Updated: 20.11.23

Personal Data Processing Policy

This Personal Data Processing Policy, together with the User Agreement and its other integral parts, has been prepared in accordance with the requirements of Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006, and defines the procedure for processing personal data and the measures taken by the Service to ensure the security of personal data.

The Service considers respect for the rights and freedoms of individuals and citizens when processing their personal data to be its most important objective and a fundamental condition for carrying out its activities, including the protection of the rights to privacy and personal and family confidentiality.

This Service Policy regarding the processing of personal data (hereinafter referred to as the “Policy”) applies to all information that the Service may obtain about visitors to the website https://Arbi.exchange/ (Arbi.exchange).

Arbi Service and its Affiliates undertake to make every effort to protect the privacy of Users. Arbi uses the information collected about the User to fulfill its contractual obligations and improve customer service.

Please read this document carefully. This Privacy Policy is intended to explain to visitors to this website how and for what purposes the Arbi Service collects, stores, protects, and uses the personal data of its Users.

Basic Concepts and Terms Used in the Policy

Personal Data - any information relating directly or indirectly to an identified or identifiable individual (data subject).

Operator - a legal entity that, independently or jointly with other persons, organizes and/or carries out the processing of personal data for the Arbi Service, determines the personal data subject to processing, and the actions performed with such personal data.

Processing of Personal Data - any action or set of actions performed with or without the use of automated means in relation to personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data.

Website - a collection of graphical and informational materials, as well as computer programs and databases that ensure their availability on the Internet at https://Arbi.exchange/ (Arbi.exchange).

Automated Personal Data Collection System - a set of tools designed to process personal data using computer technology.

Dissemination of Personal Data - actions aimed at disclosing personal data to an unspecified number of persons.

Blocking of Personal Data - temporary suspension of the processing of personal data, except where processing is necessary to clarify the personal data.

Personal Data Information System - a set of personal data contained in databases, as well as information technologies and technical means that ensure their processing.

Anonymization of Personal Data - actions as a result of which it becomes impossible to determine, without using additional information, the affiliation of personal data with a specific User or another data subject.

Provision of Personal Data - actions aimed at disclosing personal data to a specific person or a specific group of persons.

Dissemination of Personal Data - any actions aimed at disclosing personal data to an unspecified number of persons (transfer of personal data) or making personal data available to an unlimited number of persons, including publication of personal data in mass media, placement in information and telecommunications networks, or providing access to personal data by any other means.

Cross-Border Transfer of Personal Data - transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign individual, or a foreign legal entity.

Destruction of Personal Data - any actions resulting in the irreversible destruction of personal data, making it impossible to further restore the content of personal data in the personal data information system and/or resulting in the destruction of physical media containing personal data.

General Provisions

The most important condition for achieving the objectives of the Service’s activities (hereinafter referred to as the “Service”) is ensuring the necessary and sufficient level of information security for assets, which include personal data and the processes within which such data is processed.

Ensuring the security of personal data is one of the Service’s priority tasks.

The Service highly values its relationships with its existing and potential Users (hereinafter referred to as “Users”) and visitors to the Service’s Internet resources, and understands the importance of ensuring the security and confidentiality of their personal data.

By agreeing to the provisions and terms of the User Agreement and/or using the Service’s services, the User thereby gives the Service their full consent to the collection, storage, protection, and use of their personal data in accordance with this Privacy Policy, including receiving communications, including those of an advertising nature.

If the User does not agree with this Privacy Policy, use of the Service’s services must be discontinued.

The Service assumes that a User initiating contact with the Service’s Internet resources:

• Uses the Service’s Internet resources in their own name and provides accurate personal data whenever necessary;

• Determines and controls the settings of the software they use;

• Has the opportunity to review this Privacy Policy by following the “Privacy Policy” hyperlink on the Service’s Internet resource.

Concept and Composition of Personal Data

Personal data consists of any information relating directly or indirectly to an identified or identifiable individual (data subject).

