Privacy policy

of BTCBACKED AG

Last updated: 19 January 2026

General
Information

BTCBACKED AG, a company incorporated under the laws of Switzerland with its registered seat at Bahnhofstrasse 7, 6300 Zug, Switzerland (hereinafter "BTCBacked", "we", "us"), is committed to protecting the privacy of individuals whose personal data we process.

In this Privacy Notice, we explain how we collect, process, store, use, and disclose personal data when you:

  • •visit or use our website or platform;
  • •create an account or undergo onboarding and verification procedures;
  • •enter into or perform a contractual relationship with us;
  • •use our peer-to-peer Bitcoin-backed lending and escrow services;
  • •communicate with us; or
  • •otherwise interact with BTCBacked.

This Privacy Notice also explains the purposes for which we process personal data, the legal bases relied upon, the recipients of such data, how long data is retained, and the rights available to data subjects.

This Privacy Notice is aligned with the Swiss Federal Act on Data Protection (FADP, including the revised FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). The applicability of these laws depends on the individual circumstances.

Where appropriate, we may provide additional or more specific privacy information (for example, in consent forms, contractual documents, or additional notices).

Definitions

For the purposes of this Privacy Notice:

Personal data means any information relating to an identified or identifiable natural person.

Sensitive personal data includes, in particular, biometric data and personal data processed in connection with anti-money laundering (AML) and sanctions compliance, to the extent such data qualifies as sensitive under applicable law.

Processing means any operation performed on personal data, including collection, recording, storage, use, disclosure, archiving, deletion, or destruction.

Data subject means a natural person whose personal data is processed.

If you provide us with personal data relating to third parties (for example, representatives, beneficial owners, or counterparties), you confirm that you are authorized to do so and that you have informed such persons about this Privacy Notice.

Name and Address
of the Controller

Unless otherwise specified in an individual case, the controller responsible for the processing of personal data under this Privacy Notice is:

BTCBACKED AG

Bahnhofstrasse 7

6300 Zug

Switzerland

Email: privacy@btcbacked.com

You may contact us at the above address for any questions regarding data protection or to exercise your rights.

Nature of
our Services

BTCBacked does not sell or rent your personal data. However, your data may be shared under the following circumstances:

BTCBacked operates a non-custodial, peer-to-peer lending platform that enables borrowers to obtain loans secured by Bitcoin collateral and lenders to provide loans directly to borrowers.

BTCBacked provides escrow and collateral management services through 2-of-3 multi-signature Bitcoin addresses, whereby one key is held by the borrower, one key by the lender, and one key by BTCBacked. Bitcoin collateral cannot be moved without two of the three required signatures.

BTCBacked monitors collateral values and loan-to-value (LTV) ratios and facilitates margin calls and liquidation events strictly in accordance with contractual agreements.

BTCBacked qualifies as a Swiss financial intermediary pursuant to Art. 2 para. 3 of the Swiss Anti-Money Laundering Act (AMLA) and is subject to applicable AML, counter-terrorist financing, and sanctions obligations.

Categories of Personal
Data We Process

We process personal data only to the extent necessary for the operation of our platform, the provision of our services, and compliance with legal obligations. Depending on the context, we process the following categories of personal data:

Technical Data

When you use our website or platform, we process technical data, including:

  • •IP address;
  • •device identifiers;
  • •browser type and version;
  • •operating system;
  • •access logs, timestamps, and referrer URLs.

Technical data is primarily processed to ensure functionality, stability, and security of our systems.

Registration & Account Data

When you create an account or register on our platform, we process data such as:

  • •username and authentication credentials;
  • •contact details (e.g., email address);
  • •account settings and preferences.

