Your privacy matters to us. This Privacy Policy explains how personal data is collected, used, shared, retained and protected when you access or use the NCB / NordicBank.io platform, including our mobile applications, website and related services (together, the “Platform”).
The Platform is made available to eligible users in the European Economic Area (“EEA”), subject to product, partner and jurisdictional availability.
This Privacy Policy should be read together with the NCB Terms & Conditions and any privacy notices, terms or disclosures provided by the regulated financial, crypto-asset, card and identity-verification providers whose services are made available through the Platform.
NCB / NordicBank.io is operated by Amazing Trading Ltd, a company incorporated in Gibraltar under registration number GICO 125468-42, with registered office at Unit G02, Eurocity, Europort Avenue, Gibraltar, GX11 1AA (“Amazing Trading”).
For aspects of its EEA operating model, Amazing Trading operates through its Swedish registered branch, Amazing Trading Sweden Filial, registration number 516413-9791, c/o PoMoc AB, Södra Hamngatan 1B, 681 31 Kristinehamn, Sweden.
In this Privacy Policy, “NCB”, “Amazing Trading”, “we”, “us” and “our” refer to Amazing Trading Ltd in connection with the NCB Platform. For personal data for which Amazing Trading determines the purposes and means of processing, Amazing Trading acts as a data controller within the meaning of the General Data Protection Regulation (“GDPR”).
Data Protection Officer: Elise Moussa
DPO contact: dpo@amazing.trading
General privacy contact: privacy@amazing.trading
NCB is a technology and customer-interface platform. NCB does not itself issue e-money, operate payment accounts, hold customer funds, provide regulated custody of crypto-assets, or replace the regulated decision-making of the providers responsible for those services. The underlying regulated services are supplied by our licensed or regulated partners under their own regulatory responsibilities and applicable customer terms.
At the same time, Amazing Trading may process personal data in order to operate the NCB Platform, support onboarding, display account and transaction information, provide customer support, maintain security, manage provider integrations, comply with obligations applying to Amazing Trading, and administer the customer relationship.
Depending on the service and processing activity, a partner may act as an independent controller, joint controller or processor. The applicable role is determined by law and the relevant contractual and operational arrangements, not merely by where information is stored.
The principal providers used in connection with the Platform currently include the following.
UAB ConnectPay, company code 304696889, Algirdo g. 38, LT-03218 Vilnius, Lithuania, is the regulated electronic-money and payment-services provider supporting the fiat payment-account and IBAN services made available through the NCB operating model.
ConnectPay performs its own customer acceptance, KYC/AML, sanctions screening, transaction monitoring, payment processing, account restrictions and regulatory decisions in accordance with its legal obligations and its own terms and privacy notice. Information may be exchanged between NCB and ConnectPay where necessary to support onboarding, Platform functionality, customer service, complaints, security, fraud prevention, reconciliation, regulatory cooperation and the operation of the relevant services.
Crypto-asset services made available through the Platform are provided in cooperation with BitGo Europe GmbH and/or the applicable BitGo group entity (“BitGo”) under the relevant BitGo terms and regulatory framework. BitGo is responsible for the regulated crypto-asset services that it provides, including the applicable customer due diligence, transaction monitoring, custody and other regulated activities within its service scope.
Information may be exchanged between NCB and BitGo where necessary to onboard customers, provide and display crypto-asset functionality, route customer instructions and communications, show balances and transactions, support deposits, withdrawals, transfers, swaps or other supported features, provide customer support, manage risk and comply with contractual, legal or regulatory requirements.
Identity-verification, KYC, liveness, document-validation, sanctions/PEP screening and related compliance technologies used in the onboarding journey may include Sumsub services provided by Sum and Substance Ltd and/or the relevant Sumsub group entity, and services provided by UAB Ondato (“Ondato”). These services may be integrated directly by NCB and/or made available within the onboarding or compliance flow of a regulated provider.
Where a verification provider processes personal data on the instructions of NCB, it acts in accordance with the applicable data-processing arrangements. Where the provider is engaged by ConnectPay, BitGo or another independent controller, that provider relationship and processing are governed by the relevant regulated provider’s arrangements and privacy information.
Card-related services and card-processing functionality made available through the Platform are supported by Wallester AS (“Wallester”) under the applicable card programme arrangements. Personal data necessary for card issuance, card administration, transaction processing, security, fraud prevention, customer support and regulatory compliance may be exchanged with or processed by Wallester as required for those services.
Where Wallester acts as an independent controller for its regulated or card-service processing, its applicable terms and privacy information govern that processing.
