We are committed to protecting your privacy

We are Tatum and our services are provided by some or all of the following entities (the term "We" or "Our Company" means all or some of the entities listed below, depending on which is relevant to the person receiving or viewing this document). The relevant Tatum's entity is the entity that (i) sent or otherwise made this document available to you, (ii) displays this document on its website, or (iii) with which you enter into a legal relationship.

Tatum's entities:

Tatum Technology s.r.o., ID No.: 07176856, with registered office at Veveří 3163/111, Žabovřesky, 616 00 Brno, Czech Republic

Tatum Technology LLC, with registered office at 80 Southwest 8th Street, Brickell, Bayview - Suite 2000, Miami, FL 33130, represented in the European Union pursuant to Article 27 GDPR by Tatum Technology s.r.o.

Tatum Holdings Limited, ID No.: 13606548, with registered office at 12 New Fetter Lane, London, United Kingdom, EC4A 1JP, represented in the European Union pursuant to Article 27 GDPR by Tatum Technology s.r.o.

Tatum Labs s.r.o., ID No.: 14234653, with registered office at Veveří 3163/111, Žabovřesky, 616 00 Brno, Czech Republic

Tatum SPV s.r.o., ID No.: 14226723, with registered office at Veveří 3163/111, Žabovřesky, 616 00 Brno, Czech Republic

At the same time we are the Controller of your personal data responsible for its processing.

You may contact us via this contact information:

Email: privacy@tatum.io 

This Personal Data Processing Policy (hereafter “Policy”) were created in compliance with the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter “GDPR”) and they stipulate the manner, in which we process and protect your personal data.

What personal data do we process about you?

When we offer and provide our services, we come to contact with people and thus we come into contact with their personal data. In order to be able to provide you our services in high quality and professionally, we need to acquire some of your personal data. In order for you to be able to better understand the extent of processing of your personal data, but also the sense behind their processing, we divide this data into the following categories:

• Identification and address data, i.e. data that allow us to identify you so that we can enter into an agreement on the provision of services or other similar agreement with you (hereafter “Agreement”) and so that we can provide our products or services to you without unreasonable legal and factual risks.

E.g. your name, surname, business name, ID No., date of birth, delivery address, invoicing address, address of registered office, permanent residence address etc.

• Data associated with the Agreement and its performance, i.e. data arising in connection with the performance of the Agreement.

E.g.  the date of conclusion of the Agreement, the duration of the Agreement, the date and reason for termination, the date of payment of the price for the Service (hereinafter referred to as the "Subscription"), the amount of the Subscription, the number of credits, order history, customer number, data provided when communicating with us, data necessary for the proper performance of the Agreement.

• Electronic data from the website, i.e. data generated in connection with your visit to our website.

E.g. device IP/Mac address, cookies, device location data, authentication certificates.

• Electronic data processed in connection with the use of our services, i.e. data generated in connection with the use of our software products (Javascript SDK, CLI, key management system, REST API, etc.) enabling the development of blockchain applications and interaction with the blockchain ("Platform").

E.g. device IP address, authentication certificates, cookies, device localization data, public keys, API keys

• Contact information, i.e. information allowing us to establish contact and communicate with you.

E.g. e-mail address, telephone number, IM identifiers, data mailbox ID etc.

• AML-CFT data, i.e. information allowing us to identify and verify you as our customer and to be compliant with the respective AML-CFT regulations. We process this data, in particular if we are an obliged person under the AML-CFT regulations or if these or similar practices comply with our internal policy.

E.g. Identification, address and contact data of the client (see above), type, number of the ID card and the state or authority that issued it, its validity period of the ID card, copy of the ID card, political exposure, data about the Ultimate Beneficial Owner of the client, country of origin, principal business activities, including primary source of income, type of transaction  etc.

In what manner do we acquire your personal data?

