Privacy Notice

Last Revised: 27.10.2026

This Privacy Notice explains how BTY Digital AG processes personal data in connection with its website, applications, onboarding, account relationships, products and services.

BTY provides services to Personal Clients and Business Clients. We may therefore process personal data relating directly to individual clients, as well as personal data relating to directors, authorised representatives, beneficial owners, employees, contact persons and other individuals connected with a Business Client, applicant, transaction or other relationship.

1. WHO WE ARE

BTY Digital AG
Mühlegasse 18
6340 Baar
Switzerland
Swiss UID: CHE-352.538.716

BTY Digital AG (“BTY”, “we”, “us” or “our”) is responsible for the processing of personal data described in this Privacy Notice where BTY determines the purposes and means of that processing.

BTY provides digital-asset, account, payment, currency-conversion, card-related and other related services to eligible Personal Clients and Business Clients, including through arrangements with relevant third-party service providers where applicable.

For the purposes of this Privacy Notice:

  • a “Personal Client” means a natural person who uses BTY’s Services for personal, family or household purposes; and

  • a “Business Client” means a legal entity, partnership or other organisation that uses BTY’s Services in connection with its business, professional or organisational activities.

Even where the Client is a Business Client, individuals associated with that Business Client remain data subjects in respect of their personal data.

Questions concerning privacy or requests concerning personal data may be sent to privacy@brighty.app.

BTY processes personal data in accordance with Applicable Law, including the Swiss Federal Act on Data Protection (“FADP”) and, where applicable to the relevant processing, the EU/EEA General Data Protection Regulation (“GDPR”).

2. SCOPE OF THIS PRIVACY NOTICE

This Privacy Notice applies to personal data processed in connection with:

  • the Brighty website and applications;

  • account registration and administration;

  • Personal Client and Business Client onboarding;

  • identity and verification procedures;

  • Crypto Accounts and Digital Asset Services;

  • Fiat Payment Accounts and payment services;

  • Transfers and Currency Conversion;

  • Payment Cards and related services;

  • subscription plans;

  • customer support;

  • compliance and risk management;

  • AML/CFT and sanctions processes;

  • fraud prevention and security;

  • marketing and communications; and

  • other activities connected with BTY’s business relationship with a Client.

This Privacy Notice applies whether the individual is:

  • a Personal Client;

  • a prospective Personal Client;

  • a director or representative of a Business Client;

  • a beneficial owner or controlling person;

  • an authorised signatory or account user;

  • an employee or contact person of a Business Client;

  • a transaction counterparty or beneficiary;

  • a person whose information is provided during compliance or verification procedures; or

  • another individual whose personal data BTY lawfully receives or processes in connection with its activities.

Where another company or third-party provider independently determines the purposes and means of processing personal data, that entity may act as a separate controller and its own privacy information may also apply.

3. PERSONAL DATA WE MAY COLLECT

The categories of personal data BTY processes depend on the Client, the Services used, the relationship with BTY and applicable legal requirements.

3.1 Identification and Verification Data

We may process:

  • name;

  • date of birth;

  • nationality;

  • residential or correspondence address;

  • identification documents;

  • identification numbers where legally permitted or required;

  • photographs or verification images;

  • signature;

  • tax or residency information where required; and

  • other information required to establish or verify identity.

3.2 Corporate and Relationship Data

For Business Clients and individuals associated with them, we may process:

  • company or organisation details;

  • position, title or role;

  • authorised-signatory information;

  • ownership and control information;

  • beneficial ownership information;

  • information concerning directors and officers;

  • information concerning authorised representatives;

  • information concerning employees or contact persons; and

  • information about the relationship between an individual and a Business Client.

3.3 Contact and Account Data

We may process:

  • email address;

  • telephone number;

  • postal or correspondence address;

  • account identifiers;

  • username;

  • login and authentication information;

  • communication preferences;

  • customer-support records;

  • account settings; and

  • information concerning interactions with BTY.

