PRIVACY POLICY OF KUNA PAY

‍

1. General Information

Kuna Pay (“We” or “Us”) has prepared this Privacy Policy in compliance with the requirements of the General Data Protection Regulation ("GDPR") and the Law of the Republic of Lithuania on the Legal Protection of Personal Data and other relevant laws, including the Privacy Act of Canada and the Personal Information Protection and Electronic Documents Act of Canada.We care about the privacy of your data and are committed to protect it. This Privacy Policy regulates Kuna's collection, processing and use of your personal data that you give us when you access or use our website at https://kunapay.io or related services provided by us. When visiting, accessing, and using the Kuna Pay website or our services, you confirm that you have read, understood and agreed to all of the terms and conditions of this Privacy Policy. If you consider any term or condition of this Privacy Policy inappropriate, please do not visit, access or use our website or services.You may withdraw your consent at any time. All you have to do is contact us.The aim of this Privacy Policy is to provide a description of:

1. the types of personal data we may collect and how we may use it;
2. the rights you are entitled to in this context;
3. the transfer of your personal data;
4. how and why we may disclose your personal data to third parties;
5. the safeguards we use to protect and prevent the loss, misuse or change of personal data;
6. the storage of your personal data;
7. who you can contact in relation to data protection.

Any use of the terminology or other words in the singular, plural, capitalization, and/or he/she or they, are taken as interchangeable and therefore as referring to the same. Words “include”, “includes” and “including” shall be deemed to be followed by the phrase “without limitation”.Please read this Privacy Policy carefully and without limitation in its entirety. If you have any questions regarding this Privacy Policy, please contact us at kunapay@kunapay.io‍

‍

‍2. Administrative Information

‍We are in control of the way we collect your personal data and define the purposes we use personal data for. Thus, we are the controller of your data. According to Article 4 (7) of the GDPR a data controller is a legal or a natural person which alone or jointly with others determines the purposes and means of processing personal data.The data controller is UAB "Kuna Pro", a company incorporated under the laws of Republic of Lithuania, under registered number 306041195. You can always contact us if you have any questions about Kuna's processing your personal data or if you would like to exercise your rights: If you reside in any acceptable jurisdiction except Canada:

• Registered address: Eišiškių Sodų 18-oji g. 11, LT-02194 Vilnius
• E-mail: kunapay@kunapay.io, law@kuna.family (legal issues).

If you are dissatisfied with anything, you have the right to file a complaint to the State Data Protection Inspectorate (“SDPI”), whose contacts are listed below:

• Address: 17 L. Sapiegos str. (entrance on the left side), LT-10312 Vilnius;
• Phone: +370 5 271 2804 / 279 1445
• Fax: +370 261 9494;
• E-mail: ada@ada.lt 

If  you reside in Canada:

• Legal name: FlexyPay Inc
• Registered address: 398-416 Main st, Vancouver, BC, Canada, V5T3E2
• Email: kunapay@kunapay.io, law@kuna.family (legal issues)

If you are dissatisfied with anything, you have the right to file a complaint to the Office of the Privacy Commissioner of Canada via online form by the link. Nevertheless, we would appreciate it if we could solve your problems before you contact authorities, so please contact us first.

‍

‍3. Sources of personal data

‍Personal data means any information relating to an identified or identifiable natural person as defined in Article 4(1) of the GDPR.The way we collect personal data about you is wide-ranging. Generally, you provide us with your information in person by interacting with us directly:

• by visiting our website;
• by using any of our services;
• when you give us any feedback or contact us.

In addition, we will also rely on third parties and/or public sources to receive data relating to you. Any of the below sources may be used by us:

• public authorities;
• publicly available information;
• fraud and crime prevention agencies;
• public blockchain.

‍

‍4. Personal data we collect

‍Kuna Pay collects your personal data when you use our site. Failure to submit the required information and documents or provision of incorrect or incomplete information and documents, or failure to comply with our other requests will result in our services being unavailable to you.There are two types of information you may provide to us when you visit the Kuna Pay site: 

• personal data that you voluntarily share; and 
• data collected automatically when you use the Kuna Pay site or our services.

