Siristars Privacy Notice – Help Center

Last Updated: January 30, 2026

Welcome to Siristars's Privacy Notice ("Privacy Notice"). Please spend a few minutes reading it carefully before providing us with any information about you or any other person.

Content

Introduction
Objective
Who We Are
Data Processing Principles
What Data We Collect About You
How We Collect Your Data
Lawfulness of Personal Data Processing
Purposes for Personal Data Processing
Disclosures of Your Data
International Data Transfers
Data Security
Data Retention
Your Legal Rights
Final Provisions

1. Introduction

Siristars ("Siristars", "we", "us", "our") respects your privacy, and we are committed to protecting your personal data. All personal data that Siristars collects, uses, or shares about you is handled in accordance with applicable laws. We are committed to safeguarding your data, and we take all necessary steps to protect it from unauthorized or unlawful processing, as well as from accidental loss, destruction, or damage. These protections include legal, organizational, technical, and physical security measures.

2. Objective

The Privacy Notice explains how Siristars processes your personal data across all types of interactions:

visiting or using our Siristars.com website or any website made available to you by us (the "Site"), or our mobile application (the "App");
use of products, services, or applications offered on our Site and App. This may include products, services, or applications provided directly by Siristars or by third-party service providers whose products, services, or applications are integrated with or hosted on our Site and App (collectively, the "Services");

This Privacy Notice applies to all personal data processing activities carried out by us across the Services, the Site, and the App.

If you provide us with information about other individuals, you are responsible for informing them about this Privacy Notice before disclosing their information to us.

It is important that you read this Privacy Notice together with any other notice or policy we may provide from time to time when we are collecting or processing personal data about you, so that you are fully aware of why and how we are using your data. This Privacy Notice supplements other notices and policies and is not intended to override them. However, if any conflict arises between this Privacy Notice and other notices and policies, the terms of this Privacy Notice shall prevail.

Our Services, Site, and App are not intended for minors under 18 years of age, and we do not knowingly collect data relating to minors.By contacting us online or by using this website and our other services, you confirm that you have read, understood, and accepted this Privacy Notice.

Third-party links

The Site and any applicable web browser, the App, or an application programming interface required to access the Services ("Applications"), may include links to third-party websites, plug-ins, and applications ("Third-Party Sites"). Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these Third-Party Sites and are not responsible for their privacy statements and policies. When you leave our Site or Applications, we encourage you to read the privacy notice or policy of every Third-Party Site you visit or use.

3. Who We Are

Controller

BTG Technology Holdings Limited is the controller responsible for the handling of your personal data that determines the means and the purposes of any processing activities that it carries out.

Data Protection Officer

Our Data Protection Officer ("DPO") is responsible for overseeing matters in relation to this Privacy Notice. If you have any questions or complaints related to this Privacy Notice or our privacy practices, or if you want to exercise your legal rights, please reach out to dpo@Siristars.com.

Representative in the EEA

For individuals in the European Economic Area, we have appointed BTGT Europe Limited, UAB (company code 307051160) as our EEA representative to act as a contact point for data protection matters. You may contact either Siristars or its EEA representative regarding any questions or requests about your personal data at dpo@Siristars.com. Please note that messages sent to this address may be jointly accessed by Siristars and its EEA representative for the purpose of handling data protection matters efficiently.

4. Data Processing Principles

Siristars is committed to ensuring that your personal data is:

processed lawfully, fairly, and transparently;
collected only for clear and legitimate purposes and not used in ways incompatible with those purposes;
adequate, relevant, and limited to what is necessary for the purposes of processing;
accurate and, where needed, kept up to date;
retained only for as long as necessary to fulfill the purposes for which it was collected; and
secured by appropriate technical and organizational measures to protect against unauthorized or unlawful processing, accidental loss, destruction, or damage.

Siristars strictly adheres to these data protection principles and requires all processors acting on its behalf to comply with the same standards.

5. What Data We Collect About You

"Personal data", or "personal information", means any information that relates to an identified or identifiable living individual. This is a broad definition which includes information you provide to us, information that is collected about you automatically, and information we obtain from third parties, and it is described below in more detail.

