Privacy Policy
- You approach us to provide you with our cryptocurrency payment processing services, cryptocurrency sale and purchase services and/or cryptocurrency wallet services (the "Services");
- You receive the requested Services; and/or
- You visit and use our website arrows.im (the "Website"), regardless of where you visit and use it from.
|
Name of the company: |
Arrows Global Limited |
|
Postal address: |
STELLA MARIS, SUMMERHILL, DOUGLAS, IM2 4PG, Isle of Man |
|
Email address: |
[email protected] |
- Website visitors: individuals visiting our website;
- Visitors at our premises: individuals visiting our premises for any reason, inclusive of meetings, scheduled maintenance or the provision of services;
- Third parties generally: this is a generic category of data subjects that typically includes individuals with whom we do not have a direct contractual relationship, such as prospective individual service providers and persons contacting Arrows Global with enquiries or for any other reason;
- Prospective merchants: individuals who have expressed an interest in engaging our Services;
- Individual shareholders, company officers and/or executives of prospective merchants: individuals who are generally owners and/or legal and judicial representatives of a prospective merchant when the latter is a legal person.
- Customers and suppliers of our merchants: individuals being customers of our merchants, through whom they make use of the Services.
- Individual shareholders, company officers and/or executives of legal persons that are customers or suppliers of our merchants: individuals who are generally owners and/or legal and judicial representatives of legal persons, the latter being customers or suppliers of our merchants, through whom such legal persons make use of the Services.
- Identification Data: includes name, surname, title, date of birth, username or similar identifier (with regards to the Website), identification documents and details, such as identity card and passport information. We may also request additional information in order to evidence your identity, particularly if we are required by law to do so.
- Contact Data: includes postal address, email address and telephone and/or mobile number.
- Compliance Data (AML, Combatting Funding of Terrorism ("CFT") and Know-Your-Client ("KYC")): includes Identification Data and Contact Data, and shall also cover, as necessary, proof of residence, such as a utility bill, professional references, tax domicile information, financial status information, such as bank statements, source of wealth and source of funds, KYC (database) checks and any other information or documentation which may be required from time to time by the applicable rules and regulations. In carrying out its KYC checks, Arrows Global may also come across criminal record and conviction information, which it shall only process in strict accordance with the law.
- Financial Data: includes bank account and e-wallet details, as well as any relevant taxation data (this includes any applicable income tax / VAT information).
- Investment Data: includes information about your investment objectives, experience as well as prior investments.
- Transactional Data: includes information about the transactions carried out by end users of our customers on or via our electronic platform.
- Cookie Data: includes information collected via cookies used on our website, as better explained in our Cookie Policy.
We do not collect any sensitive personal data, such us ethnic origin, religious beliefs, or sexual orientation, about you.
Where we need to collect personal data by law, or pursuant to our agreement, and you fail to provide that data when requested, we may not be able to provide you with your requested Services. In certain cases, particularly where it relates to Compliance Data, we may even need to exercise our prerogative to terminate the Services, or otherwise decline to enter into professional relationship with you (as applicable). We will notify you if this is the case at the time.
- Website visitors: we collect Identification Data and/or Contact Data as submitted to us by yourself if you decide to utilise the 'Contact Us' form on and through our Website. Furthermore, and upon accessing our Website, Cookie Data is processed by ourselves and by our third party processors throughout the duration of your session. More information on the use of cookies on our Website is found in our Cookie Policy.
- Visitors at our premises: upon entering into our Premises, our front desk may manually collect the Identification Data and/or Contact Data that would be deemed proportionate and necessary in the circumstances. We may also hold images of you captured by our CCTV cameras.