Your personal data can get to us in the following manner:

• by your providing it to us within mutual communication over the telephone, by e-mail, mail, web-based contact form etc.,
• by obtaining it from publicly accessible sources (e.g. public registers of persons, public records, professional networks),
• by obtaining it in the course of fulfillment of our statutory duties,
• by obtaining it within the frame of your visit to our website (www.tatum.io) or your use of our Platform, and
• by obtaining it from third parties (typically from social networks such as Facebook, LinkedIn, Google+ etc.) based on your consent with logging in with login information to these social networks.

What are the purposes, legal grounds and the term of personal data processing?

In the charts below you may find the purposes and legal grounds (titles) for processing your personal data, and also for how long this data is stored with us.

The purpose of processing according to these Policy is understood as any activity which we perform while selling our products or providing our services and for which we need to work with your personal data (this concerns in particular concluding and performing the Agreement, fulfillment of our statutory obligations, sending newsletters etc.).

Legal grounds for processing according to this Policy is understood as one of the four below stated purposes pf statutory personal data processing in the sense of GDPR:

Purpose No. 1 – ENTERING INTO AND PERFORMING THE AGREEMENT

We process your personal data in particular so that we can provide our services to you. The legal basis for the processing is performance of the Agreement. You have no obligation to provide your data to us for this purpose. However, without this data we would not be able to provide our services to you, resulting in the inability to enter into the Agreement.

Furthermore, we process your personal data when managing your inquiries, handling incentives or complaints. If you decide to use any social network for communication with us, you need to remember that processing of such provided personal data is also governed by the terms and conditions of such social networks, over which we have no control. 

Processing of personal data for this purpose is justified by our legitimate interest to communicate with our customers, or by your consent, depending on which Party initiates the communication. Provision of personal data in this case is not a statutory or contractual requirement. As such you are not obliged to provide your personal data to us for this purpose. 

If you decide to publish a review, you do so voluntarily and we process your personal data based on your consent. You may withdraw your consent at any time. Provision of personal data in this case is not a statutory or contractual requirement. As such you are not obliged to provide your personal data to us for this purpose.

Purpose no. 2 – COMPLIANCE WITH STATUTORY OBLIGATIONS

We process some of your personal data also in order to comply with our statutory obligations, in particular tax and accounting and AML/CTF obligations. Processing of the personal data for this purpose is justified by compliance with statutory obligations. We are obliged to process this information about you.

Purpose no. 3 – SENDING OF BUSINESS NOTIFICATIONS (NEWSLETTERS)

We process some of your personal data (in particular e-mail address or telephone number) also in order to send you business notifications (newsletters and offers of our services). We send business notifications to our customers based on our legitimate interest or to those persons who granted their consent therewith (e.g. via the web-based form). 

The personal data processing for the purpose of sending business notifications is justified by your consent, or as the case may be, our legitimate interest on direct marketing, provided that you are our customer. Provision of personal data based on your consent is voluntary in this case, however, without it we would not be able to send you business notifications. You may withdraw your consent at any time. You may also object against sending the notifications based on our legitimate interest. If you let us know that you no longer wish to receive business notifications, we will immediately stop sending them. For this purpose please use the contact information above.

Provision of personal data in this case is not a statutory or contractual requirement. As such you are not obliged to provide your personal data to us for this purpose. 

Purpose no. 4 – PROTECTION OF OUR RIGHTS 

After termination of our contractual relationship, we continue to store your data for a reasonable period of time implied by the statutory period of limitation in order to protect our rights, property or security or the , rights property or security of other persons. Processing of your personal data for this purpose is justified by our legitimate interest to protect our rights, property or security of other persons. 

Provision of personal data in this case is not a statutory or contractual requirement. As such you are not obliged to provide us your personal data for this purpose, nevertheless, we process your personal data for this purpose in situations where you have already provided your personal data to us.

Purpose no. 5 – MANAGEMENT OF CUSTOMER ACCOUNTS AND PLATFORM

Certain of our websites allow you to register and by doing so create a customer account to manage your plans, Subscriptions and use our Platform. For this purpose, we usually process your name, surname, email address and default region for API keys, or you can also provide us with your address or telephone number and other billing information. This data is then used to facilitate the ordering of our services and to provide customer benefits.

