About this Privacy Notice
Data protection and data security are important to the Bitcoin Suisse Group. This Privacy Notice applies when Personal Data that concern you (hereinafter “you” and “your”) is processed by a Group Entity as defined in Section 18 (individually referred to as “BTCS”; “we”; “our”; “us”). We process your Personal Data responsibly. This Privacy Notice is aligned with the EU General Data Protection Regulation (GDPR), the Federal Act on Data Protection (FADP) and any relevant applicable national data protection laws, including but not limited to the Data Protection Act of the Principality of Liechtenstein (DPA).
In this Privacy Notice, we inform you about when, how and for what purpose we collect and process Per-sonal Data when you visit our website at www.bitcoinsuisse.com (“Website”), use our BTCS web and mobile applications (“BTCS Online Tools”) or interact with us through our social media pages. This Privacy Notice also covers the collection and processing of Personal Data when you obtain services or products from us or interact with or contact us in relation to a contract or inquire about our services as a prospect. Additionally, we may inform you about the processing of your Personal Data separately, for example, in consent declarations, terms and conditions, additional privacy notices, forms, and other notices.
Definitions
In this Privacy Notice, the following terms shall have the meanings set out below:
-
Client: Any natural or legal person who has entered into a contractual relationship with BTCS or is in the process of establishing one.
-
Prospect: Any natural or legal person who has expressed an interest in establishing a business relationship with BTCS but has not yet become a Client.
-
Personal Data: Any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
-
Sensitive Personal Data: A subset of Personal Data requiring heightened protection, including but not limited to data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric or genetic data, data concerning health or sex life or sexual orientation, and data relating to criminal convictions and offences or related security measures.
-
Processing: Any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
-
Controller: The natural or legal person, public authority, agency, or other body which alone or jointly with others determines the purposes and means of the Processing of Personal Data.
-
Processor: A natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller.
-
Recipient: A natural or legal person, public authority, agency, or other body, to which Personal Data are disclosed, whether a Third Party or not.
-
Third Party: Any natural or legal person, public authority, agency, or other body other than the Data Subject, the Controller, the Processor, and persons who, under the direct authority of the Controller or Processor, are authorized to process Personal Data.
-
Data Subject: Any identified or identifiable natural person whose Personal Data is processed by BTCS.
-
Consent: Any freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the Processing of Personal Data relating to them.
-
Profiling: Any form of automated Processing of Personal Data consisting of the use of such data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.
-
Automated Individual Decision-Making: A decision based solely on automated Processing, including Profiling, which produces legal effects concerning the Data Subject or similarly significantly affects them.
Who is the Controller
This Privacy Notice applies to all BTCS Group entities listed in Section 18. The entity of the BTCS Group with which you interact (e.g. by concluding or performing a contract, making an inquiry, or using a service) is, as a rule, the Controller responsible for Processing your Personal Data.
In certain circumstances, other BTCS Group entities may also act as Controllers, for example when they are subject to their own legal or regulatory obligations, when they receive Personal Data for their own purposes as described in this Privacy Notice, or when data is shared within the Group for administrative, compliance, or business purposes.
If Personal Data is exchanged among BTCS Group entities, each entity that uses the data for its own purposes will act as an independent Controller. Where BTCS entities process data on behalf of another entity, they will act as Processors in accordance with applicable law and contractual arrangements.
Contact
If you have any questions or if you wish to exercise your data protection rights under Section 16, please contact us as follows:
If you are located in Switzerland
Bitcoin Suisse AG
Data Protection Officer
Grafenauweg 12, 6300 Zug, Switzerland
dataprotection@bitcoinsuisse.com
If you are located in the EU/EEA
Bitcoin Suisse (Europe) AG
Data Protection Officer
Aeulestrasse 74, 9490 Vaduz, Liechtenstein
dataprotection@bitcoinsuisse.com
If you are located in the UK
Swiss GRC Ltd
5th Floor, 167-169 Great Portland Street, London, England, W1W 5PF
Company No. 10881742
dataprotection.bitcoinsuisse@swissgrc.uk.com
Categories of Personal Data & Sources
- Categories of Personal Data
Depending on your relationship with us, we process various categories of Personal Data. The main categories of data are the following:
-
Identification Data: e.g. name, date and place of birth, nationality, gender, domicile, marital and family status, passport or identity documents, residence permit numbers, tax domicile, and samples of your digital or electronic signature.