We will only collect and process data for specific and legal purposes and only as appropriate and necessary for one or more of the purposes set forth in this Privacy Policy, namely, to provide you with services and/or to fulfill legal requirements. Please note that the GDPR does not regulate the collection and processing of data about legal entities (e.g., company name, address, licenses), therefore although Kuna Pay does process such data, it is not specified in this Privacy Policy.

‍

‍

In addition, the below mentioned data may be automatically received and recorded in the logs of our server:

• your access and use our site;
• event details on your device (e.g. browser type, browser language, date and time of request and destination URL, crashes);
• the type of your device and its unique identification number(s);
• the way your device interacts with our site and services, as well as the pages visited and links clicked;
• your overall geographic location.

Please note that there are personal data which Kuna Pay does not collect and process:

1. we do not intentionally collect personal data from those under the age of 18. If we become aware that we have collected personal data from children without confirmation of parental consent, we will take steps to delete such information.
2. we also do not process sensitive personal data that includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, data concerning health or data concerning a natural person’s sex life or sexual orientation as defined in Article 9(1) of the GDPR. 

If you find out that Kuna Pay has collected such type of information, please contact us directly kunapay@kunapay.io  without delay and request its deletion.

‍

5. Rights you have with respect to your personal data 

There are individual rights you have with regard to the personal data we collect and process about you:

1. right to access your personal data - by providing us with an identity document or by verifying your identity in the manner prescribed by law or by means of electronic communication allowing personal identification, you have the right to receive information about the sources and type of your personal data that has been collected, the purpose of its processing and the data recipients to whom the data is or was disclosed at least within the last year;
2. the right to rectify your personal data - you have the right to request us to correct your personal data that you find to be inaccurate. In case you consider your data to be incomplete, you also have the right to ask us to supplement your data by giving us the missing information;
3. the right to object to processing of personal data - if the processing of your personal data is based on a legal basis other than consent, you have the right to object to it; in such a case, you must submit a written notification of your objection to the processing of personal data to us in person, by mail or by electronic means of communication. If your objection is legally justified, we will stop processing your personal data without delay, except as required by law;
4. the right to withdraw your consent to the processing of personal data - if the basis for processing your personal data was your consent, then you have the right to withdraw your consent at any time. The legality of the processing that preceded the withdrawal will not be affected by such withdrawal. However, it may impact the number of services we can provide to you. For example, if we need your consent to provide some services, after you withdraw it, we can no longer provide those services to you;
5. the right to have your personal data deleted - we will do so with no undue delay if any of the below grounds is applicable: some text
   1. the personal data has been illegally processed; 
   2. the personal data is not necessary anymore due to the purposes for which it was collected or otherwise processed; 
   3. you withdraw the consent upon which the processing is based and if no other legitimate grounds for processing exist; 
   4. the personal data must be deleted in order to meet a legal obligation under the law of the Union or the Member State to which we are subject;
6. the right to lodge a complaint - if you consider that we have violated your rights, we encourage you to contact us in the first instance at kunapay@kunapay.io  so that we can try to solve your issue or dispute informally. You also have the right to lodge a complaint with the competent supervisory authority - State Data Protection Inspectorate.

‍

6. Personal data collection purposes 

Kuna Pay only collects personal data that is necessary to provide you with the services you require.

