Privacy Notice

Last Updated: Jul 16, 2024

Introduction

Cube Exchange (“Cube”, “we”, or “us”) is committed to protecting the privacy of our customers.

This Privacy Notice describes how Cube collects and processes your personal data through the Cube websites and applications that are referenced in this Privacy Notice. Cube refers to the website https://www.cube.exchange (the “Site”) and any other website that we own or control, our mobile application (“App”) and our related products and services (collectively, the “Services”).

This Privacy Notice applies to all Personal data processing activities carried out by us, across platforms, websites, and departments of Cube.

To the extent that you are a customer or user of our services, this Privacy Notice applies together with any terms of business and other contractual documents, including but not limited to any agreements we may have with you.

To the extent that you are not a relevant stakeholder, customer, or user of our services, but are using our website, this Privacy Notice also applies to you together with our Cookie Notice.

This Notice should therefore be read together with our Cookie Notice, which provides further details on our use of cookies on the website.

• Data Controller

Cube Exchange Australia Pty Ltd, (a company incorporated under the laws of the Australia) is your operating entity and data controller.

Cube companies may share your personal data with each other and if they do so, they will use it consistently with this Privacy Notice.

• What Personal Data does Cube collect and process?

Personal data is data that identifies an individual or relates to an identifiable individual. This includes information you provide to us, information which is collected about you automatically, and information we obtain from third parties.

Information you provide to us. To open an account and access our services, we'll ask you to provide us with some information about yourself. This information is either required by law (e.g., to verify your identity and comply with “Know Your Customer” obligations), necessary to provide the requested services (e.g., you will need to provide your email address r to open your account), or is relevant for certain specified purposes, described in greater detail below. In some cases, if we add services and features you may be asked to provide us with additional information.

If you do not provide required data, Cube may not be able to offer you our services.

We may collect the following types of data/information from you:

Information we collect from you automatically.

To the extent permitted under the applicable law, we may collect certain types of information automatically, for example whenever you interact with us or use the services. This information helps us address customer support issues, improve the performance of our sites and services, maintain and or improve your user experience, and protect your account from fraud by detecting unauthorized access.

Information collected automatically includes:

Information we collect from our affiliates and third parties.

We may also obtain information about you from our affiliates or third party sources as required or permitted by applicable law.

• Why does Cube process my personal data? Which legal bases does Cube rely on for the collection and processing of your personal data?

Our primary purpose in collecting personal data is to provide our services in a secure and efficient manner. We generally use your personal data to deliver, provide, and operate our services, for content and advertising, and for loss prevention and anti-fraud purposes. Cube does not rely solely on automated tools to help determine whether a transaction or a customer account presents a fraud or legal risk.

• Can children use Cube Services?

Cube does not allow anyone under the age of 18 to use Cube Services and we do not knowingly request or collect any information about persons under the age of 18. If you are under the age of 18, please do not provide any personal information to Cube.

If a User or potential User submitting personal information is suspected of being younger than 18 years of age, Cube will require the relevant User to close his or her account, and will take steps to delete the individual’s information as soon as possible.

• What About Cookies and Other Identifiers?

We use cookies and similar tools to enhance your user experience, provide our services, enhance our marketing efforts and understand how customers use our services so we can make improvements. Depending on applicable laws in your country, the cookie banner on your browser may tell you how to accept or refuse cookies.

• How and Why does Cube share your Personal Data?

We may share your Personal Data with third parties (including other Cube entities) if we believe that sharing your Personal Data is in accordance with, or required by, any contractual relationship with you (including Cube Terms of Service), applicable laws, regulations or legal processes. When sharing your Personal Data with other Cube entities, we will do our best to ensure that such entities are either subject to this Privacy Notice, or follow practices at least as protective as those described in this Privacy Notice.

We may also share personal data with the following organizations or persons in the following circumstances:

• Affiliates: Personal data that we process and collect may be transferred between Cube companies as a normal part of conducting business and offering our Services to you.
• Third parties: We employ other companies and individuals to perform functions on our behalf. Examples include analyzing data, providing marketing assistance, processing payments, transmitting content, and assessing and managing credit risk.The third-party service providers only have access to personal information needed to perform their functions but may not use it for other purposes.Further, they must process the personal information in accordance with our contractual agreements and only as permitted by applicable data protection laws. In accordance with and as far as provided by applicable law, your personal data may also be shared by third parties (i.e. another data controller) upon exercising your right to data portability. When you use third-party services or websites that are linked through our Services, the providers of those services or products may receive information about you that Cube, you, or others share with them. Please note that when you use third-party services or Cube affiliate services which are not governed by this Privacy Notice, their own terms and privacy policies will govern your use of those services and products.
• Legal Authorities: We may share your information with courts, law enforcement authorities, regulators, attorneys or other third parties: (a) to comply with laws and legal obligations; (b) for the establishment, exercise, or defense of a legal or equitable claim; (c) to respond to law enforcement and regulatory requests, including (1) when we are compelled to do so by a subpoena, court order, search or seizure warrant, or similar legal procedure, or (2) for international law enforcement requests, pursuant to a mutual legal assistance treaty (MLAT) or letters of request; (d) to comply with one or more forms of “travel rules” that require our transmitting of your information to another financial institution, regulatory authorities or other industry partners; (e) when we believe in good faith that the disclosure of personal information is necessary to protect the rights, property or safety of our customers, Cube, or others, including to prevent imminent physical harm or material financial loss; (f) to investigate violations of our Terms of Service or other applicable policies; (g) to detect, investigate, prevent or address fraud or credit risk, other illegal activity or security and technical issues; (h) to report suspected illegal activity or to assist law enforcement in the investigation of suspected illegal or wrongful activity.
• Business transfers: As we continue to develop our business, we might sell or buy other businesses or services. In such transactions, user information generally is one of the transferred business assets but remains subject to the promises made in any pre-existing Privacy Notice (unless, of course, the user consents otherwise). Also, in the unlikely event that Cube or substantially all of its assets are acquired by a third party, user information will be one of the transferred assets.
• With your Consent: We also may disclose your Personal Data as may be described in a notice to you at the time the information is collected or before it is shared, or in any other manner to which you consent.

• International transfers of Personal Information

To facilitate our global operations, Cube may transfer your personal information outside of the European Economic Area (“EEA”), UK and Switzerland. The EEA includes the European Union countries as well as Iceland, Liechtenstein, and Norway. Transfers outside of the EEA are sometimes referred to as “third country transfers”.

We may transfer your personal information to our Affiliates, third-party partners, and service providers based throughout the world. In cases where we intend to transfer personal information to third countries or international organizations outside of the EEA, Cube implements suitable technical, organizational and contractual safeguards (including Standard Contractual Clauses), to ensure that such transfer is carried out in compliance with applicable data protection rules.

We also rely on decisions from the European Commission where they recognize that certain countries and territories outside of the European Economic Area ensure an adequate level of protection for personal information. These decisions are referred to as “adequacy decisions”.

• How Secure is My Information?

We design our systems with your security and privacy in mind. We have appropriate security measures in place to prevent your information being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. We work to protect the security of your personal data during transmission and while stored by using encryption protocols and software.We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of your personal data. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

Our security procedures mean that we may ask you to verify your identity to protect you against unauthorized access to your account. We recommend using a unique password for your Cube account that is not utilized for other online accounts and to sign off when you finish using a shared computer.

• What About Advertising?

To provide you with the best user experience, we may share your personal data with our marketing partners for the purposes of targeting, modelling, and/or analytics as well as marketing and advertising. You have a right to object at any time to processing of your personal data for direct marketing purposes.

• What Rights Do I Have?

Subject to applicable law, as outlined below, you have a number of rights in relation to your privacy and the protection of your personal data. You have the right to request access to, correct, and delete your personal data, and to ask for data portability. You may also object to our processing of your personal data or ask that we restrict the processing of your personal data in certain instances. In addition, when you consent to our processing of your personal data for a specified purpose, you may withdraw your consent at any time. If you want to exercise any of your rights please contact us at privacy@cube.xyz. These rights may be limited in some situations - for example, where we can demonstrate that we have a legal requirement to process your personal data.

• Right to access: you have the right to obtain confirmation that your personal data are processed and to obtain a copy of it as well as certain information related to its processing.;
• Right to rectify: you can request the rectification of your personal data which are inaccurate, and also add to it. You can also change your personal data in your account at any time.
• Right to delete: you can, in some cases, have your personal data deleted. Please note that personal data may still be retained in the event of account deletion to comply with our legal obligations.
• Right to object: you can object to the processing of your personal data For instance, you have the right to object where we rely on legitimate interest or where we process your data for direct marketing purposes;
• Right to restrict processing: You have the right, in certain cases, to temporarily restrict the processing of your personal data by us, provided there are valid grounds for doing so. We may continue to process your personal data if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable laws;
• Right to contest to a decision based solely on automated processing: You have the right to require that decisions be reconsidered if they are made solely by automated means, without human involvement; we use automated tools to make sure that you are eligible to be our customer taking into account our interests and legal obligations; if these automated tools indicate that you do not meet our acceptance criteria, we will not onboard you as our user;
• Right to portability: in some cases, you can ask to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format, or, when this is possible, that we communicate your personal data on your behalf directly to another data controller;
• Right to withdraw your consent: for processing requiring your consent, you have the right to withdraw your consent at any time. Exercising this right does not affect the lawfulness of the processing based on the consent given before the withdrawal of consent;
• Right to lodge a complaint with the relevant data protection authority: We hope that we can satisfy any queries you may have about the way in which we process your personal data. However, if you have unresolved concerns, you also have the right to complain to the data protection authority in the location in which you live, work or believe a data protection breach has occurred.