3.4 Financial and Transaction Data

Depending on the Services used, we may process:

  • bank account details;

  • IBANs;

  • payment information;

  • transaction history;

  • payment instructions;

  • Digital Asset addresses;

  • blockchain transaction information;

  • transaction counterparties and beneficiaries;

  • currency-conversion information;

  • card transaction information;

  • source-of-funds information;

  • source-of-wealth information; and

  • other information reasonably required to provide, monitor or secure the Services.

3.5 Compliance and Risk Data

We may process:

  • KYC/KYB information;

  • beneficial-owner information;

  • sanctions-screening results;

  • politically exposed person (“PEP”) information;

  • adverse-media information;

  • fraud indicators;

  • transaction-monitoring information;

  • blockchain analytics information;

  • risk classifications;

  • enhanced due-diligence information;

  • information concerning suspected unlawful activity; and

  • other information required for AML/CFT, sanctions, fraud-prevention or regulatory purposes.

3.6 Technical and Usage Data

When you use our website, applications or digital services, we may process:

  • IP address;

  • device information;

  • browser information;

  • operating system;

  • device identifiers;

  • log information;

  • authentication and security information;

  • application and website usage information;

  • session information;

  • crash and diagnostic information; and

  • information collected through cookies and similar technologies.

Further information about our use of cookies and similar technologies is provided in the BTY Digital AG Cookie Notice.

3.7 Communications

We may process information contained in communications between you and BTY, including:

  • emails;

  • support requests;

  • messages;

  • telephone or other customer-service interactions where lawfully recorded;

  • complaints;

  • feedback; and

  • other correspondence.

4. HOW WE OBTAIN PERSONAL DATA

We may obtain personal data:

  • directly from you;

  • when you create or use a BTY account;

  • when you apply for or use a Service;

  • from a Business Client or prospective Business Client;

  • from directors, authorised representatives or other persons acting for a Business Client;

  • from other individuals connected with a Client relationship;

  • from identity-verification and KYC/KYB providers;

  • from sanctions, PEP and adverse-media screening providers;

  • from payment, banking and card providers;

  • from custody, wallet, blockchain analytics and liquidity providers;

  • from public registers and publicly available sources;

  • from transaction counterparties where lawfully available;

  • from fraud-prevention and security providers; and

  • from other parties where disclosure to BTY is lawful and relevant to the Services.

Where personal data is not collected directly from the relevant individual, BTY will provide information required by Applicable Law, subject to applicable exceptions and restrictions.

5. PURPOSES OF PROCESSING

BTY may process personal data for the following purposes.

5.1 Client Onboarding and Account Administration

We may process personal data for:

  • assessing applications;

  • establishing and maintaining Client relationships;

  • verifying identity and authority;

  • establishing beneficial ownership and control;

  • administering accounts;

  • maintaining Client records; and

  • providing access to Services.

5.2 Providing Services

We process personal data as necessary to provide and administer:

  • Crypto Accounts;

  • Digital Asset Services;

  • Fiat Payment Accounts;

  • Transfers;

  • Currency Conversion;

  • Payment Cards;

  • subscription plans;

  • customer support; and

  • other BTY Services.

Certain Services or underlying functionality may be provided or supported by third-party service providers. Where relevant, personal data may be processed or shared as necessary to enable those Services in accordance with this Privacy Notice and Applicable Law.

5.3 Transaction Processing and Monitoring

We may process personal data to:

  • execute and monitor transactions;

  • verify payment instructions;

  • monitor Digital Asset transactions;

  • detect unusual or suspicious activity;

  • prevent fraud;

  • manage payment and transaction risks; and

  • comply with applicable transaction-monitoring requirements.

5.4 AML/CFT and Regulatory Compliance

We process personal data as necessary to comply with:

  • AML/CFT obligations;

  • sanctions requirements;

  • customer-identification requirements;

  • beneficial-owner requirements;

  • regulatory reporting obligations;

  • record-keeping requirements;

  • tax obligations;

  • accounting obligations; and

  • other legal and regulatory requirements.

