legal protocol title

Privacy Notice

Last Updated on 20 October 2025
This Privacy Notice applies to Gate Technology Ltd. (“Gate” or the “Company”) and our website www.gate.com/en-eu

Introduction
1. This Privacy Notice (“Notice”) is designed to help you understand how Gate Technology Ltd. (“us”, “we” or “our”) collects, uses and safeguards the information you provide to us and to assist you in making informed decisions regarding your personal data when using our trading platform.
2. We recognize that information privacy is an ongoing responsibility and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy notices. We respect our users’ privacy, and we are committed to maintaining robust privacy protections in compliance with applicable privacy laws – notably:
  1. - General Data Protection Regulation (EU) 2016/679 (“GDPR”)
  2. - Maltese Data Protection Act (Chapter 586 of the Laws of Malta) and its respective secondary or subsidiary legislation.
  3. - Any other data protection legislations in the territory or market of operation.
3. This Notice applies where we are acting as a data controller with respect to personal data; in other words, where we determine the purposes for which personal data is processed and the means of such processing.
4. This Notice does not apply to third-party websites (e.g., referral websites) or online/mobile stores from which you install our mobile application (“App”), which may also collect and use data about you. We are not responsible for any of the data collected by any such third-party. We do not control their websites or apps and are not responsible for their privacy notices, statements or policies. We encourage you to read the privacy notice or statement of every website and app which you use or otherwise visit.
5. In this Privacy Notice, “Site” refers to our websites operated by Gate Technology Ltd. including www.gate.com/en-eu, any associated mobile applications and APIs, any related software, forums, blogs, social media pages and other relevant platforms operated or maintained by Gate Technology Ltd (collectively the "Sites").
6. “Services” refers to the services we offer (e.g., Spot Trading) through our Site or App. “You” and derivatives of the word “you” refer to you, as a user and/or visitor of our Site or our Service.
7. Please refer to the Glossary to understand the meaning of some of the data protection specific terms used in this notice.
8. It is important that you read this Notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data.
9. This Notice supplements the other notices and is not intended to override them.
Our Details
1. With respect to this domain, the data controller is Gate Technology Ltd., a company registered in Malta under registration number C89337, with its registered office at:
2. The Core, Triq il-Wied Ta’ L-Imsida, Msida, MSD 9021, Malta.
3. You may contact Gate Technology Ltd. or its Data Protection Officer (DPO) regarding any privacy-related matters by email at privacy_eu@gate.com or by post at the address above.

Information We Collect About You and Source

While using our Site or App, we may collect, store and process different kinds of personal data about you which we have categorised below.
Our Services are not directed to anyone under the age of 18. Our Site or App do not knowingly collect or solicit information from anyone under the age of 18 or allow anyone under the age of 18 to sign up for the Service.
If we learn that we have gathered personal data from anyone under the age of 18, we will delete the information as soon as possible. If you believe we have collected such information, please contact us at privacy_eu@gate.com

Category of Personal Data	What it includes and source
Contact data	includes your full name, email address, residential address, mobile number. The source of the contact data is you.
Account data	includes your full name, email address, mobile number, date of birth, place of birth, nationality, national I.D., or passport number, residential address, website settings and marketing preferences. The primary source of account data is you.
Identification and verification data (Anti-Money Laundering/Due Diligence/KYC data)	includes full name, email address, mobile number, date of birth, place of birth, nationality, national I.D., passport or other forms of identification, residential address, proof of address, a recent photo (selfie), employment status, source of funds and/or wealth and related documentation, gross annual income and proof of wallet ownership. The primary source of identification and verification data is you.
Information collected in accordance with the requirements of the laws	Results from Politically Exposed Persons (PEP) Screening & Sanction screening, any additional personal data required for proving Source of Funds (e. g. employment contract, certificate of inheritance, etc.), data on the management structure and business activity, etc.
Transaction data	includes crypto and FIAT payments to and from you (both successful and failed deposits and withdrawals), coin pairs (e.g., BTC/ETH), date and time of transactions, account balances, source and destination wallet data, and other details of Services that you enter with us and/or through our Site or App. The source of the transaction data is you and our FIAT payment services provider.
Financial data	includes source of funds and/or wealth and related documentation, account balances, and other financial related data. The primary source of identification and verification data is you.
Usage data (analytics data)	may include your IP address, geographical location, browser type and version, device type and model, operating , referral source, length of visit, page views and website navigation paths, device location, as well as information about the timing, frequency and pattern of your service use. The source of the usage data is Google Analytics.
Marketing and communication data (calls, emails or chats)	includes the communication content and the metadata associated with the communication that you send to us or that we send to you. It also includes your marketing communication preferences.
Special categories of personal data	includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do NOT collect any special categories of personal data about you. However, we may not exclude that you, at your own discretion, send us such data in communication with us.

