GOAT Finance SAGL · Legal Pack

1. Purpose of This Privacy Notice

This Goat Finance SAGL Privacy Notice explains how Goat Finance SAGL processes personal data when it acts as controller in connection with Phase 2 onboarding, service activation, product use, transaction review, compliance monitoring, customer relationship management or another Phase 2 activity for which Goat Finance SAGL determines the purposes and essential means of processing.

This Privacy Notice forms Part B of the Goat Finance SAGL Entity Legal Pack.

This Privacy Notice supplements, and must be read together with:

1. the Goat Finance Global Privacy Policy;

2. the applicable Phase 1 Privacy Notice;

3. the applicable Product Terms;

4. any product-specific privacy notice;

5. any service-specific privacy and partner data-sharing disclosure;

6. any partner-related privacy disclosure presented to you.

This Privacy Notice does not repeat the full Global Privacy Policy. It explains only the SAGL-specific privacy information that applies when Goat Finance SAGL is the relevant Phase 2 controller.

2. Controller

Where Goat Finance SAGL acts as controller for Phase 2 processing, the controller is:

Goat Finance SAGL
Via Pasquale Lucchini 4
Lugano, Ticino 6900
Switzerland
Email: [email protected]

References to “Goat Finance SAGL”, “we”, “us” or “our” in this Privacy Notice mean Goat Finance SAGL.

3. Phase 1 and Phase 2

Goat Finance SAGL may act as controller during Phase 1 under the applicable Phase 1 Privacy Notice.

This Privacy Notice, however, applies only to SAGL’s Phase 2 processing.

Phase 1 processing is covered by the applicable Phase 1 Privacy Notice shown or made available to you during pre-onboarding, eligibility assessment, screening and routing.

Phase 2 begins when you are routed to Goat Finance SAGL for product-specific onboarding, service activation, transaction review, customer relationship management or another approved SAGL service route.

4. When This Privacy Notice Applies

This Privacy Notice applies when Goat Finance SAGL is responsible for processing personal data in connection with:

1. Phase 2 onboarding;

2. customer due diligence or enhanced due diligence;

3. product or service activation;

4. transaction review or transaction monitoring;

5. compliance screening;

6. source of funds or source of wealth review;

7. wallet or blockchain analytics review;

8. banking, payment or settlement review;

9. partner-supported service review;

10. risk management;

11. customer support;

12. complaints handling;

13. service administration;

14. legal, regulatory, tax, audit or recordkeeping obligations;

15. any product or service where Goat Finance SAGL is identified as the contracting entity or Phase 2 controller.

5. How Goat Finance SAGL Receives Personal Data

Goat Finance SAGL may receive personal data from:

1. you directly;

2. your authorized representative;

3. your company or employer;

4. Phase 1 records maintained by Goat Finance SAGL;

5. another Goat Finance entity as part of a multi-product or dual-entity route;

6. shared Goat Finance systems;

7. KYC/KYB providers;

8. identity verification providers;

9. sanctions, PEP and adverse media screening providers;

10. blockchain analytics providers;

11. fraud prevention providers;

12. banking, payment, settlement, liquidity or infrastructure partners;

13. public registers, public databases or government sources;

14. regulators, courts, law enforcement authorities or other competent authorities, where applicable.

Where SAGL is both the Phase 1 controller and Phase 2 controller, the transition from Phase 1 to Phase 2 may involve using Phase 1 information for the relevant Phase 2 route, subject to the applicable notices, product disclosures and lawful basis.

Where another entity or partner becomes involved, additional product-specific privacy or partner data-sharing disclosures may apply.

