Introduction
This Privacy Policy ("Policy") of OTCN, informs and explains the User how OTCN processes any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the User's identification or identifiability ("Personal Data") OTCN receives, when the User is using the Website and/or the Services.
This Policy sets forth the basic rules and principles by which OTCN processes the User's Personal Data and mentions Our responsibilities while processing the User's Personal Data according to transparency obligations. While using the Services the User agrees for the User's Personal Data processing in accordance with the Policy and affirm that. In case when the User does not agree with the Policy partially or fully, the User must stop using the Services. All data collected before above-mentioned refusal will be processed in accordance with Policy until the User's direct prohibition is received.
The Services are not directed to people under the age of eighteen (18). OTCN recognizes the importance of safeguarding children's Personal Data and complies with applicable data protection laws. If the User becomes aware that the User's child has provided OTCN with Personal Data without the User's consent, please contact OTCN at the email address listed below. If OTCN becomes aware that a child under eighteen (18) has provided OTCN with Personal Data, OTCN will take steps to remove such information and/or terminate the child's Account.
OTCN is the Data Controller within the meaning of the General Data Protection Regulation (GDPR) and Salvadorean legislation as Constitution or any law issued by the Congress in the matter of Personal Data Protection and determines the purposes and means of processing the User's Personal Data.
OTCN's address is Costa Rica. This address should be used for submitting physical requests related to the exercise of ARCO-POL rights or other privacy-related matters.
Definitions
Data controller means a company which determines purposes and means of Personal Data Processing.
Data processor means a company which Processes Personal Data on behalf and upon instructions of the Data controller.
Personal Data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether by automated means or not, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Sensitive Personal Data means personal data that refer to the physical or moral characteristics of individuals, as well as facts or circumstances concerning their private life or intimacy, which affect the most intimate sphere of the User.
Personal data and its processing methods
While providing the Services OTCN may collect the following:
Data used for performing customer due diligence measures,
the User's data e.g. the User's photo, name, date and place of birth, address;
identity document data, e.g. photo of the document, number and validity;
financial data, e.g. ownership and source of funds and/or wealth;
contact details, including, the User's email address or details of other means of communication the User chooses to provide Us;
transaction data and the nature of using the service, e.g. transaction sums, counter-parties, bank account and card number(s) and account holders;
other data e.g. media coverage, occupation and connection to other persons, and device information and location;
Usage data includes details about how the User uses our Website.
Technical data includes internet protocol (IP) address, the User's login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices which the User (whether a client or otherwise) uses to access and browse the Website.
Website visit data includes the full Uniform Resource Locators (URL), clickstream to, through and from the Website (including date and time), products the User viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page.
Marketing and communications data includes the User's preferences in receiving marketing from OTCN or our third parties and the User's communication preferences. This may include information whether the User has subscribed or unsubscribed from any of Our mailing lists, accepted any of Our invitations, or attended any of Our events.
Correspondence between the User and OTCN.
OTCN collects Personal Data for the next targets and legal basis:
to provide the Services and carry out Our obligations arising from any contract the User enters into with OTCN;
to perform transactions;
to provide the User with information related to providing the Services;
to grant the User access to the Services;
to remember the User's settings, manage the User's requests, host, and back-end infrastructure;
to provide newsletters/offers/updates/advertisements which may be interesting to the User;
in order to improve the Website (testing features, interacting with feedback platforms, managing landing pages, heat mapping the Website, traffic optimization, and data analysis and research, including profiling and the use of machine learning and other techniques over the User's Personal Data and in some cases using third parties to do this);
to provide customer support;
to collect statistical or technical non-personalized data about the use of the Website and the Services;
for Our justified interest, for the purpose of fulfilling a contract, including for establishing violations of the contract or legislation, as well as to confirm such violations.
in order to comply with legal requirements (including, compliance with KYC and AML regulations);
in order to protect the User's vital interests or the vital interests of another natural person.
If Personal Data processing is carried out in accordance with Our justified interests, the User has a right to submit objections to such processes.
Disclosing the User's Personal Data
OTCN only shares the User's Personal Data when OTCN has a valid reason for it, namely, to provide our services and products to the User and when OTCN is legally permitted to do so.
