PRIVACY & COOKIE POLICY

Version 1.0

Last updated on: March 2, 2022

This Privacy & Cookie Policy (the “Privacy Policy”) is adopted by Programmable Equity OÜ (KOOS, we, us and our). We are the owner and operarator of KOOS website at www.koos.io (Website) and provide the Software for Token Issuers to issue Tokens to Token Recipients as stated in our Terms of Service.

The Privacy Policy sets out the principles of processing your personal data by KOOS when you use our Services and our Website.

If you have any questions about how we process your personal data or if you wish to submit an application for exercising your rights related to processing your personal data, please contact us through the contact information provided in the section "Contacts" below.

Our Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Unless otherwise defined in the Privacy Policy, the terms such as personal data, data subject, data processing, controller and processor are used in the meaning given to them in Article 4 of the General Data Protection Regulation (2016/679/EU; the “GDPR”). Terms starting with a capital letter are either defined herein or in our Terms of Service.

1. WHY WE PROCESS PERSONAL DATA AND WHAT PERSONAL DATA DO WE PROCESS?

   1. When you as a Token Issuer or Token Recipient visit our Website or use our Software, we may need to process your personal data.
   2. When Token Issuers have decided to issue Tokens to Token Recipients or when you as a Token Recipient have decided to use Recipient Services, we may need to process your personal data.
   3. We process personal data that is submitted to us directly while you are using Issuer Services or Recipient Services (the “Services”) or that we obtain in the course of your use of these Services. We are the data controller in these cases.
   4. We also process personal data of Token Recipients that is submitted to us by Token Issuers who issue Tokens to Token Recipients. In that case, we act as the data processor.
   5. We may also process personal data that is submitted to us directly by you if you contact us with a query or question via Website or via any other channel (by sending an e-mail, for example). In such a case we process your personal data included in the inquiry to the extent that is necessary to respond to you.
   6. The personal data we process about you in the course of using our Website and/or Services may be the following:
      1. contact details: first and last name, email address and mobile number to enable Services to you.
      2. usage data: we also collect information about how you use the Website and our Services, to amend and better adapt the Services to you;
      3. identity data: if at the request of the Token Issuer we need to identify you, we do that based on applicable know-your-customer laws. In that case, we may require your first name and last name, date of birth, username, personal identification code or other identifier, identity document code and a copy of an identity document. This data may vary from country to country, and we may be required to verify your input from other sources.
   7. The source of information and our role regarding these types of personal data are summed up below:

      Personal data	Provided to us	Our role
      Contact details	By the Token Issuer(s) which issued you Tokens	Data processor
      Usage data	By you when you use our Website and Services	Data controller
      Identity data	By you on the request of the Token Issuer which issued you Tokens	Data processor

2. WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA?

   1. We process your personal data to provide Services to you (please read our Terms of Service as available on our Website). Legal basis for such data processing is GDPR Article 6-1-(b), i.e. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
   2. In certain specific situations we might also process your personal data where this is necessary for the purpose of our legitimate interests pursued by us. Legal basis for such data processing is GDPR Article 6-1-(f). In such a case we shall ensure that processing is proportionate and that we have carried out legitimate interest impact assessment. For example, for the purpose of our legitimate interest we analyse how our Services and Website are used by our customers so we can provide better service. 
   3. In certain specific situations we may also process your personal data based on your consent. Legal basis for such data processing is GDPR Article 6-1-(a). In those situations, we process your personal data on the terms provided in the consent that you have granted to us. 
   4. Additionally, we might process your personal data when processing is necessary for compliance with a legal obligation to which we are subject, for example for accounting purposes under applicable accounting legislation. Legal basis for such data processing is GDPR Article 6-1-(c).
   5. More specifically, we rely on following legal bases when processing your personal data:

      Purpose of processing	Types of personal data	How have we obtained personal data	Legal basis for processing	Retention period
      Enabling the creation of an account with us.	First name, last name and email address and mobile number.	From the Token Issuer if you are a Token Recipient.	Performance of the contract under the Terms of Service with you – GDPR art. 6 (1) (b). After the termination of the contractual relationship with you (under the Terms of Service) - legitimate interest of KOOS– GDPR art. 6 (1) (f).	During the term of the contract with you under the Terms of Service. After the termination of the contract under the Terms of Service - three years based on our legitimate interest until the end of the limitation periods under applicable law.
      Amend, adapt and improve the Website and Services provided to you.	Usage data such as geolocation data, time zone settings, browser type and version, device type, operating system and platform.	Automatically in the course of your use of the Service.	Necessary for our legitimate interests (studying how our Website and Services is being to develop and amend our Website and Services) – GDPR art. 6 (1) (f). After the termination of the contractual relationship with you (under the Terms of Service) - legitimate interest of KOOS– GDPR art. 6 (1) (f).	During the term of the contract with you under the Terms of Service. After the termination of the contract under the Terms of Service - three years based on our legitimate interest until the end of the limitation periods under applicable law.
      Answering your inquires.	Name, e-mail and other personal data that is submitted to us directly by you also if you contact us with a query or question via Website or via any other channel (by sending an e-mail, for example).	Directly from you.	To answer your request and our legitimate interest – GDPR art. 6 (1) (b) and GDPR art. 6 (1) (f).	Until the end of the limitation period of the claim related to which the inquiry is submitted. Generally, such term is three years.
      Provision of marketing content.	E-mail address; statistics concerning your use of the Services and the Website.	Directly from you; statistics concerning your use of the Services and the Website is collected by KOOS.	Your consent - GDPR art. 6 (1) (a).	Until the withdrawal of the consent.

