Privacy Policy

1. About Bull Bitcoin

Leonod SARL, operating as Bull Bitcoin (hereinafter referred to as "Bull Bitcoin" or the "Company"), is a company organized and existing under the law of France, under company registration registered with the Trade and Companies Register of Lyon under number (SIRET) 849 566 559 00019, whose having its registered office is located at 15 Place Jules Ferry, 69006 Lyon, France.

2. Scope

Bull Bitcoin, as a Data Controller, is required to collect, process and store your personal data when you use our https://app.bullbitcoin.com website. This concerns our customers but also prospects.

When we mention "personal data", we mean information about you and of which we are aware of; that can be used to personally identify you (for example, a combination of your name and postal address).

This policy sets out what information we collect, how we use it and your rights if you wish to change the way we use your personal data.

If you have any questions about how we use your personal data, you can contact us at the following address: privacy@satoshiportal.com

Bull Bitcoin uses Data processors in relation to the processing of personal data.

3. What categories of personal data does Bull Bitcoin process?

3.1 Data provided by the User

Bull Bitcoin will process the following personal data provided directly by the User. Every time a User makes a transaction through Bull Bitcoin, we collect information about the order.

The data we collect includes the following:

• Individual Users' personal data: name, surname, date and place of birth, tax code and nationality
• Contact details: residence and/or domicile address, telephone number, e-mail
• Verification data (for the purpose of verifying an account): identity documents (passport, driving license and identity card) and data of a proof of address for the verification of residence, photos, data on the condition of politically exposed persons
• Other personal and/or economic information (in order to comply with legal obligations): profession and economic sector, income and assets, origin of funds, password for the account

We could also collect additional personal data provided by the User in the use of the additional sections on the Bull Bitcoin website (for example for help desk or for incoming deposits), like the deposit amount, deposit ID, user details, and bank details; push notification tokens (if permissions are given).

Every time a User visits the Website we collect information provided by the User when he/she subscribes to the newsletter format (giving a specific consent on this marketing activity) or uses additional sections on the Bull Bitcoin Website (for example for help desk).

3.2 Data provided by Bull Bitcoin

Computer systems and software procedures on which the platform are based are made so that they get, during their ordinary activity, information and personal data that are later sent implicitly through the web by systems based on the Internet protocol.

This is information that is not collected to be associated with identified interested parties, but which by their very nature could, through processing and association with data held by third parties, allow Users to be identified.

This category of data includes:

• IP addresses or domain names of the computers used by the Users who connect to the Website
• URI (Uniform Resource Identifier) addresses of the requested resources
• The time of the request, the method used to submit the request to the server
• Size of the file given by the server in response
• Numerical code indicating the status of the response (successful, error, etc.)
• Other parameters relating to the operating system and the user's IT environment

Every time a User visits the Website, we collect information about:

• Online identifiers: browser fingerprint, operating system, mobile device type, browser name and version, anonymized IP addresses
• Usage data: authentication data, click-stream data, and other data collected via cookies and similar technologies

We use only strictly necessary, performance and functional cookies to enable essential platform features, maintain security, and ensure proper operation of our services. We do not use marketing, advertising, or non-essential tracking cookies.

The functional cookies we deploy are necessary to:

• Authenticate and maintain your session
• Ensure platform security and prevent fraud
• Enable core functionality of our crypto-asset services
• Comply with our legal and regulatory obligations

These cookies are essential for the performance of our services and cannot be disabled if you wish to use the platform. By using our services, you consent to the use of these strictly necessary cookies.

3.3 Personal Data of third parties

Should the Data Controller process personal data of third parties communicated directly by a User (for example in the event that the User intends to make an appointment with Bull Bitcoin also on behalf of a friend or a relative), the User acknowledges that in this case they are the owner of the processing of the personal data of the aforementioned third parties.

Therefore, by providing such personal data of third parties to Bull Bitcoin:

• The personal data that should be communicated by the User to Bull Bitcoin have been processed by the User in accordance with the provisions in force on privacy
• The aforementioned third parties have been previously and duly informed by the User in relation to methods and purposes of the processing itself and have authorized it to do so

All responsibility for the communication of information and data of third parties without said parties' permission or for any incorrect or unlawful use of the same is solely of the User.