-
Contact Data: e.g. private and/or business telephone numbers, postal and email addresses.
-
Financial Data: e.g. bank account details, account and transaction data, credit card information, crypto wallet addresses and transactions, tax identification numbers, investment and risk profiles, credit ratings or credit checks.
-
Professional and Qualification Data: e.g. current and past employment, job function, corporate title, professional memberships, qualifications, skills, career history, education, and investment knowledge and experience.
-
Sensitive Personal Data: e.g. information relating to criminal convictions and offences (including excerpts from criminal registers), politically exposed person (PEP) status and related information, biometric identifiers, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, lifestyle and preference data, as well as information concerning health status (such as disability, invalidity, occupational disability level).
-
Communication Data: e.g. correspondence (letters, emails, chat messages), as well as photos, video or audio recordings where you are identifiable. Where recordings take place (such as telephone calls or video conferences for training, quality assurance, compliance or legal requirements), you will be informed in advance. If you are a client, applicable laws may require BTCS to record calls with you.
-
Behavioral Data: e.g. information relating to the use of our services, your interactions with our Website or BTCS Online Tools (such as navigation patterns, session duration), your participation in general meetings (e.g. voting behaviour), or your use of BTCS infrastructure and systems.
-
Connection and Technical Data: e.g. IP address, device and browser details, operating system, preferred language, and log files generated when you access BTCS systems. Such data is required to ensure functionality and security.
-
Other Data: e.g. information relating to legal or regulatory proceedings (such as case files or evidence), access rights, entry and exit logs at BTCS premises, or similar information arising in the context of a business relationship.
Source of Personal Data
We collect Personal Data from different sources, including:
-
Directly from you: e.g. when you contact us, visit our Website or use our Online Tools, open an account, use our services, visit our offices, or apply for a job.
-
From third parties: e.g. in correspondence or meetings with clients or business partners; from referees provided by you during the application process; from clients regarding other persons involved in the business relationship (such as representatives, signatories, proxies, asset managers, or beneficial owners).
-
From publicly accessible sources: e.g. commercial registers, public websites, social networks, or other publications.
-
From authorities and regulators: e.g. where required for compliance purposes.
-
From service providers or platforms: e.g. compliance database providers, credit rating agencies, or similar institutions used to verify identity, authorizations, or background information.
Use of Website and BTCS Online Tools
General Use of the Website
You may visit our Website and obtain information about our services without actively disclosing your identity. As with any connection to a web server, certain technical data is automatically transmitted and temporarily stored by the server that hosts our Website. This data is required to establish a secure and stable connection and to ensure the functionality of our Website.
Use of BTCS Online Tools
We operate various BTCS Online Tools which allow you to access our digital services. When you register or log in as a client, we collect the data you provide (such as identification and contact data) as well as the information you or other users enter, upload, generate, store, or process when using these tools. To ensure security, we use measures such as Google Authenticator and reCAPTCHA during the registration and login process.
Web Analytics
We use web analytics services (currently PostHog) to understand how our Website is used and to improve its performance and usability. These services may use cookies to collect usage data. Before any transmission to servers outside Switzerland or the EEA, IP addresses are anonymised. This ensures that no Personal Data is disclosed abroad in this context.
External Resources
Our Website may integrate resources from external servers (e.g. for videos, images, or interactive plugins). These integrations are intended to improve functionality, security, or user experience. When such resources are accessed, the operators of the external servers may receive your IP address and technical information necessary to deliver the resource.
Cookies and Similar Technologies
We use cookies, tags, and similar technologies to operate our Website, improve performance, and enhance your experience. These small text files or comparable mechanisms are stored on your device when you use our services. Some of these technologies are strictly necessary for the functioning of our Website, while others serve analytical or functional purposes. Where their use involves the Processing of Personal Data, we comply with applicable data protection laws. You can manage your preferences by configuring your browser or device settings or by using the cookie preferences tool on our Website. You may block non-essential cookies, delete existing cookies, or withdraw your consent for non-essential technologies at any time.
Use of Social Media Pages
We maintain corporate pages on social media platforms (e.g. LinkedIn, Twitter/X, YouTube). Through these channels, we share information on our services and activities. When you interact with our pages (e.g. by commenting, liking, messaging, or visiting), we may receive Personal Data from you as well as reports generated by the platforms. Such reports are provided to us only in aggregated or anonymized form and do not allow us to identify individual visitors. Please note that the respective platform providers also collect and analyze your usage data independently. They may combine it with other data about you and use it for their own purposes, such as targeted advertising, market research, or managing their platforms. For this processing, the platform providers act as separate Controllers and apply their own privacy notices.
