K33
Privacy Policy
1. Introduction
K33 (hereinafter referred to as "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy outlines why and how we collect, process, use, disclose, and protect your Personal Data when you use our products and/or services including interacting with our website www.k33.com.
Our data processing practices are in compliance with the Norwegian Data Protection Regulation, the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.
In this Privacy Policy, the term "Personal Data" refers to any information that identifies, relates to or is associated with an individual. This includes, but is not limited to, data referred to as "personally identifiable information," "personal information," and "personal data" as defined under applicable laws, rules, and regulations. Personal Data excludes anonymized and/or aggregated data that cannot be used to identify individual users.
It is important that you read this Privacy Policy together with any other notice or policy we may provide on specific occasions when we are collecting or processing Personal Data about you so that you are fully aware of why and how we are using your Personal Data.
By using our products and/or services including our website, you agree to the collection and processing of your Personal Data in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please refrain from using our products and/or services.
2. Data Controller
We control the ways of collecting your Personal Data, and determine the goals for which we use such Personal Data. K33 offers different products and services that may facilitate the collection of your Personal Data, details of which can be found here: https://k33.com/.
Therefore, K33 is the data controller within the meaning of General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as “GDPR”) and other applicable laws pertaining to data protection. We are responsible for the processing of your Personal Data and ensuring that your Personal Data is processed in accordance with the applicable regulations. The data controller’s information are as follows:
K33
Norway
3. Information We Collect
Depending on your use of our products and/or services, we may collect, use, store and transfer your Personal Data. We may collect Personal Data from you in order to meet regulatory obligations around Know-Your-Customer (“KYC”) and Anti-Money Laundering (“AML”) requirements. Category of Personal Data that we may collect from you include but not limited to the following:
- Basic customer information such as name, username or similar identifier, residential address, date of birth, nationality, country of residence, gender, marital status, title, occupation, phone number, email address etc.
- Additional identification information such as billing address, utility bills, government-issued identity documents e.g. passport, driver’s license etc, social security number, employment information, proof of residency or other documents requested by our compliance department. If you are an institution, we collect personal identifiable information for all material beneficial owners of your business.
- Electronic Identification Verification (“eIDV”) Information such as biometric information generated based on photos or videos you provide in order for us to verify your identity.
- Financial information such as account number, trading and investment experience, tax identification number, account number, bank and account statements, payment card details, transaction history, trading data, financial status e.g. information about the transactions you make using our services, the purpose of the transactions, information on sender and receiver of funds, ultimate beneficial owner, Source of Wealth (SoW), Source of Funds (SoF), income/net assets/wealth verification statements, payment card details etc.
- All wallet information, including wallet details provided by you for processing withdrawals requests will be stored in accordance with our data protection policies and applicable legal requirements.
- Transaction information such as information about the transactions such as the name of the sender, the name of the recipient, distributed ledger address, the amount, currency preferences, payment method, date, and/or timestamps etc.
- Additional information you submit to us through communications e.g. survey responses, information (including where you are notified that calls are recorded) which you have provided to our client manager(s), as well as communications with interfaces such as our chatbots.
3.1. Information we collect which is required by applicable law, rule or regulation.
We may collect information from you in order to meet regulatory obligations around KYC and AML requirements. We may collect the following information from you:
- Full name;
- Residential address including country of residence;
- Contact details (telephone number, email address);
- Date and place of birth;
- Your status as a politically exposed person;
- A static image and a facial motion capture to confirm authenticity and prevent fraud;
- Source of funds/wealth & proof of address;
- Passport and/or national driver’s license or government-issued identification card to verify your identity;
- Transaction history and account balances in connection with your use of certain services of K33.
3.2. Other information that we collect
We also automatically collect certain computer, device, and browsing information when you access our platform or use any of our services:
- We may collect certain information automatically when you use our services, such as your internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, mobile advertising and other unique identifiers, browser or device information, location information (including precise location information and/or approximate location derived from IP address), and internet service provider. We may also automatically collect information regarding your use of our platform and/or services, such as pages that you visit before, during and after using our platform and/or services, information about the links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our services.
- Device Information: We collect information about the device you use to access your account, including the hardware model, operating system and version, and unique device identifiers, but this information is anonymised and not tied to any particular person.
4. Cookies
We collect data through cookies to deliver our services, improve the content on our website for you, and promote relevant services through third parties. You have the option to opt-out.