We may use additional approved providers for hosting, cloud infrastructure, cybersecurity, monitoring, communications, customer support, analytics, diagnostics, fraud prevention, software development and other functions necessary to operate and secure the Platform.
The personal data processed in connection with the Platform depends on the products, providers and features you use. It may include the following categories.
Depending on the integration, some KYC information may be submitted directly to ConnectPay, BitGo, Sumsub, Ondato or another provider. NCB may receive or access verification status, outcomes, risk indicators and underlying information where necessary and permitted for the Platform, customer support, compliance, audit or provider-coordination purposes.
Certain blockchain information is public by the nature of public blockchain networks and may not be capable of being altered or deleted by NCB.
Some NCB mobile-app features require access to functions on your mobile device. Permissions are requested only where relevant to the feature being used and remain subject to your device settings.
You can manage permissions through your device settings. Disabling a permission may prevent the related Platform feature from working correctly.
We may collect personal data:
We process personal data only where there is an appropriate legal basis. Depending on the activity, this may include the following.
ConnectPay, BitGo, Wallester and other regulated providers may separately process personal data to satisfy legal and regulatory obligations applying directly to them.
We rely on legitimate interests only where those interests are not overridden by your rights and freedoms.
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.
Access to payment, card and crypto-asset services may require identity verification and customer due diligence. NCB and/or the relevant regulated or verification provider may process information to confirm identity, validate documents, perform facial comparison or liveness checks, verify address or other customer information, conduct sanctions and PEP screening, identify suspected fraud or identity manipulation, perform risk assessments, carry out enhanced due diligence where required and support ongoing monitoring.
You may be unable to create or maintain an account, complete a transaction or access a particular service if required verification information is not provided or required checks cannot be completed successfully.
Identity verification may involve photographs, video, facial matching, liveness detection or similar technologies. Where such information constitutes biometric or other special-category personal data, it is processed only where the applicable legal requirements and safeguards are met. Additional information or consent may be presented during the relevant verification process where required.
Payment-account and electronic-money functionality made available through NCB is provided through ConnectPay. Information necessary for these services may be transmitted between NCB and ConnectPay. ConnectPay may independently process information for customer identification, account provision, payment execution, transaction monitoring, AML and sanctions compliance, fraud prevention, security, regulatory reporting and compliance with its legal obligations.
Where ConnectPay is the controller for a processing activity, its own privacy notice governs that processing. This Privacy Policy governs processing for which Amazing Trading is responsible.
Card services are supported through Wallester under the applicable card programme arrangements. Information necessary for card issuance, activation, administration, transaction processing, security, fraud prevention, support, dispute handling and regulatory compliance may be processed by or exchanged with Wallester and relevant card-network participants.
Where Wallester acts as an independent controller, the applicable Wallester terms and privacy information govern that processing.
Crypto-asset functionality is provided through BitGo. Information may be exchanged between NCB and BitGo where necessary to establish or maintain access to crypto-asset services; display balances and transactions; route customer instructions; facilitate supported deposits, withdrawals, transfers, swaps or conversions; support identity or compliance checks; conduct transaction or blockchain screening; prevent fraud; provide customer support; and meet contractual, legal or regulatory requirements.
Where BitGo acts as an independent controller for its regulated processing, the applicable BitGo privacy notice and terms govern that processing.
Automated technologies may be used by NCB and/or our service providers for identity-document verification, facial matching and liveness detection, sanctions and PEP screening, fraud detection, risk scoring, transaction monitoring, blockchain analytics, device security and identification of suspicious or unusual activity.
Automated systems may generate verification results, alerts or risk indicators that contribute to decisions concerning onboarding, transactions or access to services. Where a decision for which NCB is responsible is based solely on automated processing and produces legal effects or similarly significantly affects you, and Article 22 GDPR applies, NCB will ensure that the processing is legally permitted and that applicable safeguards and rights are provided. Where the relevant decision is made by an independent regulated provider, that provider’s privacy notice and procedures apply.
We may disclose personal data only where necessary and permitted by law. Recipients may include:
We do not sell your personal data.
Our mobile applications may be distributed through third-party application marketplaces such as the Apple App Store and Google Play. Apple, Google and other app-store providers may independently process information relating to your use of their services, such as store account information, downloads, device information, purchases or diagnostic information. Their processing is governed by their own terms and privacy notices.
The Platform involves service providers and technical infrastructure that may operate in different countries. Personal data may therefore be accessed, processed or transferred within the EEA and, where necessary, outside the EEA.
Where personal data subject to the GDPR is transferred outside the EEA to a country that does not benefit from an applicable adequacy decision, appropriate safeguards will be used where required by law. These may include European Commission Standard Contractual Clauses, other recognised transfer mechanisms and appropriate contractual, organisational or technical safeguards.
