1. Introduction

This Privacy Policy explains how Ebioro UAB (“Ebioro,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards your personal information when you use our services, including our websites, mobile applications, APIs, and any associated features or content (collectively, the “Services”).

By accessing or using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not access or use the Services.

We may update this Privacy Policy periodically. The latest version will always be available at www.ebioro.com/legal/privacy and the date at the top will reflect the most recent revision.

2. Who We Are

Ebioro UAB is a private limited company registered in Lithuania. We act as a data controller for the processing of your personal data in accordance with:

• The General Data Protection Regulation (EU) 2016/679 (“GDPR”)
• Lithuanian Law on the Legal Protection of Personal Data
• Other applicable privacy and data protection regulations

We have appointed a Data Protection Officer (DPO) who you can contact at: [email protected].

3. Scope of this Policy

This policy applies to personal information collected:

• Through our websites, mobile apps, or APIs
• Via communications (email, support, surveys, chatbots)
• From third-party sources (e.g., ID verification partners, marketing platforms)
• When you interact with our services (e.g., payments, account access, transactions)

4. Personal Data We Collect

5. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual necessity: To provide you with the Services you request
• Legal obligations: AML, sanctions screening, financial reporting
• Legitimate interests: To prevent fraud, ensure security, and enhance user experience
• Consent: For optional marketing communications or use of device-based features

6. How We Use Your Information

• To verify identity and comply with AML/CTF regulations
• To provide and personalize our Services
• To process transactions and monitor wallet activity
• To offer customer support and resolve disputes
• To send critical service communications and optional promotional messages
• To conduct research, improve Services, and enhance security

7. Sharing Your Personal Information

We may share your personal data with:

• Identity Verification Providers: e.g., Sumsub
• Financial Institutions & Payment Processors: For fiat and crypto transactions
• Service Providers: IT hosting, customer support, analytics, marketing
• Regulators, Law Enforcement & Supervisory Authorities: Where required by law
• Corporate Affiliates or Acquiring Entities: In connection with mergers or acquisitions

We never sell your personal data.

8. International Data Transfers

Where necessary, we transfer data outside the EU using legal safeguards such as:

• Adequacy decisions
• Standard Contractual Clauses (SCCs)
• Your explicit consent

You can request a copy of these safeguards by contacting [email protected].

9. Data Security

We use appropriate physical, technical, and organizational safeguards to protect personal data, including encryption, access control, and employee training. However, no method of transmission over the internet is fully secure. Please protect your credentials and notify us of unauthorized access.

10. Data Retention

We retain your data:

• As long as needed for the purposes described in this Policy
• In line with legal, tax, and regulatory obligations
• For up to 10 years after account closure, depending on applicable laws

Once no longer needed, your data will be securely deleted or anonymized.

11. Children’s Data

Our Services are not intended for individuals under the age of 18. If we learn that a minor has provided us personal information, we will delete the account and related data.

12. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal information
• Correct inaccuracies
• Withdraw consent
• Request deletion (subject to exceptions)
• Receive data portability
• Restrict or object to processing
• Lodge a complaint with a data protection authority

You may exercise these rights by contacting us at [email protected]. We may ask for identity verification before processing your request.

13. Marketing & Cookie Preferences

You can manage your marketing preferences via your account settings or by emailing us. To opt-out of cookies or adjust preferences, see our Cookie Policy.

14. Contact Us

If you have questions or complaints regarding this Privacy Policy, please contact us:

For residents of the EU, you may also contact the State Data Protection Inspectorate in Lithuania.