Newsletter and Analytics
When you subscribe to our newsletter, we process the Personal Data you provide to us (e.g. name and email address) in order to send you information about BTCS, our services, and market developments. We also use analytics tools to measure how newsletters are used (e.g. open rates, link clicks). These analytics help us improve our communications and provide you with more relevant content. You can unsubscribe from our newsletter at any time by using the unsubscribe link included in each message or by contacting us directly.
Purposes of Processing
We process your Personal Data only to the extent permitted by applicable law and for the following purposes:
- Communication and Relationship Management
We use your Personal Data to respond to your inquiries, requests and complaints, to contact you in the course of our business relationships and to manage and document communications with you.
- Establishing and Performing a Business Relationship
We process your Personal Data in order to prepare, conclude, administer and perform contracts with clients, prospects, service providers, business partners and other counterparties. This includes onboarding processes such as client due diligence as well as suitability and appropriateness assessments, and also the handling of job applications and recruitment processes.
- Participation in Crypto Asset Events
We may process your Personal Data to enable and support your participation in events related to crypto assets, including through interaction with third-party platforms and service providers for eligibility checks and technical execution.
- Compliance with Legal and Regulatory Obligations
We process your Personal Data to comply with statutory obligations, including anti-money laundering and counter-terrorist financing, sanctions, tax and accounting requirements, as well as supervisory and reporting obligations. This also includes cooperating with authorities, regulators, supervisory bodies and courts, and carrying out internal audits and compliance monitoring.
- Risk Management and Prudent Corporate Governance
We use your Personal Data to ensure adequate corporate organisation and governance, to manage risks and ensure business continuity, and to prevent, detect and investigate fraud, financial crime and other unlawful activities. This also includes measures to protect the security of our assets, premises, infrastructure and systems.
- Security and Access Control
We process Personal Data to control and monitor access to our premises, systems and infrastructure, and to protect against unauthorised access, misuse or threats to IT and information security.
- Marketing, Information and Events
We may use your Personal Data to provide you with information about BTCS, our services and relevant market developments, to organise and host events, webinars, competitions or promotional activities, to manage subscriptions to newsletters and similar communications, and to optimise our presence on social media and other digital platforms.
- Market Research, Service Optimisation and Product Development
We process your Personal Data to analyse how our Website, Online Tools and services are used, to conduct surveys and collect feedback, and to develop and improve our services, processes, infrastructure and technology.
- Enforcement of Rights and Legal Claims
We may process your Personal Data to establish, exercise or defend legal claims, and to handle complaints, disputes, litigation or regulatory investigations.
- Further purposes
We may also process your Personal Data for additional purposes, for example as part of our internal processes and administration, for quality assurance and staff training, or where processing is required to safeguard the legitimate interests of BTCS or a third party, provided that such interests are not overridden by your interests or fundamental rights and freedoms
Basis for Processing your Personal Data
In general, we process your Personal Data based on legal obligations or as required to perform our contractual obligations. Where there is neither a legal obligation nor a necessity arising from the performance of our contractual obligations, we process your Personal Data either based on your consent or based on our legitimate interests.
- Performance of a contract
We process Personal Data where it is necessary to prepare, conclude or perform a contract with you or the entity you represent. This also includes pre-contractual measures taken at your request.
- Compliance with legal obligations
We process Personal Data where it is required to comply with statutory obligations under applicable laws and regulations, including anti-money laundering and counter-terrorist financing, sanctions laws, tax laws, accounting rules and supervisory requirements.
- Consent
Where required, we may process Personal Data on the basis of your explicit consent, for example for marketing communications, newsletters or the use of certain cookies and analytics technologies. Consent can be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
- Legitimate interests
We process Personal Data where necessary to pursue our legitimate interests or those of a third party, provided that such interests are not overridden by your rights and freedoms. Legitimate interests include ensuring IT and system security, fraud prevention, risk management, corporate governance, optimizing services and processes, conducting marketing and business relationship management, protecting assets, compliance with legal obligations under applicable laws and regulations, insofar as this is not already recognized as a legal basis by applicable data protection laws, and defending against legal claims.
- Processing of sensitive Personal Data
Sensitive Personal Data is processed only where a specific justification applies, for example if the processing is required by law, necessary for the establishment, exercise or defense of legal claims, manifestly made public by you, necessary for reasons of substantial public interest, or based on your explicit consent.
Automated Decision-Making & Profiling
We generally do not use fully automated decision-making processes that have legal effects on you or that similarly significantly affect you. Where such processes are applied, for example during online onboarding or compliance checks, you will be specifically informed and your rights under applicable law will be safeguarded. This includes the right to request human intervention, to express your point of view and to contest the decision. We may also process Personal Data using automated methods to assess certain personal aspects. This may include compliance and risk checks, the prevention of fraud and money laundering, or the tailoring of communications and marketing. Profiling is carried out only in accordance with applicable law and with appropriate safeguards in place.
Sharing your Personal Data
To achieve the purposes described in this Privacy Notice, it may be necessary for us to share your Personal Data with others. These are the following categories of recipients:
-
Group Entities: A Group Entity as outlined in Section 18 as well as any other entity belonging to the BTCS Group, which consists of Bitcoin Suisse Holding AG and its wholly owned subsidiaries, branches and representative offices, may use Personal Data in accordance with this Privacy Notice for the same or other purposes as we use it, including for a dual onboarding at another Group Entity.
-
Service providers and platforms: We work with service providers and platforms in Switzerland and abroad who process your data on our behalf or who receive data about you from us as separate Controllers (e.g. ICT providers, banks, third-party platforms involved in Crypto Asset Events).
-
Authorities: We may disclose Personal Data to public authorities, courts or law enforcement agencies where we are legally required or authorized to do so, or where such disclosure is necessary to safeguard the legitimate interests of BTCS.
-
Other third parties: Any third party that acquires, or is interested in acquiring or securitizing, all or part of our assets or shares, or that succeeds to us in carrying on all or a part of our businesses, or services provided to us, whether by merger, acquisition, reorganization or otherwise.
We may also disclose Sensitive Personal Data where this is required by law or where another valid legal basis exists, unless we have expressly agreed with you not to disclose such data to certain third parties. Before sharing Personal Data, we carry out appropriate due diligence on third parties to ensure that they implement adequate data protection and security measures. This includes reviewing their technical and organisational safeguards, their compliance with applicable data protection laws, and their ability to respect and protect the rights of data subjects.
Retention and Deletion of Personal Data
We will process and store your Personal Data only to the extent and for as long as necessary to fulfil the purposes described in this Privacy Notice or to comply with legal and regulatory obligations. Once the relevant purpose no longer applies and no retention obligation exists, we will delete or anonymize your data. Certain legal provisions require us to retain Personal Data for defined periods, and in some cases we may also be subject to legal holds or regulatory requirements that oblige us to keep data for an undefined period. Please note that data recorded on a blockchain in connection with the provision of our services (for example the execution of trade orders) cannot be erased or altered by BTCS. To preserve the integrity and confidentiality of Personal Data during the retention period, we implement appropriate technical and organizational measures, including access controls and regular reviews of their effectiveness in line with our risk management framework.
Transfer of Your Personal Data Abroad
We primarily process and store Personal Data in Switzerland and the European Economic Area (EEA). In certain cases, however, Personal Data may also be transferred to recipients in countries outside these jurisdictions. Such transfers are limited to what is necessary for the purposes described in this Privacy Notice.
Where a recipient is located in a country that does not provide an adequate level of data protection as recognized by the European Commission or by the Swiss Federal Data Protection and Information Commissioner, we ensure that appropriate safeguards are in place before any transfer takes place. These safeguards may consist of standard contractual clauses approved by the relevant supervisory authority, binding corporate rules that have been accepted by supervisory authorities, or other contractual, technical or organizational measures agreed with the recipient to protect your Personal Data.
In specific cases, transfers may also take place on the basis of statutory exceptions. This includes situations where the transfer is necessary for the performance of a contract with you or for pre-contractual measures at your request, where the transfer is required for the establishment, exercise or defense of legal claims, where the transfer is justified for important reasons of public interest, where you have explicitly consented to the transfer, or where the Personal Data has been made publicly available by you.
Under these conditions, your Personal Data may be transferred to and processed in various countries, including but not limited to Switzerland, Liechtenstein, Denmark, Slovakia, Germany, Austria, Ireland, Finland and the United States of America.