A "data subject" is an individual who can be identified, directly or indirectly, by personal data. This is usually by reference to an identifier such as a name, identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Different pieces of information which, when collected together, can lead to the identification of a particular individual also constitute personal data. It does not include data where the identity has been removed (anonymous data).

Depending on whether and how you use our Services, Site, or App, we will collect, use, store, and transfer different types of personal data, including but not limited to:

Category of personal data	Examples of specific pieces of personal data
Identity Data	first namemaiden namelast nameusername or similar identifierdate of birthbiometric information, including a visual image of your face and a liveness check videonational identity card, passport, driving license or other form of an identification documentID numberPersonal Customs Clearance Code (PCCC)
Social Identity Data	political backgroundclose connectionsbehavioral data
Contact Data	country of residenceemail addresstelephone numbersresidential addressshipping addressproof of address documentation
Financial Data	bank accountpayment card detailsvirtual currency accountsstored value accountssource of wealth and related details
Transactional Data	amountfeescategoryorder/delegation type and priceorder statuscurrencytransactions historyother details of any transactions you initiate or receive while using the Services, Site or App
Corporate Ownership and Management Data	personal data of natural persons related to corporate entities, including ultimate beneficial owners (UBOs), directors, shareholders, and other individuals in control or management positions
Technical Data	internet connectivity datainternet service provider’s datainternet protocol (IP) addressoperator and carrier datalogin databrowser type and versiondevice type, category and modeltime zone setting and location datalanguage dataapplication version and SDK versionbrowser plug-in types and versionsoperating system and platformdiagnostics data, such as crash logs and any other data we collect for the purposes of measuring technical diagnosticsother information stored on, or available regarding, the devices you allow us to access when you visit the Site or use the Services or the App
Profile Data	username and passwordnicknameSiristars UIDtrading Team UIDsub-account UIDreferral codeinformation on whether you have a Siristars app account and the email associated with your account(s)user levelrequests by you for products or servicesyour interests, preferences and feedbackother information generated by you when you communicate with us, for example when you address a request to our customer support
Emergency Contact Data	namesurnamerelationship with the customertelephone numberemail address
Bereavement Data	copy of death certificatenational identity card, passport, driver's license, or other form of identification document of the executor.copy of the proof the relationship with the deceasedcopy of the willcopy of probate or letters of administrationstatus of the inheritance application
Usage Data	information about how you use the Site, the Services, mobile applications, and other offerings made available by us, including:device download timeinstall timeinteraction type, time and dateevent time, name and source
Behavioral Data	pages you visittime spent on our Site or Appbrowsing patternsServices you uselogin frequencyfeatures you use most oftenyour engagement trends over timereactions to marketing campaigns
Marketing Data	preferences in receiving marketing from us or third partiescommunication preferencescontact details used for direct marketingregionlanguagedata and time of the consent to direct marketingdirect marketing consent text / purposescope of direct marketing consentmethod of how direct marketing consent was collectedstatus of direct marketing consentresponses to surveys
Social Media Data	social sign up/ log in typesocial media accountsocial media profile photonamesurnameyour commentsnumber of your followersyour emotionsother customer's actions expressed via our social media accountother customer's social media profile information shared by a customer
Blockchain Data	Wallet addressTransaction hashBlock numberTimestampSmart contract interaction dataTransferred assets and amountNetwork information
Communication Data	emailchatvideo callsvoice callstimestampscreenshotsresponses to surveys
History Data	experience using the Servicesregister of customer's actions performed on our Site and App
Other personal data that may be requested or collected by Siristars, or provided by the Customer themselves or any third party.

As explained above under Identity Data, we will also collect a visual image of your face, which we will use, in conjunction with our engaged contractors (see Section Disclosure of Your Data below), to check your identity for onboarding and fraud prevention purposes. This data falls within the scope of special categories of data.

We will only process special categories of your personal data if one of the following applies:

You have given your explicit consent;
Processing relates to personal data that is manifestly made public by you;
Processing is necessary for the establishment, exercise, or defense of legal claims;
Processing is necessary for reasons of substantial public interest under applicable law;
Other relevant conditions under applicable laws are met.

It is important that the personal data we hold about you is accurate and up to date. Please inform us promptly if your personal data changes during your relationship with us.