How information is collected
1. We collect your personal data in the following manner:
  1. a. Information you provide to us directly when contacting us;
  2. b. Information you provide to any of our affiliates including parent companies, subsidiaries, and companies under common control and ownership;
  3. c. Information we receive from third parties, such as third-party service providers;
  4. d. Information acquired by us during the course of our relationship and dealings with you;
  5. e. Information collected through the use by you of our website, platforms and applications; and
  6. f. Information gathered from publicly available sources.

How we use information

We have set out below the purposes for which we may process your personal data and the legal basis of the processing. We have also identified what our legitimate interests are where appropriate.

Purpose	Category of Personal Data	Legal Basis
To register you as a new customer allowing you to access and use the website's functionalities (subject to onboarding clearance)	Contact data Account data Identification and verification data	Performance of a contract
To fulfil AML/CFT and due diligence requirements	Contact data, Account data, Identification and verification data, Financial Data	Compliance with a legal obligation
To fulfil legal, tax and accounting obligations (e.g., reporting to tax authorities)	Transaction data Financial data	Compliance with a legal obligation
To deliver our Services and process and manage transactions/orders	Contact data Account data Transaction data Financial data Marketing and communication data	Performance of a contract
To establish and investigate any suspicious behaviour in order to protect our business from any risk and fraud	Contact data Account data Identification and verification data Transaction data Financial data	Compliance with a legal obligation / Legitimate interest
To manage our relationship with you, to communicate with you, to provide you access to the Services	Contact data Account data Marketing and communication data Transaction data	Performance of a contract
Use data analytics to improve the Site, marketing purposes and customer experience	Usage data	Legitimate interest
To exercise and defend legal claims	Contact data Account data Marketing and communication data Transaction data	Legitimate interest

We will use your personal data for purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
We have a legitimate interest in understanding how customers and potential customers use our Site and Services. This would assist us with providing more tailored products and services, with providing information to our sponsors and corporate members, and with providing appropriate staffing to meet customer needs.
We rarely rely on your consent to process your personal data, as usually another lawful basis will be more suitable. Where we do seek to rely on your consent, we will always ensure that this consent is fairly obtained by clearly informing you about why your consent is needed. We will usually require that you provide your consent through a clear, affirmative action such as ticking a box, toggling/swiping a button or switch on our website or on a mobile application, signing your name or other suitable method that can clearly evidence your consent. Non-exhaustive examples of when we may need your consent are:
1. a. to enable a feature on a mobile device application; or
2. b. to enable us to place cookies and similar technologies in accordance with our Cookie Notice.
Please note that depending on the circumstances you might be asked to provide further information. For instance, when you approach us or have been approached by us either as our partner or client with regards to the provision of our Services as well as services provided to us by you, you shall be asked to provide us KYC data. Such data might include:
1. a. Personal details of directors
2. b. Personal details of UBOs.
3. c. Account signatory personal details (if applicable)
4. d. Additional information such as personal data on PEPs.
You must ensure that they are aware that their personal data is being shared with us.
In certain circumstances we may share and disclose your personal data as described below.

