Data Protection & GDPR Notice

This Data Protection & GDPR Notice supplements our Privacy Policy and provides additional information specific to the rights of data subjects under the General Data Protection Regulation (EU) 2016/679, the UK GDPR, and equivalent data-protection regimes.

Controller

The controller is VelorisOS Global Ltd, registered in the Republic of Cyprus. Contact: privacy@veloris-global.com.

Lawful bases of processing

We process personal data on the following lawful bases:

• Article 6(1)(b) GDPR — performance of a contract, where processing is necessary to provide the Services to you or to take steps at your request before entering into a contract.
• Article 6(1)(c) GDPR — legal obligation, where processing is necessary to comply with anti-money-laundering, sanctions, tax or other regulatory obligations.
• Article 6(1)(f) GDPR — legitimate interests, where processing is necessary for our legitimate interests in operating, securing and developing our business, balanced against the rights and freedoms of data subjects.
• Article 6(1)(a) GDPR — consent, where you have given consent (for example, for optional cookies or for marketing communications).

Where we process special categories of personal data, we rely on an additional lawful basis under Article 9 GDPR, typically explicit consent under Article 9(2)(a) or substantial public interest under Article 9(2)(g) where the processing relates to AML or sanctions compliance.

International transfers

Where we transfer personal data outside the European Economic Area, we rely on the following safeguards:

• adequacy decisions of the European Commission;
• the European Commission’s Standard Contractual Clauses (Module 1, 2, 3 or 4 as applicable);
• binding corporate rules; or
• your explicit consent, where applicable.

Copies of the safeguards used are available on request from privacy@veloris-global.com.

Your rights as a data subject

Subject to the GDPR and equivalent regimes, you have the right to:

• access the personal data we hold about you (Article 15);
• rectification of inaccurate or incomplete data (Article 16);
• erasure of your data in defined circumstances (Article 17);
• restriction of processing in defined circumstances (Article 18);
• data portability (Article 20);
• object to processing based on legitimate interests, including profiling (Article 21);
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a supervisory authority, including the Office of the Commissioner for Personal Data Protection in Cyprus.

Automated decision-making

Veloris does not currently engage in automated decision-making with significant legal or similarly significant effect on data subjects. Where we adopt automated decision-making in the future, we will provide additional disclosures and afford the rights required by Article 22 GDPR.

Retention

We retain personal data only for the period necessary for the purposes for which it was collected, and in any event for the periods required by applicable law and our contractual obligations. KYB and AML records are typically retained for seven (7) years from the conclusion of the engagement.

Contact

Data Protection Officer: privacy@veloris-global.com.