3. WHEN DO WE SHARE YOUR PERSONAL DATA?

   1. To the extent this is necessary for the provision of our Services, we may share your personal data with certain third parties.
   2. We may also share your personal data with third party suppliers providing services to us, e.g. IT suppliers or other service providers. At the moment of adopting this Privacy Policy, we use the following service providers:
      1. Contractors and companies that support us on specific aspects of our business such as IT, accounting and legal advice; and
      2. Google Analytics to analyse the use of our Website (see Cookies).

4. HOW LONG IS YOUR PERSONAL DATA RETAINED?

   1. We do not retain personal data longer than it is necessary for the purposes of processing personal data or pursuant to applicable law.
   2. Personal data related to contracts can be retained during the term of the contract and based on our legitimate interest pursuant to Article 6 (1) (f) of the GDPR until the end of the statutory limitation periods under applicable law. Accordingly, as a general rule, we retain your personal data as long as it is necessary for the provision of the Services during the term of the contract concluded between you and us and for three years after the term of the contract. In this regard, as a general rule, if you have not used our Services for three years, your profile and all personal data therein will be deleted, unless we have a legal basis for retaining your personal data for longer time period.
   3. More specific terms concerning the retention periods of your personal data are outlined in the table in Section 2 above.

5. HOW DO WE PROTECT YOUR PERSONAL DATA?

   To protect your personal data from unauthorized access, unlawful processing or disclosure, accidental loss, modification or destruction, we use appropriate technical and organisational measures that comply with applicable laws. These measures include but are not limited to the implementation of appropriate computer security systems, protection of paper and electronic format files by technical and logical means, controlling and limiting access to documents and buildings.

6. COOKIES

   1. Our Website uses cookies. This section incorporates our cookie policy (the Cookie Policy) that applies when you use our Website.

   2. Cookies are small data files stored on your hard drive by a website. Cookies help us monitor and improve the functionality and usage of our Website and your experience when using our Services. We can use cookies to see which areas and features are popular and to count visits to our Website to recognise you as a returning visitor and to tailor your experience of the Website according to your preferences. We may also use cookies for targeting or advertising purposes.

   3. We use statistics cookies that record information about the way our Website is used, to acquire knowledge on how often our Website is visited, where on our Website our visitors spend the most time, how often they interact with a page or part of a page, this allows us to make the structure, navigation, and content of our Website as user-friendly as possible.

   4. The specific cookies that our Website uses are the following:

      Cookie	Description	Duration	Type
      _ga	Registers a unique anonymous ID that is used to generate statistical data on how the visitor uses the website.	2 years	Statistics cookie
      ga#	Used by Google Analytics to collect data on the number of times a user has visited the website as well as dates for the first and most recent visit	2 years	Statistics cookie

   5. You can delete or block cookies on Website through your browser settings at any time. However, some cookies might be necessary for the functionality of Website. Therefore, you understand that when blocking or deleting the cookies some features of Website might not function correctly.

   6. For more general information about cookies including the difference between session and persistent cookies please see www.allaboutcookies.org.

   7. In case you have any question concerning Cookie Policy, you may contact us via contact details provided below.

7. YOUR RIGHTS

   1. We are dedicated ensuring that all data subject rights arising under applicable law are always guaranteed to you. In particular, you have:
      1. the right to withdraw consent for processing your personal data at any time. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent;
      2. the right to access the personal data that we process about you;
      3. the right to request that we rectify any inaccurate personal data about you;
      4. the right to request that we erase your personal data and/or restrict processing of your personal data if we do not have valid legal basis for processing;
      5. the right to receive your processed personal data in a structured, commonly used and machine-readable format and have the right to transmit your personal data to another controller;
      6. the right to object to the processing of your personal data.
   2. If you believe that your rights have been infringed, you may contact and lodge a complaint to the supervisory authority applicable for your jurisdiction (Data Protection Inspectorate in Estonia address Tatari 39, Tallinn 10134, info@aki.ee or other competent authority in your jurisdiction).

8. CONTACTS

   If you have any questions about this Privacy & Cookie Policy or if you have any concerns about how we use your personal or if you want to exercise your rights as described above, you may contact us via e-mail or in writing using the following contact information:

   Name	Programmable Equity OÜ
   Address	Harju maakond, Viimsi vald, Miiduranna küla, Kristjani tee 4, 74015
   E-mail	info@koos.io