Special categories of personal data
1. We may also need to occasionally process certain special categories of personal data about you as part of our statutory due diligence and sanction screening requirements. This may comprise personal data revealing your political opinions or affiliations, and also personal data relating to criminal convictions and offences or related security measures.
2. Below are the circumstances and purposes for which this may take place:
  1. a. Initial and on-going customer due diligence checks: determination of whether or not the customer and certain persons related to the customer are “politically exposed persons” in terms of applicable AML legislation; and
  2. b. Initial and on-going customer due diligence checks: due diligence checks via LexisNexis, Google Searches, databases of regulatory or supervisory authorities, and other publicly accessible sources.
3. As a lawful basis, the processing of this data is necessary for reasons of substantial public interest on the basis of an EU or national law (namely, AML related) or otherwise relates to data which has been manifestly made public by the data subject.
4. There may be other occasions where we may need to process your sensitive personal data, namely where:
  1. a. the processing is necessary for the detection or prevention of crime (including the prevention of fraud) to the extent permitted by applicable law or regulation; or
  2. b. the processing is necessary for the establishment, exercise or defence of legal rights.
Compliance with the Law
1. We may disclose your information, including personal data, to courts, law enforcement or governmental authorities, or authorized third parties, if and to the extent we are required or permitted to do so by law or if such disclosure is reasonably necessary:
  1. a. to comply with our legal obligations,
  2. b. to comply with legal process and to respond to claims asserted against us,
  3. c. to respond to requests relating to a criminal investigation or alleged or suspected illegal activity or any other activity that may expose us, you, or any other of our users to legal liability.
Third-party service providers
1. We can use third-party service providers to help us provide services related to the website and the payment services. Service providers may be located inside or outside of the European Economic Area (“EEA”).
2. These providers have limited access to your information and are contractually bound to protect and to use it on our behalf only for the purposes for which it was disclosed and as well as to provide the same level of data protection and be consistent with this Privacy Notice. The categories of such third parties are mainly the following:
  1. a. Service providers, such as card issuers and card acquirers, and any other service providers the Company has engaged to be able to provide you with the services it contracted to provide you;
  2. b. Marketing providers to perform certain marketing activities on our behalf and only with your consent;
  3. c. IT/ support services;
  4. d. Third parties assisting in investigations (such as AML investigations) for the purpose of detecting and preventing fraud or other security or technical problems;
  5. e. Cloud services providers for provision of cloud-based services such as storage or hosting certain software;
  6. f. Professional advisors acting as processors or joint controllers including lawyers, auditors and insurers who provide consultancy;
  7. g. Service providers for the purpose of data analytics;
  8. h. Service providers enabling communication with you from a technical standpoint (e.g. via email, chat).
3. Occasionally, at our discretion, we may include or offer third party products or services on our Platform. These third-party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our Platform and welcome any feedback about these sites.
Others
1. The Company’s internal corporate entities and our current and future parents, affiliates, subsidiaries, and other companies under common control and ownership, such as to
2. to facilitate and administer your business relationship with us;
3. as part of our regular reporting activities on company performances;
4. to consolidate our reporting and accounting procedures;
5. to ensure business efficiency.
  1. a. In connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of the Company by another company;
  2. b. if we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property, and safety of the Company or others. This includes exchanging information with other organisations for the purposes of fraud protection.
  3. You can always contact us to receive the full list of our service providers which process your data.
How we store and protect information
1. Our Company securely stores your data at Paris, France, in line with the below security measures.
2. Our Company will keep your personal data only for the time period allowed by law. Once this time period has expired, we will delete your data.
3. We strive to maintain the relevance, reliability, accuracy, completeness and currency of the personal data we hold and to protect its privacy and security.
4. We keep personal data only for as long as is reasonably necessary for the purpose for which it was collected or to comply with any applicable legal or ethical reporting or document retention requirements. We will not retain your personal data in a form which permits the identification of the data subject for longer than needed for the legitimate purpose or purposes for which we originally collected it, including for the purpose of satisfying any legal, accounting or reporting requirements.
5. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
6. In some circumstances we will anonymize your personal data so that it can no longer be associated with you, in which case we will use such information without further notice to you.
7. We are obligated to retain personal data about you and your transactions for such time until the retention of your personal data is no longer necessary for any business or legal purpose, i. e. in order to comply with anti-money laundering and countering the financing of terrorism and other obligations applicable to us.
8. Generally, our retention of your personal data will not exceed the period of 6 years from the termination of your relationship with us. This period is intended to take into account applicable prescriptive periods for legal claims, as well record-keeping obligations relating to accounting, taxation, regulatory and money laundering records.
9. In certain cases, we may need to retain your personal data for a period of up to 11 years in order to comply with accounting and tax laws (this will primarily consist of your transaction information).
10. Note that we may need to retain your personal data, or some of it, for longer period(s), such as in relation to threatened or commenced claims, disputes or litigation, ongoing or pending investigations, requests made by competent authorities or to abide by court orders or as dictated by the nature of the services or the business relationship.
11. The personal data storage period is set based on the below principles:
  1. - Usually, we keep data during the course of the provision of services, during the validity of the contract and 10 years after the expiration of the contract or legal relationships, while using the requirements set forth in legal acts related to document archiving and in order to declare, exercise or defend the legal claims;
  2. - If the transaction has not been concluded, we will store personal data for up to 5 years from the date of its receipt. If a transaction is refused due to the implementation of money laundering and terrorist financing prevention measures, personal data shall be stored for 5 years from the moment of refusal;
  3. - According to the requirements of legal acts regulating the prevention of money laundering and terrorist financing, we will process personal data for as long as the business relationship subsists and for 5 years after termination of the relationship. This time limit may be additionally extended if a reasonable ground exists;
  4. - If you revoke your consent for data processing or the data processing term expires (when the data is processed on the basis of your consent), only the data confirming the fact of your consent is retained for 5 years from the end of the consent period or the cancellation of consent in order to declare, ute or defend the legal claims.
12. At the end of the retention period, we will securely delete or destroy data retained and require our (sub-)processors or third-party suppliers to do likewise.
13. We will always hold your information securely.
  1. a. To prevent unauthorised disclosure or access to your information, we have implemented administrative, technical, and physical security measures to protect your personal data.
  2. b. To ensure the security of your personal data, we use the following methods:
  3. c. Personal data we collect is stored in a secure data centre compliant with international recognised standards: ISO/IEC 27001:2013, 27017:2015, 27018:2019, 27701:2019, 22301:2019, 9001:2015, and CSA STAR CCM v3.0.1.
  4. d. All sensitive data which is transmitted between your computer and us is transferred securely via the internet, using strong encryption. We use secure and tested encryption technology bearing certificates provided by renowned certificate authorities.
  5. e. All personal data is protected from unauthorised access by firewall and intrusion detection and prevention s.
  6. f. Your trading account is protected by your account password and two-factor authentication (i.e., Google Authenticator).
Marketing
1. We strive to provide you with choices regarding certain personal data uses, particularly around advertising and marketing. You may receive marketing communications from us (which may consist of newsletters, industry and legislative updates, mailshots, publications and/or information about our events, seminars and webinars) where:
  1. you have entered into a client relationship with us; and
  2. provided you have not opted out of receiving marketing from us (see Your right to object below).
2. Where the above does not apply to you, we will only send you our marketing communications where you have expressly consented to receive them from us.
3. Third-party marketing
4. We will get your express opt-in consent before we share your personal data with any third parties (including our associated corporate entities) for marketing purposes.
5. Opting out
6. You can ask us to stop sending you marketing communications (unsubscribe) at any time by following the opt-out (unsubscribe) links on any marketing communication sent to you
7. Cookies
8. You can set your browser to refuse all or some browser cookies, or to you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Website may become inaccessible or not function properly. This Notice should be read in conjunction with our Cookie Usage Policy.