Processing of your personal data for this purpose is justified by your consent. Provision of personal data based on your consent is voluntary in this case, however, without it it would be impossible to create a customer account and use in particular the Platform. You may withdraw your consent and delete your account at any time. If you let us know that you no longer wish to be registered, we will immediately cancel your account. For this purpose please use the contact information above. However, you may cancel your account yourselves in the Platform.

You can also log in to your customer account using your social network login credentials (e.g. Facebook or Google+ login credentials). The first time you log in, you will be asked whether you agree to provide us with your email address and data from your public profile, which includes data such as your email, name and other data according to your profile settings. If you do not want the social network to give us the data, then you have the option to log in to your customer account using your own login details.

Provision of personal data in this case is not a statutory or contractual requirement. As such you are not obliged to provide your personal data to us for this purpose.

Purpose no. 6 – DIRECT MARKETING AND OUR PROMOTION

The technology of creation of personalized content and advertisements allows us to display our advertisements on partner websites to visitors, who have shown interest in our Website, products or services. We strive to only display advertisements that really interests you and not advertisements without any relationship to you or your interests. Based on the history of your orders, interests and behavior on websites, personalized content and offers may be displayed to you on our Website and on third party websites and applications (including social networks). This is allowed in particular by cookies. You can read more about the management of your preferences regarding processing of cookies in the Cookie Policy.

For the purposes of direct marketing and creation of personalized content and advertisements we also process e-mail addresses and telephone numbers, however, always on the basis of your previous consent only. You may withdraw an already granted consent at any time via your account or via the contact information stated above.

Processing of personal data for the purpose of direct marketing and creation of personalized content and advertisements is justified by your consent, or as the case may be, our legitimate interest on direct marketing. Provision of personal data based on your consent is voluntary in this case, however, without it we would not be able to provide personalized content and advertisements to you. You may withdraw your consent at any time. Provision of personal data in this case is not a statutory or contractual requirement. As such you are not obliged to provide your personal data to us for this purpose.

Purpose no. 7 – VISIT OF OUR WEBSITE AND USING THE PLATFORM

When you visit our website and use the Platform, we automatically process personal data about you based on so called cookie files. You can find more information about what cookies are, what cookies do we use and for what purpose, in the Cookie Policy.

Purpose no. 8 – DATA PROCESSING FOR AML-CFT PURPOSES 

We process this data, in particular if we are an obliged person under the AML-CFT regulations or if these or similar practices comply with our internal policy.

Who do we make your personal data accessible to?

In order to ensure the security of your personal data and also to be able to offer and sell our products and provide our services to you, there are the following groups of recipients and processors helping us with personal data processing:

Is your personal data transferred also outside the EU?

The personal data we collect about you is stored and processed in Germany, Poland, the US and the Czech Republic, or wherever we or our partners, affiliates and third-party service providers have servers and other facilities.

However, if we transfer your personal data for processing to a third country (outside the European Economic Area, which includes the countries outside the European Union - Iceland, Liechtenstein and Norway) or an international organisation, we do so only if the European Commission has determined that the third country or international organisation provides an adequate level of protection or if the recipient of the personal data has provided appropriate safeguards for the protection of the personal data and there are enforceable data subject rights and effective legal protection for data subjects in the destination country. We can also transfer data to the US under the data privacy framework.

In what manner is your personal data being processed?

Personal data is processed both manually and automatically. We keep due records about all processing activities in compliance with the applicable legislation. 

‍

What are your rights as data subjects?

Contact us with realization of your rights at our contact information stated in the introduction of this Policy. We reserve the right to verify the identity of the person asserting such rights in a suitable manner. In case of repeated requests or clearly unfounded or unreasonable requests we may charge a reasonable fee or refuse to execute the request.

• Right to access to personal data

If you want to know whether we process your personal data, you have the right to obtain information from us about whether your personal data is being processed, and if so, you have the right to access your personal data. In case of repeated requests, we are entitled to charge a reasonable fee for a copy of the provided personal data based on the incurred administrative costs.

• Right to rectification of inaccurate personal data and completion of incomplete personal data

If you believe that we process inaccurate or untrue data about you, you have the right to request rectification thereof. You also have the right to completion of incomplete data. We will perform the rectification or completion without undue delay, however in each case according to our technical possibilities and available time.