4. What are the purpose of the processing and the legal basis

4.1 Registration and creation of the personal account for the establishment, the execution and the management of the contractual relationship

The personal data referred to in paragraph 3. will be processed by Bull Bitcoin for:

• The registration, creation and management of the User's personal account and any IT-technical assistance on the use of the account
• The establishment, execution and management of the contractual relationship and/or for the supply of services connected to the same contractual relationship

In particular, for the following purposes:

• Provision of the services covered by the contractual relationship: request the opening of an account by e-mail and/or telephone in the case of a legal person User, buy or sell bitcoin, consult the movements and/or communications of Bull Bitcoin about your account
• Verification of the User's identity: in order to correctly process a sell/buy request, Bull Bitcoin verifies, in confirmation of the aforementioned request, the identity of the customer
• Administrative and accounting: customer database management
• Management of active and/or passive disputes

4.2 Fulfillment of legal obligations

The personal data referred to in paragraph 3 will be processed by Bull Bitcoin for the fulfillment of the legal obligations imposed on Bull Bitcoin by virtue of civil, fiscal and accounting regulations, as well as in the field of anti-money laundering, prevention of terrorist financing ("AML/CFT"), to respond to any requests for information deriving from national authorities and supranational.

4.3 Marketing activities

The personal data of the User referred to in paragraphs 3.1. and 3.2. will be processed for promotional activities through automated e-mail by Bull Bitcoin such as:

• Newsletters, brochures and presentations
• Sending commercial and/or promotional information and updating communications in relation to Bull Bitcoin services
• Invitations to events

Bull Bitcoin for the pursuit of its legitimate interest – which does not override the interests and/or fundamental rights and freedoms of the User – in the context of the execution of the contractual relationship may process the e-mail address of the User for the CD. soft spam (art. 130, comma 4 D. Lgs. 196/2003 and 6 par. 1 letter f), GDPR).

4.4 Fix and appointment with Bull Bitcoin

The personal data of the User referred to in paragraphs 3.1. and 3.3. will be processed to fix an appointment requested by the User and/or to respond to requests for information made by the User, in order to obtain more information on Bull Bitcoin and/or on Bull Bitcoin's activities and services.

Any purpose other than the specific treatment for which personal data has been provided will be pursued by Bull Bitcoin only after, as required, a specific notice has been sent to the User and the latter's consent has been obtained.

5. Am I obliged to provide my personal data?

The disclosure of the User's personal data to the Data Controller which is required through the Website may be mandatory or optional for the pursuance of the purposes identified in this Policy.

In particular:

• The provision of personal data by the User for the purposes referred to in paragraphs 3.1. and 3.2. is optional but necessary because failure to provide it will make it impossible to register on the Bull Bitcoin Website and create your own personal account and/or to establish and/or continue in the contractual relationship and/or to provide services related to the aforementioned relationship.
• The provision of the User's personal data for the purposes referred to in paragraphs 4.3. and 4.4. is optional and failure to provide it will have no consequence on the possibility of registering and establishing a contractual relationship with Bull Bitcoin, but it will not be possible to inform the User about promotional and commercial initiatives and send the user newsletters, invitations to events, evaluate the interests and preferences of the User or fix an appointment with Bull Bitcoin to provide the User with more details about the activities and/or services offered by Bull Bitcoin.

It is also specified that where the User has given their consent to authorize the Data Controller to pursue the purposes referred to in paragraphs 4.3. and 4.4. that precede will remain free at any time to revoke your consent and/or oppose the processing of data for the aforementioned purposes, even only in relation to the methods of contact (for example, if the User wishes to receive the newsletter, but does not wish to receive commercial and/or promotional information and updating communications in relation to Bull Bitcoin services, he/she may object to the processing of his/her personal data aimed at that specific purpose) by simply sending a written notice to that end to the addresses specified in paragraph 11 below.

6. What are the ways in which my personal data are processed?

The processing of the User's personal data will take place in a lawful, correct and transparent manner, for specific, explicit and legitimate purposes and in compliance with the laws, regulations and provisions on data privacy. The User's personal data are mainly processed in electronic format and in some cases also in paper format.

7. Can we share your personal data?

Your personal data may be communicated according to the purposes pursued:

• To companies of the Bull Bitcoin group, its partners, subcontractors and service providers. This communication only takes place in the context of processing that pursues one of the purposes described in this Policy.
• In compliance with the applicable regulations, to third parties in France or abroad for the purposes of establishing, safeguarding or defending a legal right, in the context of administrative or criminal investigations by one or more regulators, compliance with commitments made to them or in the context of legal disputes of any kind.
• To certain regulated professions such as auditors, lawyers, in order to provide regulatory reports or to act in defence of our rights.
• To payment processors and account information service providers, only with your consent or at your request.