We collect and use your personal data for the foregoing purposes:

1. to interact with you about services and transaction issues - your personal data is used by us to communicate with you in connection with the Kuna Pay services regarding administrative or account related information. For example, we will contact you to inform you of relevant security issues, updates, or other information related to transactions. You may not be aware of significant events related to your account that may have an impact on how you can use our services without such communications;
2. if it is essential for us to meet our legal obligations and to execute and enforce legal rights;
3. to identify, investigate and prevent fraud or other illegal or unauthorized operations or activities;
4. to monitor and govern the effectiveness of our business operations, for analyzing productivity and preparing internal reports;
5. to maintain, service, deliver or improve our website - personal data is used by us to ensure the proper functioning of our website and we also process your data to ensure that we can provide you with a personalized experience and implement the preferences you have requested;
6. to research and develop - we process your personal data to gain a deeper understanding of you and the way you use and interact with our site. In addition, we use this information to customize, measure and improve the content and design of our site and to create new services. Absent such processing, we may not be able to provide you with further use of our site;
7. to maintain the security, protection and integrity of our website - in order to enhance security, control and check identities or service access, combat any malware or security risks, and meet applicable security laws, we process your personal data. This data is processed by us to verify accounts and relevant activity, to find and fix violations of our Terms of Use, to conduct investigations of potentially suspicious behavior etc;
8. to participate in marketing and promotional activities -  we may send you marketing and promotional messages based on your communication preferences to let you know about relevant product and service offerings and provide you with targeted marketing. You can opt out of receiving our marketing messages at any time by contacting us at kunapay@kunapay.io.

We rely on the following legal justifications for each of the purposes for which we process information:

1. consent - we use your data in reliance on your consent;
2. contractual obligations - we rely on this justification when we process your personal data to fulfill a contractual obligation to you in order to provide our services;
3. regulatory and legal requirements - we rely on this justification whenever we use your data to comply with legal and regulatory requirements. We do so not just to comply with our legal obligations, but also as it may be in our legitimate interests to do so;
4. legal business interest - we rely on this justification in cases where we need to process your personal data to satisfy our own requirements to operate, manage and develop our business or to protect a legitimate interest that we or a third party is pursuing (as long as the balance of interests is respected);
5. legal proceedings - we rely on this justification when we need to process your data for legal advice; for any legal proceedings; or to enforce or protect legal rights in accordance with applicable data protection laws.

‍

7. Disclosure of personal data 

Your personal data may be shared with our third parties in order to carry out assignments and provide services to you on our behalf. We will only transfer your information if and only insofar as is appropriate or necessary to fulfill one or more of the purposes outlined in this Privacy Policy, and we will ensure that the transfer of such Information is limited to the minimum amount necessary. 

In particular, we may disclose your personal data to:

1. our present or future parent companies, subsidiaries, affiliates and other companies that are under common ownership or control with us or our international offices;
2. law enforcement agencies, public officials or other third parties if we are compelled to do so by subpoena, court order or other similar legal procedure; or we honestly believe that it is necessary to disclose personal data to avoid physical harm or financial loss, to report suspected illegal conduct, or to investigate breaches of any of our policies;
3. identity verification agencies to do the appropriate background checks (for instance, our trusted partner Sum and Substance Ltd (“SumSub”), which collects and stores your data on our behalf);
4. fraud or crime prevention agencies to assist in combating crimes, which include fraud, money laundering and terrorist financing;
5. service providers, advisors, consultants, subcontractors, agents, and other third parties we work with or who do work for us, as well as those who maintain our business operations ;
6. transaction processors (to provide transaction execution and functionality);
7. users of the interactive areas of the KUNA Pay website or our social media platforms, in case you choose to share or reveal your personal details on them in public, for example, your username and any content that you post;
8. third parties, agents, advisors and other service providers in relation to a reorganization, ownership change, merger or transfer of all or any part of our assets or business, either financing or participating in an acquisition, or in any other situation where disclosure or transfer may be made as one of the assets of our business;
9. those providing ancillary services in addition to the services that we provide.

Once we involve a third party to process your personal data on our behalf, a processing agreement is signed, under which the appointed third party is also obligated to comply with the GDPR.

From time to time, our website may contain links to other websites. We do not control any of these third party websites or any content posted on them. You agree that we are not responsible in any manner for such sites linked to or from our site, including but not limited to site content, policies, advertising, interruptions, products, services or activities and/or any  losses, damages, failures or problems arising from, connected to or in relation to those sites. These sites have a distinct and independent privacy policy. We recommend that you check the policies, terms and conditions of every site you visit. Our goal is to protect the integrity of our site and we are pleased to receive any feedback about the information on external sites provided on our site.