A cookie is a text-only file that is placed on your computer via the internet to recognize when you’re visiting a particular website. They’re widely used to make websites work more efficiently, as well as to provide analytics to the owner(s) of the site.
Cookies enable us to understand how many people visit our site and how they use it. The information we gather using cookies is generic, and we have no access to data regarding individual users. Data gathered includes how users arrive on our website, how they navigate between pages, and what device they are using.
We then use Google Analytics to understand the data and to improve the overall experience of our website.
We may use the following tools:
- Google Ads, Facebook Ads, LinkedIn Ads, SnapChat, X (formerly Twitter) ads for advertising;
- Google Tag Manager for tracking.
By using our website and viewing our contents, you accept our Cookies Policy
The cookies have a lifetime not exceeding two years from the moment you visited our website. You may delete all our cookies in the “Settings” menu of your browser. Our cookies may also be disabled by visiting the following link: https://tools.google.com/dlpage/gaoptout.
5. How we collect your Personal Data?
We collect, store, and use Personal Data for different reasons, depending on who you are and how the Personal Data is collected, for example, when you provide information directly to us such as when applying to use our product and/or services, you create an account or fill out a form to download a document from our website, make use of any of our platforms, subscribe to a research newsletter, send us an email, chat with us, or otherwise contact us; personal information is collected automatically when you view the contents in our emails, visit our websites including through cookies.
Additionally, when we collect Personal Data, we may use it for some or all of the following legal grounds:
- Performance of Contract: To provide you with our services, process your transactions and manage your accounts. We will process your Personal Data only for the purpose(s) for which it has been provided to us.
- Compliance with legal obligations: To fulfil KYC (Know Your Customer) requirements, to verify your identity in accordance with the applicable laws, regulations and AML policy, as well as address other law enforcement needs, legal and regulatory requirements. We also may share your Personal Data with other financial institutions and with tax authorities if such actions are required from us due to any applicable legislation.
- Legitimate interest: To detect, investigate and prevent fraudulent transactions or unauthorized or illegal activities; or protect our rights and property.
- To help us respond to your customer service requests and support needs, answer your inquiries or respond to a communication from you;
- Contact you about products and/or services. The email address you provide may be used to communicate information and updates related to your use of our products and/or services;
- Consent: For some processing activities, we require your prior explicit consent. This applies for example to some of our direct marketing activities which fall under the scope of the GDPR. You will always be prompted to take clear, affirmative action so that we can ensure that you agree with the processing of your Personal Data. If you have given us your consent for processing operations, you may always change your mind, and withdraw your consent at any time and easily; all you need to do is to send us an email at the following address: privacy@k33.com.
We may process your Personal Data under multiple legal grounds, depending on the specific purposes for which the data is used. If you would like further details regarding the legal basis relied upon in processing your Personal Data, please feel free contact us at privacy@k33.com.
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at privacy@k33.com.
We will process your Personal Data solely for the purposes for which it was originally collected, unless we reasonably determine there is a lawful basis to process it for a new purpose that is compatible with the original intent. If you would like an explanation of how the new purpose aligns with the original one, please reach out to us at privacy@k33.com.
If we need to process your Personal Data for an unrelated purpose, we will notify you and provide an explanation of the legal basis that allows us to do so.
Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
If the collection of Personal Data is required by law or is necessary to fulfill the terms of a contract with you, and you do not provide this data upon request, we may be unable to perform or proceed with the contract (for example, to provide you with our products and/or services). In such circumstances, we may need to cancel the product or service provided to you. If this becomes necessary, we will inform you at the earliest opportunity.
6. For what purpose do we collect your Personal Data?
We collect your Personal Data to:
- Provide our services (including customer support);
- Process transactions and send notices about your transactions;
- Enforce our contractual terms.
- Resolve disputes, collect fees, and troubleshoot problems;
- Comply with applicable laws and regulations;
- Establish, exercise and defend legal claims;
- Monitor and report compliance issues;
- Perform risk management, including comparing information for accuracy and verify it with third parties and protect against, identify and prevent fraud and other prohibited or illegal activity, claims and other liabilities; and
- Provide you with information about our products and services, including sending research newsletters, and also deliver targeted marketing, service update notices, and promotional offers based on your communication preferences, and measure the effectiveness of it. We may use your name, email address, job title, and phone number. This processing of Personal Data is based on your consent.