For a complete and updated list of the subjects to whom the data is communicated, the User can write to the contact details indicated in paragraph 1 above.

8. How long Bull Bitcoin keep your personal data?

For the purposes referred to:

• Paragraphs 4.1 (Registration and creation of the personal account for the establishment, the execution and the management of the contractual relationship) and 4.2 (Fulfillment of legal obligations), the User's personal data will be kept by Bull Bitcoin for the entire duration of the contractual relationship and for a period of 5 years after the contractual relationship has come to an end.
• Paragraph 4.3, the personal data will be stored for 2 years from the collection of consent and its registration in the CRM or in any case until the withdrawal of consent.
• In paragraph 4.4 (Fix and appointment) personal data will be stored for 1 year from the collection of consent and its registration in the CRM or in any case until the withdrawal of consent, unless cancellation is always possible by email.

9. Transfer of data outside the European Economic Area (EEA)?

Due in particular to the international dimension of the Bull Bitcoin group, the processing described in this Policy is likely to involve transfers of personal data to countries that are not members of the EEA. However, your personal data remains at all times hosted within the European Union.

Furthermore, your personal data may, within the limits of what is authorised by the applicable regulations, be communicated to the official bodies and to the authorised administrative and judicial authorities of countries that are not members of the EEA, in particular within the framework of the regulations on the fight against money laundering and the financing of terrorism, international sanctions and embargoes, the fight against fraud and the determination of your tax status.

10. How can I exercise my rights?

Pursuant to articles 13, paragraph 2, letters b), c) and d) and 15-22 of the GDPR, Users can exercise the following rights:

• The right to request access to their personal data together with indications relating to the purpose of the processing, the category of personal data processed, the subjects or categories of subjects to whom they have been or will be communicated (with indication of the possibility in which such subjects are located in third countries or are international organizations), when possible to the retention period of personal data or to the criteria used to determine this period, to the existence of their rights to rectify and/or delete personal data, to limit processing and of opposition to processing, to one's right to lodge a complaint with a supervisory authority, to the origin of the data, to the existence and logic applied in the event of an automated decision-making process. If they exercise this right, and unless otherwise indicated by the User, they will receive an electronic copy of their personal data that is subject to processing.
• The right to obtain:
  • Their personal data rectified if inaccurate or completed if incompleted
  • The cancellation of their personal data should there be one of the conditions laid down in art. 17 of the GDPR (for example: the User's personal data are no longer necessary with respect to the purposes for which they were collected, the User decides to revoke the consent to the processing – where this represents the legal basis – and there is no other legal basis for the processing itself, the User opposes the processing and no other legitimate interest of the Data Controller prevails, the personal data are processed unlawfully)
• The limitation of the processing of personal data concerning the User: 1) for the time necessary for Bull Bitcoin to ascertain the accuracy of the User's personal data (in the event that the User has contested it), or 2) if the processing of personal data is illegal and the User requests, instead of deleting his personal data, the limitation of the related processing, or 3) when Bull Bitcoin no longer needs the User's personal data but the same are for the User necessary to ascertain, exercise or defend a right in court, or, finally, 4) for the time necessary to assess the possible prevalence of the legitimate reasons of the Data Controller with respect to those of the User, if the User has opposed the processing of their personal data pursuant to point c) below
• The User's personal data in a structured format, commonly used and readable by an automatic device also in order to transmit them to another owner, if the processing is based on consent or on a contract and is carried out by automated means (so-called right to data portability). If the User is interested, they can ask Bull Bitcoin to transmit their directly to the other Data Controller, if this is technically feasible
• The right to object to the processing of their personal data, if such processing is carried out pursuant to art. 6.1 lett. e) (i.e. for the execution of a task of public interest to which the Data Controller is subject) or lett. f) (i.e. to pursue a legitimate interest of the Data Controller) of the GDPR, unless there are compelling legitimate reasons for the Data Controller to proceed with the processing, pursuant to art. 21 of the GDPR.
• The right to withdraw consent at any time, where given, without prejudice to the lawfulness of the processing of the User's personal data based on consent and carried out before the revocation.
• If carried out, the User also has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or which significantly indicates his person, also having the right to obtain human intervention from the Data Controller, to express their opinion and to contest the decision.
• If you are not satisfied with the processing of your personal data carried out by Bull Bitcoin, you can lodge a complaint with the CNIL, following the procedures and indications published on the official website of this authority.
• Any corrections or deletions of the User's personal data or limitations of the processing carried out at the User's request (unless this proves impossible or involves a disproportionate effort) will be communicated by Bull Bitcoin to each of the recipients to whom the personal data may have been transmitted of the User in accordance with this Privacy Policy.

