Privacy Policy

Introduction

This Privacy Policy explains how Alea Group AG (hereinafter: “Alea”, “we”, “our” or “us”) collects, uses, stores, and protects your personal data when you access our website aleagroupag.ch or use any of our services.

We are committed to ensuring the confidentiality, integrity and availability of your personal data, in compliance with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the General Data Protection Regulation (GDPR).

Data Controller

The data controller is:

• Alea Group AG
• Rue du Mont-Blanc 11
• 1201 Geneva, Switzerland
• CHE-445.359.847

Scope of Application

This policy applies to:

• Visitors of our website
• Clients and merchants using our payment infrastructure, and individual clients using our Exchange services
• Natural persons linked to corporate clients (e.g., UBOs, directors)
• Business partners, suppliers, and service providers

What Personal Data We Collect

Identification Data

• Full name, nationality, date of birth
• Address, phone number, email
• Government-issued ID (passport, national ID)

Compliance Data

• KYC documentation
• Proof of source of funds
• Sanctions and PEP screening results

Technical Data

• IP address, browser type
• Device identifiers
• Log data (time of access, page interactions)

Transactional Data

• Payment history
• Usage of payment gateways
• Transaction metadata

Digital Asset Data

• Wallet addresses provided for the receipt of digital assets
• Blockchain transaction records associated with your orders
• Digital asset type and quantity per transaction

Purpose of Processing

Data Retention

We retain personal data only as long as necessary to fulfil the purposes for which it was collected or as required by Swiss law (e.g., 10 years under the Swiss Code of Obligations for transactional data).

Data Sharing

We may share your data with:

• Regulatory authorities (e.g., FINMA, MROS) when legally required
• SO-FIT, our OAR, for compliance supervision

Third-party service providers, such as:

• KYC/AML providers
• IT infrastructure (cloud, cybersecurity)
• Payment partners (banks, PSPs, crypto processors)

All partners are contractually bound to ensure data protection and may only process data on our instructions.

Data Transfers Abroad

Where we transfer data outside of Switzerland or the EEA, we ensure such transfers comply with revFADP and, if applicable, GDPR requirements (e.g., Standard Contractual Clauses, adequacy decisions).

Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• SSL/TLS encryption
• Role-based access control
• Secure servers located in Switzerland and/or the EU
• Regular penetration testing
• Data pseudonymisation and minimisation

Your Rights as a Data Subject

Under the revFADP, you have the following rights:

• Access to your data
• Rectification of inaccurate or outdated data
• Erasure where permitted by law
• Objection to processing (in certain cases)
• Data portability (if processing is automated and based on consent or contract)

To exercise your rights, please contact us at development@aleagroupag.ch with proof of identity.

Use of Cookies

We use cookies for technical operation, analytics, and site optimisation.

You can control cookie settings through your browser.

Details are available in our Cookie Policy.

Automated Decision-Making

Alea does not perform automated decisions that produce legal effects on users without human intervention (e.g., credit scoring, profiling).

If this changes, we will inform you in advance and obtain explicit consent when required.

Updates to This Policy

This Privacy Policy may be updated periodically. We encourage users to review this page regularly to stay informed of changes. The date of the latest version is always indicated at the top.

Contact

Data Protection Officer (DPO)

Alea Group AG – Rue du Mont-Blanc 11, 1201 Geneva, Switzerland

Email: development@aleagroupag.ch