Privacy Policy

1. Information We Collect

1.1 Account Information (All Users)

• Email address
• Wallet address (public blockchain address)
• Username (optional)
• Account creation date

1.2 Verification Information (Tier 2+ Users)

For users requiring identity verification (transactions ≥ NZD $1,000, service providers, enterprise clients):

• Government-issued photo ID (passport, driver's license, national ID)
• Selfie with ID (for liveness verification)
• Proof of address (utility bill, bank statement — service providers only)
• Business registration documents (service providers, if applicable)
• Tax identification number (service providers)

1.3 Transaction Information

• Transaction hashes (public blockchain data)
• Transaction amounts and timestamps
• Escrow contract details
• RFP and RTS submissions

1.4 Technical Information

• IP address
• Browser type and version
• Device information (operating system, device type)
• Usage data (pages visited, features used, time spent on Platform)
• Log files and analytics data

1.5 Blockchain Data

Certain information is inherently public and immutable on the blockchain, including transaction hashes, wallet addresses, and smart contract interactions. This data is part of the public ledger and cannot be deleted or modified by BitRegalo.

2. Purpose of Collection (IPP 1)

We collect personal information for the following lawful purposes:

• To provide and maintain Platform services
• To process transactions and verify digital assets
• To authenticate users and prevent fraud
• To comply with legal obligations (AML/CFT Act for high-value transactions)
• To communicate with you about your account and Platform updates
• To improve Platform features and user experience
• To monitor and analyze usage patterns
• To enforce our Terms of Service

3. Source of Information (IPP 2)

We collect information from:

• You directly: When you register, submit verification documents, or use Platform features
• Automated collection: Through cookies, log files, and analytics tools
• Third-party providers: Identity verification services (e.g., SumSub)
• Public blockchain: Transaction data that is publicly available

4. Use of Information (IPP 10)

We use your information only for the purposes for which it was collected:

• Account management and authentication
• Transaction processing and escrow management
• Identity verification (where required)
• Customer support and communication
• Platform improvement and development
• Security monitoring and fraud prevention
• Legal compliance and regulatory reporting

5. Disclosure of Information (IPP 11)

We do NOT sell, trade, or rent your personal information. We may disclose information only in the following circumstances:

• Service Providers: Third-party vendors who perform services on our behalf (hosting, verification, analytics, customer support). These providers are contractually obligated to protect your data.
• Legal Requirements: When required by law, court order, or government authority (e.g., AML/CFT reporting obligations).
• Business Transfers: In connection with a merger, acquisition, or sale of assets.
• With Your Consent: When you explicitly authorize disclosure.
• Protection of Rights: To protect the rights, property, or safety of BitRegalo, users, or the public.

6. Data Storage & Security (IPP 5)

We implement appropriate technical and organizational measures to protect your information:

• Encryption at rest and in transit (TLS 1.3, AES-256)
• Secure data centers with physical access controls
• Regular security audits and penetration testing
• Access controls and authentication for employees
• Incident response procedures for data breaches

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your information as follows:

• Account information: Duration of account + 7 years after closure (AML/CFT Act Section 48)
• Verification documents: 7 years after account closure (AML/CFT Act Section 48)
• Transaction records: 7 years after transaction (legal requirement)
• Technical logs: 12 months (for security and analytics)
• Blockchain data: Permanent (cannot be deleted — public ledger)

8. Your Rights (IPPs 6, 7, 8)

Under the Privacy Act 2020, you have the following rights:

• Access (IPP 6): You may request access to the personal information we hold about you.
• Correction (IPP 7): You may request correction of inaccurate or incomplete information.
• Accuracy (IPP 8): We take reasonable steps to ensure information is accurate, up-to-date, and complete before use.
• Deletion: You may request deletion of your personal information, subject to legal retention requirements (e.g., AML/CFT Act).
• Objection: You may object to certain processing of your information.
• Data Portability: You may request a copy of your information in a portable format.

To exercise these rights, contact us at privacy@bitregalo.com or through our support channels.

9. Cookies & Tracking (IPP 3)

We use cookies and similar technologies to:

• Remember your preferences and settings
• Authenticate your session
• Analyze Platform usage and performance
• Improve user experience

You can control cookies through your browser settings. Disabling cookies may affect Platform functionality.

10. International Data Transfers (IPP 12)

Your information may be transferred to and processed in countries other than New Zealand. These countries may have different data protection laws. We ensure appropriate safeguards are in place, including:

• Contractual clauses requiring equivalent privacy protection
• Data processing agreements with service providers
• Compliance with New Zealand's cross-border disclosure requirements

11. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us and we will delete it.

12. Data Breaches

In the event of a privacy breach that poses a risk of serious harm, we will:

• Notify the Privacy Commissioner as soon as practicable
• Notify affected individuals as soon as practicable
• Take steps to contain the breach and prevent further harm
• Investigate the cause and implement corrective measures

13. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or Platform announcement. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

15. Complaints

If you believe your privacy has been breached, you may:

• Contact us directly to resolve the issue
• Complain to the New Zealand Privacy Commissioner
• Visit: www.privacy.org.nz or call 0800 803 734

16. Contact Information

For privacy-related inquiries or to exercise your rights, please contact:

BitRegalo® Limited
Privacy Officer
Email: privacy@bitregalo.com
Website: bitregalo.com
New Zealand Registration: 7699356