‍

8. International transfer of personal data

Our rational efforts to ensure that third parties with whom we do business are bound by the terms of this Privacy Policy or similar policies. Your information may be transmitted to or available to recipients in any country in the world. These countries may have different and possibly less rigorous standards with regard to data protection than your country. If so, we will, to the extent possible, provide adequate legal safeguards, to the best of our ability, with respect to your personal data that is transferred to such recipients. Using our services, you are consenting to the transmission of your data to other countries, including countries with data privacy and protection laws that differ from the laws in your country. We will protect and process your personal data in all such transfers as described in this Privacy Policy.

When we transfer personal data outside the EEA to a country that has not been designated by the European Commission as ensuring an adequate level of personal data protection, such transfer will be based on an agreement that covers EU requirements for the transfer of personal data outside the EEA, for example, standard contractual clauses approved by the European Commission. The European Commission approved standard contractual clauses are available here.

So, we can only transfer your personal data in the below cases:

• if the country to which we transfer your personal data ensures an acceptable level of personal data protection (as defined by the European Commission);
• if we take adequate precautions to protect your rights as a data subject.

‍

9. Security of personal data 

We develop our system taking into consideration your safety and confidentiality. Physical, electronic and procedural safeguards are applied by us in relation to the collection, retention and disclosure of your personal data. 

As a result, the steps we follow to ensure the safety and protection of your data include:

• two-factor authentication (2FA);
• pseudonymization and encryption of personal data using the TLS 1.2 standard;
• the ability to provide ongoing privacy, integrity, accessibility and stability to our processing systems and services;
• access control;
• only authorized employees have access to your personal data, and such employees are obliged to keep your information confidential.

When you create an account on our website to use our services, be sure to choose a password of appropriate length and difficulty (your password must contain: uppercase and lowercase characters, at least one special character (%/&/@), length must be 8 and more characters), do not disclose that password to any third party, and inform us immediately if you become aware of unauthorized access or use of your account. Also, we suggest using a unique password that is not used for other online accounts and to log out when you are done working on a general computer.

Notwithstanding the safeguards we take, it is essential to remember that data transfer via the Internet may not be entirely safe, and that you should take adequate precautions when transferring data to us over the Internet. Please note that even though we will do everything in our power to protect your personal data, the security of your data transmitted to our site cannot be guaranteed, and any transmission is at your own risk. After receiving your data, strict procedures and safeguards will be used to try to prevent unauthorized access.

‍

10. Advertising 

We may share your personal data with our marketing partners for purposes of targeting, modeling and/or analytics, also for marketing and advertising activities, so as to provide you with the optimal user experience. If you would like to withdraw your consent to marketing processing and newsletter, please contact us by kunapay@kunapay.io.

‍

11. Personal data retention period 

Your personal data will only be kept by us for as long as necessary to accomplish the purposes for which we collected it, including to fulfill any legal, accounting or reporting obligations, to comply with Anti-Money Laundering laws or to settle disputes and/or legal claims. This decision varies on a case-by-case basis and depends on factors such as the type of data, the reason for its collection and processing, and the applicable legal or operational requirements for retention. 

Please also note that in accordance with our legal or regulatory obligations and international data retention standards, you give us your consent and permission to store your personal data for the entire duration of the business relationship with you and for a period of five years after the termination of the business relationship.

‍

12. Changes to Privacy Policy 

This Privacy Policy will be regularly updated to be current. The date when this policy was last updated can always be found at the top of this page. When we update it, necessary steps will be taken (for example, by sending an email) to inform you, depending on the significance of the changes we make.  

The revised Privacy Policy will be considered valid when it is posted on our website. If you continue to use the Kuna Pay website and/or our services, then you consent to be bound by any such changes to the Privacy Policy. In the event that you do not agree to any changes to this Privacy Policy, please discontinue your accessing and using the Kuna Pay website and our services.

‍