MoonPay App Privacy and Cookie Policy

Last updated: 4/9/2023

MP Technology Services Limited (defined below under “Our relationship to you”) is committed to protecting the privacy of users of our services. This privacy policy (“Privacy Policy”) describes how we handle your personal data when you access our services or app, which includes your use of the MP Technology Services App (commonly known as the MoonPay App and referred to here as the “Wallet Application” or “Application” or “App”) or any other services that we provide to you (referred to collectively hereinafter as "Services"). Please also read MP Technology Services App’s Terms of Service (the “Terms”), which describe the terms under which you use the Services.

If you have any questions about this Privacy Policy, please send them to [email protected]

Changes to this privacy policy

We may modify this Privacy Policy from time to time. Please check the date at the top of this Privacy Policy to see when it was last updated.

Our Relationship to you

MP Technology Services Limited is a company organised and existing under the laws of the Seychelles, and having its principal place of business at Suite 108, Premier Building, Victoria, Mahe, Seychelles and is registered under number 207216 (“MP Technology Services” or “we” or “us” or “our”).

MP Technology Services decides how your personal data is processed in relation to the Services provided to you (typically referred to as a “data controller”).

Personal data we collect

Personal data means any data which relates to a living individual who can be identified from that data, or from that data and other information, which is in the possession of, or is likely to come into the possession of MP Technology Services (or its representatives or service providers). In addition to factual information, it includes any expression of opinion about an individual and any indication of the intentions of MP Technology Services or any other person in respect of an individual.

Personal data you provide to us

This includes personal data that you provide to us in order to install and access our Services or establish an account. This information is either required by law, necessary to provide the requested services, or is relevant for our legitimate interests described in greater detail below.

The nature of the Services you are requesting will determine the kind of personal data we might ask for, but may include:

• Account Information - In order to create an account for the App, you will need to provide us with a valid email address which will be associated with the crypto wallet address(es) in your App.
• Profile Information: In the App, you may choose to customize your username or add a profile picture. We will store these images and username and associate them with your account.
• Transaction Information: Information about the transactions you make through our Services, such as the wallet address of the recipient, the crypto asset or non-fungible token, the amount, and/or timestamp.
• Correspondence: Survey responses, information provided to our support team or user research team.

Personal data we collect automatically or generate about you

This includes personal data that we collect automatically, such as whenever you use the Services. This information helps us address customer support issues, improve the performance of our applications, provide you with a streamlined and personalized experience, and protect your account from fraud by detecting unauthorized access. Information collected automatically includes:

• Online Identifiers: Geo location/tracking details, operating system, browser name and version, and/or personal IP addresses.
• Device Information: model, make, operating system, language, and version preferences
• Usage Data: Authentication data, security questions, click-stream data and public social networking posts.
• Metrics and Performance Data: service-related, diagnostic, and performance information including diagnostic, crash, website, and performance logs and reports.
• Status Information - We may collect information about your online status on our Services, such as when you last used our Services (your "last seen status").

How we use your personal data

We may use your personal data in the following ways and for the following purposes:

1) To maintain legal and regulatory compliance

MP Technology Services needs to process your personal data in order to help detect, prevent, and mitigate fraud and abuse of our Services and to protect you against account compromise or funds loss. If you do not provide personal data required by law, we will have to close your account.

2) To provide MP Technology's Services

We process your personal data to provide Services to you. The consequences of not processing your personal data for such purposes is the termination of your account. We also process your personal data when you contact us to resolve any questions, disputes, collect fees, or to troubleshoot problems. Without processing your personal data for such purposes, we cannot respond to your requests and ensure your uninterrupted use of the Services

3) To provide communications

According to your preferences and in compliance with applicable law, we may send you marketing communications to inform you about events, to deliver targeted marketing and to share promotional offers. If you are a new customer, we will contact you by electronic means for marketing purposes only if you have consented to such communication. If you do not want us to send you marketing communications, please go to your account settings to opt-out or submit a request via [email protected]

We may send you service updates regarding administrative or account-related information, security issues, or other transaction-related information. These communications are important to share developments relating to your account that may affect how you can use our Services. You cannot opt-out of receiving critical service communications.

4) In our legitimate business interests

Sometimes the processing of your personal data is necessary for our legitimate business interests, such as:

• quality control and staff training;
• to enhance security, monitor and verify identity or service access, and to combat spam or other malware or security risks;
• research and development purposes;
• to enhance your experience of our Services; or
• to facilitate corporate acquisitions, mergers, or transactions.