-
Third parties generally: in each of the following categories, Identification Data and Contact Data are usually collected through direct interaction with the data subject:
- Prospective service providers: when you, as a prospective individual service provider, express an interest in doing business with us, and during the course of our negotiations or dealings;
- Persons contacting us: upon contacting us by means other than our Website, such as through a telephone enquiry or written enquiry through an instant messaging application; and
- Representatives/agents: when an individual has been sent to deal with us on behalf of another entity, be it another individual or a third party. For the purposes of this Policy, individual shareholders, company officers and/ or executives of prospective merchants that are legal persons, such as companies, comprise a separate category of data subjects, and shall accordingly be treated as such.
-
Prospective merchants: we collect your personal data when you express an interest in engaging our Services, and this is typically done through:
- Direct interactions, through meetings, calls, email correspondence or by other means, usually when you submit the relevant Identification Data, Contact Data, Compliance Data, Financial Data and Investment Data to us; and
- Third parties and other available sources, such as company registers of other jurisdictions, and from electronic data searches, online search tools, anti-fraud databases and other third-party databases, sanctions lists and general searches carried out via online search engines.
-
Individual shareholders, company officers and/or executives of prospective merchants: we collect your personal data when the prospective merchant, of which you are a shareholder, company officer or executive, expresses an interest in engaging our Services, and this is typically done through:
- Direct interactions, through meetings, calls, email correspondence or by other means, usually when you submit the relevant Identification Data, Contact Data and Compliance Data to us; and
- Third parties and other available sources, such as the company registers of other jurisdictions, and from electronic data searches, online search tools, anti-fraud databases and other third-party databases, sanctions lists and general searches carried out via online search engines.
- Customers and suppliers of our merchants: we collect your personal data when a transaction made by yourself, through our merchant, over our electronic platform is deemed to present a higher risk, and such information is typically collected through our merchant.
- Individual shareholders, company officers and/or executives of legal persons that are customers or suppliers of our merchants: we collect your personal data when a transaction made by the legal person of which you are an individual shareholder, company officer or executive, through our merchant (of which said legal person is a customer or supplier), over our electronic platform is deemed to present a higher risk, and such information is typically collected through our merchant.
- where you wish to formally engage our Services;
- where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
- where we need to comply with our legal and professional obligations to third parties.
DATA SUBJECT |
DATA |
LEGAL BASIS IN TERMS OF GDPR |
PURPOSE |
|---|---|---|---|
| Website Visitors |
Identification Data Contact Data |
a. Protection of our legitimate interests (or those of a third party), such that we may require this information for security, administrative and logistical purposes in the general course of our business, as well as to handle any relevant issues that may arise on a day-to-day basis. Legitimate interests shall be understood as our interests to conduct and manage our business affairs appropriately, to protect our reputation, and to provide our clients and website users with a professional and secure experience. We make sure we consider and balance any potential impact on your rights before we process your personal data for our legitimate interests. Unless you have consented or it is otherwise required or permitted by law, we do not use your personal data for activities where our interests are overridden by the impact on you.] |
We may collect your personal data in order to stay organised and be in a position to respond to your queries with the intention of growing our customer base and network. |
|
b. Consent. |
We will, if you so desire, and based on the information you provide, respond to your queries and/ or provide you with further information about our Services. |
||
| Website Visitors |
Cookie Data |
a. Protection of our legitimate interests, such that we require this information in order for our website to function securely. |
Please refer to our Cookie Policy for further information. |
| Visitors at our Premises |
Identification Data Contact Data |
a. Protection of our legitimate interests (or those of a third party), such that we may require this information for security, administrative and logistical purposes in the general course of our business, as well as to handle any relevant issues that may arise on a day-to-day basis. |
In this regard: - We may keep and update a visitor log which identifies the people that have visited our premises; and - We will also be positioned to defend legal proceedings, pursue any available remedies, or limit the damages that we may sustain. |
|
b. For reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued. |
We strive to ensure that our premises, as well as our data, are kept secure. Aside from keeping a visitor log, information we record about visitors may be transmitted to law enforcement and other authorities should the need arise. |
