Legal

At Kiln, protecting your personal data is our priority.

This Privacy Policy (the “Policy”) outlines the types of information Kiln SAS and our affiliates (“Kiln”, the “Company”, “we”, “us” or “our”) collect about you when you visit our website, use our products and services, interact with us offline, or which we otherwise obtain directly from you or from another party. It also outlines why and how we use that information and how we may share it. Services include, but are not limited to, our content on the websites located at https://kiln.fi/, or any other webpages or applications we own, operate or distribute (collectively, the “Website”) and your staking of digital assets through our SaaS Platform (hereinafter the "Platform" and “Services”) with us.
‍
Please read this Privacy Policy carefully. By using the Website, you agree to the collection, use, and disclosure of your personal data as described in this Privacy Policy. If any term in this Privacy Policy is unacceptable to you, please do not use the Website or provide any personal data to us.
‍
Your use of the Services is subject to this Privacy Policy as well as our Terms of Service.

1. Introduction

The data controller is Kiln, a French simplified joint stock company, registered with the Registry of Trade and Companies of Paris under the number 839 230 125 and whose head office is located at 17 rue Henry Monnier, 75009 Paris.

This Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy policy of every Website you visit.

2. What personal data we collect?

Personal data, or personal information, means any information about an individual from which that person can be identified. Personal data commonly include an individual’s name, identification number, phone number, email address and residential address. Personal data does not include anonymous data (i.e., information that cannot be associated with or tracked back to a specific consumer, household or device).dividual directly or indirectly, in particular by reference to an identifier such as a name.

We may collect the following personal data:

‍Identification data (e.g. name and surname, email address, residential address, business address, nationality, official/government identifiers such as national identification number and passport numbers and photographs);
Data relating to your professional life (e.g. your job position, your company name);
Economic and financial data (e.g. the amount and nature of assets you entrust to us, information about source of funds, credit reports);
Geo-location data (e.g. internet protocol (IP) address or cookie identifiers (please see our Cookie Policy for further details)); and

We inform you, when collecting your personal data, whether some of these data are mandatory or optional. Mandatory data are indicated with an asterisk.

3. What are the purpose and legal grounds for processing your data?

Purposes

Legal basis

Data retention period

To provide you with our services on our Website and Platform (staking of the user’s cryptoassets, whitelabelled staking functionality for businesses).

Performance of a contract to which you are party

Identification data, economic and financial data, geo-location data, blockchain data.

To send direct marketing, newsletters

For our customers: our legitimate interest in winning customer loyalty and informing our customers of our latest news.

For our prospects: your consent

Identification data, professional data

To answer to your contact request

Taking steps at your request and initiative prior to entering into a contract.

Identification data , professional data and contact data

To process your applications

Taking steps at your request prior to entering into a contract, including identity verification.

Identification data, economic and financial data, geo-location data, blockchain data.

To process data subjects’ requests to exercise their rights.

Our legitimate interest in responding to your requests and keeping records of them.

If we ask you for proof of identity: we only retain it for the necessary time to verify your identity. Once the verification has been carried out, the proof is deleted.

4. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory and tax, accounting or other requirements.

5. Who are the recipients of your personal data?

The following recipients may have access to your personal data:

The staff of our company and affiliates;
Our processors: hosting provider, mailing provider, external recruitment website, form builder tool, user journey analysis tool, customer relationship management software, cryptocurrency custodian, cryptocurrency transaction analysis software, identity verification provider;
If applicable: public and private organisations, exclusively to comply with our legal obligations.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Where third party service providers act as processors on our behalf, we do not allow them to use your personal data for their own purposes and only permit them to process your personal data for specified purposes in accordance with our instructions.

6. Are your personal data likely to be transferred outside the European Union?

As part of the tools we use (see article on the recipients of your personal data, especially our processors), your personal data may be transferred outside the European Union. The transfer of your personal data in this context is secured with the use of following safeguards:

Either personal data are transferred to a country that has been recognized as ensuring an adequate level of protection by a decision of the European Commission, in accordance with article 45 of the GDPR: in this case, this country ensures a level of protection deemed sufficient and adequate to the provisions of the GDPR; or
The personal data are transferred to a country whose level of data protection has not been recognized as adequate to the GDPR : in this case these transfers are based on appropriate safeguards indicated in article 46 of the GDPR, adapted to each provider, including but not limited to the execution of Standard Contractual Clauses approved by the European Commission, the application of Binding Corporate Rules or under an approved certification mechanism; or
The personal data are transferred under any appropriate safeguards described in Chapter V of the GDPR.

7. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so..

8. What rights do you have regarding your personal data?

You have the following rights regarding your personal data:

Right to be informed: this is precisely why we have drafted this privacy policy as defined by articles 13 and 14 of the GDPR.
Right of access: you have the right to access all your personal data at any time as defined by article 15 of the GDPR.
Right to rectification: you have the right to rectify your inaccurate, incomplete or obsolete personal data at any time as defined by article 16 of the GDPR.
Right to restriction of processing: you have the right to restrict the processing of your personal data in certain cases defined in article 18 of the GDPR.
Right to erasure: (“right to be forgotten”): you have the right to request that your personal data be deleted and to prohibit any future collection as defined by article 17 of the GDPR.
Right to file a complaint to a competent supervisory authority: (in France, the CNIL), under GDPR article 77, if you consider that the processing of your personal data constitutes a breach of applicable regulations.
Right to define instructions related to the retention, deletion and communication of your personal data after your death (article 40-1 of French law “informatique et libertés”).
Right to withdraw your consent at any time: for purposes based on consent, Article 7 of the GDPR provides that you may withdraw your consent at any time. Such withdrawal will not affect the lawfulness of the processing carried out before the withdrawal.
Right to data portability: under specific conditions defined in article 20 of the GDPR, you have the right to receive the personal data you have provided us in a standard machine-readable format and to require their transfer to the recipient of your choice.
Right to object: You have the right to object to the processing of your personal data as defined by article 21 of the GDPR. Please note that we may continue to process your personal data despite this opposition for legitimate reasons or for the defense of legal claims.

You can exercise these rights by writing to us using the contact details below. For this matter we may ask you to provide us with additional information or documents to prove your identity.

9. Contact information for data privacy matters

Contact email: legal@kiln.fi
Contact address: 17 Rue Henry Monnier, 75009 Paris

10. Modifications

We may modify this privacy policy at any time, in particular in order to comply with any regulatory, jurisprudential, editorial or technical change. These modifications will apply on the date of entry into force of the modified version. Please regularly consult the latest version of this Privacy Policy. Nevertheless, your continued use of the Services and Platform reflects your periodic review of this Policy and other terms of service, and indicates your consent to them.

Legal & Privacy

IDENTIFICATION

TERMS AND CONDITIONS

PRIVACY POLICY