Privacy policy

of BTCBACKED AG

Last updated: 13 July 2026

1. General
Information

BTCBACKED AG, a company incorporated under the laws of Switzerland with its registered seat at Bahnhofstrasse 7, 6300 Zug, Switzerland (hereinafter "BTCBacked", "we", "us"), is committed to protecting the privacy of individuals whose personal data we process.

In this Privacy Notice, we explain how we collect, process, store, use, and disclose personal data when you:

  • •visit or use our website or platform;
  • •create an account or undergo onboarding and verification procedures;
  • •enter into or perform a contractual relationship with us;
  • •use our peer-to-peer Bitcoin-backed lending and escrow services;
  • •communicate with us; or
  • •otherwise interact with BTCBacked.

This Privacy Notice also explains the purposes for which we process personal data, the legal bases relied upon, the recipients of such data, how long data is retained, and the rights available to data subjects.

This Privacy Notice is aligned with the Swiss Federal Act on Data Protection (FADP, including the revised FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). The applicability of these laws depends on the individual circumstances.

Where appropriate, we may provide additional or more specific privacy information (for example, in consent forms, contractual documents, or additional notices).

Our platform and services are intended solely for individuals who are at least 18 years old, or the age of majority in their jurisdiction. We do not knowingly collect or process personal data relating to minors.

2. Definitions

For the purposes of this Privacy Notice:

Personal data means any information relating to an identified or identifiable natural person.

Sensitive personal data includes, in particular, biometric data and personal data processed in connection with anti-money laundering (AML) and sanctions compliance, to the extent such data qualifies as sensitive under applicable law.

Processing means any operation performed on personal data, including collection, recording, storage, use, disclosure, archiving, deletion, or destruction.

Data subject means a natural person whose personal data is processed.

If you provide us with personal data relating to third parties (for example, representatives, beneficial owners, or counterparties), you confirm that you are authorized to do so and that you have informed such persons about this Privacy Notice.

3. Name and Address
of the Controller

Unless otherwise specified in an individual case, the controller responsible for the processing of personal data under this Privacy Notice is:

BTCBACKED AG

Bahnhofstrasse 7

6300 Zug

Switzerland

Email: privacy@btcbacked.com

You may contact us at the above address for any questions regarding data protection or to exercise your rights.

4. Nature of
Our Services

BTCBacked operates a non-custodial, peer-to-peer lending platform that enables borrowers to obtain loans secured by Bitcoin collateral and lenders to provide loans directly to borrowers.

BTCBacked provides escrow and collateral management services through 2-of-3 multi-signature Bitcoin addresses, whereby one key is held by the borrower, one key by the lender, and one key by BTCBacked. Bitcoin collateral cannot be moved without two of the three required signatures.

BTCBacked monitors collateral values and loan-to-value (LTV) ratios and facilitates margin calls and liquidation events strictly in accordance with contractual agreements.

BTCBacked qualifies as a Swiss financial intermediary pursuant to Art. 2 para. 3 of the Swiss Anti-Money Laundering Act (AMLA) and is subject to applicable AML, counter-terrorist financing, and sanctions obligations.

5. Categories of Personal
Data We Process

We process personal data only to the extent necessary for the operation of our platform, the provision of our services, and compliance with legal obligations. Depending on the context, we process the following categories of personal data:

5.1 Technical Data

When you use our website or platform, we process technical data, including:

  • •IP address;
  • •device identifiers;
  • •push notification tokens (in our mobile app);
  • •browser type and version;
  • •operating system;
  • •access logs, timestamps, and referrer URLs.

Technical data is primarily processed to ensure functionality, stability, and security of our systems.

5.2 Registration and Account Data

When you create an account or register on our platform, we process data such as:

  • •username and authentication credentials;
  • •contact details (e.g., email address);
  • •account settings and preferences.

5.3 Identification, KYC, and AML Data

In order to comply with AMLA and related regulations, we process identification and verification data, including:

  • •full name, date of birth, nationality, and domicile address;
  • •copies of identification documents;
  • •selfies, liveness checks, and verification metadata;
  • •proof of address;
  • •beneficial ownership information;
  • •sanctions and politically exposed person (PEP) screening results;
  • •source of funds and source of wealth declarations;
  • •risk classifications and internal compliance assessments.

5.4 Crypto-Asset and Transaction Data

In connection with our services, we process crypto-related and financial data, including:

  • •Bitcoin wallet addresses;
  • •proof of wallet ownership (e.g., cryptographic signatures or test transactions);
  • •escrow addresses and multi-signature configurations;
  • •loan parameters (loan amount, duration, interest rate, LTV);
  • •collateral amounts;
  • •margin calls, repayments, and liquidation events;
  • •blockchain transaction hashes and analytics results.