5.5 Security and Fraud Prevention

We may process personal data to:

  • protect Client accounts;

  • authenticate users;

  • detect unauthorised access;

  • prevent fraud and abuse;

  • investigate security incidents;

  • protect BTY, Clients and service providers; and

  • maintain the security and integrity of our systems.

5.6 Communications and Support

We may process personal data to:

  • respond to enquiries;

  • provide customer support;

  • send service notifications;

  • communicate account or transaction information;

  • manage complaints; and

  • administer the Client relationship.

5.7 Business Operations

We may process personal data for legitimate business purposes, including:

  • internal administration;

  • financial management;

  • auditing;

  • accounting;

  • risk management;

  • service development;

  • quality assurance;

  • business continuity;

  • establishing, exercising or defending legal claims; and

  • corporate governance.

5.8 Marketing

Where permitted by Applicable Law, we may process personal data to provide information about BTY Services, subscription plans, products, offers and other communications that may be relevant to the Client.

Where consent is required for a particular marketing activity, BTY will obtain the relevant consent before carrying out that activity.

BTY processes personal data on the legal bases available under Applicable Law.

Where the GDPR applies, BTY relies on one or more legal bases depending on the particular processing activity. These may include:

  • performance of a contract with you or taking steps at your request before entering into a contract;

  • compliance with a legal obligation to which BTY is subject;

  • BTY’s legitimate interests or those of a third party;

  • protection of vital interests, where applicable; and

  • consent, where consent is specifically required or relied upon.

BTY’s legitimate interests may include:

  • providing, operating and improving the Services;

  • maintaining the security and integrity of the Services;

  • preventing fraud, misuse and financial crime;

  • managing and developing BTY’s business;

  • managing risk;

  • protecting BTY’s legal rights and interests; and

  • establishing, exercising or defending legal claims.

Where BTY relies on legitimate interests under the GDPR, BTY considers whether those interests are overridden by the interests, fundamental rights or freedoms of the affected individual.

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Under Swiss law, BTY processes personal data in accordance with the applicable principles and requirements of the FADP.

7. AML/CFT AND REGULATORY PROCESSING

BTY carries out onboarding, customer-acceptance, compliance and monitoring procedures applicable to its activities.

Personal data may therefore be processed to:

  • identify and verify Clients and relevant individuals;

  • establish beneficial ownership and control;

  • assess Client and transaction risk;

  • perform sanctions and PEP screening;

  • conduct transaction monitoring;

  • perform blockchain analytics;

  • conduct enhanced due diligence;

  • identify and prevent fraud and financial crime;

  • comply with applicable reporting obligations; and

  • maintain records required by law.

Providing certain information may be necessary for BTY to consider an application, establish or continue a Client relationship, provide a Service or process a transaction.

If required information is not provided, BTY may be unable to onboard the applicant, establish or maintain the relevant Client relationship, provide a Service or process a transaction.

8. AUTOMATED PROCESSING AND PROFILING

BTY may use automated systems, rules, algorithms or other technologies to support activities such as:

  • identity verification;

  • fraud detection;

  • sanctions screening;

  • transaction monitoring;

  • risk assessment;

  • security monitoring; and

  • Service personalisation.

Automated systems may support BTY personnel in assessing information and making decisions and do not necessarily result in decisions being made solely by automated means.

Where BTY makes a decision based solely on automated processing and Applicable Law treats that decision as an automated individual decision or otherwise provides specific rights or safeguards, BTY will comply with the applicable requirements.

This may include, where required by Applicable Law, providing relevant information about the automated decision and allowing the affected individual to request appropriate human review or otherwise exercise applicable rights.