OTCN may disclose the User's Personal Data to:
Data processors (including banking partners, technology providers, customer support center) – we use carefully selected service providers (data processors) that provide sufficient guarantees to implement appropriate technical and organizational security measures to protect the User's Personal Data. OTCN has concluded appropriate data processing agreements with the service providers and shall remain responsible for their actions in respect of the processing of the User's Personal Data.
Third parties – in some circumstances, OTCN also shares the User's Personal Data with third parties who act as independent data controllers as regards the User's Personal Data. OTCN only shares the User's Personal Data with third parties if stipulated herein, if required under the applicable law (e.g., auditors, national regulators or other authorities), when we need to protect the User's legal rights (e.g. disclosing Personal Data to attorneys or debt collection agencies) due to Our legitimate interest for the performance of an agreement, or with the User's consent.
Acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets. In such case, OTCN makes sure that the User's rights and conditions as a data subject shall not be decreased.
The User's representatives, advisers, and other third parties the User has contacted regarding the Service or which the User has authorized to interact with OTCN on the User's behalf. Please note that OTCN considers such authorization as the User's consent and therefore the User's request for such an activity must be present to OTCN in a written form.
OTCN will not sell the User's Personal Data to any third party.
In certain cases, Personal Data may undergo processes of anonymization or pseudonymization to ensure the privacy of the User. This means that the data will be altered in such a way that it cannot be directly linked to an individual unless required by applicable law. Records of such processes will be maintained when necessary.
OTCN will only transfer the User's Personal Data with the User's prior explicit consent, providing the User with:
The specific purpose of the transfer.
The identity of the recipient or sufficient details to identify them.
All data transfers will be conducted to fulfill purposes directly related to the legitimate interests of the User or OTCN, in compliance with applicable law.
The User has the right to revoke consent for specific data transfers at any time. Upon revocation, OTCN will cease the transfer and notify the recipient to stop processing the User's Personal Data.
OTCN will ensure that third parties acting as independent data controllers comply with applicable data protection standards. OTCN will only share the User's Personal Data with such parties after verifying their ability to provide equivalent levels of protection.
Sensitive Personal Data
No individual may be compelled to provide Sensitive Personal Data. Providing such data is entirely voluntary and subject to the User's explicit consent.
Sensitive Personal Data may only be processed with the explicit, unequivocal, and written consent of the User. The Data Controller must inform the User of their right to withhold consent and any consequences associated with not providing such data.
Sensitive Personal Data may be processed without prior consent in the following circumstances:
To protect the life of the User or another person in emergencies where consent cannot be obtained.
For health-related purposes, including prevention, diagnosis, or medical treatment, provided such processing is conducted by a healthcare professional or an individual bound by equivalent confidentiality obligations.
Sensitive Personal Data may be collected and processed for statistical or scientific purposes only when dissociated from the User to ensure anonymity and protect their identity.
Personal Data storage
OTCN stores the User's Personal Data while it is necessary to process data, to protect Our interests or on the grounds provided by legal acts requirements. In accordance with our record keeping obligations OTCN will retain wallets and personal information for at least a period of five years after they are closed by the User.
Cookies
Our Cookies Policy is available on the Website.
Security and international transfers
Although generally the Personal Data is processed within the European Economic Area, certain activities may result in the transferring of Personal Data to Third Countries, meaning countries located outside the EU/EEA. OTCN takes all necessary measures to protect the data against unauthorized access, modify, disclosure or destruction. OTCN has implemented various technical and organizational measures to be compliant with applicable Personal Data, privacy, and data security legislation in the countries where OTCN operates or where the applicable law applies to OTCN.
OTCN has put in place procedures to deal with any suspected Personal Data breach and will notify the User and any relevant regulator of a breach where OTCN is required to do so by law.
OTCN is not responsible for the Personal Data protection measures violations if such violations caused by actions performed by the User or a third person.
Personal data storage
OTCN stores the User's Personal Data while it is necessary to process data, to protect Our interests or on the grounds provided by legal acts requirements. In accordance with our record keeping obligations OTCN will retain Personal Data for at least a period of five years after they are closed by the User.