5.5 Contractual and Communication Data

We process data related to contractual relationships and communications, including:

  • •contractual documents and records;
  • •correspondence via email, platform messaging, or other communication channels;
  • •records of interactions with customer support or compliance teams.

6. Purposes of
Processing

We process personal data for the following purposes:

  • •onboarding and identification of users (KYC/KYB);
  • •compliance with AMLA, sanctions laws, and regulatory obligations;
  • •establishment, administration, and performance of loan and escrow agreements;
  • •creation and management of multi-signature escrow addresses;
  • •monitoring of collateral values and LTV ratios;
  • •issuing margin calls and executing liquidation events;
  • •fraud prevention, security, and risk management;
  • •communication with users;
  • •reporting and cooperation with competent authorities (e.g., SROs, MROS, SECO, courts).

7. Legal Bases
for Processing

We process personal data on the following legal bases, as applicable:

Legal obligations, in particular under AMLA, sanctions legislation, and related regulations;

Performance of a contract, in particular loan, escrow and platform agreements;

Legitimate interests, such as platform security, fraud prevention, and business continuity;

Consent, where required by law (e.g. optional communications).

8. Profiling and
Automated Processing

BTCBacked performs profiling and automated analyses for compliance, risk management, and security purposes, including transaction monitoring, risk scoring, and collateral monitoring.

Automated alerts may be generated in connection with margin calls or potential liquidation events. Decisions with legal or significant financial effects are governed by predefined contractual rules and safeguards.

These automated processes, including margin calls and liquidation of collateral at the agreed LTV threshold, are necessary for the performance of your contract. You may contact us at privacy@btcbacked.com to request human review of a compliance decision that significantly affects you.

9. Disclosure of
Data to Third Parties

We may disclose personal data to the following categories of recipients, to the extent necessary:

  • •KYC/KYB and identity verification providers;
  • •AML and compliance service providers;
  • •travel rule messaging and compliance service providers;
  • •wallet verification and blockchain address ownership verification providers;
  • •blockchain analytics providers;
  • •IT and hosting providers;
  • •banks and payment service providers, where applicable;
  • •auditors and professional advisers;
  • •competent authorities, regulators, courts, and law enforcement agencies where legally required.

Some of our verification and compliance service providers also process certain data as independent controllers for their own purposes, as described in their own privacy notices, which are presented to you during the verification process.

BTCBacked does not sell personal data and does not disclose personal data to lenders or borrowers beyond what is contractually necessary.

10. International
Data Transfers

Personal data may be processed in Switzerland, the European Union, and, where necessary, in other jurisdictions.

Where personal data is transferred to countries that do not provide an adequate level of data protection, BTCBacked implements appropriate safeguards, such as standard contractual clauses or equivalent mechanisms.

11. Retention
Periods

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Notice and to comply with legal obligations.

Personal data subject to AMLA and the Swiss Code of Obligations is retained for at least ten (10) years following termination of the business relationship or completion of the transaction, unless longer retention is required by law or legal proceedings.

12. Data
Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or misuse.

Despite these measures, no system can be completely secure.

13. Your
Rights

Depending on applicable law, you may have the right to:

  • •access your personal data;
  • •request rectification of inaccurate data;
  • •request erasure of your personal data;
  • •request restriction of processing;
  • •object to processing in certain circumstances;
  • •request data portability;
  • •withdraw consent where processing is based on consent;

Requests may be submitted using the contact details provided above. We may require verification of your identity before responding.

14. Deleting
Your Account

You can request deletion of your account and personal data at any time, either in the app or by contacting us.

In the app

Open the BTCBacked app, go to Settings, and tap Delete account. Choose a reason, add an optional note, and confirm. You will be signed out and your account will be marked for deletion. We process deletion requests within 30 days. Records we must retain under Swiss anti-money laundering and record-keeping law are kept for the periods described in the Retention Periods section and blocked from any other use.

By email

If you cannot access the app, email privacy@btcbacked.com from the address registered to your account and ask us to delete it.

Before deletion, you must close all active loans and contracts and ensure any Bitcoin collateral has been released from escrow.

When your request is processed, we anonymize the personal data we are not legally required to keep. Records we are required to retain under AMLA and the Swiss Code of Obligations, including identity verification documents, anti-money laundering checks, and transaction and loan history, are kept for the periods described in the Retention Periods section above.

BTCBacked is non-custodial. We cannot delete data recorded on the Bitcoin blockchain, and we cannot delete or recover the private key that you control.

15. Changes to This
Privacy Notice

We may update this Privacy Notice from time to time to reflect legal, regulatory, or operational changes. The current version is made available through our website or upon request.