Privacy

Introduction and Scope

Changes to This Privacy Notice

Our Relationship to You

• U.S. Users: Uphold HQ Inc.
• U.K. Users: Uphold Europe Limited
• Other Regions: Uphold Worldwide Ltd.

How do we collect Personal Data about you?

What Personal Data do we collect?

Cookies and Similar Tracking Technologies

• Analyze our web traffic using an analytics package
• Identify whether you have previously visited our Sites
• Test content on our Sites
• Store information about your preferences
• Recognize when you return to our Sites
• Track advertising attribution statistics
• Remember user details to streamline transactions, including pre-filling email, past transactions, and asset details

• Consent & Control: When you first visit our Site, you can manage your cookie preferences via our cookie consent banner, where you may opt in or out of preference storage separately from analytics and advertising cookies.
• Updating Your Preferences: You can modify your cookie settings at any time through our widget, where you can enable or disable preference cookies.
• Opting Out via Browser Settings: If you prefer not to have this information stored, you can disable cookies via your browser settings. Disabling cookies may affect certain features. For guidance on modifying your browser settings, please refer to your browser’s Help menu (e.g., Chrome, Firefox, Safari). Please note that disabling preference cookies may require you to manually re-enter details during future visits.

• Cloudflare – Ensures a stable connection and helps identify spammers.
• Google Analytics & Ad Tags – Tracks website traffic and user interactions to improve services and ad targeting.
• LinkedIn Ads & Twitter Ads – Tracks ad performance and enables targeted advertising.

How do we use your Personal Data, and on what legal basis do we collect your Personal Data?

• To provide you with a service: It may sound obvious, but we need to make Topper work in the first place. Without your name, credit/debit card information, and other details; and information about your interaction and use of Topper and the technology you use to access Topper, we simply could not offer you our products and services.
• To verify your identity: As a financial institution, we must be able to confirm the true identity of our users. There are rules and regulations across the globe that require us to identify our customers, including laws concerning anti-corruption, anti-bribery, anti-terrorism, and anti-money laundering. We use Veriff to verify your identity by determining whether a selfie you take matches the photo in your government-issued identification. Veriff’s facial recognition technology collects information from your photos that may include biometric data, and when you provide your selfie, you will be asked to agree that Veriff may process biometric data and other data (including special categories of data) from the photos you submit and share it with us. Automated processes may be used to make a verification decision. Veriff’s privacy policy describes its collection, processing, storage, and use of your personal data in more detail.
• To verify your address: We use Ekata to validate your physical address. Automated processes may be used to make a verification decision. Ekata’s privacy policy describes its collection, processing, storage, and use of your personal data in more detail. In lieu of Ekata, we may use Trulioo to validate your physical address. Automated processes may be used to make a verification decision. Trulioo’s privacy policy describes the collection, processing, storage, and use of your personal data in more detail. We additionally may require further address verification and validation through our partner, SumSub by requesting that you provide us with documentation verifying your physical address such as bank statements, utility bills, Internet/cable TV/house phone line bills, tax returns, council tax bill, and or government-issued certifications of residence. SumSub’s privacy notice describes its collection, processing, storage, and use of your personal data in more detail.
• To perform your transactions: To verify that you are eligible to use Topper and perform the transactions you request, and also to ensure compliance with regulatory requirements (e.g., anti-money laundering laws) and our own internal policies, we must receive and share various information regarding your finances with third parties including accounts you hold, balances, transactions, and a risk score. For example, if you choose to fund a transaction using a third-party service such as PayPal or Venmo, we may share relevant personal and transaction data with those providers to facilitate the payment. These providers process your data in accordance with their own privacy policies. For more information about the service providers we work with, please refer to our sub-processor list.
  
• To prevent fraud: We use the personal information we collect in connection with providing you our services to detect and prevent fraudulent activity. We share this information with Unit 21 and Oscilar, both third-party service providers, to assist us with this effort. Unit 21  and Oscilar use various technologies to capture various device identifiers, such as canvas fingerprinting and may use automated decision-making to detect and prevent fraudulent activity. For more information on the privacy practices of Unit 21, please review their Privacy Policy. For more information on the privacy practices of Oscilar, please refer to their Privacy Policy.
• To comply with legal obligations: We retain and process data as required by anti-money laundering and other financial regulations.
• To keep your account secure: We use your phone number to verify the number you provide at signup. This includes sending SMS or text messages (including by an automatic telephone dialing system) to any of the phone numbers provided by you or on your behalf in connection with your Topper account. We additionally use your email address to conduct a verification round-trip at each session.
• To keep you informed: It is important for security and financial transparency that we keep you aware of your transactions and related activity at Topper. We will send you emails with confirmations, invoices, technical notices, updates, security alerts, legal and support, and administrative messages.
• For investigations: Occasionally, we need to look at your account activity to check and protect against fraudulent, unauthorized, or illegal behavior.
• For customer care: We strive to make sure you can easily use Topper with no headaches, but sometimes you need help. Our customer care team will occasionally need access to your account data to fix any issues or answer your questions.
• To manage and improve our service: We like to understand how you use and engage with Topper to make sure it is the best it can be. This process includes combining different accounts, transactional, marketing, and other data to analyze the effectiveness and performance of our offering.
• Marketing and advertising analytics: We want you to be aware of product updates, news, events, promotions, and much more. If you consent, we will (i) send you information, including regular personalized emails, to keep you up to date with all things Topper; (ii) keep you informed of industry updates and much more; (iii) from time to time we may also invite you to take part in our polls, surveys, focus groups and other types of market research; and (iv) if you have consented/opted in by accepting our cookies we collect hashed identifiers derived from email addresses for cross-device tracking for targeted advertising, and where you may have seen Topper advertisements.
• Marketing and email data: We use Customer.io for all marketing and transactional communications. Our email headers contain tracking pixels that collect the following information:
  - Whether the email was opened
  - How long the email was open
  - How far down the email a recipient scrolls
  - Whether any links in the email were clicked
  - The recipient’s IP address
  - The recipient’s email client and device type
  - The recipient’s location‍
  