• Right to erasure

You have the right to request erasure of personal data that we process about you in the following cases:

1. your personal data is no longer necessary for the purpose, for which it was collected or processed;
2. we process your personal data contrary to the law;
3. you have withdrawn your consent, on the basis of which the processing of your personal data was performed, and we have no other authorization (legal grounds) to process this data any further;
4. you raise an objection against the processing of your personal data in case your personal data is being processed for marketing purposes (e.g. sending newsletters);
5. you raise an objection against the processing of your personal data which we process based on our legitimate interest, and if we are unable to prove that our legitimate interest outweighs your right to erasure;
6. there is a statutory reason that requires erasure of this persona data;
7. we process personal data of a child without the consent of parents with such processing.

• Right to restriction of personal data processing

In case you are not interested in complete erasure of, but only in temporary restriction of processing of your personal data, you can request us to restrict the processing of your personal data.

• Right to personal data portability

In case you want us to transfer your personal data to a third party, you may exercise your right to data portability. However, in case exercising of this right could have adverse effects on the rights and freedoms of third parties, we would be unable to grant your request.

• Right to object

You have the right to object at any time against the processing of personal data, which is being processed in order to complete a task performed in public interest or when exercising public authority or for the purpose of our legitimate interests. In case we are unable to prove that there are serious legitimate grounds for the processing that outweigh your interests or rights and freedoms, we will terminate the processing on the basis of your objection without undue delay.

• Right to withdraw consent at any time

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. 

‍

As far as processing of your personal data for the purpose of sending business notifications is concerned, you may withdraw your consent with processing personal data and sending of business notifications simply by replying “No” to the e-mail or by expressing your disagreement in your reply in any other way, or by clicking the relevant ling, if it is provided at the end of the business notification.

‍

• Right to information on automated decision-making, including profiling

You are not a subject to any decision making based exclusively on automated processing, including profiling, that may have legal effects or any other significant impact on you.

‍

• Right to file a complaint with the Office for Personal Data Protection

You may also file a complaint at any time with the supervisory authority, which is the Office for Personal Data Protection, with a registered office at Pplk. Sochora 27, 170 00 Prague 7, tel.: 234 665 111. Complaints may be filed via the contact information stated here.

‍

Where personal data is processed pursuant to Article 3(2) of the GDPR, those Tatum entities that are not established in the European Union are represented pursuant to Article 27 of the GDPR by Tatum Technology s.r.o., for the purposes of (i) dealing with the supervisory authority, (ii) making a request, and (iii) exercising the rights of data subjects. If the controller or processor of the personal data is a Tatum entity located outside the European Union (cf. the introduction to this document) and the processing of personal data pursuant to Article 3(2) GDPR occurs, you may exercise your rights through Tatum Technology s.r.o. and file a complaint with the aforementioned supervisory authority.

‍

Is personal data concerning children also being processed?

Our products, services or Website are not primarily designated for persons under the age of 16. As such we do not intentionally collect their personal data. If we provide our products or services to a person under the age of 16, we request the consent of the person exercising parental responsibility for the child. If we find that we have accidentally collected personal data of a person under the age of 16 without the relevant consent, we will take steps towards erasing this data as soon as possible, with the exception of cases, where the applicable law obliges us to keep it.

‍

What legislation regulates personal data processing and protection of privacy?

Personal data protection in the Czech Republic is governed in particular by the following legislation:

• Regulation (EU) 2016/679, the General Data Protection Regulation, 
• the Act no. 110/2019 Coll., on Personal Data Processing,
• the Act no. 89/2012 Coll., the Civil Code.

‍

Conclusion

Legislation as well as our business strategy and the associated manner of processing of your personal data may change. If we decide to update this Policy, we will publish the changes on our Website and we will notify you about these changes. In cases where any more significant change of this Policy is to take place, or in case we are required to do so by the law, we will notify you in advance.

We would like to ask you to carefully read this Policy and to review it regularly when you communicate with us in the future or use the Website.