PRIVACY POLICY

1. Who we are and our role

Freebnk Europe, UAB (“FreeBnk”, “we”, “us”), registration number 306725542, Žalgirio str. 88-101, LT-09303 Vilnius, Lithuania, is a technology and software company. We do not provide regulated financial services; those are provided by licensed partners under their own authorisations and their own privacy notices.

We are the data controller for personal data collected through this website, through our contact forms, and when a business is onboarded to a FreeBnk product (the Stablecoin API, the Business Global Account web dashboard, FreeBnk Pay, the OTC Desk). Where a licensed partner or a white-label partner uses our technology to serve its own clients, that partner is the controller of its clients’ data and FreeBnk processes the data on the partner’s instructions as a data processor; the partner’s privacy notice applies to that processing.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

2. What data we collect

Website visitors

• IP address, approximate location derived from it, browser and device type, pages viewed, referring site and time of visit;
• cookie and analytics identifiers (see section 11);
• your answer to the notice about the United Kingdom, stored in your browser only.

Business contacts and enquiries

• name, work email, phone number, company name and website, country, type of business and the content of your message when you use a contact or request form;
• correspondence with our sales, support, desk and compliance teams.

Clients and the people behind them (onboarding)

When a business applies for a FreeBnk product we collect, directly or through our identity-verification providers, data about the company and about its ultimate beneficial owners, directors, authorised signatories and the individuals who will operate the account:

• name, date and place of birth, nationality, residential address, contact details, role and ownership percentage;
• identity documents (passport, national ID, residence permit) and the data they contain, proof of address;
• a selfie or short video used for liveness detection and matching to the identity document (see section 3);
• results of sanctions, politically-exposed-person, adverse-media and watch-list screening, and the risk rating assigned;
• source-of-funds and source-of-wealth information where enhanced due diligence applies.

Product use and transactions

• account and API activity, log-in and security events, device and IP data, API keys and their usage;
• blockchain addresses, transaction hashes, amounts, assets, networks and counterparties, and the results of wallet and transaction screening;
• quotes, trades, payment links, invoices, settlement instructions and bank account details provided for payouts;
• Travel Rule information (originator and beneficiary data) where a transfer requires it.

Some of this data concerns individuals who are not our direct contacts (for example a company’s beneficial owners, or a customer who pays a merchant through FreeBnk Pay). Where you provide data about other people, you confirm that you are entitled to do so and that they have been informed of this policy.

3. Identity documents and biometric data

Liveness detection and face matching involve biometric data, a special category of personal data under Article 9 GDPR. This processing is performed by our specialist identity-verification providers on our behalf or on behalf of the licensed partner, for the sole purpose of verifying that the person presenting an identity document is its genuine holder. It takes place on the basis of your explicit consent, given at the start of the verification step, and of the legal obligations of our licensed partners to identify their clients. You may decline, in which case onboarding cannot be completed. Biometric templates are not retained by FreeBnk beyond the verification result and the document images required for record keeping.

Sanctions and PEP screening may reveal information about political exposure or alleged criminal conduct. We process such information only as required to meet AML, CTF and sanctions obligations.

4. Why we use your data and on what basis

• Responding to enquiries and requests (contact, desk access, partnership forms): our legitimate interest in answering you and taking steps at your request before entering into a contract.
• Onboarding, verification and screening of businesses and the people behind them: compliance with legal obligations that apply to our licensed partners and that we are contractually required to support, our legitimate interest in preventing our technology from being used for financial crime, and, for biometric data, your explicit consent.
• Providing and operating the products, including wallet creation, quotes, payments, trades, settlement instructions, confirmations and support: performance of the contract with you or with the partner you use.
• Transaction monitoring, wallet screening, Travel Rule exchange and reporting: legal obligations of our partners, our legitimate interest in financial-crime prevention, and the public interest in preventing money laundering and terrorist financing.
• Security, fraud prevention, logging and auditing: our legitimate interest in keeping our systems and our clients safe, and legal obligations.
• Analytics and improvement of the website and products: our legitimate interest, and consent where cookies require it.
• Marketing communications about our products to business contacts: your consent, or our legitimate interest in informing existing business clients about similar products; you can opt out at any time.
• Establishing, exercising or defending legal claims and complying with requests from courts, regulators and law enforcement: legal obligations and legitimate interests.

We do not sell personal data and we do not use it for automated decisions with legal or similarly significant effects without human review; screening results are reviewed by a person before an application is declined.

5. Blockchain data

Our products create and read transactions on public blockchains such as Tron and Ethereum. Addresses, amounts and transaction hashes written to a public blockchain are visible to anyone, are not controlled by FreeBnk, and cannot be altered or deleted. Where a blockchain address can be linked to a person, that public record is outside the scope of the rights described in section 10. We hold the link between an address and a verified client in our own systems, where the usual protections apply.

6. Who we share data with

• Licensed partners that provide the regulated part of a product (fiat payments, conversion, settlement, custody of fiat): onboarding and screening data, transaction and Travel Rule data, to the extent needed for their service and their own legal obligations.
• Identity-verification and screening providers that perform document checks, liveness detection, sanctions and PEP screening and blockchain analytics on our behalf.
• Infrastructure and service providers: cloud hosting, blockchain node and data providers, email and communication tools, customer-support and ticketing tools, website hosting and security services. These providers act as our processors under contract.
• White-label partners, where you were onboarded through a partner’s branded deployment of our technology: that partner is the controller of your data.
• Competent authorities: financial intelligence units, supervisory authorities, courts and law enforcement, where the law requires it or a lawful request is made; usually through the licensed partner responsible for the regulated service.
• Professional advisers (auditors, lawyers, insurers) under confidentiality, and a buyer or successor in the event of a merger, acquisition or reorganisation of our business.

7. International transfers

We store data primarily within the European Economic Area. Some of our providers and partners are located, or process data, outside the EEA (for example in the United Kingdom, the United States or the countries where a licensed partner settles payments). Where that happens we rely on an adequacy decision of the European Commission or on the European Commission’s Standard Contractual Clauses together with additional safeguards where needed. You can ask us for details of the safeguards used for a particular transfer.

8. How long we keep data

• Enquiries and business contacts: for as long as needed to deal with your request and, if no relationship follows, up to two years after our last contact.
• Onboarding, screening, transaction and Travel Rule records: at least five years after the end of the business relationship or the date of the transaction, as required by anti-money-laundering law applicable to our partners, and longer where a specific law, investigation or claim requires.
• Security and access logs: typically twelve months, longer where an incident is investigated.
• Analytics data: for the lifetime of the relevant cookie (section 11) or in aggregated form.

When data is no longer needed it is deleted or irreversibly anonymised.

9. Security

We protect personal data with encryption in transit and at rest, access controls and role-based permissions, logging and monitoring, segregated environments, secure key-management for our non-custodial wallet infrastructure, and contractual security obligations on our providers. No system is completely secure; if a personal data breach is likely to put you at high risk we will inform you and the supervisory authority as the GDPR requires.

10. Your rights

Subject to the conditions in the GDPR, you have the right to access the personal data we hold about you, to have it corrected or completed, to have it deleted, to restrict or object to its processing, to receive the data you provided in a portable format, and to withdraw consent at any time without affecting processing carried out before withdrawal. You may object to direct marketing at any time.

These rights are limited where the law requires us or our partners to keep data, for example anti-money-laundering record-keeping, or where disclosing information would amount to tipping-off or would prejudice an investigation. Data written to a public blockchain cannot be erased (section 5).

To exercise a right, email help@freebnk.io with “Data protection request” in the subject. We may ask you to verify your identity before responding, and we will reply within one month, extendable by two further months for complex requests.

11. Cookies and analytics

This website uses:

• Strictly necessary storage, such as the record that you have seen the United Kingdom notice and the session data needed for forms to work;
• Analytics: Google Analytics and Google Tag Manager, and WordPress.com (Jetpack) site statistics, which set cookies and collect IP address, device and page-view data to help us understand how the site is used;
• Protection against abuse: Google reCAPTCHA on our forms, which collects device and interaction data to tell humans from bots and is subject to Google’s privacy policy and terms.

You can block or delete cookies in your browser settings; strictly necessary storage may be required for parts of the site to work. Where consent is required for analytics cookies, we rely on the choice you make in your browser or in the cookie notice shown to you.

12. Who this website is for

Our products are offered to businesses and institutions, not to consumers, and we do not knowingly collect data from anyone under 18. This website and FreeBnk’s products are not directed at, or intended for, persons resident or located in the United Kingdom; if you are in the United Kingdom, please do not submit personal data through this website.

13. Changes to this policy

We may update this policy as our products, partners or the law change. The current version is always available on this page, with the “last updated” date at the top. Where a change materially affects onboarded clients, we will tell them through the dashboard or by email.

14. Contact and complaints

Data protection questions and requests: help@freebnk.io · Freebnk Europe, UAB, Žalgirio str. 88-101, LT-09303 Vilnius, Lithuania.

If you are not satisfied with our response, you have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or with the supervisory authority of the EU country where you live or work.