Privacy Policy

Introduction to Our Privacy Policy

This Privacy Policy describes our practices regarding the collection, use, and disclosure of your information when you interact with our services. It is essential to read this Privacy Policy alongside any other privacy notices we may provide when collecting or processing your personal data. This ensures you fully understand how and why we use this data.

This policy covers all services provided by the respective Bull Bitcoin entities ("we," "our," or "Bull Bitcoin") specified below:

In Canada: Satoshi Portal Inc., a Canadian corporation located in Alberta, registered with FINTRAC (registration number M16730720) as a Money Service Business (MSB) dealing in virtual currencies.
In European Union countries: (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden): Leonod SARL, a French corporation registered with the AMF under the PSAN license E21-014.
In Costa Rica: Toro Pagos Limitada, a Costa Rican corporation located in the province of San Jose.
In Mexico: Toro Pagos, a Mexican corporation located in the State of Mexico.

Data Protection Contact

For any privacy-related inquiries, please contact our Data Privacy Manager at: privacy@bullbitcoin.com.

Please note that while we provide translations of our Privacy Policy for your convenience, in case of any discrepancy or conflict, the English version shall prevail.

Last update: 4 November, 2024

1. Definitions

Personal Data: Any information relating to an identified or identifiable individual.
Processing: Any operation performed on personal data, such as collection, storage, use, or disclosure.
Data Controller: The entity that determines the purposes and means of processing personal data.
Data Processor: The entity that processes personal data on behalf of the Data Controller.

2. Consent

General Consent

We use your information only with your consent or as permitted by law. We obtain your consent to collect, use, disclose, and store your personal information when you:

Create an account
Use our services
Request to verify your identity to upgrade to the Verified level
Communicate or interact with us

By using our services, you - "the User" - give your affirmative consent to the practices outlined in this Privacy Policy. This includes complying with all related terms and conditions as well as applicable laws and regulations. Your consent, which supersedes all previous versions, remains valid throughout your relationship with Satoshi Portal. If you disagree with any part of the Privacy Policy, we respectfully advise you not to use our services.

3. Legal Bases for Processing

We process your personal data based on the following legal bases:

Consent: Where you have given us explicit permission to process your data for specific purposes.
Performance of a Contract: Where processing is necessary for the performance of a contract with you.
Legal Obligations: Where we are required to process your data to comply with legal obligations.
Legitimate Interests: Where processing is necessary for our legitimate interests, provided that your interests and fundamental rights do not override these interests.

4. Information We Collect

Data We Collect

Here is a detailed breakdown of the types of information we collect during your interaction with our services, why we collect it, and when we may share it with third parties.

Email address: We collect email addresses to allow users to log in to the Bull Bitcoin application, confirm transactions, contact users, and send updates. Your email address may be shared with identity verification services, payment service providers, and mailing list software providers.
First and last name: We collect your full name to comply with KYC/AML regulations, verify residency, prevent fraud, and facilitate transactions. Your name may be shared with identity verification services and payment service providers.
Phone number: We collect your phone number for KYC/AML compliance, fraud prevention, and as an additional contact method. Your phone number may be shared with identity verification services and payment service providers.
Residential address: We collect your address for KYC/AML compliance and residency verification. Your address may be shared with identity verification services and payment service providers.
Date of birth: We collect your date of birth for KYC/AML compliance. Your date of birth may be shared with identity verification services and payment service providers.
Occupation and source of funds: We collect your occupation for KYC/AML compliance. This information is not shared.
IP address and device information: Automatically collected for account security and fraud prevention. This information may be shared with identity verification services.
Identification documents and selfies for manual verification: Collected for KYC/AML compliance. This information is not shared.
Identification documents and selfies for automated verification: Collected for KYC/AML compliance and fraud prevention. This information may be shared with identity verification services and payment service providers. These identity services may share information extracted from identity documents with third parties for database queries and data validation.
Legal Entities Data: If you represent a legal entity, we may collect information such as the company’s trade name, legal form, registration number, and details of the legal representative. This may include official documents proving the entity's registration, like a Kbis extract (for French companies) or similar documents.

Identity Verification Services

MaxMind Inc: IP address, browser information, and email address may be shared for fraud prevention.
Telesign Corporation: Phone number may be shared for fraud prevention.
ESC Corporate Services Ltd: Name, address, date of birth, and phone number may be shared for identity verification. Data is deleted 24 hours after submission.
Incode Technologies: ID and face verification data shared for identity verification. Data is deleted 30 days after review. Incode uses 256-bit TLS encryption and is SOC 2 Type II Compliant.