Legal bases for processing your personal data

We rely on legal bases for processing your personal data under the relevant data protection legislation. These bases mean we will only process your personal data where we are legally required to, where processing is necessary to perform any contracts, we entered with you (or to take steps at your request prior to entering into a contract with you), for our legitimate interests to operate our business, to protect MP Technology Services's or your property rights, or where we have obtained your consent to do so. We will not use your personal data for purposes other than those purposes we have disclosed to you, without your permission.

Disclosing your personal data to Affiliates

MP Technology Services is part of the MoonPay family of companies and affiliates. Our “family of companies” is the broad MoonPay group which is related to us by common control or ownership (“Affiliates”). We will share your data with our Affiliates as part of the normal conduct of business and in order to offer products and services to you.

Disclosing your personal data to third parties

We allow your personal data to be accessed only by those who require access to perform their work and share it only with third parties who have a legitimate purpose for accessing it. MP Technology Services will never sell or rent your personal data to third parties without your explicit consent. We will only share your personal data with the following types of third parties:

• Service providers and professional advisors under contract who help with parts of our business operations. Our contracts require these service providers to only use your information in connection with the services they perform for us and prohibit them from sharing your information with anyone else;
• Companies or other third parties in connection with business transfers or bankruptcy proceedings;
• Companies or other entities that purchase MP Technology Services assets; and
• Law enforcement, regulators, or any other third parties when we are compelled to do so by applicable law or if we have a good faith belief that such use is reasonably necessary, including to: protect the rights, property, or safety of MP Technology Services customers, third party, or the public; comply with legal obligations or requests; enforce our terms and other agreements; or detect or otherwise address security, fraud, or technical issues.

How we protect and store personal data

MP Technology Services implements and maintains reasonable measures to protect your personal data. Customer files are protected with safeguards according to the sensitivity of the relevant information. Reasonable controls (such as restricted access) are placed on our computer systems. Physical access to areas where personal data is gathered, processed or stored is limited to authorized employees.

We may store and process all or part of your personal and transactional data outside of your jurisdiction where our facilities or service providers are located. We protect your personal data by maintaining physical, electronic, and procedural safeguards in compliance with the applicable laws and regulations.

As a condition of employment, MP Technology Service’s employees are required to follow all applicable laws and regulations, including in relation to data protection law. Access to special categories of personal data is limited to those employees who need to it to perform their roles. Unauthorized use or disclosure of confidential customer information by an MP Technology Services employee is prohibited and may result in disciplinary measures.

When you contact an MP Technology Services employee about your file, you may be asked for some personal details. This type of safeguard is designed to ensure that only you, or someone authorized by you, has access to your file. You also play a vital role in protecting your own personal data. When registering with our Services, choose a password of sufficient length and complexity, don’t reveal it to any third-parties and immediately notify us if you become aware of any unauthorized access to or use of your account.

Retention of personal data

How long we hold your personal data for will vary. The retention period will be determined by the following criteria:

• the purpose for which we are using your personal data – we will need to keep the information for as long as is necessary for that purpose; and
• legal obligations – laws or regulation may set a minimum period for which we have to keep your personal data.

If you have further questions about our data retention practices, please contact us at [email protected].

If we anonymize your personal data so that it can no longer be associated with you, it will no longer be considered personal data, and we can use it without further notice to you.

Cookies

We may collect personal data about you when you browse our site and App via “cookies”, which are small text files placed on visitors’ hard drives that enhance their experience.

Cookies are a standard feature of many websites and applications and are readable only by the organization hosting the website or application. Cookies cannot access, read or modify any other data on a visitor’s device, nor can they capture any data that allows the organization hosting the website or application to identify the visitor as an individual. Our App uses only strictly necessary cookies to link your IP address and customer ID to provide our Services.

Children's personal data

We do not knowingly request to collect personal data from any person under the age of 18. If a user submitting personal data is suspected of being younger than 18 years of age, MP Technology Services will require the user to close his or her account and will not allow the user to continue using our Services. We will also take steps to delete the information as soon as possible. Please notify us if you know of any individuals under the age of 18 using our Services so we can take action to prevent access to our Services.

International transfers

MP Technology Services is an international business which means we may transfer to locations outside of your jurisdiction. When we transfer your personal data to another country, we will ensure that any transfer of your personal data is compliant with applicable data protection law.

Data transferred out of the EU or UK

When we transfer your personal data outside of the United Kingdom (“UK”) or the European Economic Area (“EEA”), we will ensure that it is protected in a manner that is consistent with how your personal data will be protected by us in the UK and EEA respectively. This can be done in a number of ways, for instance:

• the country that we send the data to might be approved by the UK Government or European Commission (as applicable); or
• the recipient might have signed up to a contract based on “standard contractual clauses” approved by the UK Government or European Commission (as applicable), obliging them to protect your personal data.

In other circumstances the law may permit us to transfer your personal data outside the UK or EEA. In all cases, however, we will ensure that any transfer of your personal data is compliant with data protection law. You can obtain more details of the protection given to your personal data when it is transferred outside the UK and EEA (including a copy of the standard contractual clauses which we have entered into with recipients of your personal data) by contacting us using the details listed in the ‘How to contact us section’ below.

Your privacy rights

Depending on applicable law of where you reside, you may be able to assert certain rights related to your personal data. These rights include:

• the right to obtain information regarding the processing of your personal data and access to the personal data which we hold about you;
• the right to withdraw your consent to the processing of your personal data at any time. Please note, however, that we may still be entitled to process your personal data if we have another legitimate reason for doing so. For example, we may need to retain personal data to comply with a legal obligation;
• in some circumstances, the right to receive some personal data in a structured, commonly used and machine-readable format and/or request that we transmit those data to a third party where this is technically feasible. Please note that this right only applies to personal data which you have provided directly to MP Technology Services;
• the right to request that we rectify your personal data if it is inaccurate or incomplete;
• the right to request that we erase your personal data in certain circumstances. Please note that there may be circumstances where you ask us to erase your personal data, but we are legally entitled to retain it;
• the right to object to, or request that we restrict, our processing of your personal data in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your personal data but we are legally entitled to refuse that request; and
• the right to lodge a complaint with the relevant data protection regulator if you think that any of your rights have been infringed by us.

You can exercise your rights by contacting us using the details listed in the ‘How to contact us section’ below. Further information about your rights may be obtained by contacting the supervisory data protection authority located in your jurisdiction.

How to contact us

If you have questions or concerns regarding this Privacy Policy, or if you have a complaint, please contact us at [email protected], or by writing to us at the MP Technology Services entity address provided above.

If you reside in the European Union, you can file a complaint with the International Centre for Dispute Resolution by phone at +1.212.484.4181, or through your relevant data protection authority.

In the UK, the data protection authority is the Information Commissioner's Office (see https://ico.org.uk/).

US consumer privacy notice

This Privacy Policy applies to you if you are an individual who resides in the United States and uses MP Technology Services’s services for your own personal, family or household purposes.

What does MP Technology Services do with your personal information? Why?

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this Privacy Policy carefully to understand what we do.

What personal information?

The types of personal information we collect and share depends on how you use our services. This information can include, but is not limited to:

• Social Security number, passport number, or driver’s license number;
• Bank account information, trading data, or transaction history; and
• Identification information such as your name, email, date of birth, nationality, or signature

When you are no longer our customer, we continue to share your information as described in this notice.

How?

All financial companies need to share customers’ personal information to run their everyday business. In the table below, we list the reasons financial companies can share their customers’ personal information; the reasons we choose to share; and whether you can limit this sharing.

Reasons we share your personal information

• For our everyday business purposes – such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus Does MP Technology Services share? Yes Can you limit sharing? No
• For our marketing purposes – to offer our products and services to you Does MP Technology Services share? Yes Can you limit sharing? No
• For joint marketing with other financial companies Does MP Technology Services share? Yes Can you limit sharing? Yes
• For our Affiliates’ everyday business purposes – information about your transactions and experiences Does MP Technology Services share? Yes Can you limit sharing? Yes
• For our Affiliates’ everyday business purposes – information about your creditworthiness Does MP Technology Services share? Yes Can you limit sharing? Yes
• For our Affiliates to market to you Does MP Technology Services share? Yes Can you limit sharing? Yes
• For our non-Affiliates to market to you Does MP Technology Services share? Yes Can you limit sharing? Yes

Questions

Call our customer service line at 833 610 0735 or visit our help center.

Who is providing this privacy notice?

MP Technology Services Limited

How does MP Technology Services protect my personal information?

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.

How does MP Technology Services collect my personal information?

We collect your personal information, for example, when you:

• Create an account with MP Technology Services;
• Use and interact with the MP Technology Services App;
• We also collect your personal information from others, such as from affiliates or other companies.

Why can’t I limit all sharing?

Federal law gives you the right to limit only:

• Sharing for Affiliates’ everyday business purposes—information about your creditworthiness;
• Affiliates from using your information to market to you; and
• Sharing for Nonaffiliates to market to you - State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under State law.

Definitions

• Affiliates - Companies related by common ownership or control. They can be financial and nonfinancial companies. This includes other companies in the MoonPay group of companies.
• Nonaffiliates - Companies not related by common ownership or control. They can be financial and nonfinancial companies.
• Joint Marketing - A formal agreement between nonaffiliated financial companies that together market financial products or services to you.

California Privacy Rights

Pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), California residents have certain rights in relation to their personal information, subject to limited exceptions. Any terms defined in the CCPA have the same meaning when used in this California Privacy Rights section.

Depending on which services you use, you may have different rights and choices for managing your personal data. For example, the CCPA does not apply to personal data collected, processed, or disclosed by a financial institution according to federal laws, such as the Gramm-Leach-Bliley Act.

Collection and Disclosure of Personal Information

Over the past 12 months we may have collected and disclosed the following categories of personal information from or about consumers. We use this information for the purposes described in the “HOW WE USE YOUR PERSONAL INFORMATION” section of this Privacy Policy:

• Identifiers, such as email, phone number, name, date of birth, IP address, driver’s license number, passport number, or other similar identifiers. This information is collected directly from the consumer or device;
• Geolocation data, including GPS location information and approximate location derived from your IP address. This information is collected directly from the consumer or device;
• Internet or other electronic network activity information, including your browser type and version, time zone settings, operating system or platform, or website visit information. This information is collected directly from a device;
• Biometric information, such as a live photo. This information is collected directly from the consumer or device;
• Commercial information, including payment card information and transaction verification information. This information is collected directly from the consumer or device;
• Audio, electronic, visual, thermal, olfactory, or similar information. This information is collected directly from the consumer; and
• Other information that is described in subdivision (e) of Section 1798.80, such as nationality and gender (this information is being collected in the consumer context rather than the employer context). This information is collected directly from the user.

We may disclose each category of personal information listed to each entity listed in the “DISCLOSING YOUR INFORMATION TO THIRD PARTIES” section above. MP Technology Services does not sell your personal information in its ordinary course of business and will never sell your personal information to third parties without your explicit consent.

Rights under the CCPA

If you are a California resident and the CCPA does not recognize an exemption that applies to you or your personal information, you have the right to:

• Request we disclose to you free of charge the following information covering the 12 months preceding your request:
  • the categories of personal information about you that we collected;
  • the categories of sources from which the personal information was collected;
  • the purpose for collecting personal information about you;
  • the categories of third parties to whom we disclosed personal information about you and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about you; and
  • the specific pieces of personal information we collected about you;
• Request we delete personal information we collected from you, unless CCPA recognizes an exemption; and
• Be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or deny goods or services to you when you exercise your rights under the CCPA.

We aim to fulfill all verified requests within 45 days pursuant to the CCPA. If necessary, extensions for an additional 45 days will be accompanied by an explanation for the delay.

How to exercise your rights

You can exercise your rights by contacting us via [email protected] so that we may consider your request.

If you are a California resident, you may designate an authorized agent to make a request to access or a request to delete on your behalf. We will respond to your authorized agent's request if they submit proof that they are registered with the California Secretary of State to be able to act on your behalf, or submit evidence you have provided them with power of attorney pursuant to California Probate Code section 4000 to 4465. We may deny requests from authorized agents who do not submit proof that they have been authorized by you to act on their behalf, or are unable to verify their identity.

Vermont Privacy Rights

Vermont residents have certain rights in relation to their personal information, subject to limited exceptions. Under Vermont law, we will not share information we collect about Vermont residents with companies outside of our corporate family, unless the law allows. For example, we may share information with your consent, to service your accounts or under joint marketing agreements with other financial institutions with which we have joint marketing agreements. We will not share information about your creditworthiness within our corporate family except with your consent, but we may share information about our transactions or experiences with you within our corporate family without your consent.