Privacy Policy

This Privacy Policy explains how Connectee OÜ (“Connectee”, “we”, “us” or “our”) collects, uses, stores and protects personal data when you visit our website, access our platform, hold or manage an account with us, communicate with us or otherwise interact with our services.
This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy, Complaints Handling Policy and any other applicable notices or policies made available on our website.

1. Data Controller
The data controller responsible for the processing of your personal data is:
Connectee OÜ
Registry code: 14891451
Address: Narva mnt 7, 10117 Tallinn, Estonia
Email: support@connectee.io
Website: https://connectee.io/

For privacy-related questions or requests, please contact us at support@connectee.io.
Connectee remains the controller of personal data processed in connection with existing client accounts, account closure, withdrawal handling, AML/CTF checks, sanctions screening, safeguarding, legal and regulatory obligations, complaints and record retention.
As part of the current controlled account closure process, Connectee is not migrating clients to another service provider or receiving entity, and client personal data will not be transferred to another service provider or receiving entity for migration purposes.

2. Scope of This Privacy Policy
This Privacy Policy applies to personal data relating to:

• clients and prospective clients;
• authorised representatives, directors, beneficial owners, employees and authorised users of legal entity clients;
• persons involved in transactions, withdrawals or transfers;
• persons who contact Connectee or submit requests, complaints or enquiries;
• visitors to Connectee’s website.

Where a client is a legal person, we may process personal data relating to individuals connected with that client, including authorised representatives, directors, beneficial owners, employees, agents, contact persons and authorised users.

3. Personal Data We Collect
Depending on your relationship with Connectee and the services or processes involved, we may collect and process the following categories of personal data:

• identification data, such as name, surname, date of birth, nationality, personal identification number and identity document details;
• contact data, such as email address, phone number, residential address, business address and correspondence details;
• corporate and role-related data, such as company name, registry details, position, authority to represent a legal person, ownership and control information, beneficial ownership information and authorised user details;
• KYC/KYB and due diligence data, including identity verification information, source of funds, source of wealth where relevant, business activity, expected account activity and risk assessment information;
• sanctions, PEP, adverse media, AML/CTF and fraud prevention screening results;
• account and service data, including account status, wallet addresses, deposit and withdrawal details, transaction history, balance information, account restrictions and closure-related records;
• technical and usage data, such as IP address, browser type, device identifiers, login data, access logs, security logs and website usage information;
• communication data, including emails, support requests, complaints, notices, call notes and other correspondence;
• documents and evidence provided by you or generated during checks, reviews, investigations, withdrawal handling, account closure or complaint handling;
• information required under applicable crypto-asset transfer, AML/CTF, sanctions, safeguarding or regulatory requirements.

During the controlled account closure process, we may also process account status, balance information, withdrawal status, wallet screening results, closure evidence, support correspondence, internal approval records and other information necessary to complete withdrawal handling, account restriction, account closure, post-deadline balance handling and related legal, AML/CTF, sanctions, safeguarding and regulatory steps.
We collect personal data directly from you, from legal entity clients, from authorised representatives, from your use of our services or website, from transaction and wallet activity, and from third-party service providers such as identity verification, screening, blockchain analytics, custody, payment, IT, hosting, compliance and support providers.

4. Why We Process Personal Data
We process personal data for the following purposes:

• to identify and verify clients, authorised representatives, directors, beneficial owners and authorised users;
• to perform KYC/KYB, AML/CTF, sanctions, PEP, adverse media, fraud prevention and risk assessment checks;
• to manage client accounts and provide or support available account functionality;
• to process withdrawals, transfers, balance handling and account closure steps;
• to comply with legal, regulatory, AML/CTF, sanctions, safeguarding, accounting, tax, reporting and record retention obligations;
• to monitor transactions and wallet activity where required by law or internal risk controls;
• to detect, prevent and investigate fraud, misuse, unauthorised access, suspicious activity, sanctions exposure or other prohibited activity;
• to communicate with you about your account, account closure, withdrawal deadlines, verification requests, security alerts, service notices, complaints and other important matters;
• to respond to your questions, requests, complaints or data subject rights requests;
• to maintain the security, integrity and resilience of our website, systems and records;
• to establish, exercise or defend legal claims and protect Connectee’s legal rights;
• to maintain audit trails, closure evidence, internal approvals, MLRO decisions and other records required for accountability.

During the controlled account closure process, personal data may also be processed for withdrawal-only access, balance reconciliation, account restriction, account closure, post-deadline balance handling, evidence retention and related AML/CTF, sanctions, safeguarding, legal and regulatory steps.