9. RECIPIENTS AND SERVICE PROVIDERS

Where necessary for the purposes described in this Privacy Notice, personal data may be disclosed to or accessed by:

  • companies and other service providers providing operational, technology, administrative or other support to BTY;

  • KYC/KYB and identity-verification providers;

  • sanctions, PEP and adverse-media screening providers;

  • blockchain analytics providers;

  • banks and payment institutions;

  • electronic-money and other payment-service providers;

  • Digital Asset custody and wallet providers;

  • liquidity and execution providers;

  • card issuers, processors and programme partners;

  • cloud and hosting providers;

  • cybersecurity providers;

  • communications providers;

  • customer-support providers;

  • professional advisers;

  • auditors;

  • insurers;

  • debt-collection or similar service providers where applicable;

  • courts and competent authorities;

  • regulators;

  • law-enforcement bodies; and

  • other recipients where disclosure is required or permitted by Applicable Law.

Depending on the relevant service and legal arrangement, a recipient may act as BTY’s processor, sub-processor, joint controller or independent controller.

BTY uses appropriate contractual, organisational and technical safeguards where required by Applicable Law.

9.1 Shared KYC and Identity Verification

BTY shares customers’ personal data with third-party service providers participating in its Shared Know Your Customer (“Shared KYC”) arrangements for the purposes of customer identification, identity verification, onboarding, compliance with applicable anti-money laundering and counter-terrorist financing (“AML/CFT”) requirements, and the provision of relevant Services.

The personal data shared under these arrangements includes, as relevant to the verification process, identification and contact details, identity documents, verification results, beneficial ownership information, and other KYC/KYB documentation and information collected during customer onboarding and ongoing due diligence.

Under the Shared KYC arrangements, relevant third-party providers receive and process such personal data to conduct or support customer verification, assess eligibility for their services, fulfil applicable legal and regulatory obligations, and facilitate the provision of services to customers.

Depending on the nature of the relevant arrangement, third-party providers may act as independent data controllers or as data processors acting on behalf of BTY. Personal data is shared in accordance with Applicable Law, including the Swiss Federal Act on Data Protection (“FADP”) and the General Data Protection Regulation (“GDPR”).

BTY implements appropriate contractual, technical and organisational safeguards to protect personal data shared under these arrangements and limits such sharing to information relevant to the stated purposes.

10. INTERNATIONAL TRANSFERS

BTY and its service providers may process personal data in Switzerland and other countries.

Where personal data is transferred to a country that does not provide an adequate level of data protection under Applicable Law, BTY will use an appropriate lawful transfer mechanism and safeguards where required.

Depending on the circumstances, these safeguards may include:

  • recognised standard contractual clauses;

  • contractual data-protection obligations;

  • recognised safeguards under Swiss data-protection law; or

  • another lawful transfer mechanism available under Applicable Law.

Where required by Applicable Law, information concerning relevant international transfers, destination countries and applicable safeguards will be made available to the data subject.

Additional information about applicable transfer safeguards may be requested at privacy@brighty.app.

11. DATA RETENTION

BTY retains personal data for as long as reasonably necessary for the purposes for which it was collected and to comply with applicable legal, regulatory, AML/CFT, accounting, tax and record-keeping requirements.

Retention periods may therefore continue after:

  • an application has been declined;

  • a Client has stopped using a Service;

  • a subscription has been cancelled; or

  • the Client relationship has ended.

Where applicable Swiss AML/CFT requirements prescribe a specific retention period, BTY retains the relevant records for that period, which may include a period of ten years for certain records.

Other personal data may be retained for a shorter or longer period where required or permitted by Applicable Law or where reasonably necessary to establish, exercise or defend legal claims.

When personal data is no longer required for the relevant purposes and there is no legal or other lawful basis for continued retention, BTY will delete, destroy or anonymise it, as appropriate.

12. DATA SECURITY

BTY maintains appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration or disclosure.