Identification, KYC, & AML Data

In order to comply with AMLA and related regulations, we process identification and verification data, including:

  • •full name, date of birth, nationality, and domicile address;
  • •copies of identification documents;
  • •selfies, liveness checks, and verification metadata;
  • •proof of address;
  • •beneficial ownership information;
  • •sanctions and politically exposed person (PEP) screening results;
  • •source of funds and source of wealth declarations;
  • •risk classifications and internal compliance assessments.

Crypto-Asset & Transaction Data

In connection with our services, we process crypto-related and financial data, including:

  • •Bitcoin wallet addresses;
  • •proof of wallet ownership (e.g., cryptographic signatures or test transactions);
  • •escrow addresses and multi-signature configurations;
  • •loan parameters (loan amount, duration, interest rate, LTV);
  • •collateral amounts;
  • •margin calls, repayments, and liquidation events;
  • •blockchain transaction hashes and analytics results.

Contractual & Communication Data

We process data related to contractual relationships and communications, including:

  • •contractual documents and records;
  • •correspondence via email, platform messaging, or other communication channels;
  • •records of interactions with customer support or compliance teams.

Purposes of
Processing

We process personal data for the following purposes:

  • •onboarding and identification of users (KYC/KYB);
  • •compliance with AMLA, sanctions laws, and regulatory obligations;
  • •establishment, administration, and performance of loan and escrow agreements;
  • •creation and management of multi-signature escrow addresses;
  • •monitoring of collateral values and LTV ratios;
  • •issuing margin calls and executing liquidation events;
  • •fraud prevention, security, and risk management;
  • •communication with users;
  • •reporting and cooperation with competent authorities (e.g., SROs, MROS, SECO, courts).

Legal Bases
for Processing

We process personal data on the following legal bases, as applicable:

Legal obligations, in particular under AMLA, sanctions legislation, and related regulations;

Performance of a contract, in particular loan, escrow and platform agreements;

Legitimate interests, such as platform security, fraud prevention, and business continuity;

Consent, where required by law (e.g. optional communications).

Profiling and
Automated Processing

BTCBacked performs profiling and automated analyses for compliance, risk management, and security purposes, including transaction monitoring, risk scoring, and collateral monitoring.

Automated alerts may be generated in connection with margin calls or potential liquidation events. Decisions with legal or significant financial effects are governed by predefined contractual rules and safeguards.

Disclosure of
Data to Third Parties

We may disclose personal data to the following categories of recipients, to the extent necessary:

  • •KYC/KYB and identity verification providers;
  • •AML and compliance service providers;
  • •travel rule messaging and compliance service providers;
  • •wallet verification and blockchain address ownership verification providers;
  • •blockchain analytics providers;
  • •IT and hosting providers;
  • •banks and payment service providers, where applicable;
  • •auditors and professional advisers;
  • •competent authorities, regulators, courts, and law enforcement agencies where legally required.

BTCBacked does not sell personal data and does not disclose personal data to lenders or borrowers beyond what is contractually necessary.

International
Data Transfers

Personal data may be processed in Switzerland, the European Union, and, where necessary, in other jurisdictions.

Where personal data is transferred to countries that do not provide an adequate level of data protection, BTCBacked implements appropriate safeguards, such as standard contractual clauses or equivalent mechanisms.

Retention
Periods

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Notice and to comply with legal obligations.

Personal data subject to AMLA is retained for at least ten (10) years following termination of the business relationship or completion of the transaction, unless longer retention is required by law or legal proceedings.

Data
Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or misuse.

Despite these measures, no system can be completely secure.

Your
Rights

Depending on applicable law, you may have the right to:

  • •access your personal data;
  • •request rectification of inaccurate data;
  • •request erasure of your personal data;
  • •request restriction of processing;
  • •object to processing in certain circumstances;
  • •request data portability;
  • •withdraw consent where processing is based on consent;

Requests may be submitted using the contact details provided above. We may require verification of your identity before responding.

Changes to this
Privacy Notice

We may update this Privacy Notice from time to time to reflect legal, regulatory, or operational changes. The current version is made available through our website or upon request.