The aforementioned rights are not subject to any formal constraint and are free of charge. Bull Bitcoin may only ask the User to verify their identity before taking further actions following the User's request.

11. Who can I contact to exercise my rights or for more information?

You can exercise your rights and contact the data protection officer as follows:

• At the following mailing address: Bull Bitcoin DPO, 15 Place Jules Ferry, 69006 Lyon, France
• By e-mail to the following address: privacy@bullbitcoin.com

Finally, you have the right to lodge a complaint with the "Commission Nationale de l'Informatique et des Libertés" ("CNIL"), the supervisory authority in charge in France of compliance with obligations in terms of personal data.

12. What about Social Media?

12.1 Social sharing buttons

The Website can be reached by interacting with the Bull Bitcoin pages on social networks. The social network may collect data relating to the User's visit to the Website. This Privacy Policy does not concern the processing of the User's personal data by the social network, therefore, the User must refer exclusively to the dedicated Privacy Policy of the social network itself.

12.2 Who is responsible in such cases?

Bull Bitcoin is present on various social media platforms (see below) to communicate with active customers, potential customers and interested social media users about Bull Bitcoin's services, products and other news.

If you use such social media platforms, the general terms and conditions and the data protection guidelines of the platform operators also apply. As part of the technical process of different social media platforms (e.g. Google, Facebook, X, etc.), these platforms will know when you click on content or a website you are visiting, if you are logged in to your social media account at the same time.

Such information is collected by social media platforms and assigned to your social media accounts, regardless of whether you click on content of this platform or not. By logging out from your accounts, you can prevent such companies from associating the information collected with your accounts.

The activities of those companies are not controlled by Bull Bitcoin and therefore, we do not assume any liability for damages that you may incur through the use of your data by these companies.

Bull Bitcoin can only process personal data of social media users if they communicate directly with Bull Bitcoin via such platforms (e.g. number of visitors, posted articles, likes, direct messages, Client inquiries, comments, etc.). In such cases, Bull Bitcoin is also responsible for the processing of personal data gathered thereby.

In addition to the data processing by us, other providers, in particular operators of social networks and platforms, also process personal user data. We have no influence on this data processing and are not responsible for it - the data processing takes place exclusively in the area of responsibility of the other providers.

For a detailed explanation of the respective processing and the possibilities of objection (opt-out) by providers of social media networks, we refer to the respective privacy policies of the providers (see below). In the case of requests for information and the assertion of data subject rights regarding data processing by other providers, we point out that these can be asserted with the below-mentioned providers. Only the providers have access to the data of the users and can directly take appropriate measures and give information.

Bull Bitcoin Social Media

Our social media pages and channels and the links to the respective data protection declarations:

• Twitter (X): @BullBitcoinFR & @BullBitcoin_
• Instagram: @bull.bitcoin
• LinkedIn: Bull Bitcoin
• YouTube: @BullBitcoinFr & @bullbitcoin_

12.3 Security measures

Bull Bitcoin takes the protection of your information very seriously. Pursuant to art. 32 of the GDPR, Bull Bitcoin and the persons appointed as data processors adopt adequate security measures in order to minimize the risk of destruction or loss, even accidental, of personal data, unauthorized access or processing that is not permitted or does not comply with collection purposes indicated in our Privacy Policy.

We have put in place appropriate physical, electronic and managerial security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed, including use of secure servers, passwords and industry standard encryption for data both in transit and at rest.

We limit access to your personal data to those employees, agents, contractors and other third parties who have a business, need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

Where we have given you a password or PIN code that enables you to access certain parts of our account, you are responsible for keeping this password or PIN code confidential. We ask you not to share a password or PIN code with anyone.

You can also set up 2 factor authentication (2FA), which we strongly advise you to do to improve the security of your account.

13. If I am a minor, can I use the Services?

The Website is intended to be used and viewed by adults. Therefore, requests from minors cannot be considered.

14. Is the Privacy Policy subject to change or update?

This Privacy Policy may be subject to modification also as a consequence of any regulatory changes. We kindly invite you to periodically review this Privacy Policy for the latest information on our privacy practices.