- To analyse user behavior and user statistics on our products, services and applications, we may collect your name, email address, user identifiers, IP address, location, browser (type and version), equipment (e.g. Mobile OS/Device Type), hardware (processor, RAM, bandwidth, etc.), events, duration of sessions, what features are being used, what pages is looked at, search queries, country and other data related to your registered user. This also includes that we may track your behavior on our products and applications. In this regard, we may use tools delivered by third parties for analytical purposes and behavioral statistics. We also have in place ticketing systems and in-app chat systems that store your email address, how often you have logged into these applications and what pages you have accessed. Our processing of Personal Data is based on a balancing of interests, and collection and use of this Personal Data is necessary to improve our products and applications and to provide you with tailored service and support at your request.
- Information about how our services are performing when you use them, i.e. service-related diagnostic and performance information, including timestamps, crash data, website performance logs, and error messages or reports and for the purposes of further development or improvement of our products and services based on feedback from customers or partners, or for documentation purposes, we may record meetings with customers and store such video and/or audio recordings. We will always inform you that we will record a meeting in advance of the meeting, and we encourage you to let us know if you do not want us to record the meeting.
- We also collect, use and share aggregated data such as statistical or demographic data for reporting purposes as well as for product and service development and improvement. Aggregated data could be derived from your Personal Data but is not considered Personal Data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Privacy Policy.
- We do not collect any special categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, criminal convictions about offences, information about your health, and genetic and biometric data).
- We also obtain information about you, including social identification data, from third parties or publicly available sources. These sources may include:
- Government agencies such as Skatteetaten, Folkeregister or other similar government agencies
- fraud and crime prevention agencies
- public blockchain
- publicly available information on the Internet (websites, articles etc.)
7. Third-Party Links
Using our website, products and/or services may result in links to third-party websites, plug-ins, spam detectors and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites or applications and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit or service provider you encounter.
8. Data Sharing and Disclosure
8.1. Disclosures to third parties
In processing your transactions and by using our products and/or services, we may share your Personal Data with our third party service providers who help with our business operations and are required to provide certain services to you; and/or in connection with our efforts to prevent and investigate fraudulent or other criminal activity.
Your Personal Data will not be shared with any third parties without your consent, except to provide services or as required by law. Therefore, by using our products and/or services you consent to the disclosure of your Personal Data as described in this Privacy Policy.
Our third-party service providers are strictly prohibited from using your Personal Data for their own purposes. They are authorized to process your Personal Data only for the specified purposes and in accordance with our instructions, except where otherwise required or permitted by law.
K33’s third-party service providers are bound by Data Processing Agreements (DPAs) that contractually require them to protect your Personal Data and limit its use strictly to the purposes outlined in this Privacy Policy. These DPAs impose stringent confidentiality and security obligations, ensuring that third parties process your data solely in accordance with our instructions and only to the extent necessary to perform their services. Additionally, these agreements obligate third parties to maintain data protection standards that are no less stringent than those outlined in this Privacy Policy and that meet or exceed the requirements set forth by applicable data protection laws.
8.2. Disclosures to legal authorities
We disclose Personal Data to authorities to the extent we are under statutory obligation to do so. We may share your Personal Data with tax authorities, law enforcement, data protection authorities, government officials, regulatory agencies, our banks, authorities in relevant countries, and other third parties when:
- Compelled by subpoena, court order, or other legal procedure including tax purposes.
- We believe that the disclosure is necessary to prevent physical harm or financial loss.
- Disclosure is necessary to report suspected illegal activity.
- Disclosure is necessary to investigate violations of this Privacy Policy or any of our agreements with you.
8.3. Third country transfers
In some cases, we may transfer Personal Data to third party service providers in so-called third countries (countries outside of the European Economic Area). Such transfers are undertaken in accordance with our legal and regulatory obligations and are performed only via protected channels. We ensure that a similar degree of protection is afforded to such Personal Data. Therefore, such transfers can be made if any of the following conditions apply;
- the EU Commission has decided that there is an adequate level of protection in the country in question, or
- other appropriate safeguards have been taken, for example the use of the Standard Contractual Clauses (EU model-clauses) approved by the EU Commission or the data processor has valid Binding Corporate Rules (BCR) in place, or
- that there are exceptions in special situations, such as to fulfil a contract with you or your consent to the specific transfer.
