Legal
Privacy Policy
1. Introduction
This Privacy Policy describes how Crestum AG, its affiliates, and subsidiaries (collectively, "we," "us," "our," or "Crestum AG") collect, use, process, store, and disclose your information when you access or use our website(s), mobile application(s), APIs, and any other services provided by us (collectively, the "Services").
Protecting your privacy and securing your data is a top priority for us. We are committed to transparency regarding our data practices. By using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Please read it carefully.
If you do not agree with the terms of this Privacy Policy, please do not access or use the Services.
2. Data Controller Information
For the purposes of applicable data protection laws (such as the General Data Protection Regulation - GDPR), the data controller is Crestum AG, located at 123 Alpha Avenue, Financial District, New York, NY 10005, USA.
If you have questions about this policy or our data practices, you can contact our Data Protection Officer (DPO) or privacy team at [email protected] or via our Contact Page.
3. Information We Collect
We collect information about you directly from you, automatically through your use of our Services, and sometimes from third-party sources. The types of information we collect depend on how you interact with us and the Services you use.
A. Information You Provide Directly:
- Account Information: When you register for an account with Crestum AG, we collect information such as your name, email address, password, phone number, and country of residence.
- Identity Verification (KYC) Information: To comply with legal and regulatory obligations (such as Anti-Money Laundering - AML and Counter-Terrorist Financing - CTF requirements), Crestum AG collects identity verification information. This may include your date of birth, nationality, government-issued identification documents (e.g., passport, driver's license, national ID card), a photograph of you holding your ID, proof of address (e.g., utility bill, bank statement), social security number or national identification number (where applicable), and potentially biometric data (e.g., a selfie for liveness check and comparison with your ID).
- Financial Information: Information related to your transactions on the Crestum AG platform, including deposit and withdrawal details (bank account information, credit/debit card details, crypto wallet addresses), trading history, order details, account balances, and information about your source of funds or wealth if required for enhanced due diligence.
- Communications: Information you provide when you contact Crestum AG's support team, participate in surveys, promotions, contests, or communicate with us in any other way (including emails, chat logs, and recordings of calls if applicable and with your consent where required).
- User Content: Any information you voluntarily post or submit to public areas of the Crestum AG platform (e.g., community forums, blog comments, social media interactions, if applicable).
B. Information Collected Automatically:
- Usage Data: Information about how you access and use the Crestum AG Services, including your IP address, browser type and version, operating system, device information (e.g., model, UDID, MAC address), pages viewed, links clicked, features used, time spent on pages, session duration, and the referring URL or service that led you to Crestum AG.
- Trading Activity Data: Detailed records of your trading activities on Crestum AG, including order types, amounts, prices, timestamps, execution details, fees paid, and market data interactions.
- Location Information: We may collect precise or approximate location information derived from your IP address, GPS (if you grant permission on a mobile device), or Wi-Fi network information to provide location-based services, for security purposes, or to comply with regional restrictions.
- Cookies and Similar Technologies: Crestum AG uses cookies, web beacons, pixel tags, and similar tracking technologies to collect information about your interaction with our Services, personalize your experience, remember your preferences, perform analytics, and for security purposes. Please see our separate Cookie Policy for more details on how we use these technologies and your choices.
C. Information from Third Parties:
- Identity Verification and Fraud Prevention Services: We may receive information from third-party identity verification services, credit bureaus, and fraud prevention agencies to assist with our KYC/AML processes and to detect and prevent fraudulent activity on Crestum AG.
- Financial Institutions and Payment Processors: Information from banks, payment service providers, or other financial institutions related to your deposits, withdrawals, or payment transactions on Crestum AG.
- Analytics Providers: We use third-party analytics services (like Google Analytics, Mixpanel) to help us understand Service usage, user demographics, and behavior on Crestum AG. These providers may collect information sent by your browser or mobile app as part of a web page request, including your IP address or cookies.
- Public Blockchains: We collect transaction information from public blockchain networks (e.g., Bitcoin, Ethereum) related to your Digital Asset transactions involving your Crestum AG platform wallet addresses. This information is publicly available but we associate it with your account.
- Advertising Partners: We may receive information about you from our advertising partners to measure the effectiveness of our ad campaigns and to personalize advertising content (where you have consented to such).
- Social Media Platforms: If you choose to interact with Crestum AG through social media platforms (e.g., by logging in via a social media account or linking your account), we may receive information from those platforms, subject to your privacy settings on those platforms.
4. How We Use Your Information
Crestum AG uses the information we collect for various purposes, in accordance with applicable laws, including:
- To Provide, Maintain, and Secure the Services: Operating the Crestum AG platform, facilitating account creation and login, processing transactions (deposits, withdrawals, trades for arbitrage, futures, crypto earn, and fixed-term fiat deposits), managing your account, providing customer support, and ensuring the security and integrity of our Services.
- To Improve, Personalize, and Develop the Services: Understanding user behavior and preferences, improving user experience, developing new features and products for Crestum AG, customizing content and offers, conducting A/B testing, and troubleshooting.
- For Security, Fraud Prevention, and Risk Management: Verifying identity, monitoring for suspicious or fraudulent activity, preventing unauthorized access, detecting and mitigating security incidents, enforcing our terms and policies, protecting our rights, your rights, and the rights of others.
- For Compliance with Legal and Regulatory Obligations: Meeting our legal and regulatory requirements, including KYC/AML, CTF, tax reporting, responding to lawful requests from government authorities, courts, or law enforcement, and fulfilling our obligations under applicable financial regulations.
- For Communication and Marketing: Sending important account notifications (e.g., security alerts, transaction confirmations, policy updates), providing information about Crestum AG's products and services, sending marketing communications (where permitted by law and with your consent if required, offering opt-out options), and responding to your inquiries, feedback, or requests.
- For Research, Analytics, and Reporting: Analyzing trends, user engagement, and market dynamics, measuring platform performance, generating aggregated and anonymized statistical insights for internal use or public reporting (without identifying individual users).
- To Enforce our Agreements: Enforcing our Terms of Service and other agreements with you.
- For Other Purposes: For any other purpose disclosed to you at the time we collect your information or with your consent.
5. Legal Basis for Processing (GDPR/Relevant Laws)
If you are located in the European Economic Area (EEA), UK, or Switzerland, Crestum AG's legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. However, we will normally collect personal information from you only where:
- Performance of a contract: We need the personal information to perform a contract with you (e.g., to provide the Crestum AG Services you requested, such as opening an account, executing trades, processing deposits/withdrawals for arbitrage, futures, crypto earn, and fixed-term fiat deposits).
- Legitimate interests: The processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms (e.g., for fraud prevention, maintaining the security of our platform, improving our Services, conducting direct marketing subject to opt-out rights, analytics). We will identify these legitimate interests to you where appropriate.
- Consent: We have your explicit consent to do so (e.g., for sending certain marketing communications, using non-essential cookies, or processing sensitive personal data where required). You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
- Legal obligation: We need to comply with a legal or regulatory obligation (e.g., KYC/AML regulations, tax reporting, responding to lawful requests from authorities).
If you have questions about or need further information concerning the legal basis on which Crestum AG collects and uses your personal information for any specific processing activity, please contact us using the details provided in Section 2.
6. How We Share Your Information
Crestum AG does not sell your personal information to third parties. We may share your information in the following circumstances and with the following categories of recipients:
- Service Providers and Vendors: With third-party vendors, consultants, contractors, and other service providers who perform services on our behalf or to help us operate our business. This includes providers for hosting and cloud services, payment processing, identity verification (KYC/AML), fraud detection, customer support software and services, analytics, email delivery and marketing automation, IT support, and security services. These providers are contractually obligated to protect your information and are restricted from using your personal information for any other purpose than to provide services to Crestum AG.
- Affiliates: With our parent company, subsidiaries, and other companies within the Crestum AG group for operational, administrative, and compliance purposes, and for purposes consistent with this Privacy Policy.
- Financial Institutions and Partners: With financial institutions, payment processors, and other partners necessary to process your transactions, facilitate deposits and withdrawals, or provide specific services you have requested on Crestum AG.
- Compliance and Legal Obligations: If required by law, regulation, legal process (such as a subpoena or court order), or governmental request. We may also disclose information to law enforcement, tax authorities, or other government bodies to comply with our legal obligations, prevent or investigate illegal activities, or to protect the rights, property, or safety of Crestum AG, our users, or others.
- Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, acquisition of all or a portion of our business by another company, or in the event of bankruptcy or similar proceedings. Your information may be transferred as part of that transaction, subject to standard confidentiality arrangements.
- Aggregated or De-identified Data: We may share aggregated or de-identified information that cannot reasonably be used to identify you with partners, for research, or for public reporting.