  Customer.io’s Privacy Policy describes the collection, processing, storage, and use of your personal data in more detail.
• Business operations: We may need to use your Personal Data for our business operations, including internal training and administration, legal compliance, enforcing our legal rights, protecting third-party rights, and in connection with a business transition such as a merger, acquisition by another company, or sale of all or a portion of our assets.
• Website and software applications: We use data analytics to improve our website and software applications, activities and operations, products/services, events, etc.
• Third parties: If you (i) use Topper by (a) using an application (whether directly or by authorizing an application to use Topper, (b) using a link provided by a third-party, or (c) any third party integrations or (ii) if you partner with us in a program or other business arrangement where a third-party intermediary is involved, all such third parties may receive detailed information about your account, your use of Topper, transaction history or even the ability to take actions on your behalf. When you authorize an application or third-party integration via Topper, you will be notified of what Personal Data will be shared with these third parties. Information collected by these applications or third-party integrations is subject to their terms and policies and is required by contract by Uphold to maintain the confidentiality and security of your Personal Data.

• Consent: We get your clear permission before using your data.
• Contractual Necessity: We process data needed to provide our services.
• Legal Obligations: We must collect some of your information to follow laws and regulations, like those that prevent money laundering and require financial reports.
• Legitimate Interests: We process data for legitimate business needs while protecting your rights. It is important to note that a single processing activity may rely on multiple legal bases. We carefully assess and document the most appropriate legal ground for each specific purpose of data processing, ensuring transparency and compliance with data protection regulations.

How do we keep your Personal Data safe?

How do we share your Personal Data?

• Regulatory Authorities and Law Enforcement: Where required by law or under lawful requests, subpoenas, or legal processes
• Identity Verification and Compliance Partners: Trusted third-party service providers that assist in identity verification, fraud prevention, and compliance checks
• Financial Institutions and Payment Service Providers: Banks, payment processors, and financial institutions involved in transaction processing and settlement. If you choose to pay with PayPal or Venmo, we share necessary personal data (like your name, email, address, and device details) with PayPal, Inc. and its processor, Braintree, to complete your transaction. We may also receive limited data from PayPal or Venmo for verification and fraud prevention. These services process your data under their own privacy policies: PayPal Privacy Statement and Venmo Privacy Policy.
• Affiliates and Business Partners: Where necessary for providing our services, ensuring platform security or enabling regulatory compliance

• Transaction ID
• Timestamp
• $ Amount
• Crypto purchased
• Fees
• Transaction status (e.g., completed, on hold)
• Crypto address where crypto was sent

International Data Transfers

Your Privacy Rights

• Access and obtain a copy of your data.
• Correct inaccurate information.
• Request deletion of your data (subject to legal retention requirements).
• Object to or restrict processing.
• Withdraw consent for marketing communications.
• File a complaint with a data protection authority.

How long do we retain your Personal Data?

• We will only retain your Personal Data for as long as necessary to fulfill the purposes we collected it for, including to satisfy any legal, accounting, regulatory, audit or reporting requirements, as well as other factors required by General Data Protection Regulation or other laws to which we are subject, including obligations under the California Money Transmission Act, the California Digital Financial Assets Law, the federal Bank Secrecy Act, anti-money-laundering and counter-terrorist-financing laws and regulations, and economic sanctions laws administered by the U.S. Office of Foreign Assets Control. As a general matter, we retain customer data for a minimum of 5 years after the end of the customer relationship and up to 10 years, or longer where required to comply with sanctions screening, enforcement actions, or government investigations.
• When it is no longer necessary to retain your Personal Data, we will securely delete it, subject to applicable laws and regulations.
• In some circumstances, we may anonymize your Personal Data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
• If you request that we stop sending you marketing materials, we will continue to keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.
• Should you make a Data Subject request through our standard customer support channel, we will retain the minimum required amount of data to keep a record of your request and the action we took to resolve it.

Notice to California Residents

• Directly from you. For example, from forms you complete or products and services you purchase, or from applications for employment with us.
• Indirectly from you. For example, from observing your actions on our website.
• From third parties. For example, from our third-party service providers to verify your identity or to facilitate our provision of services to you.

• The categories of personal information we have collected about you;
• The categories of sources for the personal information we have collected about you;
• Our business or commercial purpose for the information collection;
• The categories of third parties with whom we share that personal information;
• The specific pieces of personal information we collected about you.

How do we protect children’s privacy?

How do we use your personal data for communication and marketing purposes?

Where does this Privacy Notice apply?

Who can you contact if you have further questions or requests about your privacy?

Topper Subprocessor list