Your Rights
1. We would like to make sure you are fully aware of all your data protection rights. Every person is entitled to the following:
  1. a. The right to access – You have the right to request copies of your personal data we hold about you. We may charge you a small fee for this service.
  2. b. The right to rectification – You have the right to request that we correct any information you believe is inaccurate or incomplete
  3. c. The right to erasure – You have the right to request that we erase your personal data, under certain limitations and exceptions.
  4. d. The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain limitations and exceptions.
  5. e. The right to object to process – You have the right to object to the processing of your personal data, under certain limitations and exceptions.
  6. f. The right to data portability – You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain limitations and exceptions.
  7. g. he right to complain to a supervisory authority – You have the right to complain about our processing of your personal data; and
  8. h. The right to withdraw consent – to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent.
2. You have a right not to be subject to a decision based solely on automated processing (i.e., by computers and without human intervention), including profiling, which produces legal effects concerning you or similarly significantly affects you.
3. However, this right does not apply when the decision:
  1. - is necessary for entering into, or performance of, a contract between you and us;
  2. - is required or authorised by law; or
  3. - is based on your explicit consent.
4. Although certain third parties may use automated decision-making tools or software, we do not use automatic decision-making or profiling when processing personal data. If this changes, we will confirm this with you and provide meaningful information about the logic involved, as well as the significance and the envisaged consequences for you.
5. You may exercise any of your rights in relation to your personal data by writing to us at the postal address above or by email at privacy_eu@gate.com.
6. Kindly note that none of these data subject rights are absolute and must generally be weighed against our own legal obligations and legitimate interests. If a decision is taken to override your data subject request, you will be informed of this by our data protection officer along with the reasons for our decision.
7. We will collect any information about the communication and any additional information that you choose to give us. We will use this information to review, investigate and respond to any comment or question that you may raise. Please note that we record your communication with us and may use it in our dealings with you, including any dispute resolution.
8. We have one (1) month, from receipt of your communication, to reply to you.
Incomplete and Inaccurate Information
1. If you do not provide us with some or all of the information that we ask for, we may not be able to verify your identity and as such you may not be able to open a trading account with the Company.
2. You can provide and update your information at any time by visiting our website. We recommend that you update your profile in your account regularly, to ensure that the functions offered to you are appropriate for your current circumstances. You may have to update such information upon our request, if we consider the information provided as untrue, incorrect, incomplete and/or inconsistent with other information provided by you at any time.
3. Where we need to collect personal data by law, or pursuant to our terms of business, and you fail to provide that data when requested, we might not be able to assist you or provide you with your requested Services. In certain cases, particularly where it relates to data related to our onboarding and compliance requirements, we may even need to exercise our right to terminate the Services and your engagement with us or otherwise decline to enter into client relationship with you (as applicable).
4. We will notify you if this is the case at the time.
International Data Transfers
1. We do not generally transfer your personal data to entities outside the European Economic Area (“EEA”) except as may be necessary to:
  1. a) enable your use of the Platform,
  2. b) fulfil our contractual obligations to you or exercise our contractual obligations against you,
  3. c) comply with our legal or regulatory obligations, or
  4. d) assert, file, or exercise a legal claim. Where we do need to transfer your personal data outside the EEA (whether for these stated purposes or any other purpose listed in above), we will ensure a similar degree of protection is afforded to that personal data by ensuring at least one of the following safeguards applies or is otherwise implemented:
    1. i. We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
    2. ii. In the absence of an adequacy decision, we will use standard contractual clauses that have been approved by the European Commission.
    3. iii. Where we use providers based in the U.S., we may transfer data to them if they are part of the EU - U.S. Data Privacy Framework which requires them to provide similar protection to personal data shared between Europe and the US.
Promotional Communications