- With Your Consent: We may share your information with other third parties when we have your explicit consent to do so for a specific purpose.
- Professional Advisors: With our professional advisors, such as lawyers, auditors, and insurers, where necessary in the course of the professional services that they render to us.
7. International Data Transfers
Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from, and potentially less protective than, the laws of your country.
Specifically, Crestum AG's servers may be located in the United States, Germany, Singapore, and other countries where our service providers operate. This means that when we collect your personal information, we may process it in any of these countries. Where Crestum AG transfers your information internationally to a country not deemed to provide an adequate level of data protection by relevant authorities (e.g., the European Commission), we will take appropriate safeguards to ensure that your information remains protected in accordance with this Privacy Policy and applicable law. These safeguards include implementing Standard Contractual Clauses (SCCs) for transfers of personal information between our group companies or with our third-party service providers, or relying on other valid transfer mechanisms such as Binding Corporate Rules (BCRs) or adequacy decisions where available.
8. Data Security
Crestum AG implements and maintains robust technical, administrative, and physical security measures designed to protect your personal information from unauthorized access, disclosure, use, alteration, loss, or destruction. These measures include, but are not limited to, encryption of data in transit and at rest, access controls and authorization mechanisms, secure software development practices, network firewalls, intrusion detection and prevention systems, and regular security assessments and vulnerability scanning.
However, no security system is impenetrable, and we cannot guarantee the absolute security of your information transmitted to our Services or stored on our systems. You also play a vital role in keeping your information secure by choosing a strong, unique password, enabling and protecting your Two-Factor Authentication (2FA) methods, and being vigilant against phishing and malware.
9. Data Retention
Crestum AG retains your personal information for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Privacy Policy, including for the purposes of satisfying any legal, regulatory, accounting, tax, or reporting requirements. Typically, we will retain your account information for as long as your Crestum AG account is active and for a period of at least 5 years (or longer if required by applicable law, such as AML/CTF regulations) thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements.
When we have no ongoing legitimate business need to process your personal information, or when the applicable retention period expires, we will either delete or anonymize it. If deletion is not immediately possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. Anonymized data may be retained for research or statistical purposes indefinitely.
10. Your Data Protection Rights
Depending on your location and applicable data protection laws (such as GDPR for individuals in the EEA, UK GDPR for individuals in the UK, CCPA/CPRA for California residents, etc.), you may have the following rights regarding your personal information held by Crestum AG:
- The right to access the personal information we hold about you and receive a copy of it.
- The right to rectify or correct inaccurate or incomplete personal information.
- The right to erase or delete your personal information (the 'right to be forgotten'), under certain conditions (e.g., if the data is no longer necessary for the purposes for which it was collected).
- The right to restrict the processing of your personal information under certain conditions (e.g., if you contest the accuracy of the data).
- The right to data portability, which allows you to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another controller, under certain conditions.
- The right to object to the processing of your personal information, particularly where we process your data based on legitimate interests or for direct marketing purposes.
- The right to withdraw consent at any time, where Crestum AG relies on your consent as the legal basis for processing your personal information. Withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal.
- The right to not be subject to automated individual decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you, under certain conditions.
- The right to lodge a complaint with a relevant data protection supervisory authority if you believe that Crestum AG has processed your personal information in a manner that is not compliant with applicable data protection laws.
To exercise these rights, or if you have any questions about your rights, please contact Crestum AG's Data Protection Officer or privacy team using the contact details provided in Section 2. We will respond to your request in accordance with applicable laws and may need to verify your identity before processing your request.
11. Children's Privacy
The Crestum AG Services are not directed to, nor intended for use by, individuals under the age of 18 (or the age of legal majority in their jurisdiction of residence if higher). Crestum AG does not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child without verification of parental consent, we will take steps to delete such information from our records promptly.
13. Changes to This Privacy Policy
Crestum AG may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make (e.g., by posting the revised policy on our website with an updated 'Last updated' date, or by sending you a notification). We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.
We encourage you to periodically review this Privacy Policy to stay informed about how Crestum AG is protecting your information. You can see when this Privacy Policy was last updated by checking the "Last updated" date displayed at the top of this Privacy Policy.
14. Contact Us
If you have any questions, comments, or concerns about this Privacy Policy, our data practices, or if you wish to exercise your data protection rights, please contact Crestum AG's Data Protection Officer (DPO) or privacy team at: [email protected] or via our Contact Page.