6. How We Collect Your Data

We use different methods to collect information from and about you, including through:

Direct interactions. You may provide us with your Identity Data, Social Identity Data, Contact Data, Financial Data, Transaction Data, Corporate Ownership and Management Data, Emergency Contact Data, Communication Data, and Marketing Data by directly interacting with us, including by filling in forms, providing a visual image of yourself via the Service, by email, or otherwise. This includes personal data you provide when you:

visit our Site or App;
apply for our Services;
create an account;
make use of any of our Services;
have given your consent or have not objected to direct marketing communications;
enter a competition, promotion, or survey, including through social media channels; or
give us feedback or contact us.

Automated technologies or interactions. As you interact with us via our Site or App, we will automatically collect Technical Data about your equipment and Behavioral Data about your browsing actions and patterns. We collect this personal data by using cookies, server logs, and other online identifiers. We will also collect Usage Data. We may also receive Technical Data and Marketing Data about you if you visit other websites employing our cookies. You may find more information about how we use cookies through the Cookie Settings and in the Cookie Policy

Social media widgets and similar links. Our Site may contain links, social media plug-ins, "widgets," "tweet," "share," and "like" buttons linked to social media platforms such as Facebook, X (Twitter), Instagram, Threads, Discord, LinkedIn, Reddit, and Telegram. By using them, you provide us with your Social Media Data, as well as Technical Data, Usage Data, and Behavioral Data.

7. Lawfulness of Personal Data Processing

We will only process your personal data when the applicable legislation allows us to. In other words, we must ensure that we have a lawful basis for such use.

Most commonly, we will process your personal data in the following circumstances:

performance of a contract: means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract; we use this basis for the provision of our Services;
legitimate interests: means our interests (or those of a third party), where we make sure we use this basis as far as your interests and individual rights do not override those interests;
compliance with a legal obligation: means processing your personal data where we need to comply with a legal obligation we are subject to;
consent: means a freely given, specific, informed, and unambiguous indication of your wishes by which you, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to you; under specific circumstances this consent should be explicit – if this is the case, we will ask for it properly;
public interest: means that processing of your personal data is necessary for substantial public interest reasons that are proportionate to the purpose(s) pursued, respecting the principles of data protection and providing for suitable and specific measures to safeguard the rights of the data subjects.

8. Purposes for Personal Data Processing

We have set out below, in table format, a description of the ways we plan to use your personal data and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Please note that the provision of your personal data is necessary for the purposes described below and may be required by law or by the terms of our contractual relationship. Failure to provide the requested information may result in our inability to enter into or perform the contract and to provide you with the requested services.

