Privacy Statement

First, let’s define some key terms. Many of these definitions are adapted (with changes) from the General Data Protection Regulation (or “GDPR”), the data privacy law which applies in the European Union. We use the GDPR as a guidepost because it applies directly to our European companies and because we believe it sets the highest legal standard for user privacy. However, in some cases we have simplified definitions here for the purpose of clarity. Some definitions that are not defined in this Definitions Section or within the Privacy Statement have the meaning as is in the Blueboard Terms of Service.

Personal data: “any information relating to an identified or identifiable natural person” as the GDPR says. This includes data such as your IP address, device IDs, advertising IDs, and location. Below where we describe how we Process personal data, we also list the specific Purpose for doing so, as well as our Legal basis under the GDPR (as those terms are defined below).

Data controller: The person or company that decides whether and how to Process Personal data.

Purpose: the specific reason or reasons we have for Processing Personal data.

Process or processing: collecting or using Personal data. As defined in the GDPR, the word “processing” can mean doing almost anything with Personal data. Below we have used it in this general sense when we have a general meaning in mind, and used more specific terms (like “store” or “share”) where appropriate.

Retention / retain: the time period for which we will continue to store data. 

Opera Group: Blueboard affiliated group of companies, including Opera Norway AS (a Norwegian company) which develops and publishes the Opera browsers, as well as other subsidiaries and affiliated companies around the world. 

You may access our Services like MiniPay or Rewards Wallet Service via Opera browser that is subject to the Opera Terms of Service and Opera Privacy Statement or as well as a standalone app in case of MiniPay. When you use our Services, we need to process certain information from and about you. Some of the data we Process is considered Personal data. We act as a Data controller of Personal data that Process via Services.

The categories of information, including Personal data, that we collect and Processes include information that you provide to us directly (for example during the onboarding process) and information that we collect about you from other sources.

Information that you provide directly

Some categories of data we collect when you provide it to us directly, e.g. when you register as a new user, or request and use specific Services. Those data includes your: 

• mobile phone number: to set up a MiniPay account and use MiniPay (“Contact Information”); 
• receiver phone number: if you make a Crypto Asset transaction. 

Information that we collect about you

If you choose to use our Services, we will collect certain data about you from your device or other sources, including:

• Personal data like: your IP address, a unique user ID (UID) which is a unique identifier assigned to your use of the Service, and other technical data including data about your device or use of the Services, your app version, locale, language, dialog events, or other in-app actions (“Technical Data”); and
• Wallet address and wallet Crypto Assets (“Wallet Data”).

Additionally, if you choose to make a Crypto Assets transaction, we will collect data including the type of Crypto Assets or amount of Crypto Assets transferred, and generate some additional data to identify and complete the transaction including a unique item ID, and a link to your user ID (“Transactional Data”).

MiniPay and Reward Wallet Service

We use the information you provide us or that we collect about you for different Purposes and under different Legal bases, as explained more in detail below.

Purposes:

• to carry out obligations imposed by applicable laws, including the obligation to avoid money laundering, terrorist financing and fraud; to ensure the security of our Services; and to comply with the lawful inquiries and order of public authorities ;
• to enter into or perform our contracts with you, including providing the Services you have requested (this covers among other communication related to onboarding and technical functionality);
• to gain a better understanding of the preferences of our customers and how they interact with our Services, and making improvements to them;
• to send you marketing information about our products and services.

Legal bases: 

Promotion & Marketing

We process some data in order to promote and market our products and services. Some of this data comes directly from you, when you submit it to us for some specific purpose. For example, if you decide to provide feedback to us or you participate in a promotional campaign, contest, or survey, organized by us or our partners on behalf of us, we may ask for information such as your name, age, phone number, email, or postal address. Depending on the nature of the campaign or contest, it may be necessary to share your data with third parties. When that applies, we will make it clear in the terms applicable to the campaign.

We may display in-app or send push-notifications information about campaigns and promotions of Blueboard, Opera, or third-party products, services or features. You may disable these notifications in your user profile settings.