||
|
c. Consent. |
We will, if you so desire, and based on the information you provide, respond to your queries and/ or provide you with further information about our Services. |
||
| Third parties generally |
Identification Data Contact Data |
a. The identification of the specific legal ground would be dependent on the case at hand. However, the more common scenarios of data Processing in this case are supported by the following legal grounds: (a) Adherence to our legal obligations generally and as applicable; (b) Eventual performance of a contract with you or a person you represent; (c) Protection of our legitimate interests (or those of a third party), such that we may require this information for security, administrative and logistical purposes in the general course of our business, as well as to handle any relevant issues that may arise on a day-to-day basis. (d) Consent. |
The specific purpose is established on a case-by-case basis. |
| Prospective merchants |
Identification, Contact, Compliance, Financial and Investment Data |
a. Adherence to our legal obligations, particularly as deriving from the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019 ('the 2019 Code'), and the Proceeds of Crime Act 2008 ("POCA"). |
In this regard: - We will verify your identity through our KYC processes; - We will be able to determine if we may enter into a contractual relationship with you; - We will be able to detect, prevent, and/or report fraud or any other criminal activity that comes to our knowledge; and - We will be able to fulfil any external mandatory reporting requirements that we may have with the Isle of Man Financial Services Authority (the "IOMFSA"). |
|
b. Adherence to our legal obligations, as primarily deriving from the Designated Businesses (Registration & Oversight) Act 2015 (the "Designated Business Act"). |
In this regard: - Generally, we will be able to fulfil our legal obligations as a entity registered under the Designated Business Act; |
||
|
c. Protection of our legitimate interests (or those of a third party), such that we may require this information for administrative and logistical purposes in the general course of our business, as well as to handle any relevant issues that may arise on a day-to-day basis. |
In this regard:
- We will require this information to eventually enter into a contract with you if we are to provide our Services; - We will develop and improve the manners in which we deal with financial crime; - We will be able to assist and cooperate in any criminal or regulatory investigations as may be required of us; and - We will also be positioned to defend legal proceedings, pursue any available remedies or limit the damages that we may sustain |
||
| Individual Shareholders, Company Officers and/ or Executives of Prospective Merchants |
Identification Data Contact Data Compliance Data Investment Data |
a. Adherence to our legal obligations, particularly as deriving from the 2019 Code. |
In this regard: - We will verify your identity through our KYC processes; - We will be able to determine if we may enter into a contractual relationship with the entity you represent (for example, if we are processing Compliance Data about a director who is representing a prospective corporate customer); - We will be able to detect, prevent, and/or report fraud or any other criminal activity that comes to our knowledge; and - We will be able to fulfil any external mandatory reporting requirements that we may have with the FSA or FIU. |
|
b. Adherence to our legal obligations, as deriving from the Designated Business Act. |
In this regard: - Generally, we will be able to fulfil our legal obligations as a registered entity under the Designated Business Act; |
||
|
c. Protection of our legitimate interests (or those of a third party), such that we may require this information for administrative and logistical purposes in the general course of our business, as well as to handle any relevant issues that may arise on a day-to-day basis. |
In this regard: - We will require this information to eventually enter into a contract with the entity you represent if we are to provide the Arrows Global Services; - We will develop and improve the manners in which we deal with financial crime; - We will be able to assist and cooperate in any criminal or regulatory investigations, as may be required of us; and - We will also be positioned to defend legal proceedings, pursue any available remedies or limit the damages that we may sustain. |
||
| Customers and suppliers of our merchants |
Compliance, Financial and Transactional Data |
a. Adherence to our legal obligations, particularly as deriving from the 2019 Code. |
We will require this information in order to investigate high risk transactions made by end users of our customers over our electronic platform. |
| Individual Shareholders, Company Officers and/ or Executives of customers or suppliers of our merchants that are legal persons |
Compliance Data |
a. Adherence to our legal obligations, particularly as deriving from the 2019 Code. |
We will require this information in order to investigate high-risk transactions made by end users of our customers over our electronic platform. |
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Website may become inaccessible or not function properly. This Policy should be read in conjunction with our Cookie Policy.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose, or we are obliged to process your data by applicable laws or court/enforceable orders.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without the need to obtain your consent, in compliance with the above rules, where this is required or permitted by law.