Purpose and/or activity	Categories of personal data	Legal basis for processing
To register you as a new customer	Identity DataContact DataFinancial Data	Performance of a contract
To carry out and comply with anti-money laundering requirements	Identity DataContact DataFinancial DataTransactional DataTechnical DataProfile DataSocial Identity DataCorporate Ownership and Management DataBlockchain DataCommunication Data	Compliance with a legal obligation
To process and deliver the Services (including products offered by third-party service providers with whom we work) and any App features to you, including to execute, manage, and process any instructions or orders you make through the Services	Identity DataContact DataFinancial DataTransactional DataTechnical DataEmergency Contact DataBereavement DataBlockchain DataCommunication Data	Performance of a contractConsent, if required
To prevent abuse of our Services and promotions	Identity DataContact DataFinancial DataTransactional DataTechnical DataUsage DataBehavioral DataMarketing DataCommunication DataSocial Media DataHistory Data	Legitimate interests: safeguarding the security and integrity of our Services by detecting and preventing fraud and unauthorized activities, thereby protecting both our business and our customers
To manage our relationship with you, which will include asking you to leave a review, take a survey, or keep you informed of our company's business and product development	Identity DataContact DataProfile DataTransactional DataMarketing DataCommunication DataUsage Data	Performance of a contractConsent, if required
To keep our records updated and to study how customers use our products/services	Identity DataContact DataProfile DataTransactional DataTechnical DataUsage DataBehavioral DataMarketing DataCommunications Data	Legitimate interests: to maintain accurate customer data for effective service and informed business decisions, and to enhance our offerings by understanding customer interactionsConsent, if required
To manage, process, collect, and transfer payments, fees, and charges	Identity DataContact DataFinancial DataTransactional DataBlockchain Data	Performance of a contract
To obey applicable legislation and handle complaints, including:manage risk and crime prevention involving the performance of anti-money laundering, counter-terrorism, sanctions screening, fraud, and other background checksdetect, investigate, report, and prevent financial crime in a broad sense andensure your account's security in order to honor requests regarding information and/or changes to your account	Identity DataSocial Identity DataContact DataFinancial DataTransactional DataBlockchain DataTechnical DataProfile DataUsage DataBehavioral DataCommunication DataHistory DataSensitive Data (a.k.a. Special Categories Data*) data that you give us directly or that we receive from third parties and/or publicly available sources:data which might be revealed by KYC or other background checks (for example, because it has been reported in the press or is available in public registers);data collected via facial scan as part of identity verification processes;data that is incidentally revealed by photographic ID, although we do not intentionally process this personal data.	Compliance with a legal obligationPerformance of a contractLegitimate interests: ensuring that we are not involved in dealing with the proceeds of criminal activities and do not assist in any other unlawful or fraudulent activities, as well as to develop and improve our internal systems for dealing with financial crime and to ensure effective dealing with complaints* Special Categories Data: where we process such data we rely on a consent or reasons of substantial public interest under the Seychelles AML CFT Act, the EU AML Directives, the UK AML framework and so forth.
To provide customer support and ensure the quality of the Services	Identity DataContact DataFinancial DataTransactional DataTechnical DataProfile DataEmergency Contact DataBereavement DataUsage DataBehavioral DataMarketing DataBlockchain DataCommunication DataHistory Data	Performance of a contractLegitimate interest: to respond to customer inquiries, resolve issues, and monitor service interactions to maintain and improve the quality, efficiency, and reliability of Siristars's services. This processing helps ensure a smooth user experience and supports business continuity while maintaining a fair balance with customers' privacy rights.
To use our social media accounts to share Siristars news and raise awareness about its services	Social Media DataCommunication Data	Legitimate interest: increasing Siristars's visibility, sharing relevant service updates, and improving public communication through the use of social media accounts and anonymized audience insights
To enable you to partake in a prize draw or competition	Identity DataContact DataProfile DataUsage DataCommunications DataSocial Media Data	Performance of a contractConsent, if requiredLegitimate interest: to create opportunities for customers to freely decide whether they wish to participate in special events organized by Siristars and to receive prizes or other incentives
To perform direct marketing communication and campaigns	Identity DataContact DataTechnical dataTransaction DataUsage DataProfile DataMarketing Data	Legitimate interest: to keep Siristars customers informed about updates, news, and developments related to Siristars services, and to invite them to share feedback or participate in relevant surveys, if and for as long as they have not objected to receiving direct marketing communicationsThis also enables Siristars to identify which products, services, and offers are most relevant to each customer, helping them save time and capture valuable market opportunities when they receive customized direct marketing news based on legitimate interest.Consent, if required
To verify the identity of guests at organized events	Identity DataContact DataProfile Data	Legitimate interest: ensuring the security and proper organization of Siristars events by verifying the identity of guests and preventing unauthorized access
To gather market data for studying customers' behavior, including their preferences, interests, and how they use our products and services, determining our marketing campaigns and growing our business	Identity DataContact DataProfile DataUsage DataBehavioral DataHistory DataMarketing DataCommunication Data	Legitimate interests: understanding our customers and improving our products and services
To administer and protect our business, our Site, App(s), and social media channels, including bans, troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data	Identity DataProfile DataSocial Identity DataSocial Media DataContact DataFinancial DataBlockchain DataTechnical DataTransactional DataUsage DataBehavioral DataHistory Data	Legitimate interests: to run our business, provide administration and IT services, ensure network security, prevent fraud, and operate in the context of a business reorganization or group restructuring exercise
To deliver relevant website content and advertisements to you, and to measure or understand the effectiveness of the advertising we serve to you	Identity DataContact DataProfile DataUsage DataBehavioral DataTechnical DataMarketing DataCommunications Data	Legitimate interests: to study how customers use our products and services, to develop them, to grow our business, and to form our marketing strategyConsent, if required
To use data analytics to improve our website, products/services, marketing, customer/user relationships and experiences	Technical DataUsage DataBehavioral DataMarketing DataCommunication Data	Legitimate interests: to define types of customers/users for our products and services, to keep our website updated and relevant, to develop our business, and to form our marketing strategyConsent, if required
To make suggestions and recommendations to you about goods or services that may be of interest to you	Identity DataContact DataTechnical DataUsage DataBehavioral DataProfile DataMarketing DataCommunication Data	Legitimate interests: to develop our products/services and grow our businessConsent, if required
To use the services of social media platforms or advertising platforms, some of which will use the personal data they receive for their own purposes, including marketing purposes	Technical DataUsage DataBehavioral Data	Consent
To use the services of, and enter into partnerships with, financial institutions, third-party partners whose products form a part of the Services offered, crime and fraud prevention companies, and risk-measuring companies, which will use the personal data they receive for their own purposes in their capacity as independent controllers	Identity DataContact DataFinancial DataTransactional DataBlockchain DataTechnical DataUsage DataBehavioral DataCommunication Data	Performance of a contractLegitimate interests: to conduct our business activities, to provide the Services to you, and to participate actively in the prevention of crime and fraud