8.4. Other circumstances for disclosure of personal information
We also can disclose your Personal Data in the following circumstances:
- with our current or future parent companies, affiliates, subsidiaries and with other companies under common control or ownership with us or our offices internationally. We ensure that listed parties will be bound by terms not less protective those described in this Privacy Policy, or those we are subject to under applicable data protection laws;
- if the sharing of Personal Data is necessary for protection of our rights and property, or rights and property of the above listed current or future parent companies, affiliates, subsidiaries and with other companies under common control or ownership with us or our offices;
9. Storing of Personal Data
We will only retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal obligations including AML Regulation, accounting, reporting and regulatory obligations or to resolve disputes. While retention requirements vary by jurisdiction, information about our typical retention periods for different aspects of your Personal Data are described below.
- Personal Data collected to comply with our legal obligations under financial or Anti-Money Laundering Regulations may be retained after account closure for as long as required under such laws.
- Personal Data such as your name, email address and telephone number collected for marketing purposes is retained on an ongoing basis until you unsubscribe.
We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
When Personal Data is no longer necessary for the purpose for which it was collected, we will remove any details that identify you or we will securely destroy the records, where permissible. However, we may need to maintain records for a significant period of time (after you cease using our products and/or services) as mandated by regulation. For example, where we are subject to certain Anti-Money Laundering laws, we may be required to retain the record for as long as it is prescribed by the applicable regulation after our business relationship with you has ended.
10. Your Rights
Under GDPR, you have statutory rights related to your Personal Data. Please note that these rights are not absolute and may be subject to certain conditions.
You have the right to request additional information from us about how we process your Personal Data. You may also request access to all the Personal Data we have stored about you or object to the processing of your Personal Data where permissible.
Your rights in relation to Personal Data are as follows:
- Right to withdraw consent: Insofar as our processing of your Personal Data is based on your consent, you have the right to withdraw consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
- Right of access: You have the right to request access to your Personal Data and receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
- Right to rectification: You have the right to request rectification of your Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Right to erasure: You have the right to request the erasure of your Personal Data. This right allows you to ask us to delete or remove your Personal Data in certain circumstances, particularly where we no longer have a legal or legitimate basis for processing it. Please note, however, that we may not be able to fulfill your erasure request in all cases due to specific legal obligations or other permissible reasons. If such exceptions apply, we will inform you of the relevant reasons at the time of your request.
- Right to object to processing: You have the right to object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Right to restriction: You have the right to request restriction of processing of your Personal Data in certain circumstances.
- Right to data portability: In some cases, you have the right to obtain all of your Personal Data we store in a machine readable format and request to transfer your Personal Data to you or to a third party of your choice.
You are able to exercise all the above mentioned rights, if this does not prevent us from providing our products and/or services to you; contradict the legal requirements in relation to the prevention of money laundering and terrorist financing laws, our record keeping obligations and other applicable laws and regulations etc.
To exercise these rights, contact us at privacy@k33.com. We will respond to your inquiry as soon as possible, and at the latest within 30 days. In addition, if you no longer like to be contacted by K33 or through our third party service provider, please contact us on the above mentioned email.
If you wish to exercise your rights, we will require that you confirm your identity by providing additional information. We do this to ensure that third parties are not given access to Personal Data.
11. Automated Decision-Making and Profiling
We may employ automated decision-making processes in specific areas, such as account verification and fraud prevention. These automated processes are designed to fulfill our legal obligations and ensure the security and integrity of our platform. Such processing is carried out in accordance with GDPR requirements, including where it is necessary to safeguard legitimate interests, meet regulatory standards, or fulfill contractual obligations.
In cases where automated decision-making or profiling has a significant effect on you, you have rights under the GDPR to understand the logic involved, request human intervention, and contest the decision. Should you have any concerns or wish to object to automated decision-making related to your account, please contact us, and we will address your inquiry promptly.
12. Complaints
If you believe that our collection, storage and use of Personal Data does not comply with our Privacy Policy or does not comply with applicable privacy law, you may reach out to us on privacy@k33.com
You also have the right to make a complaint to the local data protection authority here:
Norwegian Data Protection Authority (Datatilsynet)
PO Box 458 Centrum
0105 Oslo
Phone: +47 22 39 69 00
13. Changes to our Privacy Policy
We may amend this Privacy Policy with immediate effect from time to time in order to comply with law or to meet our changing business requirements. Any such changes will be posted here and, where appropriate, notified to you in writing. We advise you to review this page regularly to see if there have been any updates or changes.
Didn’t find the answer you are looking for? Contact us at contact@k33.com.