If you agree to receive marketing information from us via email, or other communications means, we may use third-party technology providers to deliver such messages to you. You can opt-out from marketing communication at any time in your user profile settings or directly from a marketing email you receive.

In general when we process data in the context of a promotional campaign, contest, or survey, we process your personal data on the basis that doing so is necessary to enable you to participate in the campaign. In some cases we may process data for marketing purposes based on your consent. In any case we will not retain your data any longer than necessary to fulfill the specific purpose for which it was processed to begin with. You can always control your preferences via the settings menu, and if you have other concerns you can reach us through this form.

If we process your data for the purpose of marketing and promotional activities we may process your Transactional Data, Technical Data, Contact Information (email address). 

Purpose: To promote and improve our products and services.

Legal basis: Varies by context as explained above - includes contractual grounds, legitimate interest, or consent (in some cases).

Other Services

Except MiniPay and Reward Wallet Service we may, alone or in cooperation with our partners, provide you with some additional Services. In such a case the Purpose and Legal basis of your data Processing may vary. You can read more about how our certain other Services processes data below.

MiniPay Card

If you set up a MiniPay Card we act as a:

• data processor for Gnosis Pay Co Ltd. You may read more how Gnosis Pay Co Ltd. processes your data in Gnosis Pay Co Ltd Privacy Policy; or
• data controller for marketing purposes (including Cashback service). In such a case we will process your data in accordance with the Promotions and Marketing section of this Privacy Statement, and Transactional Data includes your MiniPay Card transaction related data. 

Third Party KYC

To access certain third party services you may need to be onboarded by such a third party for KYC purposes. In such a case you will provide a third party service provider with your personal data that may vary depending on the third party service provider KYC process. We do not process any data you provided to such a third party. Your data is processed under the relevant third party service provider privacy policy.

If you use the SumSub service to create a SumSub ID, SumSub will provide us with you SumSub ID. In such a case we do not have access to your personal data you provided to SumSub. 

‍

In general, we do not Process or store Personal data longer than needed and therefore delete it after a certain period of time. Below we have included some more specific details on retention periods, which vary depending on the type of Personal data at issue and the Purpose for which it is Processed.

• Contact Information, Technical Data, Personal Data, and Wallet Data are kept for a period of two years thereafter.
• Transactional Data is retained for as long as a Crypto Assets or transaction is active, and for a period of two years thereafter.

In some circumstances we may share data (including Personal data) with third parties, including:

• Other members of the Opera Group, especially Opera Norway AS. Blueboard is a member of the Opera Group that provides data Processing, marketing, and other support services to Blueboard.
• Third party services providers who help us to operate the Services. E.g. text message technology providers, customer support technology providers, analytic system technology providers.
• Law enforcement agencies, if and when we are required to provide information to them in accordance with applicable law.
• Third party services providers who provide their own services inside Blueboard Services including on-ramp providers, off-ramp providers, swaps providers and Crypto Assets related services providers (no Personal data).
• Blockchain networks and related providers with whom you might complete a Crypto Assets transaction (no personal data).

MiniPay includes third-party technology or code, some of which may use your data in different ways. When such third-party technologies use previously collected data, they typically act as data processors for us. When they collect data on their own, they typically act as independent data controllers. For convenience, we have included links to their privacy policies below.

• AppsFlyer
• Firebase Cloud Messaging
• WhatsApp
• Telegram (Indonesia only)

You have the right to make a request to access or delete any of your Personal data that we might possess. You can make a request via this online request form. You may be required to provide additional information to authenticate your request. In such a case we will process your email address for the purpose of your inquiry.
‍
You also have the right to lodge a complaint with the appropriate authorities. You can contact the Data Protection Commission, the data protection supervisory authority of Ireland, or Datatilsynet, the Norwegian Data Protection Authority, through their websites.

‍

We are very open about privacy and recognise your trust as a great value. If you have any questions about this statement or any privacy issues in our applications or Services, feel free to contact our Data Protection Officer via this online request form in such a case we will process your email address for the purpose of your inquiry.

‍