Automated Decision Making

What is an automated decision?

An automated decision is typically a decision that produces legal effects or similarly significantly affects you and is made entirely by software algorithms, without any human intervention.

Why is an automated decision important to you?

We may use automated decisions to verify your identity and to detect and prevent fraudulent activities to keep our platform secure. These systems analyze information such as your ID data, photos, device and transaction details, and behavioral patterns to confirm your identity and assess potential risks. The system uses automated risk-scoring and pattern-matching techniques to identify inconsistencies or potential signs of fraud. The results may automatically determine whether you can access or continue using certain services. You may request human review of any such decision, express your point of view, or contest the outcome.

In addition, please note that we offer a variety of services that include automation features designed to help users save time, reduce emotional influence, and capture market opportunities 24/7. However, these processes are intended to assist users in executing their own trading strategies efficiently. They do not produce legal or similarly significant effects on users, as participation is entirely voluntary and user-controlled at all times.

Direct Marketing

Siristars may process your personal data to provide you with general and/or personalized updates about our Services, request your feedback, or invite you to participate in related surveys. We may also use your Identity Data, Contact Data, Technical Data, Transaction Data, Usage Data, and Profile Data to better understand your preferences and interests based on our legitimate interest. This enables us to determine which products, services, and offers may be most relevant to you when delivering customized direct marketing materials or seeking your opinion about specific services.

You will receive marketing communications from us if you have consented to receive direct marketing news, or if you have signed up for our Services and have not opted out of receiving such communications based on our legitimate interest according to the applicable laws and regulations. We will use your Marketing Data and Communication Data for our respective activities.

Third-party Marketing

We will obtain your opt-in consent before we share your personal data with any third party for marketing purposes.

Right to Object and Revoke Consent

You have a right to revoke your consent or object to direct marketing at any time by managing your preferences in the User Center under Notification Settings, by clicking the withdrawal link in the received direct marketing message, or by sending us an email with your request at dpo@Siristars.com or support@Siristars.com.

Where you opt out of receiving direct marketing messages, this will not apply to service messages that are directly related to the use of our Services (e.g., maintenance, a change in the terms of use and so forth).

Cookies

You may set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Services or Site may become inaccessible or not function properly. For more information about the cookies we use, please review the Cookie Policy and manage cookies in Cookie Settings.

Change of Processing Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so.

Sale or Transfer of Business

We may also need to process your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving all or part of our shares, business or assets. This will be based on our legitimate interests in carrying out such transactions, or to meet our legal obligations.

9. Disclosures of Your Data

We may share your personal data with our third-party service providers, agents, subcontractors, and other associated organizations, as well as with our group companies and affiliates (as described below), in order to perform tasks and provide the Services and App functionality to you on our behalf.

