Privacy Policy

Introduction

This Privacy Policy explains how Alea Group AG (hereinafter: “Alea”, “we”, “our” or “us”) collects, uses, stores, and protects your personal data when you access our website aleagroupag.ch or use any of our services.

We are committed to ensuring the confidentiality, integrity and availability of your personal data, in compliance with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the General Data Protection Regulation (GDPR).

Data Controller

The data controller is:

• Alea Group AG
• Rue du Mont-Blanc 11
• 1201 Geneva, Switzerland
• CHE-445.359.847

Scope of Application

This policy applies to:

• Visitors of our website
• Clients and merchants using our payment infrastructure, and individual clients using our Exchange services
• Natural persons linked to corporate clients (e.g., UBOs, directors)
• Business partners, suppliers, and service providers

What Personal Data We Collect

Identification Data

• Full name, nationality, date of birth
• Address, phone number, email
• Government-issued ID (passport, national ID)

Biometric Data

Facial images and liveness check results, collected during online identification to verify that you are the holder of the identity document.

Compliance Data

• KYC documentation
• Proof of source of funds
• Sanctions and PEP screening results

Technical Data

• IP address, browser type
• Device identifiers
• Log data (time of access, page interactions)

Transactional Data

• Payment history
• Usage of payment gateways
• Transaction metadata

Digital Asset Data

• Wallet addresses provided for the receipt of digital assets
• Blockchain transaction records associated with your orders
• Digital asset type and quantity per transaction

Purpose of Processing

Data Retention

We retain personal data only as long as necessary to fulfil the purposes for which it was collected or as required by Swiss law, in particular for 10 years after the end of the business relationship or the completion of the transaction under Art. 7 para. 3 of the Anti-Money Laundering Act (AMLA), and for 10 years for accounting records under the Swiss Code of Obligations. At the end of the retention period, personal data is deleted or anonymised.

Data Sharing

We may share your data with:

• Regulatory authorities (e.g., FINMA, MROS) when legally required
• SO-FIT, our OAR, for compliance supervision
• Service providers that process data on our behalf and on our instructions, under written agreements, such as identity verification and AML screening providers, transaction monitoring and blockchain analytics providers, and IT and hosting providers.
• Other recipients that process data as independent controllers, such as banks and payment institutions, liquidity providers, and the virtual asset service provider (VASP) receiving a crypto-asset transfer. Where you request a transfer to a wallet held with another VASP, we transmit your name, your wallet address and your address (or your date and place of birth) to that VASP, as required by Art. 10 of the FINMA Anti-Money Laundering Ordinance (Travel Rule). Our identity verification provider may also process certain data, such as wallet addresses, as an independent controller for fraud prevention and Travel Rule purposes, under its own privacy notice.

Data Transfers Abroad

Personal data is disclosed in particular to recipients in member states of the European Union and the European Economic Area and in the United Kingdom. Identity verification data is stored on servers located in the European Union. Where our service providers engage sub-processors, personal data may also be disclosed to the United States of America, the United Arab Emirates, Singapore and Brazil. Where you request a crypto-asset transfer to a wallet held with another VASP, the transfer information is disclosed to the country in which that VASP is established.

Personal data is disclosed abroad only to countries that provide an adequate level of data protection as determined by the Swiss Federal Council, or on the basis of appropriate safeguards, in particular standard contractual clauses recognised by the Federal Data Protection and Information Commissioner, or where an exception under Art. 17 FADP applies, in particular where the disclosure is necessary for the performance of the contract with you.

Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Individual user accounts, multi-factor authentication and role-based access control
• Selection and supervision of service providers, including independent security certifications where available
• Data minimisation and secure deletion at the end of the retention period

Your Rights as a Data Subject

Under the revFADP, you have the following rights:

• Access to your data
• Rectification of inaccurate or outdated data
• Erasure where permitted by law
• Objection to processing (in certain cases)
• Data portability (if processing is automated and based on consent or contract)

These rights may be restricted where required by law, in particular by anti-money laundering legislation. Information on reports to the Money Laundering Reporting Office Switzerland (MROS) is not disclosed (Art. 34 AMLA).

To exercise your rights, please contact us at rudolf.h@aleagroupag.ch with proof of identity.

Use of Cookies

We use cookies for technical operation, analytics, and site optimisation.

You can control cookie settings through your browser.

Details are available in our Cookie Policy.

Automated Decision-Making

During onboarding, certain applications may be refused automatically, for example where an identity document cannot be verified, the applicant is resident in a country we do not serve, or a sanctions match is identified. You may request that such a decision be reviewed by a member of our staff and express your point of view by contacting us at the address below. We also assign each client a risk classification, as required by anti-money laundering legislation.

Updates to This Policy

This Privacy Policy may be updated periodically. We encourage users to review this page regularly to stay informed of changes. The date of the latest version is always indicated at the top.

Contact

Data Protection Officer (DPO): Rudolf Hengl

Alea Group AG – Rue du Mont-Blanc 11, 1201 Geneva, Switzerland

Email: rudolf.h@aleagroupag.ch