You may contact privacy@amazing.trading or dpo@amazing.trading for further information about safeguards applicable to transfers for which Amazing Trading is responsible. Transfers independently carried out by ConnectPay, BitGo, Wallester or another controller are governed by that provider’s privacy information.
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and as required or permitted by applicable law, contractual commitments and provider arrangements.
Amazing Trading maintains records relating to customer onboarding, identity-verification status, transaction activity available to NCB, compliance monitoring, complaints, customer agreements, account statements and other business records where required. Relevant compliance and customer records are generally retained for a minimum of five (5) years following the end of the customer relationship or completion of the relevant transaction, or longer where required by applicable law, contractual obligations, regulatory requirements, disputes or ongoing investigations.
The BitGo integration agreement also requires the Platform Operator to maintain specified customer-agreement, account-statement and formal customer-communication records during the agreement term and for five years thereafter. Records maintained by ConnectPay, BitGo, Wallester or another independent controller are retained according to that provider’s legal and regulatory obligations and privacy notice.
Closing your NCB account does not necessarily result in immediate deletion of all personal data. When information is no longer required, it will be deleted, anonymised or securely restricted as appropriate.
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental or unlawful disclosure, loss, destruction, alteration, misuse and other unlawful processing. Measures may include access controls, authentication, encryption, secure communications, logging, monitoring, least-privilege access, segregation of duties and security testing where appropriate.
No electronic system can be guaranteed to be completely secure. Users are also responsible for protecting their login credentials and devices and should notify us promptly if they believe their account has been compromised.
We may send communications necessary to administer your account or provide the services, including security alerts, transaction notifications, compliance requests, service notices, changes affecting your account, changes to contractual terms and other important operational communications.
Where required by law, promotional or marketing communications will be sent only with the appropriate consent or other lawful basis. You may opt out of marketing communications at any time using the unsubscribe method provided or by contacting us. Opting out of marketing does not prevent necessary service, security, legal or account communications.
Subject to the GDPR and applicable exceptions, you may have the right to:
You can make a request relating to processing carried out by Amazing Trading by contacting privacy@amazing.trading or dpo@amazing.trading. We may need to verify your identity before responding.
Where your request relates to information controlled independently by ConnectPay, BitGo, Wallester or another provider, you may exercise your rights directly with that provider. Where appropriate, we will assist you in identifying the relevant controller.
If you have concerns about how Amazing Trading processes your personal data, please contact privacy@amazing.trading or dpo@amazing.trading.
You also have the right to lodge a complaint with a competent data-protection supervisory authority, including the supervisory authority in the EEA country of your habitual residence, place of work or place of the alleged infringement, as applicable. This right relates to data protection and is separate from the financial-services licensing status of NCB or its regulated service providers.
Some personal data is optional. Other information is necessary to create an NCB account, verify your identity, enter into or perform a contract, access regulated payment, card or crypto-asset services, satisfy a request from a regulated provider, or comply with applicable legal or regulatory requirements.
Where required information is not provided, NCB or the relevant provider may be unable to open, activate or maintain an account, process a transaction or provide a particular service.
The NCB Platform is intended only for persons who satisfy the eligibility and minimum-age requirements set out in the NCB Terms & Conditions and the terms of the relevant regulated providers. We do not knowingly offer NCB accounts to persons who do not meet those requirements. If you believe personal data relating to an ineligible child has been provided to us, please contact privacy@amazing.trading.
Our website and mobile applications may use cookies, software development kits (“SDKs”) and similar technologies for authentication, security, Platform functionality, remembering preferences, diagnostics, performance monitoring, analytics and service improvement. Where consent is legally required for a non-essential technology, consent will be requested before that technology is used.
Because NCB integrates services supplied by third parties, certain processing is governed by separate privacy notices and terms. Users should review the applicable privacy information made available for ConnectPay, BitGo, Wallester, Sumsub, Ondato and any additional regulated or specialist provider whose service the user accesses.
Where required by a provider agreement, applicable provider privacy notices, terms, consents and disclosures will be presented or linked in the Platform, website or onboarding journey so that the customer receives the information required by that provider before using the relevant service.
We may update this Privacy Policy from time to time to reflect changes to the Platform, providers, processing activities, laws, regulations, security practices or operational arrangements. The current version will be made available through the Platform and/or nordicbank.io. Where required, we will provide additional notice of material changes.
For questions about this Privacy Policy, the processing of personal data by NCB or to exercise your data-protection rights, please contact: