PRIVACY POLICY

Information
Through this Privacy Policy, the user (hereinafter, the “User”) is unequivocally informed that the personal data provided through the Criptan website (hereinafter, the “Website”), as well as (ii) the Criptan mobile application (hereinafter, the “Application”) and (iii) analogous environments such as forms or contact emails, will be processed by CRIPTAN in accordance with the provisions of this Privacy Policy.
The User must read this Privacy Policy carefully, which has been written in a clear and simple manner to facilitate understanding.

Obligation to provide personal data
The data requested in the Website and Application forms are generally mandatory (unless otherwise specified in the required field) to fulfill the purposes for which they are being collected.
Therefore, if they are not provided or are not provided correctly, CRIPTAN will not be able to provide its services adequately.

Personal data collected on the Website and the Application
The personal data that may be collected by CRIPTAN on the Website and the Application are as follows:
– Copy of National ID (D.N.I) or identification document.
– Facial photograph (will not be retained indefinitely).
– Email address.
– Telephone number.
– Complete personal or fiscal postal address.
– Name and surname.
– Bank account number.
– Bank card photograph.

Purpose of the user data processing by Criptan
The personal data provided through the Website and the Application will be processed by CRIPTAN for the following purposes:

– Identification and Onboarding of Users for the provision of services: to identify the User so they can access the services provided on the Website and the Application, as well as the data necessary to carry them out.

– Responding to questions raised in contact forms and email: managing, processing, and responding to the User’s petitions, requests, incidents, or queries.

– Attending to the Users’ exercise of rights: processing, analyzing, answering and, where appropriate, executing the exercise of rights requested by the User in accordance with the provisions of this Privacy Policy.

– Conducting quality and satisfaction surveys: consulting Users regarding quality and their satisfaction with the services provided by CRIPTAN. Analysis of reports and statistics obtained from User responses.

– Sending commercial communications: sending commercial communications regarding CRIPTAN through telematic or conventional means.

Legal basis for the processing of user data by Criptan
The legal basis for the processing of the User’s personal data shall be the following:

– Identification and Onboarding of Users for the provision of services: the data processing derived from this purpose is the fulfillment of the contractual relationship or for the application of pre-contractual measures at the User’s request, as well as on certain occasions for the fulfillment of a legal obligation when provided for by applicable regulations.
As we are considered an obligated entity under money laundering regulations, based on Article 4 of Royal Decree 304/2014, of May 5, approving the Regulation of Law 10/2010, of April 28, on the prevention of money laundering and terrorist financing; we must collect the facial data of our users with the aim of verifying their identity, contrasting it with the data reflected in their National ID (D.N.I.).

– Responding to questions raised in contact forms: the data processing derived from this purpose is the fulfillment of the contractual relationship or for the application of pre-contractual measures at the User’s request.

– Attending to the Users’ exercise of rights: all processing derived from this purpose will be based on the fulfillment of legal obligations, in accordance with the provisions of applicable data protection regulations.

– Conducting quality and satisfaction surveys: the processing derived from conducting quality and satisfaction surveys will be based on legitimate interest, recognized to the data controller by the regulations.
This legitimate interest is based on being able to offer Users CRIPTAN’s services, both on the Website and in the Application, with the highest quality and best possible experience for the User.

– Sending commercial communications: The processing derived from this purpose will be based on consent, recognized to the data controller by the regulations.

The User has the right to object to the processing of their personal data for the purpose of sending personalized commercial communications at any time and free of charge. The user may express said opposition by clicking on the link established to unsubscribe from commercial communications or by sending an e-mail to the following email address: [email protected].

Likewise, in the event that the User gives their consent for CRIPTAN to process their data for any additional purpose to those mentioned in this Privacy Policy, the User will be duly informed of said processing, and the User themselves will be entitled to revoke said consent by contacting CRIPTAN via the following email address: [email protected].

Who will user data be shared with?
User data may be communicated to:

– Public Administrations in cases provided for by law.
– Courts and Tribunals in cases provided for by law.
– The State Security Forces and Corps in cases provided for by law.
– Companies that are part of the CRIPTAN group for internal administrative purposes.
– Companies with whom CRIPTAN carries out commercial operations, provided that the processing is necessary for the successful completion of the operation and guarantees, where appropriate, continuity in the provision of services offered to Users; this includes, in particular, facial data.
These facial data are shared with our two providers, MetaMap and Veriff, whose website you can consult here https://es.metamap.com / https://www.veriff.com/es. These providers do not share the information they collect with third parties, and store this information on Amazon Web Services (AWS) servers located in Frankfurt (Germany). You can access privacy information in the MetaMap and Veriff privacy policies regarding facial data in sections A and C of their Privacy Policy.