-
Information security means, such as:
- Appropriate firewalls and security software, inclusive of anti-malware and anti-virus software;
- data segregation mechanisms and user access control;
- robust authentication measures;
- encryption;
- source code security;
- pseudonymisation of data;
- appropriate data backup measures;
- wi-fi network segregation, allowing for a separate 'Guest' network;
- mobile device management solutions; and
- Physical security means, such as fire alarms, implemented at our premises.
In addition, we limit access to your personal data to those employees, and other third parties who have a business need to know. These persons will only process your personal data on our instructions and are subject to a duty of confidentiality.
| IT development services |
Service providers who help us in developing software necessary for the running of our business. |
| IT backup and cloud services |
Service providers who assist us in relation to backups for business continuity purposes so that your personal data is not lost. |
| Administration |
Service providers who provide administrative assistance in order to enable us to better organise and streamline our internal administrative processes. Within this category, we are also considering service providers that will assist us in our onboarding process, such as fraud prevention and identity verification agencies and service providers, that shall undertake required due diligence and anti-fraud checks via the relevant databases. |
| Third party consultants and professional advisors |
Service providers who assist us in various matters, including lawyers, accountants, insurers, auditors and security consultants. |
| Regulators, courts, law enforcement and other authorities |
Entities that may require the disclosure of processing activities in certain circumstances, such as the FIU, the FSA and the executive police. |
We require all third parties with whom we share personal data to respect the security of such personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our documented instructions.
- for the performance of contractual or pre-contractual obligations between you and us;
- for the purpose of IT software support/security;
- for adherence with our legal and/ or regulatory obligations;
- for the establishment, exercise or defence of legal claims; or
- for any other reason where any such transfer would be permitted in terms of law.
- ACCESS: you have the right to access your personal data and request a copy thereof.
- RECTIFICATION: you have the right to rectify any incorrect personal data that we may hold about you.
- ERASURE: you have the right to be forgotten, which enables you to ask us to delete your personal data where there is no good reason for us continuing to process it. Note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, and if we are so permitted, at the time of your request. If you opt to exercise this right, we may not always be able to continue our relationship with you or continue providing our Services to you.
- RESTRICTIONS ON PROCESSING: you have the right to request the restriction of our processing. This can be done in the following cases: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. If you opt to exercise this right, we may not always be able to continue our relationship with you or continue providing our Services to you.
- PORTABILITY: you have the right to data portability. Your data may be requested in a machine-readable format (for example, in the form of a spreadsheet or a '.csv' file) and you may also ask that your data be transferred directly to another person or service provider. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- OBJECTIONS TO PROCESSING: you may object to the processing of your data where we are relying on legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- WITHDRAWAL OF CONSENT: if you have provided consent for the processing of your data you have the right, in certain circumstances, to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn. Any processing activities that are not based on your consent will remain unaffected.
- AUTOMATED DECISION-MAKING AND PROFILING: you shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Note that we do not exercise decision-making and profiling in an automated manner.
No fee will be charged to access your personal data (or to exercise any of the other rights mentioned above). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
Please note that none of these data subject rights are absolute and must generally be weighed against our own legal obligations and legitimate interests. If we are permitted, and if a decision is taken to override your data subject request, we will inform you.
- Make any enquiry regarding your personal data;
- Have your personal data corrected; or
- Request access to your personal data,
| Postal address: |
STELLA MARIS, SUMMERHILL, DOUGLAS, IM2 4PG, Isle of Man |
| Email address: |
If however you are not satisfied by this, you may file a complaint with the data protection supervisory authority in the jurisdiction where you are based, or to Isle of Man Information Commissioner: