Home » Privacy Policy

NEXO PRIVACY POLICY

I. INTRODUCTION

This Nexo Privacy Policy (the "Privacy Policy") governs the privacy relations between you ("Client" or "you") and any holding company, subsidiary or entity belonging to the Nexo group of companies ("Nexo" or "we"), in regard to how we process and protect your personal data as you use the Nexo Services provided on any Nexo website, including https://nexo.com/ (the "Website"), mobile application(s), Nexo application programming interfaces ("APIs") or third party applications relying on our API (together, our "Apps"), and any other official Nexo communication channel, including the content and services made available on or through the same, and any updates, upgrades, and versions thereof, and constitutes a legally binding agreement (the "Agreement") between Nexo and you. We encourage you to seek out and read the Privacy Policy to understand how the information that we collect about you is used and protected.

The Privacy Policy is reviewed regularly to ensure that any new services or updates, as well as any changes to our business model and practices are taken into consideration. We will alert you of material changes by, for example, placing a notice on the Website, the Nexo Platform and/or by sending you an email. Your continued use of the Nexo Platform after we make changes is deemed to be acceptance of those changes, so please review the Privacy Policy periodically for updates.

Unless stated otherwise herein, references shall be made to the Nexo Terms of Service, Nexo Cookies Policy, Nexo Chat Terms of Service, Straight Arrow Card Provider General Terms and Conditions,and any other terms and conditions governing the use of the Nexo Platform and the Nexo Services (jointly the "Nexo General Terms"). All capitalised terms not defined herein, shall have the same meaning as the one given to them in the Nexo General Terms, as the case may be.

II. DEFINITIONS

• Controller means any holding company, subsidiary or entity belonging to the Nexo group of companies, which may have the capacity of a personal data controller for the purpose of this Privacy Policy;
• Processor means a natural or legal person, public authority, agency or other body which processes personal data when it processes data on behalf of the Controller;
• Personal Data means any information relating to an identified or identifiable natural person ("Data Subject");
  an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or to one or more factors specific to that natural person;
• Privacy Laws means any applicable personal data protection legislation;
• Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data.

III. INFORMATION WE COLLECT

Nexo may collect the following types of Personal Data when you visit the Website, the Apps, register on the Nexo Platform, use the Nexo Services, and when you interact and communicate with Nexo on the Website or through the Apps:

Client-provided information

• Identification information: full name, personal identification number, tax number, date, place and/or country of birth, country of residence, copies of your identification document (passport, ID or driver's licence) - front and back, gender, email address, PEP status (Politically Exposed Persons), indicators of your social status or official position held, sanctions status;
• Contact and communication information: permanent and current address, telephone number, social media profiles, tags and handles, messages in any social platform or communication channel or medium;
• Labour status: occupation, industry, employment status;
• Financial information: bank account number, digital asset wallet, source of funds or Digital Assets transaction history, assets on the Nexo Platform;
• Biometric data: biometric information generated based on photos or videos of you and your identification document(s) necessary for the purpose of identity verification;
• Other information: any information that you provide to Nexo at your own discretion. This may include any information you have voluntarily provided to a Digital Agent in accordance with the Nexo Chat Terms.

Information we collect automatically

When you visit the Nexo Platform, we automatically collect the following information:

• App, browser, and device information: information about the device, operating system, and browser you use to access your Nexo Account, including your IP address and/or other characteristics or identifiers;
• Product usage information: activity information, including information about what you view or interact with when using the Nexo Services and service-related diagnostic and performance information;
• Information from cookies and similar technologies: as described in our Cookies Policy.

Information we get from third parties

Nexo may receive Personal Data about you from third parties such as payment processors, compliance service providers assisting with anti-money laundering (AML), fraud, and security matters, and information that can be lawfully accessed from public sources. For example:

• Financial institutions: Banks involved in processing your transfers may share basic personal details (such as your name and address) together with financial information, including your account number and related transaction data.
• Card-issuing partners: Our card-issuing partners supply us with transaction records and fraud-risk indicators so that we can display your card activity, investigate potential disputes, and meet applicable regulatory obligations.
• Risk and compliance service providers: External partners may confirm identity attributes and supply information relevant to fraud, security, sanctions, AML, or other compliance matters.
• Public sources: We may access and retain information recorded on blockchains, other publicly available ledgers, or otherwise accessible in the public domain.

Nexo receives Personal Data from third parties for the purposes of compliance with its legal obligations, and the provision of contractual obligations in relation to the requested services. These third parties may collect Personal Data on behalf of Nexo, or act as Controllers in accordance with their own privacy policies. Some of these third parties may have obtained your data from publicly daccessible sources.

Please note that if you refuse to provide Personal Data when requested, especially where we need to collect it by law, or under the terms of a contract we have or are looking to enter into with you, we may not be able to perform the relevant contract, including the ability to offer or continue to provide the Nexo Services to you.

IV. PURPOSES AND LEGAL BASIS FOR PROCESSING

Nexo processes Personal Data only in accordance with applicable Privacy Laws and this Privacy Policy. Nexo collects and processes your Personal Data in a legitimate and transparent manner under the Privacy Laws, and namely:

• for the purpose of concluding and/or implementing a contract with you;
• to fulfil our obligations under the applicable legislation;
• for the purposes of our legitimate interests, except when your interests and rights take precedence over Nexo's legitimate interests; or
• based on your consent, where necessary - in the event your consent is required, Personal Data Processing shall commence only after receipt of such consent.

The table below sets out the processing purposes, their legal justification, and the categories of Personal Data involved.

V. AUTOMATED DECISION MAKING AND PROFILING

Automated decision-making refers to decisions made solely by technological means without human involvement, including profiling. Nexo may rely on automated decision-making in certain processes because it:

• enhances consistency and fairness by reducing the potential for human error or bias;
• enables faster and more efficient decision-making, thereby improving service delivery;
• supports fraud prevention and responsible lending by reducing the risk of Clients failing to meet loan obligations;
• facilitates customer interaction through innovative Digital Agent technologies.

Automated decision-making may occur in:

• Identity verification: automated checks on identification documents and biometric data during onboarding.
• Account opening: automated approval or rejection of applications, subject to compliance checks.
• Fraud and AML monitoring: automated detection of unusual patterns of activity, sanctions screening, and other security checks.
• Crypto credit decisions: automated assessment of LTV ratios or other risk indicators relevant to Nexo's lending services.
• Service personalization: automated recommendations based on usage data and transaction history.

Automated decisions may be based on:

• Client-provided information (e.g., identification data, financial data);
• Data observed during use of the Nexo Platform (e.g., transactional or location data);
• Inferred or derived data (e.g., LTV ratios).

VI. SHARING PERSONAL DATA WITH THIRD PARTIES

Nexo may disclose Personal Data to carefully selected third parties outside of Nexo, but only where such disclosure is lawful, limited to the necessary scope, and subject to appropriate safeguards. Any such disclosure is made in accordance with applicable Privacy Laws, this Privacy Policy, and the Nexo General Terms.

Nexo may share Personal Data with the following categories of external third parties:

• Banking and payment partners: to enable the topping up of funds, execution of payments, and withdrawals. These include banks, card providers, acquirers, account information service providers, and alternative payment processors.
• Compliance and risk management providers: to perform identity verification, (KYC) checks, anti-money laundering AML screening, sanctions monitoring, and fraud detection.
• Card-issuing partners: to provide payment card services. Such partners may act as independent controllers for their own regulatory obligations (e.g., fraud prevention, AML checks).
• Third-party providers of AI technology: to provide the Chat Service, in line with Chat Terms of Service;
• Auditors, consultants, and advisors: including legal, tax, compliance, and accounting professionals, subject to strict confidentiality obligations.
• Marketing and advertising platforms: for lawful marketing purposes, including online campaigns, subject to your consent or applicable legal bases. No Personal Data will be shared with third parties for their independent marketing or promotional purposes.
• Regulators, courts, and law enforcement authorities: where required by Privacy Laws or other applicable regulation, including but not limited to financial supervisory authorities, tax agencies, police, and judicial authorities.

In certain cases, third parties to whom Nexo discloses Personal Data may act as independent data controllers for specific processing activities (e.g., card-issuing partners, banks, or governmental authorities). In such cases, those third parties are responsible for their own compliance with applicable Privacy Laws.

The Nexo Platform may contain links to third-party websites, plug-ins, or applications. Clicking on such links may allow third parties to collect or share Personal Data. Nexo does not control these third-party websites and is not responsible for their processing of Personal Data. We encourage you to review the privacy notices of each third-party website you visit.

VII. TRANSFERS

When transferring Personal Data, we are committed to ensuring that the data importer maintains materially similar security measures for storage and Processing of Personal Data as we do. Your Personal Data may be processed, stored and transferred to third parties in the manner and amount as provided in this Privacy Policy, the contract(s) concluded between you and us, and consents you give to us from time to time.

Locations outside your home jurisdiction may be used for processing (including storing) the data we collect about you. The information we transfer may be shared with our service providers. It may include such processes as processing a payment, data analysis (including fraud, risk and compliance checks), collecting data on the use of our websites and services, for advertising purposes (including behavioural advertising), or offering support for your service or product needs. We take all reasonable action to ensure the safety of your Personal Data in agreement with this Privacy Policy and applicable local and international legislation. The legal basis for international data transfers depends on your home jurisdiction. If Personal Data of individuals located in the European Economic Area (EEA) or the United Kingdom (UK) is transferred to a country that does not provide a level of data protection equivalent to that of the EU/EEA or the UK, Nexo will ensure that the data is appropriately protected by using contractual arrangements with strict data protection safeguards or other lawful transfer mechanisms recognised under applicable Privacy Laws. For more information, you can contact Nexo's Data Protection Officer (DPO) at dpo@nexo.com.

VIII. DIRECT MARKETING

Subject to applicable Privacy Laws, Nexo may from time to time send direct marketing communications about the Nexo Services and related offerings to existing Clients, or to individuals who have subscribed to receive updates. Such communications may be sent by email, push notifications, or other electronic means, in accordance with applicable Privacy Laws.

You may opt out of receiving marketing communications at any time:

• by using the unsubscribe link included in each communication; or
• by contacting Nexo's Data Protection Officer (DPO) at dpo@nexo.com.

If you opt out, Nexo will retain your contact details on a suppression list to ensure that you do not receive further marketing communications, except where you have expressly opted back in.

IX. DATA SECURITY

Personal Data collected by Nexo through the Nexo Platform or otherwise is stored on secure servers, hosted in a cloud environment in the European Union (EU). Nexo is certified under ISO/IEC 27001 and SOC 2 Type 2 and implements appropriate technical and organisational measures designed to protect Personal Data against accidental loss, unauthorised access, alteration, or disclosure. These measures include, among others, network safeguards such as firewalls and encryption, regular malware scanning, and continuous monitoring of systems.

Access to Personal Data is strictly limited to employees, contractors, and authorised third parties who require such access to perform their duties or comply with legal obligations. All such individuals are subject to confidentiality obligations and receive regular training on data protection and information security. Access rights are carefully screened, granted on a need-to-know basis, and periodically reviewed.

In the event of a personal data breach resulting in the destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, Nexo will, where required under applicable Privacy Laws, notify the competent data protection authority and affected individuals without undue delay. Such notification will include sufficient information to enable affected individuals to take protective measures. For additional details about Nexo's security practices, please visit the security panel on the Nexo Website.

To help maintain security, Clients are responsible for keeping their Nexo Account credentials confidential. Nexo employees will never ask for passwords or authentication codes. Clients should also exercise caution when accessing their Nexo Account from shared or unsecured devices.

X. STORAGE AND RETENTION

Nexo retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or to comply with legal, regulatory, or contractual obligations. When Personal Data is no longer required, Nexo will securely delete it or anonymise it so that individuals can no longer be identified.

Depending on the context, Personal Data may be retained for different reasons, including:

• Marketing suppression: If you opt out of receiving marketing communications, Nexo will retain your contact details on a suppression list to ensure you do not receive further communications, unless you later choose to opt back in.
• Contractual and operational purposes: Account and transaction information may be retained for the duration of your relationship with Nexo and for a reasonable period afterwards, in line with industry standards, contractual obligations, or legitimate interests (such as preventing abuse or resolving disputes).
• Legitimate business interests: Some Personal Data may be retained to support fraud prevention, product and service improvement, record-keeping, handling complaints, or enforcing legal rights.
• Legal and regulatory compliance: Nexo is subject to AML and other regulations that may require retention of certain Personal Data for at least five (5) years after the end of the Client relationship or the date of a specific transaction. This period may be extended if required by Applicable Law.
• Third-party processing: Where Personal Data is processed on Nexo's behalf by third-party providers, they are contractually required to retain and protect it in line with this Privacy Policy and applicable Privacy Laws.

In some cases, Nexo may need to retain Personal Data beyond the periods outlined above, for example where deletion is not possible for legal, regulatory, or technical reasons. In such cases, Nexo will continue to ensure that the Personal Data is appropriately safeguarded.

XI. YOUR RIGHTS

Nexo will respond to any request to exercise your rights as a Data Subject without undue delay, and in any case within the timeframes required by applicable Privacy Laws (normally within one month, extendable by two further months where necessary). You may exercise the following rights to the extent permitted by applicable Privacy Laws:

• Access: You have the right to obtain confirmation as to whether Nexo processes Personal Data concerning you, and, if so, to request access to a copy of that data together with details of how it is processed.
• Rectification: You have the right to request correction of any inaccurate Personal Data and to have incomplete data completed. If Nexo has disclosed the data to third parties, those parties will be informed where possible.
• Erasure: You have the right to request deletion of your Personal Data in certain circumstances. This right may be limited by Nexo's legal or regulatory obligations (for example, under AML laws). Where feasible, Nexo will inform third parties to whom your data has been disclosed of your request.
• Restriction of processing: You have the right to request the restriction of processing of your Personal Data, for example where you contest its accuracy or object to its processing. Nexo may continue to store the data but will not process it further without your consent, except as permitted by Privacy Laws.
• Portability: You have the right to receive Personal Data you have provided to Nexo in a structured, commonly used, and machine-readable format, and to transmit that data to another Controller, where technically feasible.
• Objection: You have the right to object at any time to the processing of your Personal Data:
  • for direct marketing purposes (in which case the data will no longer be processed for such purposes); or
  • where processing is based on Nexo's legitimate interests, unless Nexo can demonstrate that the processing is based on a legal obligation or is necessary for the performance of a contract.
• Automated decision-making and profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects for you, except where the decision is necessary for a contract with Nexo, authorised by law, or based on your explicit consent. In such cases, you may contest the decision, express your point of view, and request human intervention.
• Withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before the withdrawal.
• Complaint: You have the right to lodge a complaint with a competent data protection authority if you believe that your rights have been infringed. Where possible, Nexo encourages you to first contact Nexo's DPO so that concerns can be addressed directly.

To protect your privacy, Nexo may need to verify your identity before responding to your request. We will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests as may be required by applicable Privacy Laws. Depending upon the circumstances and the nature of the request, Nexo may not be permitted to provide access to certain Personal Data or may be unable to fully comply; for example, producing your information may reveal the identity of another individual.

You will not have to pay a fee to exercise the rights listed above. However, requests that are manifestly unfounded or excessive may be refused or subject to a reasonable fee, in accordance with applicable Privacy Laws. Please note that any request concerning Personal Data which is publicly available should be submitted directly to the third-party supplier of that information.

XII. CONTACT US

Nexo values your privacy. If you have any comments or questions about this Privacy Policy, Nexo's handling of your Personal Data, a possible Personal Data Breach, or if you wish to exercise your rights, please contact Nexo's DPO at dpo@nexo.com.

When submitting a request, please include the following information to help Nexo process it efficiently:

• your full name;
• your preferred communication channel (if none is specified, email will be used by default);
• your country of residence;
• if applicable, the type of right you wish to exercise;
• a detailed description of your request.

Nexo treats all requests and complaints with confidentiality and will make reasonable efforts to respond in line with applicable Privacy Laws.

If you believe that Nexo has not adequately addressed your concern, you have the right to lodge a complaint with your local data protection authority. For individuals located in the EEA, a list of supervisory authorities is available on the website of the European Data Protection Board (EDPB).

XIII. MISCELLANEOUS

Nexo Services are not directed to individuals under the age of 18 or under the legal age required to enter into a binding contract with Nexo, whichever is higher ("Children"). Nexo does not knowingly collect or process the Personal Data of Children.

If Nexo becomes aware that it has inadvertently collected Personal Data from a Child, Nexo will take legally permissible steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a Child has provided Personal Data to Nexo, please contact Nexo's DPO at dpo@nexo.com.