International data transfers
CRIPTAN does not intend to transfer Users’ personal data to a third country or international organization. However, in the event that this were to happen, Users would be expressly informed of this circumstance, indicating the existence or absence of an adequacy decision by the European Commission, or of the appropriate guarantees and the means to obtain a copy thereof.

Data retention periods
User data will be kept for the following periods:

1. Identification and Onboarding of Users for the provision of services will be kept for the period necessary for the provision of services from the Website or the Application at the User’s request and, once these have ended, during the limitation period for legal actions derived from the aforementioned provision of services.
Regarding facial data, as it is a verification required at the time of onboarding our Users, these will be deleted once the process of verifying User data upon first access is completed.

2. Data provided through contact forms, will be kept for the period necessary to process and respond to your request and, once finished, during the limitation period for legal actions derived from said request.

3. Data used to attend to the Users’ exercise of rights , will be kept for the period necessary to carry out the right requested by the User and, once said right has been fulfilled, they will be kept until the prescription of any liabilities derived from this processing.

4. Conducting quality and satisfaction surveys, will be kept for the time necessary to provide services to Users and until they object or the data ceases to be necessary to fulfill the established purpose and any liabilities derived from the provision of services have prescribed.

5. Data used for sending commercial communications, will be processed until the User objects or revokes their consent.
In any case, CRIPTAN will duly block the personal data of Users, having no access to them from the moment they cease to be necessary to fulfill the purpose for which they were collected, being only processed in the event that it is required by the competent judicial or administrative authority in the cases expressly established by Law.

User Responsibility
The user:

– Guarantees that they are over eighteen (18) years of age and that the data they provide to CRIPTAN are true, accurate, complete, and up-to-date. For these purposes, the User is responsible for the veracity of all data communicated and will keep the information provided conveniently updated so that it responds to their real situation.

– Guarantees that they have informed the third parties whose data they provide, if applicable, of the aspects contained in this document. Likewise, they guarantee that they have obtained their authorization to provide their data to CRIPTAN for the indicated purposes.

– Will be responsible for any false or inaccurate information provided through the Website and the Application and for the damages and losses, direct or indirect, that this causes to CRIPTAN or third parties.

Exercise of rights
The User may send a written communication to CRIPTAN, at the address indicated in the header of this Privacy Policy, or via email to the address: [email protected] attaching a photocopy of their identity document, at any time and free of charge, to:

– Revoke consents granted.
– Obtain confirmation as to whether or not personal data concerning the User is being treated at CRIPTAN.
– Access their personal data.
– Rectify inaccurate or incomplete data.
– Request the suppression (deletion) of their data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
– Obtain from CRIPTAN the limitation of data processing when any of the conditions provided for in data protection regulations are met.
– Request the portability of the data provided by the User in those cases provided for in the regulations.

Likewise, a claim regarding the protection of their personal data may be filed with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at the address C/ Jorge Juan 6, 28001 – Madrid, when the interested party considers that CRIPTAN has violated the rights recognized by applicable data protection regulations.

Security measures
CRIPTAN will treat the User’s data at all times in an absolutely confidential manner and maintaining the mandatory duty of secrecy regarding them, in accordance with the provisions of applicable regulations, adopting for this purpose the necessary technical and organizational measures that guarantee the security of their data and prevent its alteration, loss, unauthorized processing or access, taking into account the state of technology, the nature of the stored data and the risks to which they are exposed.

Changes
CRIPTAN reserves the right to review its Privacy Policy at the time it deems appropriate, in which case it will be communicated to Users. For this reason, we request that you check this privacy statement regularly to read the most recent version of CRIPTAN’s Privacy Policy.

Acceptance, consent, and understanding
The User declares to have been informed of the conditions regarding personal data protection, accepting and understanding the content of this Privacy Policy. Otherwise, please do not accept the Privacy Policy and/or do not make use of the Website and the Application.

Last updated: November 27, 2025.

CRIPTAN TRADE S.L. es una empresa registrada en Banco de España con el número D646 para servicios de custodia y compraventa de activos digitales, la inscripción en este registro no implica aprobación o verificación alguna de la actividad realizada por los proveedores de servicios de cambio de moneda virtual por moneda fiduciaria y de custodia de monederos electrónicos por parte del Banco de España.
Criptan utiliza tecnología robusta y probada a lo largo de los años para la custodia de los criptoactivos de sus clientes. La mayoría de los fondos (+80%) se guardan en monederos multifirma ultra-frios que requieren la colaboración de varios empleados distintos, localizados en lugares geográficamente dispersos, para poder mover los fondos. El resto de fondos, custodiados en monederos fríos, templados y calientes, así como con los proveedores de liquidez con los que trabaja Criptan, también requieren la colaboración de diferentes personas dentro del equipo de Criptan. Ninguna criptomoneda puede transferirse por ninguna persona de forma individual. Las claves de recuperación de dichos monederos se guardan en cajas de seguridad con seguridad física.