Payment Service Providers and Banks

When sending money to Bull Bitcoin, your bank or payment service provider collects your information. Some of your data, such as your name and bank account information, may be transmitted by your bank to our banking partners or payment processors as part of the information included in the payment notification. For withdrawals or bill payments, we share the beneficiary payment information with our processing partners or banks, which may include the name, bank account, and address of the beneficiary, as required to process bank transactions.

Bull Bitcoin Orders and Transaction Data

Transaction logs: Collected and stored for compliance, accounting, and user information.
Bitcoin addresses: Collected for transaction purposes and fraud prevention. Not shared with third parties unless as part of a law enforcement or judicial request or a fraud investigation.
Bitcoin transaction IDs: Collected and stored for compliance, user information, and fraud prevention. Not shared with third parties unless as part of a law enforcement or judicial request or a fraud investigation.

Communications with Bull Bitcoin

Communications: When you communicate with Bull Bitcoin via our platform, email, or other channels, we may collect your name, email, phone number, and the content of your communication. This helps us provide better service, handle your requests, and comply with legal obligations.
Phone call recordings: If applicable, phone conversations may be recorded for quality assurance and training purposes.

5. Data Protection, Storage, and Retention

Data Protection: We are committed to keeping your information safe. We employ technological and administrative safeguards. However, no service can be completely secure. If you have concerns about a data breach, please contact us immediately.
Data Retention: We retain your personal information as necessary, subject to applicable laws and regulations, generally for 5 to 7 years post-last transaction.
Post-Retention Data Management: Data is securely deleted or de-identified after the retention period. Deletion permanently erases data, while de-identification prevents identifying individuals.
International Data Transfers: If your personal data is transferred outside of your jurisdiction, we ensure it is protected by appropriate safeguards such as adequacy decisions, standard contractual clauses, or other mechanisms.

Children's Privacy and Parental Consent

Our services are not for individuals under 14. We do not collect data from children under 14 without parental consent. If a child provides data without consent, we remove it and terminate the account.

6. Your Rights to Your Data

Accessing and Correcting Your Data: You have the right to access your personal data and obtain a copy. If information is inaccurate, you can request changes. Requests must provide enough detail for us to identify the information.
Withdrawing Consent and Objecting: You may object to or withdraw consent for our data processing under certain conditions. Withdrawing consent may impact our ability to serve you and may be subject to legal limitations.
Post-Mortem Data Rights: EU users can set instructions on how their data should be handled after death. These instructions can be detailed or general.
Right to Lodge Complaints with CNIL: If you are a resident of France, you have the right to file a complaint with the CNIL if you feel your data rights have been violated.
Unsubscribing from Promotional Emails: You can unsubscribe from promotional emails by clicking the "Unsubscribe" link in the email or contacting us.
How to Exercise Your Rights: To exercise your rights, contact us via the chat box on your Bull Bitcoin account or by email at privacy@bullbitcoin.com.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small data files stored on your device.

Types of Cookies We Use

Essential Cookies: Necessary for the operation of our website.
Performance Cookies: Collect information about how you use our website.
Functional Cookies: Remember your preferences and personalize your experience.

Managing Cookies

You can manage your cookie preferences through your browser settings. Disabling cookies may affect the functionality of our services.

Retention: Cookies are stored for a maximum of 13 months, after which consent must be renewed. A consent banner is displayed to manage cookie preferences upon your first visit.

8. Jurisdiction-Specific Information

GDPR Compliance

For users in the European Union, we comply with the General Data Protection Regulation (GDPR). This includes:

Lawful Basis for Processing: Processing personal data based on consent, contract, legal obligation, legitimate interests, or other lawful bases.
Data Subject Rights: EU users have the right to access, rectify, erase, restrict, and object to the processing of their personal data. They also have the right to data portability.
Data Protection Officer (DPO): We have appointed a DPO to oversee GDPR compliance. You can contact our DPO at dpo@satoshiportal.com.
Data Breach Notification: In the event of a data breach, we will notify affected individuals and relevant authorities as required by GDPR.
International Transfers: Personal data transferred outside the EU is protected by appropriate safeguards such as standard contractual clauses.

Canada

For users in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). This includes obtaining consent for data collection and ensuring data is protected and used appropriately.

Costa Rica

For users in Costa Rica, we comply with the Law on the Protection of Individuals against the Processing of their Personal Data (Law No. 8968). This includes ensuring data is collected, processed, and stored in accordance with the law.

Mexico

For users in Mexico, we comply with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). This includes obtaining consent for data collection and ensuring data is protected and used appropriately.

9. Updates to Our Privacy Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via our website. Changes are effective as of the date indicated in the Privacy Policy.