The User's rights and obligations
In accordance with relevant legal acts (primarily – GDPR) the User can exercise the following rights by contacting Us:
Request an access to the User's own Personal Data;
Request changes in the User's own Personal Data;
Request removal of the User's own Personal Data;
Submit objections to the User's own Personal Data processing on any grounds.
Request the transmission of the User's own Personal Data to another Data Controller in a structured, commonly used format.
Request that OTCN restrict the processing of the User's own Personal Data under specific condition.
OTCN replies to the User's requests and requirements within the legally required timeframe: (i) Revocation requests: Five (5) business days; Other requests: within 1 month and notifies about measures took to perform provided requests and requirements.
If the requests or requirements of the User are obviously not justified or excessive, primarily due to their repetitive nature, OTCN has the right to refuse performing requests or requirements.
The User does not need to pay a fee to access information or other rights, but OTCN may charge a reasonable fee if the User's request is clearly unfounded, repetitive, or excessive or refuse to comply with the User's request in these circumstances.
In case when Personal Data is processed by the User's consent, the User always has a right to revoke his consent. If the User revokes the User's consent for Personal Data processing all the data processing performed before revoke considers to be legitimate and lawful.
Where OTCN needs to collect Personal Data by law, or under the terms of a contract OTCN has with the User and the User fails to provide that data when requested, OTCN may not be able to perform the contract OTCN has or are trying to enter into with the User (including the Services). In this case, OTCN may have to cancel the User's use of our Services, but OTCN will notify the User if this is the case at the time.
The User must notify OTCN about changes in the User's contact details to keep them up to date.
As part of the right to access, The User have the right to be informed if their Personal Data has undergone anonymization or pseudonymization processes.
Upon request, OTCN will provide documentation of such processes when applicableTo exercise ARCO-POL rights (Access, Rectification, Cancellation, Opposition, Portability, and Limitation), Users may contact the Data Controller via the following methods:
E-Mail: [email protected]
These requests will be addressed within the legally established timeframes.
In case of the User's rights violation, the User has a right to ask State Data Protection Inspectorate or court to protect the User's rights. The State Data Protection Inspectorate can be contacted as follows:
E-Mail: [email protected]
Address: Mata Redonda, Barrio Las Vegas San José, San José, Costa Rica
Revocation of Consent
Explicit Right to Revoke Consent
Users may revoke their consent for the processing of their Personal Data at any time, without retroactive effect. The revocation of consent does not affect the legality of any processing carried out prior to the revocation or that is based on other legal grounds.
Timelines for Processing Revocation Requests
The Data Controller must process revocation requests within five (5) business days from the date of receipt. Any delays must be communicated to the User, with reasons for the delay provided.
Notification to Third-Party Processors
If Personal Data is also processed by third-party service providers, the Data Controller must notify these parties of the revocation decision within five (5) business days from the resolution date to ensure immediate cessation of data processing.
Response to Refusals of Revocation
In cases where the Data Controller refuses to process a revocation request, the User may file a complaint with the relevant Supervisory Authority or pursue other legal remedies as permitted by applicable law.
Legal Limitations
Notwithstanding anything to the contrary in the Policy, OTCN may preserve or disclose the User's information if OTCN believes that it is reasonably necessary to comply with a law, regulation, legal process, or governmental request; to protect the safety of any person; to address fraud, security or technical issues; or to protect Our or the Users' rights or property.
The User acknowledges that the OTCN is not liable for any illegal or abusive use of the User's information. The User acknowledges that in a case where the User shares the User's information from the Software or the Website in social or other networks, or in other third-party sites and/or platforms, the User's information is subject to the privacy policies of such third-party resources.
OTCN may share the User's Personal Data with law enforcement, data protection authorities, government officials, and other authorities only when OTCN is legally bound to do so or has to protect the safety of its users and the Website.
Third-party links
The Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about the User. OTCN does not control these third-party websites and are not responsible for their privacy notice or policies. OTCN strongly encourages the User to read the privacy notice of every website he visits, particularly when leaving the Website.
Policy changing
The Policy can be changed to comply with changes in law, Personal Data processing or under instructions of supervisory authorities. OTCN will make available the updated Policy on the Website.