We may transfer your personal data to the categories of personal data recipients indicated below:

companies and organizations that assist us in processing, verifying, or refunding transactions/orders you make and in providing any of the Services that you have requested;
third-party service providers with whom we work and whose products, services, or applications are hosted/integrated on our Site and App;
identity verification agencies to undertake required verification checks;
fraud or crime prevention agencies to help fight against crimes including fraud, money laundering and terrorist financing;
anyone to whom we lawfully transfer or may transfer our rights and duties under the relevant terms and conditions governing the use of any of the Services;
any third party because of any restructure, sale, or acquisition of our group or any affiliates, provided that any recipient uses your information for the same purposes as it was originally supplied to us and/or used by us; and
your specified emergency contact or legitimate heirs;
technical and operational service providers;
auditors, legal, and financial consultants;
regulatory and law enforcement authorities, whether they are outside or inside the Republic of Seychelles, where the law allows or requires us to do so;
other service providers that help Siristars to perform certain processing activities involving personal data.

We cooperate closely with local and international authorities and institutions. Therefore, upon a lawful and justified request, your personal data may be disclosed to such authorities without prior notice to you.

Specifics Regarding The Use of The Blockchain Certain Services provided by Siristars operate using blockchain technology. The blockchain functions as a decentralized ledger in which transactions are recorded in an immutable and transparent manner. This ensures the integrity and security of data stored on the blockchain.

Siristars ensures that no personally identifiable information (PII) is recorded directly on the blockchain. Only non-identifiable transaction data or cryptographic hashes are stored on-chain, making it impossible to attribute any blockchain record to an individual without additional information held off-chain.

Due to the immutable nature of the blockchain, once data is recorded it cannot be altered or deleted. For this reason, Siristars carefully designs its systems to keep all personal data off-chain and processes such data through secure, controlled systems. If you exercise your data protection rights, Siristars will take all reasonable steps to accommodate your request to the extent technically and legally feasible.

10. International Data Transfers

Where the processing of your personal data involves a transfer to a country or territory outside the Republic of Seychelles, Siristars ensures that such transfers are conducted in accordance with the Seychelles Data Protection Act, 2023.

We will only transfer personal data to countries or international organizations that are recognized as providing an adequate level of data protection. In cases where no adequacy decision has been adopted, we will implement appropriate safeguards, such as standard contractual clauses or binding corporate rules, to ensure that your personal data continues to benefit from protection consistent with Seychelles data protection requirements.

In exceptional circumstances, where none of the above mechanisms apply, we may rely on specific legal grounds permitted under the law — for example, where the transfer is necessary for the performance of a contract with you, required by law, made with your explicit consent, or necessary for the establishment, exercise, or defense of legal claims.

You may contact us at any time to obtain further information or a copy of the safeguards used for international transfers.

11. Data Security

We take the protection of your personal data extremely seriously and apply a combination of legal, organizational, technical, and physical safeguards to maintain its confidentiality, integrity, and availability. In accordance with applicable data protection principles, we have implemented appropriate measures to protect personal data against unauthorized or unlawful processing, accidental loss, alteration, misuse, destruction, or disclosure.

All sensitive personal data processed by Siristars is encrypted both in transit and at rest, ensuring that your information remains protected throughout its lifecycle. Access to personal data is strictly limited to authorized employees, contractors, and service providers who require it for legitimate business purposes and are bound by confidentiality and data protection obligations.

Our security framework includes, among other measures:

Technical safeguards such as the latest security systems, firewalls, data encryption, two-factor authentication, and password protection;
Organizational safeguards including employee training, internal access management, and regular security audits;
Operational measures ensuring the resilience, integrity, and continuous availability of our systems through backups and incident response plans; and
Vendor due diligence, ensuring that we work only with trustworthy service providers who maintain equivalent security standards.

While we strive to use industry-leading technologies and maintain robust cybersecurity measures to detect and prevent attacks or other threats, no method of transmitting information over the internet or of electronic storage is completely secure. We therefore encourage you to take appropriate precautions when using our Services or sharing information via email or other communication channels.

In the unlikely event of a personal data breach, we will promptly implement remedial measures and, where required by law, notify the competent Data Protection Authority and affected individuals without undue delay.

Data Retention

To determine the appropriate retention period for personal data, we take into account the amount, nature, and sensitivity of the personal data; the potential risks arising from unauthorized use or disclosure; the purposes for which the personal data is processed and whether those purposes can be achieved by other means; as well as any applicable legal, regulatory, tax, accounting, or other requirements.

