Privacy Notice

We, nbnq swiss ag, Dammstrasse 16, 6300 Zug, Switzerland ("nbnq", "we", "us" or "our"), are responsible for the processing of personal data described in this Data Protection and Privacy Notice. This Notice explains how nbnq processes personal data in connection with our website https://nbnq.ch/, any nbnq mobile application or digital platform, the onboarding process, prospective and existing customer relationships, the products and services provided or facilitated by nbnq, communications withus and other interactions connected with our business activities.

This Notice applies in particular to website visitors, prospective and existing customers, authorisedrepresentatives, directors, shareholders, beneficial owners, controlling persons, signatories, counterparties, payment senders and recipients, and any other natural persons whose personal data is processed in connection with nbnq. Additional product-specific, contractual or regulatory notices may supplement this Notice where necessary.

The current version of this Data Protection and Privacy Notice is freely accessible at https://nbnq.ch/. It is provided for transparency and does not itself constitute consent to the processing of personal data. Where applicable law requires consent for a specific processing activity, nbnq will obtain such consent separately through an appropriate and documented mechanism. nbnq may revise this Notice from time to time, and the current version and its effective date will be made available on the website or the nbnq platform.

In the event of any inconsistency between translations, the English-language version is intended to prevail to the extent permitted by applicable law. This does not restrict any mandatory rights available to an individual under the data protection law applicable to the relevant processing activity. nbnq primarily processes personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the Swiss Data Protection Ordinance (DPO). Where a particular processing activity falls within the territorial or substantive scope of the European General Data Protection Regulation (GDPR) or another applicable data protection law, nbnq also complies with the relevant requirements of that law.

Personal Data and Sources of Information

Personal data means any information relating to an identified or identifiable natural person. This may include, for example, a person's name, address, telephone number, email address, date and place of birth, nationality, identification-document information, signature, IP address, device information, bank or payment details, wallet address, transaction data, tax information or information concerning that person's role in a company or legal arrangement. Depending on the relevant processing activity, nbnq may also process sensitive personal data, including biometric or facial information used for identity verification and information concerning criminal, administrative, regulatory or judicial proceedings.

Personal data is not collected only when it is actively submitted by the individual. nbnq may obtain personal data directly from you or from a person acting on your behalf; automatically when you use our website, application, platform or systems; from public registers, official databases and other publicly available sources; and from third parties where relevant and permitted by law. Such third parties may include banks, payment institutions, card issuers, custody and wallet providers, crypto exchanges, liquidity providers, identity-verification and KYC/KYB providers, sanctions and adverse-media screening providers, blockchain analytics providers, counterparties, professional advisers and competent authorities.

How We Collect and Process Personal Data

Depending on the nature of the relationship, nbnq may process identity and contact data; corporate, ownership and authorisation information; KYC and KYB documentation; information on beneficial owners and controlling persons; source-of-funds and source-of-wealth information; sanctions, PEP and adverse- media screening results; tax residence, TIN, CRS and FATCA information; bank-account, IBAN, card and payment data; custodial-wallet information, wallet addresses and blockchain transaction data; device, authentication, IP and geolocation data; communications, recordings and customer-support information; and marketing or communication preferences.

nbnq processes this information in order to operate and secure its website, application and platform; respond to inquiries; assess customer eligibility; conduct onboarding, identification, KYC, KYB and enhanced due diligence; establish, administer and terminate customer relationships; provide or facilitate payment, card, foreign-exchange, crypto-exchange, transfer and custodial-wallet services; execute and document customer instructions; conduct sanctions, PEP, fraud, adverse-media, wallet and transaction screening; comply with AML, CFT, Travel Rule, sanctions, tax, CRS, FATCA, record keeping and other legal or regulatory requirements; protect nbnq, its customers and third parties against fraud, cybercrime, misuse and unauthorized access; investigate complaints or suspicious activity; respond to authorities; maintain audit trails; and establish, exercise or defend legal claims.

nbnq may also use personal data to maintain and improve its products, services, systems and customer experience, to conduct internal statistical analysis and, where legally permitted, to send newsletters, surveys, service information or other commercial communications. Where consent is required for marketing, profiling or another specific activity, it will be obtained separately. A person may object to direct marketing or withdraw the relevant consent at any time.

nbnq regards compliance with data protection requirements as an integral part of its responsible handling of personal data. nbnq seeks to process only the data that is relevant and proportionate for the applicable purpose, while maintaining the security, traceability and regulatory documentation required for its services.

Log Files

When you visit our website or use an nbnq application or platform, information is automatically transmitted by the browser, device or application to the relevant server and may be temporarily stored in system or log files. This information may include the IP address, date and time of access, the name and URL of the resource accessed, the referring website, browser and operating-system information, device information, access-provider information, login and authentication events and other technical data generated in connection with the session.

This information is processed in order to establish and maintain the connection, operate the relevant service, protect system security and stability, diagnose errors, prevent misuse, investigate incidents and improve the performance of our internet and platform services. Where the GDPR applies, such processing may be based on nbnq's legitimate interests in operating secure and reliable systems, unless another legal basis is more appropriate.

An IP address and related log information may constitute personal data. nbnq may analyse such information where there is an attack on its infrastructure, suspected unauthorized or improper use, a need to investigate or defend a legal claim, or a requirement to support criminal, civil, regulatory or internal proceedings.

Tracking Tools

nbnq may use cookies and similar technologies to operate its website, application and platform, maintain security and authentication, remember user preferences and understand how the relevant services are used. Technologies that are strictly necessary for the requested service may be used without optional consent where permitted. Optional analytics or marketing technologies are activated in accordance with the cookie settings made available to the user and, where required by applicable law, only after the relevant consent has been obtained.

Google Analytics

Where enabled, nbnq uses Google Analytics 4, a web-analytics service provided by Google Ireland Limited and other companies within the Google group. Google Analytics uses cookies and similar technologies to generate information concerning the use of the website, including navigation paths, page and session duration, the page from which a visitor leaves, approximate geographical information, device and browser characteristics, the referring URL, timestamps and whether a visitor is new or returning.

The information is used to evaluate website usage, prepare reports, identify technical or usability issues and improve the website. Google states that IP addresses of users in Switzerland and the EEA are used for geolocation and are not logged or stored by Google Analytics. Information may nevertheless be processed by Google group companies or service providers in other countries, including the United States, subject to the safeguards described under International Data Transfers below. Users may control optional analytics through the cookie settings made available on the website and may also use the controls provided by Google for its analytics services.

Google Maps

Where a map or geographical function is displayed, nbnq may use the Google Maps API provided by Google Ireland Limited and other companies within the Google group. When the map function is activated, technical information such as the IP address, device information and information about the page from which the map was accessed may be transmitted to Google. Where required by applicable law, the function will be activated only after the relevant cookie or content setting has been selected. Users who do not activate the map function may be unable to use the corresponding geographical display.

Social Media Links

The nbnq website may contain links to nbnq profiles on LinkedIn or other social-media platforms actually displayed on the website. Ordinary links do not establish a connection with the relevant social-media provider until the link is selected. Once a link is opened, the provider may receive information such as the IP address, device information and the fact that the link was accessed from the nbnq website. If the user is logged into the relevant platform, the provider may associate the visit with the user's account in accordance with its own privacy notice and settings.

LinkedIn Conversion Tracking and Insight Tag

Where enabled, nbnq uses the LinkedIn Insight Tag to measure the effectiveness of LinkedIn campaigns, understand how visitors interact with the website and support audience or conversion analysis. The tag may collect encrypted or pseudonymised metadata such as the IP address, timestamp, page views, referring URL and device or browser information. LinkedIn may store a browser cookie for up to six months from the last loading of the tag. Optional LinkedIn tracking is subject to the website's cookie settings and, where required, the user's consent. Users may also adjust advertising and cookie preferences through their LinkedIn account settings.

International Data Transfers

Personal data may be processed in Switzerland, countries within the European Economic Area, the United Kingdom, the United States and, where necessary to provide a requested service or execute a transaction, in the destination country or intermediary countries involved in the relevant banking, payment, card, custody, crypto or transaction chain. The exact countries involved may depend on the selected provider, payment route, counterparty and service requested.

Where personal data is transferred to a country that is not recognised as providing an adequate level of data protection, nbnq implements a safeguard permitted under applicable law. Depending on the recipient and processing activity, this may include the Swiss-U.S. Data Privacy Framework for eligible certified recipients, recognised standard contractual clauses, binding contractual safeguards or another legally recognised transfer mechanism. Further information regarding the principal destination countries and the safeguards applicable to a particular processing activity may be requested from nbnq.

Contact Form and Contact via Email

When you use a contact form, register to be contacted or communicate with nbnq by email or another communication channel, nbnq processes the contact information and message content you provide. Technical information, including browser, operating-system, device, IP-address and timestamp information, may also be recorded for security, evidence and system-operation purposes. nbnq uses this information to respond to the inquiry, assess the requested service, maintain a record of the communication, protect against misuse and comply with legal or regulatory obligations. You may notify nbnq at any time if you no longer wish to receive commercial communications by email.

nbnq may monitor or record telephone calls, video-identification sessions or other communications for quality control, training, security, evidence, compliance and the protection of nbnq or its customers, where permitted by applicable law. Not every communication is necessarily recorded, and nbnq does not guarantee that a recording of any particular communication will be retained or retrievable.

Automated Processing and Profiling

nbnq and its service providers may use automated systems to support identity and document verification, biometric matching and liveness checks, sanctions and PEP screening, adverse-media review, customer and transaction risk classification, fraud and device analysis, wallet attribution, blockchain-risk scoring, transaction monitoring, jurisdiction and product eligibility and the application of transaction limits, holds, restrictions or blocks. These systems are used to support the secure and compliant operation of nbnq's services and may result in an application, transaction or service being delayed, restricted, blocked or escalated for manual review.

Where a decision constitutes an automated individual decision within the meaning of applicable data protection law, nbnq will provide the information and rights required by that law. Subject to statutory exceptions, this may include the opportunity to express your position and request review by a natural person.

Data Retention

nbnq stores personal data only for as long as required for the relevant processing purpose or for

applicable legal, regulatory, contractual, audit, security or evidentiary requirements. Customer, account,

onboarding, KYC/KYB, transaction and contractual records are generally retained for ten years after the

termination of the relevant business relationship or completion of the relevant transaction, unless a longer

period is required or justified.

Longer retention may apply where a legal, regulatory or internal investigation is pending; an account or

transaction is subject to a hold, freeze or reporting process; a dispute or legal claim exists or is reasonably

anticipated; or an authority requires continued retention. Website logs, contact inquiries, analytics

information and marketing data are retained in accordance with shorter purpose-specific periods or until

the relevant consent is withdrawn or an objection is made, unless continued retention is otherwise

permitted or required. When data is no longer required, it is deleted, anonymised or otherwise disposed

of securely.

Data Security

nbnq applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, destruction or disclosure. Depending on the relevant system and risk, these measures may include access controls, encryption, multi-factor authentication, secure transmission, logging and monitoring, backup and recovery procedures, confidentiality obligations, vendor-security requirements and periodic review of security controls.
Access to personal data is limited according to the need-to-know principle. nbnq reviews its security measures in light of technological and operational developments. Although nbnq takes reasonable measures to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure.

Notice of Your Rights

Subject to applicable law and any statutory limitations, you may request information as to whether nbnq processes personal data concerning you and obtain access to that data and information about its processing. You may also request the correction of inaccurate or incomplete data and, where the relevant conditions are met, request deletion, destruction, restriction or cessation of processing. Where the statutory conditions are satisfied, you may request that personal data you have provided to nbnq be supplied to you in a commonly used, machine-readable format or transferred to another controller.
Where processing is based on consent, you may withdraw that consent at any time with effect for the future. You may object at any time to direct marketing and may object to other processing where the applicable law provides such a right. Where an automated individual decision is involved, the rights described under Automated Processing and Profiling may also apply. If the GDPR applies to the relevant processing activity, you may additionally exercise the rights available under the GDPR, including any applicable right to restriction, objection or complaint to the competent supervisory authority.
These rights are not absolute. In particular, nbnq may be required or permitted to restrict or refuse a request where processing or retention is required under AML, sanctions, tax, financial-market, criminal, litigation or other legal obligations, or where disclosure would adversely affect the rights of another person. nbnq may request appropriate information to verify your identity before processing a request.
Requests, objections and questions may be sent to [email protected] or by post to nbnq swiss ag, Dammstrasse 16, 6300 Zug, Switzerland. You may also contact the Swiss Federal Data Protection and Information Commissioner regarding a suspected violation of Swiss data protection law. Where the GDPR applies, you may lodge a complaint with the competent data protection supervisory authority.

Third-party Data Providers and Other Recipients

nbnq may disclose personal data, to the extent necessary for the relevant purpose, to identity- verification, KYC/KYB, sanctions, PEP, adverse-media and fraud-screening providers; blockchain analytics, transaction-monitoring and Travel Rule providers; banks, banking-as-a-service providers, payment institutions, card issuers, card processors and payment-network participants; custody and wallet-infrastructure providers; crypto exchanges and liquidity providers; hosting, cloud, cybersecurity, communications, document-management and customer-support providers; auditors, lawyers, tax advisers and other professional advisers; counterparties and transaction participants; and VQF, MROS, FINMA, tax authorities, courts, law-enforcement bodies and other competent authorities where disclosure is required or permitted.

Some recipients process personal data as processors acting on nbnq's documented instructions. Other recipients, including banks, payment institutions, card issuers, crypto exchanges, counterparties and public authorities, may process personal data as independent controllers under their own legal obligations and privacy notices. nbnq requires processors and service providers to observe appropriate confidentiality, security and data protection obligations and, where permitted to use subprocessors, to impose corresponding obligations on them. International disclosures are handled in accordance with the section International Data Transfers above.

Third-party Websites

The nbnq website, application or platform may contain links to websites or services operated by third parties. Those third-party websites and services are governed by their own terms and privacy notices. nbnq is not responsible for the privacy practices or content of third-party websites or services that it does not control. Users should review the relevant provider's privacy information before submitting personal data or using the provider's services.

Changes and Amendments to the Notice

nbnq may update this Data Protection and Privacy Notice to reflect legal, regulatory, technical or operational changes. The current version and its effective date will be published through the nbnq website or platform. Where appropriate, material changes will also be communicated through additional channels, such as email or an in platform notification.

Applicable Law

This Data Protection and Privacy Notice is governed primarily by the substantive laws of Switzerland. Mandatory rights and remedies available under another data protection law applicable to a particular processing activity remain unaffected. Nothing in this Notice limits an individual's right to contact a competent supervisory authority or rely on a mandatory forum. Contractual matters relating to an nbnq customer relationship remain subject to the applicable contractual terms and conditions.

Contact Details

nbnq swiss ag

Dammstrasse 16

6300 Zug

Switzerland

Email: [email protected]