Personal data includes personal information provided by the Client when submitting or entering their personal data and documents (including copies of documents in electronic form) when completing electronic forms on the Company’s Internet resources, as well as when submitting written requests to the Company, inquiries through the online chat form on the Company’s Internet resources, and similar communications.

Such information includes, but is not limited to:

• Full name;

• Mobile phone number;

• Email address;

• Registered address;

• Postal address;

• Details of an identity document and the data contained therein;

• Bank account details and bank account agreement information;

• Photos and video images of the Client;

• Other data.

Documents Required to Identify the User

• Details of an identity document and the data contained therein;

• Utility bills and/or a bank statement or constituent documents of a legal entity;

• Standard data automatically obtained by the HTTP server when accessing the Service’s Internet resources (host IP address, address of the requested resource, time, type and information about the browser program that sent the request for the resource, type of the User’s operating system, and the address of the page from which the User accessed the requested resource);

• Information automatically obtained when accessing the Company’s Internet resources (cookies).

Purposes of Personal Data Processing

The Service processes personal data in the following cases:

• To identify the User;

• For the purpose of taking measures to protect against fraud and other unlawful activities;

• To promptly inform Users about news, expansion of the range of services provided by the Service, promotions and advertising offers of the Service, as well as to provide Users with consultations on a wide range of issues;

• To inform Users about advertising and/or marketing campaigns, surveys, questionnaires, and marketing research concerning services provided by the Service and/or by third parties on whose behalf or for whose benefit the Service acts;

• To maintain an accurate User registration database;

• For the purpose of analyzing statistical data concerning the use of the Service’s Internet resources, their performance and efficiency, in order to offer Users higher-quality products and services.

Principles of Processing, Storage, and Protection of Personal Data

The processing of personal data by the Service is carried out based on the following principles:

• Legality and fairness of the purposes and methods of processing personal data;

• Compliance of the purposes of personal data processing with the purposes predetermined and stated at the time of collecting personal data, as well as with the authority of the Service;

• Compliance of the volume and nature of the personal data being processed and the methods of processing personal data with the purposes of personal data processing;

• Accuracy of personal data, their sufficiency for the purposes of processing, and inadmissibility of processing personal data that is excessive in relation to the purposes stated when collecting personal data;

• Inadmissibility of combining databases created for purposes that are incompatible with one another and containing personal data;

• Personal data must be stored in a form that allows the data subject to be identified for no longer than required by the purposes of processing, unless the storage period for personal data is established by law or by a contract to which the data subject is a party, beneficiary, or recipient;

• Destruction of personal data upon achievement of the purposes of processing personal data or when the need to achieve such purposes no longer exists, unless otherwise provided by law.

The Service processes personal data using automated means, including information technologies and technical means such as computer equipment, information and technical systems and networks, means and systems for transmitting, receiving, and processing personal data, software (operating systems, database management systems, etc.), information security tools used in information systems, as well as without the use of automated means.

The Service has the right to transfer the personal data of a data subject to subsidiaries/affiliated companies, banks, Service agents, including payment agents, or other trusted organizations and persons (hereinafter referred to as “Trusted Persons”) solely for the purpose of processing the User’s requests.

The Service guarantees that Trusted Persons will comply with this Policy and take the necessary measures to protect the confidential information of Users.

The Service has the right to provide confidential information concerning the User’s personal data to third parties who are not Trusted Persons only upon receipt of an official request from administrative and/or judicial authorities.

The Service undertakes not to provide access to Users’ personal data to anyone other than the Service’s employees, agents, and partners to the extent necessary for conducting business, including banking and credit relationships.

The Company guarantees compliance with this Privacy Policy by such persons, including the adoption of adequate measures for the storage and protection of Users’ personal data.

The Service does not publish the personal data of a data subject in publicly accessible sources without the data subject’s prior consent.

The Service has the right to disclose Users’ personal data to federal or state regulatory and law enforcement authorities within whose jurisdiction the Service operates, in response to duly formalized legal requests for such information. The Service also has the right to disclose information about a User in response to court orders or a summons to appear in court.

The Company takes all necessary organizational and technical measures to ensure the security of personal data against accidental or unauthorized access, modification, disclosure, or destruction, blocking of access, and other unauthorized actions.

Such measures include, in particular, internal reviews of data collection, storage, and processing processes and security measures, including appropriate encryption and measures to ensure the physical security of data in order to prevent unauthorized access to personal data storage facilities.

Links to Third-Party Internet Resources

The Service’s Internet resources may contain hyperlinks to the Internet resources of other (non-affiliated) companies.

When following any of these links to another Internet resource, the User leaves the Service’s Internet resource.

The Service does not manage the Internet resources of other companies and does not control their privacy practices, which may differ from those adopted by the Service.

Personal data provided by the User to other companies is not covered by this Privacy Policy.

The Service recommends reviewing the privacy policy of other companies before providing them with personal data.

Correspondence Sent to the Service

All correspondence sent by Users or visitors to the Service’s Internet resources to the Service (letters in regular or electronic form, comments on the Service’s materials, etc.) is considered restricted-access information and may be published only with the written consent of the sender.

The sender’s address, telephone number, and other personal data may not be used without the sender’s specific consent, except for the purpose of responding to the subject matter of the correspondence received.

Cookies

By registering on the Service’s website and using its services without registration, in accordance with this Policy, the User:

• Gives consent to the use of their personal data and to the processing thereof, including the collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of any information directly or indirectly relating to the User, their transactions, and payments.

• Acknowledges that the processing of personal data will be carried out by the Service in the interests of the User and for the purposes of providing the User with consultations (clarifications) and/or offering the User services provided by the Service and/or services provided by persons on whose behalf or for whose benefit the Service acts, and/or conducting surveys, questionnaires, advertising and marketing research concerning services provided by the Service and/or persons on whose behalf or for whose benefit the Service acts.

This also includes informing Users about advertising and/or marketing campaigns conducted by the Service and/or the aforementioned persons concerning services provided by the Service and/or persons on whose behalf or for whose benefit the Service acts.

Such contact may be made directly or by telephone, postal mail, fax, email, or other means of communication.

The processing of personal data may also be carried out for the purposes of preparing for the conclusion, concluding, performing, modifying, or terminating contracts (agreements) between Users and the Service or persons on whose behalf or for whose benefit the Service acts, including proper identification of the User.

It may also be carried out for the purpose of preparing application forms, notifications, agreements, and contracts that do not directly result in the conclusion, termination, or modification of the relevant contract or agreement, as well as for other purposes consistent with the purposes set out above.

The User confirms that they have been duly informed of the purposes of processing their personal data.

The User confirms that they have been informed that the processing of personal data is carried out by the Service by any means, including both with the use of automated means (including software) and without the use of automated means (using various physical media, including paper documents).

The User confirms that the processing of personal data may be carried out both by the Service and by other persons who have entered into an agreement with the Service subject to confidentiality obligations and liability for disclosure of Personal Data.

This right (consent) is valid for 10 years and may be withdrawn by sending written notice to the Service.

This consent shall be deemed withdrawn 30 (thirty) days after the Service receives written notice of withdrawal of this consent. The day on which the notice is received is not included in the thirty-day period.

Final Provisions

This Privacy Policy is an open and publicly accessible document. The current version is published on the Internet through the Service’s Internet resource.

The Service reserves the right to amend the Privacy Policy by notifying Users on the page located at the relevant address. Any changes made to the Privacy Policy will be published on this page.

In the event of significant changes, the Service will notify Users in a more explicit manner, for example, by sending an email notification.

This Policy shall be amended and supplemented in the event of changes to applicable legislation, the adoption of new legislative acts, or the introduction of special regulatory documents concerning the processing and protection of personal data.