Dear Visitor,

Thank you for visiting our website and for your interest in our services. In the course of operating this website and providing our services, we process personal data that you provide to us. The protection of such data is extremely important to us.

This document contains information regarding the processing of your personal data and information about your rights under Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”), and Act No. 110/2019 Coll., on the Processing of Personal Data (hereinafter the “Act”).

This document also includes information about the cookies used on our websites, in accordance with Act No. 127/2005 Coll., on Electronic Communications, as amended.

When we refer to AML regulations in this document, we primarily mean Act No. 253/2008 Coll., on

Certain Measures Against the Legalisation of Proceeds of Crime and Financing of Terrorism, as amended, as well as related national and European binding legal regulations concerning AML and the application of international sanctions.

1. Data Controller and Data Protection Officer

ILAVO GROUP a.s., having its registered office at Pražákova 1024/66a, Štýřice, 639 00 Brno, Company ID No.: 223 77 301, registered with the Commercial Register maintained by the Regional Court in Brno under file no. B 9042 (hereinafter “we” or “ILAVO”), acts as the data controller within the meaning of the GDPR and the Act, determining the purposes and means of processing your personal data as a data subject.

The processing of personal data under this document applies to any processing activities carried out by ILAVO, especially through the websites https://kvapay.com/, https://kvakomat.com, and also via the automated device – Kvakomat (Bitcoin ATM).

In connection with the processing of personal data, our company has appointed a Data Protection Officer in accordance with the GDPR, who may be contacted via email at: gdpr@kvapay.com.

The Data Protection Officer oversees the personal data protection system within ILAVO. His responsibilities include providing advice to us and our processors involved in personal data processing regarding their obligations in the field of data protection. He also serves as the contact point for the supervisory authority.

2. Extent, Purposes, and Legal Basis for the Processing of Personal Data

ILAVO processes your personal data in the following situations:

• For the purpose of creating your client account on kvapay.com as a payment gateway for digital assets (pre-contractual relationship): we process your full name, date of birth or personal identification number (if assigned), permanent address or another address including street, building number, city, postal code, and country, as well as nationality. These data are processed in order to conclude a contract with you for account creation on the above-mentioned website. The legal basis for processing personal data under the GDPR is the performance of a contract.
• For the purpose of setting up your digital wallet: we process your full name, date of birth or personal identification number (if assigned), permanent address or another address including street, building number, city, postal code, and country, as well as nationality. These data are processed in order to conclude a contract with you for the creation of your virtual wallet. The legal basis for processing personal data is the performance of a contract.
• For the purpose of fulfilling obligations under AML regulations, particularly for your identification when entering into a contract with us or during individual transactions, we process your full name, date of birth or personal identification number (if assigned), permanent or other residential address (including street, building number, city, postal code, and country), nationality, type and number of your identity document (identity card, passport), and a photo of your face. The legal basis for the processing of personal data is the fulfilment of obligations under AML regulations.
• For the purpose of creating statistics and developing new products, we process data related to your use of our website and services. This includes information about the services you view on our website, the links you click on, your navigation patterns on our site, and data about the device you use to access our website, such as your IP address, inferred location, device identification, technical parameters, and information from cookies and similar technologies. The legal basis for this processing is our legitimate interest.
• For the purpose of fulfilling the contract with you and providing our services, we process information related to your transactions, their execution, and payment details. Without this processing, we would not be able to provide our services. The legal basis for this processing is the performance of the contract with you.
• For the purpose of responding to your requests and communicating with you, we process information concerning your inquiries, your email address, name, surname, and possibly your telephone number. The legal basis for this processing is our legitimate interest.
• For the purpose of fulfilling our legal obligations in the fields of accounting, taxation, document, and register management, we process data related to contract performance, your name, surname, address, and other information required by applicable legislation. The legal basis for this processing is compliance with legal obligations.
• For the purpose of protecting our interests and legitimate claims, we process your name, surname, address, and data concerning the performance of contracts with you, as well as information about the services we have provided. The legal basis for this processing is our legitimate interest.
• For the purpose of promoting our services and company through newsletters, we process your name, surname, and email address. This is done on the basis of your consent, or, if you register an account or order a service from us and do not opt out of marketing communications, we may process your data for this purpose in accordance with legal regulations even without your consent. The legal basis for this processing is either your consent or our legitimate interest.

If the processing of your personal data is based on the performance of contractual (or pre-contractual) obligations arising from a contract with you, or on compliance with legal obligations—especially those under AML regulations—such processing is a prerequisite for us to provide our services. If you do not provide the required personal data, we cannot offer our services.

If the processing of your personal data is based on our legitimate interest, it is conducted following a proportionality and necessity assessment carried out by our company. If you do not provide the data, we cannot pursue this interest. We respect your rights during data processing, adhere to the principle of data minimisation concerning the processing purpose, and follow the conclusions of the balancing tests. If you believe your rights are infringed by such processing, you may object as outlined in Article 7 below. In such a case, we will restrict the processing of your personal data until we can demonstrate compelling legitimate grounds for the processing that override your interests and rights. If we cannot demonstrate such grounds, we will no longer process your data for these purposes. If you object to processing for direct marketing purposes, we will cease processing without further delay.

Unless otherwise stated, the personal data we process is obtained directly from you.

3. To whom do we disclose your personal data?

In most cases, we process your personal data for purposes defined by us as the data controller. In such cases, processing is carried out by our employees. Occasionally, we must use external service providers to ensure proper delivery of our services. These service providers process your personal data on our behalf for purposes we define, including:

• providers of services necessary for your identification and fulfilment of obligations under AML regulations;
• providers of analytical and statistical tools;
• providers of cloud services and other technology and support vendors;
• providers of marketing tools.
In certain cases, we transfer your personal data to other parties acting as data controllers. This occurs when a third party’s service is required to provide our services to you, and such third party determines the purposes of processing independently. These are primarily:
• payment system providers to facilitate payment processing, especially card payments; and
• providers of legal services, auditors, and tax advisors.