1. You may opt out of receiving promotional emails or text messages from Gate Technology Ltd by following the instructions in those emails or text messages or by visiting the Notifications tab in the Settings menu on our platform. If you opt out, we may still send you non-promotional emails, such as service messages about your Account or our ongoing business relationship.
Advertising and Analytics Services Provided by Others
1. We may allow others to provide analytics services and serve advertisements about our products and services on our behalf across the web and in mobile applications. This may involve cookies and other technologies to collect information about your use of the Services. This information may be used by Gate Technology Ltd to, among other things, analyse and track data, determine the popularity of certain content, and better understand your online activity in connection with the Services.
2. Please refer to the About Cookies section and our Cookie Notice for more information about the cookies involved and the process of consenting or refusing cookies.
About Cookies
1. Gate Technology Ltd. uses cookies and similar technologies to improve user experience, analyze site traffic, and provide tailored content. For further details about the types of cookies we use, how we use them, and how you can manage your preferences, please refer to our Cookies Policy.
Changes to our Privacy Policy
1. This Notice may be updated from time to time.
2. Please note that if our business, or any part of it, is sold or transferred at any time, the information we hold may form part of the assets transferred, although it will still only be used in accordance with this Notice.
3. We reserve the right, at our discretion, to change, modify, add, or remove portions from this Notice at any time. Please read this Notice carefully and re-visit this page from time to time to review for changes.
4. We may inform you of the modifications made to the Notice by updating and publishing the effective date of the release of new versions hereof and highlighting the amendments. Sometimes, we may issue a notice to inform you of the modification made in the Notice, which, however, is not an obligation for us.
5. It is your sole responsibility to keep yourself updated of any amendments by reviewing the Notice at our Sites regularly
6. If you have any questions regarding this Notice, or if you would like to send us your comments, please contact us using the Contact Details indicated in this Notice.
How to Contact the Appropriate Authority
1. If you are not happy with the way in which your personal data has been processed in connection with the use of our Services, you are in the first instance encouraged to contact us by email at privacy_eu@gate.com
2. Should you remain dissatisfied with the measures for remedying the situation undertaken by us, you have the right to lodge a complaint at any time to a competent supervisory authority on data protection matters, such as in particular the supervisory authority in the place of your habitual residence or your place of work. In the case of Malta, this is the Office of the Information and Data Protection Commissioner (the “IDPC”):
3. The Office of the Information and Data Protection Commissioner can be contacted at:
4. Information and Data Protection Commissioner
5. Level 2, Airways House
6. High Street
7. Sliema SLM 1549
8. Malta
9. www.idpc.org.mt
GLOSSARY
1. Set out below are key definitions of certain terms which appear in this Notice:
  1. “data subjects” means living, natural persons about whom we process personal data;
  2. “data controller” or “controller” means any entity or individual who determines the purposes for which, and the manner in which, any personal data is processed;
  3. “data processor” or “processor” means any entity or individual that processes data on our behalf and on our instructions (we being the data controller);
  4. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
  5. “legitimate interest” means our interest to conduct and manage our business appropriately and responsibly, to protect the reputation of our business, and to provide the best possible services. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests;
  6. “personal data” means data relating to a living individual (i.e., natural person) who can be identified from the data we possess about him or her. This includes, but is not limited to, your name and surname, address, date of birth, contact details. The term “personal information”, where and when used in this Notice, shall have the same meaning as personal data;
  7. “processing” means any activity or set of operations that involves use of personal data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including, organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties; and
  8. “special categories of personal data” includes information about a person's racial or ethnic origin, political opinions, religious, philosophical or similar beliefs, trade union membership, physical or mental health or condition or sexual life or his or her biometric data.

Introduction

Our Details

Information We Collect About You and Source

How information is collected

How we use information

Special categories of personal data

Compliance with the Law

Third-party service providers

Others

How we store and protect information

Marketing

Your Rights

Incomplete and Inaccurate Information

International Data Transfers

Promotional Communications

Advertising and Analytics Services Provided by Others

About Cookies

Changes to our Privacy Policy

How to Contact the Appropriate Authority

GLOSSARY