Residents of certain states in the United States of America are granted certain rights over their Personal Data as prescribed by relevant legislation.

California

The California Privacy Rights Act (“CPRA”) provides rights including:

• Right to know: You may request that businesses disclose to you what personal information they have collected, used, shared, or sold about you, and why they collected, used, shared, or sold that information, at which point we are required to provide you with responses to your inquiries within a 12 months period. Specifically, you may request that businesses disclose:
• The categories of personal information collected;
• Specific pieces of personal information collected;
• The categories of sources from which we collected personal information;
• The purposes for which we use the personal information;
• The categories of third parties with whom we share the personal information; and
• The categories of information that we sell or disclose to third parties.
• The right to delete: You have the right to request that your personal information collected from us be deleted. We shall comply with requests pending that there are no exceptions or requirements that would mandate us to retain the data;
• The right to opt-out: You may request that we stop selling or sharing your personal information (“opt-out”). Note that sharing refers specifically to sharing for cross-context behavioral advertising, which is the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s online activity across numerous websites. With some exceptions, we cannot sell or share your personal information after we receive your opt-out request unless you later provide authorization allowing them to do so again. We must wait at least 12 months before asking you to opt back into the sale or sharing of your personal information.
• The right to non-discrimination: We cannot deny goods or services, charge you a different price, or provide a different level or quality of goods or services just because you exercised your rights under the CCPA;
• The right to correct: You may ask us to correct inaccurate information that they have about you;
• The right to limit: You can direct us to only use your sensitive personal information (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) for limited purposes, such as providing you with the services you requested; and,
• The right to obtain: You have a right to request and obtain a copy of the personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format.

Illinois

The Illinois Biometrics Information Privacy Act provides rights including:

• The right to be Informed in writing of what data is being collected or stored. (e.g. fingerprint is stored when using TouchID to log into bank account app on phone); and,
• The right to be informed in writing of the specific purpose and length of time the for which the data will be collected, stored and used (e.g. fingerprint is stored for ease of logging into app and only for a duration of six months).

Virginia

The Virginia Consumer Data Protection Act (“VCDPA”) provides rights including:

• The right to have the controller confirm if the data controller is actually processing their personal data;
• The right to correct inaccuracies in the consumer’s personal data that is collected by the data controller;
• The right to have the data controller delete personal data provided by or obtained about the consumer;
• The right to obtain copies of the personal data collected by the data controller; and,
• The right to opt out of the processing of personal data for purposes of targeted advertising, the
• sale of personal data, or further profiling.

If you have any questions or objection as to how we collect and process your personal data, please contact us at privacy@cube.xyz.

• How Long Does Cube Keep My Personal Data?

We keep your personal data to enable your continued use of Cube Services, for as long as it is required in order to fulfil the relevant purposes described in this Privacy Notice, and as may be required by law such as for tax and accounting purposes, compliance with Anti-Money Laundering laws, to resolve disputes and/or legal claims or as otherwise communicated to you.

While retention requirements vary by jurisdiction, information about our typical retention periods for different aspects of your personal data are described below.

• Personal Identifiable Data collected to comply with our legal obligations under financial or anti-money laundering laws may be retained after account closure for as long as is required under such laws.
• Contact Information such as your name, email address and telephone number for marketing purposes is retained on an ongoing basis and until you (a) unsubscribe, or (b) we delete your account. Thereafter we will add your details to an unsubscribed list to ensure we do not inadvertently send you marketing materials.
• Content that you post on our website such as support desk comments, photographs, videos, blog posts, and other content may be kept after you close your account for audit and crime prevention purposes.
• Recording of voice calls with you may be kept for a period of up to six years, for audit/ compliance purposes and to resolve disputes and/or legal claims.
• Information collected via cookies, web page counters and other analytics tools is kept for a period of up to one year from the date of the collection of the relevant cookie.

• Notices and Revisions

If you have any concerns about privacy at Cube, please contact us, and we will try to resolve it. You also have the right to contact your local Data Protection Authority.

Our business changes regularly, and our Privacy Notice may change also. You should check our website frequently to see recent changes. We will update the “Last Updated” date accordingly at the beginning of this Privacy Notice. We will announce any material changes to this Privacy Notice on our Platform or by sending an email that you have provided under your account. Your continued use of Cubee after the changes to this Privacy Notice means that you understand and agree to such changes.

Unless stated otherwise, our most recent Privacy Notice applies to all information that we have about you and your account.

• Languages

This Privacy Notice may be published in different languages. In case of any discrepancy, this English version shall prevail.

• Contact Information

Our data protection officer can be contacted via email at privacy@cube.xyz and will work to address any questions or issues that you have with respect to the collection and processing of your personal data.

If you have a question about your account management, or Cube products or services the Data Protection Officer will not be able to assist you. In that case, please contact our Customer Support team.

The latest Privacy Notice changes were made on Jul 16, 2024