If your personal data is processed via social media, we act as joint controllers with the operators of the respective social media platforms (especially Facebook, Instagram). In such cases, we are obligated to inform you about such processing and provide a lawful basis for the processing of personal data. For more information regarding processing of personal data on Facebook and Instagram, see:

• Facebook: https://www.facebook.com/policy.php
• Instagram: https://help.instagram.com/519522125107875

Where required by generally binding legal regulations, we are also obliged to disclose your personal data to competent public and administrative authorities, in particular to regulatory authorities, law enforcement agencies, tax authorities, and other government institutions. However, in such cases, we only disclose your data to the necessary extent required by law.

4. Transfer to Third Countries

Most processing of personal data by our company and its partners takes place within the EU, the European Economic Area, the United Kingdom, or Switzerland. In certain cases, however, we may transfer your data to processors in third countries that do not provide an adequate level of data protection.

All such transfers are conducted based on written contracts that include the standard contractual clauses issued by the European Commission. We also continuously monitor the level of data protection and security at the partner receiving your data.

5. Retention Period of Personal Data

ILAVO retains your personal data only for as long as necessary to achieve the purposes of processing, or as long as required by applicable legal regulations. If you have provided consent for data processing, your personal data will be processed until you withdraw that consent. The duration may vary depending on the purpose, but we always ensure data minimization and only process data that is necessary for the specific purpose. Once the purpose ceases, your data is deleted or anonymized.

We process your personal data for the following durations:

• Contractual data: for the duration of the contract and for the general limitation period extended by one year;
• AML compliance data: for 10 years from the moment of identification;
• Communication and request handling data: for the time necessary to resolve the request and the general limitation period extended by one year (unless AML regulations require a longer retention period);
• Accounting, tax, documentation, and registry data: for a maximum of 10 years;
• Data necessary for protecting our interests and legitimate claims: for the general limitation period extended by one year and for the duration of any legal proceedings related to disputed claims.

6. Automated Decision-Making and Profiling

Our company currently uses automated decision-making and profiling for fulfilling obligations under AML regulations, specifically to evaluate an image of your face and compare it with your identity document and previous images in our database.

In the case of a rejection, you have the right to request human review of the decision.

7. Your Rights

As a data subject, under Articles 12 et seq. of the GDPR and relevant national law, you have a range of rights concerning the processing of your personal data by ILAVO.

Your primary right is the right to information about the processing of personal data. ILAVO fulfils this obligation through this document, which contains all key details.

Other rights under the GDPR include:

• Right of access – the right to obtain confirmation of whether ILAVO is processing your personal data.
• Right to rectification: If your personal data is inaccurate, you have the right to have it corrected.
• Right to erasure: You have the right to request deletion of your personal data if there is no longer a purpose or legal basis for processing, if the processing is unlawful, if a supervisory authority requires us to delete the data, or if you have objected to the processing and there are no overriding legitimate grounds for continued processing.
• Right to restriction of processing: You may request the restriction of processing if you believe your data is inaccurate (until we verify or correct it), if there is no legal basis for processing and deletion has not occurred, if we no longer need the data but you need it for the establishment, exercise, or defence of legal claims, or if you have objected to the processing and we are verifying whether there are overriding legitimate grounds for processing.
• Right to data portability: Where processing is based on your consent or a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
• Right to object: If the processing is based on a legitimate interest, you may object to it. In such cases, we will suspend processing until we assess whether overriding legitimate grounds exist. If the objection concerns processing for direct marketing purposes, we will stop such processing immediately.
• Right to human review of automated decisions: In cases of automated individual decision-making, you have the right to request a human review of the decision.
• Right to lodge a complaint with a supervisory authority: You can file a complaint with the Office for Personal Data Protection, located at Pplk. Sochora 727/27, Holešovice, 170 00 Prague 7. You may exercise the above rights by submitting a request via email to info@kvapay.com or in writing to our company’s address. We reserve the right to verify your identity before processing your request. Your request will be handled without undue delay and no later than one month from receipt or identity verification. If the request is complex or we receive a large number of requests, we may extend the response period by up to two additional months. If so, we will notify you of the extension and reasons for the delay within the original one-month period.

8. Cookie Policy

Definition of cookies

Cookies are small text files that are downloaded to your electronic device (e.g., smartphone, tablet, or computer) when you visit a website. The purpose of cookies is to enhance the overall user experience and to enable certain website functionalities (depending on the type of cookie used).

Cookies essential for the proper functioning of our website may be set and used without your consent (so-called essential cookies). All other cookies require your explicit consent before they are activated. While cookie files themselves cannot be directly linked to an identifiable person, data derived from them may be associated with a specific individual. For more information on the processing of such data, please refer to Section 2 above.

Types and Purposes of Cookies Used

By duration, we distinguish between:

• Session cookies: These are temporary cookies that are activated each time you visit our website and are deleted after you close your browser.
• Persistent cookies: These remain stored in your browser until their set expiration date or until manually deleted.

We use both session and persistent cookies on our website.

By function, we distinguish between:

• Essential cookies: These enable core functionalities of the website. They allow you to navigate the website and use basic features. Disabling these in your browser may significantly impair or entirely prevent access to the site. These cookies do not collect any information for marketing purposes or remember your browsing history. Use of these essential cookies is based on our legitimate interest, so your consent is not required, although you can still disable them in your browser settings. Please note, however, that without these cookies, we cannot guarantee the full functionality of our website.