that define the Data Controller’s personal data processing policy, and have been trained/instructed accordingly.
27. When processing personal data, the Data Controller will make sure that personal data is accurate (assuming such data is true without having to verify the same), sufficient, and, where necessary, and fit for purpose. The Data Controller will take appropriate measures to delete or update incomplete or inaccurate data, including in the events referred to in this Policy.
28. The Data Controller will apply required managerial, technical, and administrative arrangements to protect personal data received on the Site in accordance with the PD Laws. At the same time, no systems for storage or transfer of data via the Internet may guarantee full security. If you have reasons to believe that data exchange with the Data Controller is not secure (for example, you believe that security of any of your data is compromised), please terminate the use of the Site and notify the Data Controller of the same immediately in accordance with clause 4 of this Policy.

PERSONAL DATA PROCESSING TERM AND TERMINATION

29. The Data Controller will store personal data collected on the Site for as long as necessary for the purposes of this Policy unless longer storage is necessary or permitted by the laws applicable to the Data Controller.
30. The Data Controller may terminate personal data processing once the purposes of such processing have been attained or where such processing is found to be illegitimate.
31. If processing of personal data collected on the Site is found to be illegitimate (on receipt of your or your representative's query, on receipt of a request from an authorized agency, or following an internal audit) or if personal data is found to be inaccurate, the Data Controller will block or procure the blocking of such personal data that is processed illegitimately on receipt of such query or request for as long as such personal data processing is verified:
    • if the inaccuracy of personal data is confirmed based on the information you, your authorized representative, or an authorized agency may provide in any form in writing, or based on any other documents pursuant to PD Laws, the Data Controller shall update such personal data or procure the same to be updated within seven (7) business days of receipt of such data and unblock the same.
    • if the illegitimate personal data processing is confirmed, the Data Controller shall terminate such illegitimate processing within three (3) business days of confirmation of the illegitimate processing or delete such personal data within ten (10) business days of confirmation of the illegitimate processing. The Data Controller shall notify you, or your representative, or the authorized agency, if the legitimacy of processing was verified at the request of such agency, of remedying any such violations.
32. If you revoke your consent, the Data Controller shall terminate personal data processing immediately, except when continued processing of such personal data is required by the laws applicable to the Data Controller, and in any event the Data Controller shall notify you of the outcome of such revocation.
33. If the purposes for which personal data collected on the Site have been attained, the Data Controller shall terminate personal data processing and destroy personal data within thirty (30) days of when the purposes of processing have been attained, unless your consent received by the Data Controller provides for a different deadline. If personal data collected on the Site may not be destroyed by such deadline, the Data Controller will block such personal data and ensure that the same destroyed within six (6) months, unless the laws applicable to the Data Controller, your consent for personal data processing, or an agreement to which you are a party, require otherwise.

PERSONAL DATA RIGHTS

34. Subject to applicable PD Laws, the Data Controller provides you with the ability to view, update, access, edit, delete and/or correct your personal data. To update your personal data, contact us. You may also object to legitimate interest processing, withdraw any consent you provided and/or request the restriction or portability of your personal data, in accordance with and subject to applicable PD Laws and statutory exemptions. We aim to process these requests within one month, but it may take up to three months. We may also ask for verification of your identity to process these requests.
35. The Site is not aimed at minors (i.e., persons who are under 18 years of age or such higher age as required under applicable laws). By becoming a user, you represent and warrant that you are not a minor and that you have the right, authority, and capacity to enter into and abide by the terms and conditions of this Policy. We reserve the right to verify your information and can exercise our absolute discretion not to provide any Services to you if we are not satisfied that you are not a minor. If we learn that a minor under the age of 18 (or such legally required higher age) has submitted personally identifiable information online without parental consent, we will take all reasonable measures to delete such information from our databases and to not use such information for any purpose (except where necessary to protect the safety of the child or others as required or allowed by law). If you become aware of any personally identifiable information, we have collected from minors under 18 (or such legally required higher age), please contact us. If a child has provided us with personal data, a parent or legal guardian of that child may contact us as described below. Upon confirmation, we will then make reasonable efforts to delete the child’s personal data from our database.