How We Protect Your Personal Data
We take appropriate security measures to maintain the required level of protection for your Personal Data, to ensure its confidentiality, integrity and availability, and to safeguard it against unauthorized or unlawful processing as well as to mitigate the risk of loss, accidental alteration, unauthorised disclosure or access.
Your Rights & How to Exercise Them
Depending on the applicable data protection law, you may have the following rights with respect to your Personal Data:
-
Right to be informed about how your Personal Data is collected, used, shared and otherwise processed.
-
Right of access to obtain confirmation whether and which Personal Data we process about you and to receive a copy of such data.
-
Right to rectification to request correction of inaccurate or incomplete Personal Data.
-
Right to erasure to request the deletion of Personal Data where no legal or regulatory obligations or overriding interests prevent such deletion.
-
Right to restriction of processing under certain conditions, for example where the accuracy of data is contested or processing is unlawful.
-
Right to object to the processing of Personal Data, in particular where processing is based on legitimate interests or for direct marketing purposes.
-
Right to data portability to receive the Personal Data you have provided to us in a structured, commonly used and machine-readable format and to request its transfer to another controller where technically feasible.
-
Right to withdraw consent at any time with effect for the future, where processing is based on your consent.
-
Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, and to request human intervention in such cases.
-
Right to lodge a complaint with the competent data protection authority or to seek judicial remedies if you believe that your rights have been infringed.
If you wish to exercise any of these rights in relation to BTCS, you can contact us in writing at our offices or, unless otherwise indicated or agreed, by e-mail. Our contact details are set out in Section Error! Reference source not found.. Where your request relates to Personal Data that is processed by other parties acting as independent controllers, we will support you in coordinating your request with the relevant party.
Please be aware that certain rights may be subject to conditions, limitations or exceptions under applicable data protection law, for example where the rights and freedoms of third parties could be affected or where trade secrets must be protected. In some situations, we may need to continue processing or retaining certain Personal Data, such as to fulfil a contract with you, to meet legal or regulatory requirements, or to safeguard our legitimate interests, including the establishment, exercise or defense of legal claims. To the extent permitted by law, requests may therefore be restricted or rejected in whole or in part, for example by removing information that relates to third parties or confidential business information.
If you disagree with how we handle your request or with our data protection practices more generally, you may contact us or our Data Protection Officer directly. In addition, you are entitled to raise a complaint with the competent supervisory authority. The relevant authorities and their contact details are listed in Section 18.
Changes to this Privacy Notice
We may change this Privacy Notice at any time, in particular if we change our data processing practices or if new legal obligations become applicable. The version provided at www.bitcoinsuisse.com/legal applies in each case.
BTCS Group Entities Covered by this Privacy Notice
BTCS Holding AG
Theilerstrasse1a, 6300 Zug, Schweiz
Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Adresse: Feldeggweg 1, 3003 Bern, Schweiz
Tel.: +41 58 462 43 95
Website: EDÖB
Bitcoin Suisse AG
Theilerstrasse1a, 6300 Zug, Schweiz
Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Adresse: Feldeggweg 1, 3003 Bern, Schweiz
Tel.: +41 58 462 43 95
Website: EDÖB
Bitcoin Suisse (Europe) AG
Äulestrasse 74, 9490 Vaduz, Liechtenstein
Datenschutzstelle Fürstentum Liechtenstein
Adresse: Kirchstrasse 8, Postfach 684, 9490 Vaduz, Liechtenstein
Tel.: +423 236 60 90
E-Mail: info.dss@llv.li
Website: Datenschutzstelle
BTCS Tech. ApS Copenhagen
Højbro Plads 10, GST 101, 1200 København K, Denmark
Danish Data Protection Agency
Adresse: Carl Jacobsens Vej 35, DK-2500 Valby, Denmark
Tel.: +45 33 19 32 00
E-Mail: dt@datatilsynet.dk
Website: Datatilsynet
BTCS Slovakia s.r.o.
Pribinova 4, 811 09 Bratislava, Slovakia
Office for Personal Data Protection of the Slovak Republic
Adresse: Budova Park one, Námestie 1.mája 18, 811 06 Bratislava, Slovak Republic
Tel.: +421 2 32 31 32 14
E-Mail: statny.dozor@pdp.gov.sk
Website: Office for Personal Data Protection of the Slovak Republic
Last Update: 14. Oktober 2025