5. Legal Bases for Processing
We process personal data in accordance with the GDPR, applicable Estonian data protection law and other Applicable Law, relying on the following legal bases:
Contract or steps before entering into a contract
Where processing is necessary to provide services, manage your account, process account-related requests, handle withdrawals, communicate with you or administer the contractual relationship.
Legal obligation
Where processing is necessary to comply with AML/CTF, sanctions, counter-terrorist financing, safeguarding, accounting, tax, regulatory, reporting, record retention, complaints handling or other legal obligations.
Legitimate interests
Where processing is necessary for Connectee’s legitimate interests, including fraud prevention, platform and system security, operational resilience, risk management, internal governance, legal claims, service administration and controlled account closure, provided that such interests are not overridden by your rights and freedoms.
Consent
Where we rely on your consent, for example for certain cookies, analytics or marketing communications, where applicable. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

• Identification, KYC/KYB and beneficial ownership data — Client identification, due diligence, onboarding, ongoing monitoring and closure-related verification (Legal basis: Legal obligation; contract)
• AML/CTF, sanctions, PEP, adverse media, fraud and transaction monitoring data — AML/CTF, sanctions compliance, fraud prevention, risk assessment and suspicious activity review (Legal basis: Legal obligation; legitimate interests)
• Account, wallet, transaction, withdrawal and balance data — Account administration, withdrawals, transfers, balance handling, safeguarding and account closure (Legal basis: Contract; legal obligation; legitimate interests)
• Communication and support data — Client support, notices, complaints, account closure communication and evidence retention (Legal basis: Contract; legal obligation; legitimate interests)
• Technical and usage data — Website operation, security, access logs, fraud prevention and system integrity (Legal basis: Legitimate interests; legal obligation where applicable)
• Cookie and analytics data — Website functionality, analytics and user experience (Legal basis: Consent where required; legitimate interests where permitted)
• Marketing preferences, if applicable — Managing marketing opt-ins, opt-outs and communication preferences, where applicable (Legal basis: Consent where required; legitimate interests where permitted by law)

6. AML/CTF, Sanctions and Transaction Monitoring
Connectee is required to process certain personal data to comply with AML/CTF, sanctions, fraud prevention, crypto-asset transfer information requirements, including Travel Rule requirements where applicable, and other regulatory obligations.
This may include identity data, corporate data, beneficial ownership data, wallet addresses, transaction details, source of funds information, screening results, risk scoring, blockchain analytics information, verification records and communication records.
If required information is missing, incomplete or inaccurate, Connectee may be unable to process a withdrawal, return assets, complete account closure or provide other account-related support. Connectee may also delay, restrict, block or refuse a transaction, withdrawal or account action where required by Applicable Law, AML/CTF obligations, sanctions requirements, internal risk controls or instructions from competent authorities.

7. Automated Tools, Risk Scoring and Human Review
Connectee may use automated tools, screening systems, blockchain analytics, risk scoring and fraud detection tools to support AML/CTF, sanctions, fraud prevention, transaction monitoring and account risk assessment.
These tools may help identify risk indicators, unusual activity, sanctions exposure, high-risk wallets, suspicious transaction patterns or other issues requiring review.
Where a decision may significantly affect you, such as a withdrawal delay, account restriction, request for additional verification or refusal to process a transaction, Connectee does not rely solely on automated processing where human review is required by law or internal procedures. You may contact us if you wish to request additional information or human review, subject to applicable legal restrictions.

8. Who We Share Personal Data With
We may share personal data with third parties where necessary for the purposes described in this Privacy Policy, including:

• identity verification and KYC/KYB service providers;
• sanctions, PEP, adverse media, AML/CTF and fraud screening providers;
• blockchain analytics and transaction monitoring providers;
• custody, wallet infrastructure, payment, e-money institution, settlement and safeguarding partners;
• IT, cloud hosting, cybersecurity, system administration and support providers;
• auditors, legal advisers, tax advisers, consultants and other professional advisers;
• competent authorities, regulators, law enforcement agencies, courts, tax authorities or financial intelligence units where required by law;
• other obliged entities where required for Travel Rule, AML/CTF, sanctions or fraud prevention purposes.

For identity verification, KYC/KYB, AML/CTF, sanctions screening, fraud prevention and required regulatory screening purposes, Connectee may use third-party service providers, where applicable. Such service providers may process identity documents, corporate documents, verification data, screening results, wallet-related information and related verification information in accordance with applicable data protection requirements and the contractual safeguards agreed with Connectee.
We require service providers acting on our behalf to process personal data only under our instructions, to apply appropriate security measures and to comply with applicable data protection requirements.
Connectee does not sell personal data.

9. International Data Transfers
Some of our service providers or technical systems may process personal data outside the European Economic Area.
Where personal data is transferred outside the European Economic Area, Connectee takes steps to ensure that appropriate safeguards are in place. These may include:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses approved by the European Commission;
• additional technical, organisational or contractual safeguards where required.

You may contact us at support@connectee.io if you would like more information about the safeguards applied to international transfers. Some of our service providers or technical systems may process personal data outside the European Economic Area.

10. How Long We Keep Personal Data
Connectee retains personal data only for as long as necessary for the purposes for which it was collected, including to comply with legal, regulatory, AML/CTF, sanctions, accounting, tax, safeguarding, complaints handling, dispute resolution and record retention obligations.
The main retention periods are:

• KYC/KYB, client due diligence, beneficial ownership, AML/CTF, sanctions, risk assessment and transaction monitoring records — Up to eight (8) years after the end of the business relationship or the relevant transaction date, or longer where required by Applicable Law, competent authorities, legal proceedings or regulatory obligations
• Account, wallet, transaction, withdrawal, balance handling and closure evidence records — Up to eight (8) years after the end of the business relationship or the relevant transaction date, or longer where required by Applicable Law
• Complaints, disputes, legal claims and related correspondence — For the period necessary to handle the matter and comply with limitation periods, regulatory or recordkeeping requirements
• Support and client communication records — For as long as necessary to handle the request, maintain evidence of client communication and comply with legal or regulatory obligations
• Website, technical, security and access logs — For as long as necessary for security, fraud prevention, troubleshooting, audit and legal purposes
• Cookie and analytics data — In accordance with the Cookie Policy and applicable cookie settings
• Marketing preference data — Until consent is withdrawn or the data is no longer needed for the relevant communication purpose

After the applicable retention period expires, personal data will be deleted, anonymised or securely archived in accordance with Connectee’s internal retention and deletion procedures.
Data subject rights, including erasure requests, may be limited where Connectee is required to retain certain records under AML/CTF, sanctions, safeguarding, accounting, regulatory, legal, complaints handling, dispute resolution or other record retention obligations.

11. Data Security
Connectee applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.
These measures may include access controls, encryption, authentication measures, audit logs, monitoring, secure storage, segregation of duties, backups, vendor controls, staff confidentiality obligations and internal security procedures.
Although we take reasonable steps to protect personal data, no system can be guaranteed to be completely secure.

12. Your Rights
Subject to the GDPR and applicable legal limitations, you have the following rights in relation to your personal data:

• the right to access your personal data;
• the right to receive information about how your personal data is processed;
• the right to request correction of inaccurate or incomplete personal data;
• the right to request erasure of personal data;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to data portability, where applicable;
• the right to withdraw consent where processing is based on consent;
• the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or another competent EU data protection supervisory authority.

These rights are not absolute. Connectee may be required to retain or continue processing certain personal data where necessary to comply with AML/CTF, sanctions, accounting, safeguarding, regulatory, legal, complaints handling, dispute resolution or record retention obligations.
To exercise your rights, please contact us at support@connectee.io. We may ask you to provide information necessary to verify your identity and understand your request.
We normally respond within one month. This period may be extended where permitted by law, for example if the request is complex or if we receive multiple requests.

13. Cookies
Connectee may use cookies and similar technologies on its website to ensure website functionality, improve user experience, analyse website usage, support security and remember preferences.
Where required by law, we will ask for your consent before using non-essential cookies.
You can manage or disable cookies through your browser settings. However, disabling some cookies may affect the functionality of the website or certain services.
For more information, please see our Cookie Policy.

14. Service Communications and Marketing Preferences
Connectee may send you important service, account, security, legal, regulatory, withdrawal, closure, transaction or support-related communications where necessary. These communications are not marketing communications and may be required for the administration of your account, account closure, withdrawal handling or compliance with legal and regulatory obligations.
Where permitted by law and, where applicable, based on your consent, Connectee may send marketing communications or updates. During the controlled account closure process, our communications are primarily service, account, legal, regulatory, withdrawal, closure or support-related.
You may opt out of marketing communications at any time by using the unsubscribe link in the relevant message or by contacting us at support@connectee.io.
Opting out of marketing communications does not affect our ability to send you important service, account, security, legal, regulatory, withdrawal, closure or transaction-related communications.

15. Complaints
If you have a complaint about how Connectee processes your personal data, please contact us first at support@connectee.io so that we can review and respond to your concerns.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or with another competent EU data protection supervisory authority where you have the right to do so under the GDPR.

16. Children’s Privacy
Connectee does not knowingly provide services to persons under the age of 18 and does not knowingly collect personal data from children.
If we become aware that we have collected personal data from a person under the age of 18, we will take reasonable steps to delete such data, unless retention is required by Applicable Law.

17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our operations, legal requirements, regulatory expectations, website functionality or data processing practices.
The date of the latest update will be indicated at the top of this Privacy Policy. The date of the latest update will be indicated at the top of this Privacy Policy. Where required by law, where changes are material, or where changes relate to account closure, withdrawal deadlines, withdrawal-only access, account restrictions, balance handling or cessation of active client servicing, we may notify you by email, in-account notice, website notice or other appropriate electronic means.

18. Contact Information
For any questions, requests or concerns regarding this Privacy Policy or the processing of your personal data, please contact:
Connectee OÜ
Registry code: 14891451
Address: Narva mnt 7, 10117 Tallinn, Estonia
Email: support@connectee.io
Website: https://connectee.io/