We typically consider the following factors when determining how long to retain your personal data:

Legal obligations: for example, under the Seychelles Anti-Money Laundering and Countering the Financing of Terrorism Act, we are required to retain certain personal data for at least seven (7) years after the end of our business relationship with you. This period may be extended where required by law.
Litigation and defense: where we reasonably believe that a claim or dispute may arise in relation to our relationship with you, we may retain relevant information (such as correspondence and transaction records) for up to ten (10) years, depending on the applicable statutory limitation period.
Regulatory and audit requirements: where laws or professional standards require us to maintain certain records for audit or compliance purposes.
Legitimate business needs: such as preventing abuse of promotions, maintaining service integrity, or ensuring accurate record-keeping.
Complaints handling: where personal data may be required to investigate or resolve a complaint.

Once the applicable retention period expires, or where personal data is no longer necessary for the purpose for which it was collected, we will securely delete, anonymize, or otherwise render it permanently unusable. Irreversibly anonymized data may be retained indefinitely and used for statistical, analytical, or service improvement purposes.

13. Your Legal Rights

You have several rights in relation to your personal data. The rights that apply to you may vary depending on the legal basis on which we process your information. If you would like more detailed information or wish to exercise any of the rights listed below, please contact us.

You may:

request confirmation of whether your personal data is being processed and, if so, obtain access to that data along with information about how it is processed;
request rectification of your personal data by asking us to rectify information you think is inaccurate and to complete information you think is incomplete (subject to our verification of the accuracy of the new data you provide to us);
request erasure (cancellation or deletion) of your personal data; note, however, that we may not always be able to comply with your request of erasure for specific legal reasons, e.g., if the processing is necessary for compliance with a legal obligation. In addition, please also check sub-section "Specifics Regarding the Use of the Blockchain" above;
object to the processing of your personal data where we are relying on a legitimate interest or a public interest (or those of a third party), including profiling, and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts your fundamental rights and freedoms; in some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms; you also have the right to object where we are processing your personal data for direct marketing purposes;
require not to be subject to a decision based solely on automated processing, including profiling, and request human intervention on the part of Siristars, as well as express your point of view and contest the decision (detailed explanation in Section 8 above);
request restriction of processing your personal data, which enables you to request us to suspend the processing of your personal data if you want us to establish the data accuracy; where our use of the data is unlawful; where you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims; or if you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it;
request the transfer of your personal data to you or to a third party, and we will provide to you, or a third party you have chosen (where technically feasible), your personal data in a structured, commonly used, machine-readable format; note that this right only applies to automated information that you initially provided consent for us to use or where we used the information to perform a contract with you;
withdraw consent at any time where we are relying on consent to process your personal data; however, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you, but we will advise you if this is the case at the time you withdraw your consent;
lodge a complaint with the Information Commission of Seychelles or your local competent Data Protection Authority if you believe your rights have been infringed or wish to seek compensation for damages suffered.

No Fee for Exercising Your Rights

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is manifestly unfounded or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

Period for Responding to a Legitimate Request

In accordance with applicable data protection laws, we aim to respond to a legitimate request within one (1) month from the date the customer's identity is successfully verified. This period may be extended, if necessary, by up to two (2) additional months, depending on the complexity and number of requests. In such cases, the customer will be informed of the extension and the reasons for the delay.

Verification of Identity

A customer may exercise their data protection rights only after Siristars has successfully verified their identity. You may be required to provide additional information necessary to confirm your identity before we can process your request. If Siristars is unable to verify the identity of the individual submitting the request, it may refuse to act on the request in order to protect personal data from unauthorized disclosure.

14. Final Provisions

This Privacy Notice is governed by and shall be interpreted in accordance with the Seychelles Data Protection Act 2023 and any other applicable laws. We review and update this Privacy Notice periodically to ensure ongoing compliance and transparency. The date at the top of this document indicates when it was last revised.

Siristars reserves the right to modify or update this Privacy Notice at any time. Any changes will take effect once the updated version is published on our Site or App, and we will take appropriate steps to inform you of any material updates. We encourage you to review this Privacy Notice regularly to stay informed about how we process your personal data. Your continued use of our Site, App or Services after changes have been made will constitute your acceptance of the revised Privacy Notice. If you do not agree with the updated terms, you should discontinue using our Site, App and Services.

Related to

Related articles