These measures may include:

  • access controls;

  • authentication measures;

  • encryption and other security technologies;

  • monitoring and logging;

  • confidentiality obligations;

  • security testing;

  • incident-management procedures; and

  • other appropriate technical and organisational safeguards.

Access to personal data is restricted according to business need and appropriate confidentiality obligations.

No electronic system can be guaranteed to be completely secure. BTY therefore reviews and adapts its safeguards having regard to the nature of the information, the processing involved and relevant risks.

13. YOUR DATA-PROTECTION RIGHTS

Subject to Applicable Law and any relevant exemptions or restrictions, individuals may have the right to:

  • request access to their personal data;

  • request information about how their personal data is processed;

  • request correction of inaccurate or incomplete personal data;

  • request deletion or destruction of personal data where legally available;

  • request restriction of processing where legally available;

  • object to certain processing;

  • request data portability where applicable;

  • withdraw consent where processing is based on consent; and

  • exercise applicable rights relating to automated individual decisions.

Swiss data-protection law provides data subjects with rights concerning information, access, correction and deletion or destruction, subject to applicable statutory conditions and restrictions.

Where the GDPR applies, additional rights may apply depending on the circumstances and the legal basis for processing.

To exercise your rights, contact privacy@brighty.app.

BTY may need to verify your identity before acting on a request.

BTY may retain or continue processing personal data where this is required or permitted by Applicable Law, including where necessary for AML/CFT, regulatory, legal, security or record-keeping purposes.

14. COMPLAINTS AND SUPERVISORY AUTHORITIES

If you have concerns about how BTY processes your personal data, you may contact us at privacy@brighty.app.

You may also have the right to lodge a complaint with the competent data-protection supervisory authority.

In Switzerland, the competent federal supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

Where the GDPR applies, you may also have the right to lodge a complaint with the competent data-protection supervisory authority in the relevant EU/EEA jurisdiction.

15. MARKETING COMMUNICATIONS

Where permitted by Applicable Law, BTY may send marketing communications concerning its Services, products, subscription plans, offers and other relevant information.

Where consent is required by Applicable Law, BTY will send such communications only after obtaining the required consent.

You may opt out of marketing communications at any time by using the unsubscribe mechanism provided in the relevant communication or by contacting BTY.

Opting out of marketing communications does not prevent BTY from sending service, security, compliance, transaction, legal or other non-marketing communications necessary in connection with the Client relationship or Services.

16. COOKIES AND SIMILAR TECHNOLOGIES

BTY’s website, applications and related web interfaces may use cookies and similar technologies.

Strictly necessary technologies may be used to operate, secure and maintain the relevant website, application or functionality.

Non-essential technologies are used subject to consent or other requirements under Applicable Law.

Where consent is required, you may manage or withdraw your cookie preferences through the applicable cookie preference mechanism.

Further information is available in the BTY Digital AG Cookie Notice.

17. CHILDREN

BTY’s Services are intended only for individuals who satisfy the eligibility and age requirements applicable to the relevant Service and are legally able to enter into the relevant contractual relationship.

BTY does not knowingly provide financial, payment or Digital Asset Services to children or other persons who are not legally eligible to use the relevant Service.

Where BTY becomes aware that personal data has been collected from a person who is not eligible to use the relevant Service, BTY may take appropriate steps in accordance with Applicable Law.

18. CHANGES TO THIS PRIVACY NOTICE

BTY may update this Privacy Notice from time to time to reflect changes in:

  • our Services;

  • our processing activities;

  • Applicable Law;

  • regulatory requirements;

  • service providers; or

  • our business operations.

The current version will be made available through the relevant Brighty website or application and will indicate the date on which it was last revised.

Where required by Applicable Law, BTY will provide appropriate additional notice of material changes.

19. CONTACT

BTY Digital AG
Mühlegasse 18
6340 Baar
Switzerland

Swiss UID: CHE-352.538.716

Privacy enquiries and data-subject requests:
privacy@brighty.app