6. Purposes Specific to Goat Finance SAGL

Goat Finance SAGL may process personal data for the general purposes described in the Goat Finance Global Privacy Policy and, specifically, to:

1. complete SAGL Phase 2 onboarding;

2. verify identity, business information, beneficial ownership and authority to act;

3. conduct KYC, KYB, customer due diligence and enhanced due diligence;

4. screen customers, representatives, beneficial owners, counterparties, wallets and transactions against sanctions, PEP, adverse media, fraud and risk databases;

5. assess source of funds and source of wealth;

6. assess eligibility for SAGL products or services;

7. determine whether partner-supported services require additional onboarding, approval, disclosures or data sharing;

8. provide, administer, monitor, suspend or terminate approved SAGL products or services;

9. review, process, settle, return, reject or investigate transactions;

10. comply with Swiss AML/CFT, sanctions, regulatory, tax, audit, reporting and recordkeeping obligations;

11. comply with EU/EEA or UK legal or regulatory requirements where applicable to the relevant route;

12. support reverse-solicitation, financial-promotion, product-availability and jurisdiction-aware controls where relevant;

13. prevent fraud, cybercrime, misuse, sanctions evasion, money laundering, terrorist financing and other unlawful activity;

14. respond to regulator, law enforcement, court, tax authority, partner, banking provider or payment provider requests;

15. maintain records of legal documents, notices, disclosures, acceptances and acknowledgments;

16. establish, exercise or defend legal claims.

7. Legal Bases for EU/EEA and UK Individuals

Where EU GDPR or UK GDPR applies to Goat Finance SAGL’s processing, Goat Finance SAGL may rely on one or more of the following legal bases:

Goat Finance SAGL’s legitimate interests may include operating secure and compliant services, preventing fraud and financial crime, protecting customers and partners, enforcing terms and policies, managing legal and regulatory risk, maintaining records, controlling product availability, supporting jurisdiction-aware onboarding and defending legal rights.

8. Swiss Privacy Framework

Where Swiss data protection law applies to Goat Finance SAGL’s processing, Goat Finance SAGL processes personal data in accordance with applicable Swiss privacy principles, including:

1. transparency;

2. fairness;

3. proportionality;

4. purpose limitation;

5. accuracy;

6. security;

7. lawful disclosure;

8. appropriate safeguards for international transfers.

Where personal data is transferred from Switzerland to another country, Goat Finance SAGL will apply appropriate safeguards where required by applicable law.

9. Sensitive Data, Biometric Data and Criminal-Offence Related Data

Goat Finance SAGL may process sensitive, biometric, sanctions-related, adverse media or criminal-offence related information where necessary or permitted for:

1. identity verification;

2. liveness or selfie checks;

3. KYC/KYB;

4. AML/CFT compliance;

5. sanctions screening;

6. PEP and adverse media screening;

7. fraud prevention;

8. cybersecurity;

9. regulatory compliance;

10. legal claims;

11. partner-supported service review.

Where EU GDPR or UK GDPR applies, Goat Finance SAGL processes special category data or criminal-offence related data only where an applicable legal basis and condition permit such processing.

Where Swiss law applies, Goat Finance SAGL processes sensitive personal data only where permitted and subject to appropriate safeguards.

10. Sharing Within Goat Finance

Goat Finance SAGL may share personal data with other Goat Finance entities, personnel, contractors, shared service functions and global roles where necessary for:

1. Phase 2 onboarding;

2. customer due diligence;

3. enhanced due diligence;

4. compliance review;

5. transaction monitoring;

6. fraud prevention;

7. customer support;

8. technology operations;

9. legal or regulatory compliance;

10. internal governance;

11. reporting;

12. audit;

13. recordkeeping;

14. security;

15. multi-product or dual-entity routing.

Personal data is not made available to all Goat Finance entities by default.

Access is granted on a need-to-know basis, taking into account the relevant product, entity, phase, role, case assignment, compliance purpose, legal requirement, transfer requirement and security control.

11. Sharing With Partners and Providers

Goat Finance SAGL may share personal data with third parties where necessary or permitted for the purposes described in this Privacy Notice, the Global Privacy Policy, the applicable Product Terms, or a product-specific privacy or partner data-sharing disclosure.

These third parties may include:

1. KYC/KYB providers;

2. identity verification providers;

3. sanctions, PEP and adverse media screening providers;

4. blockchain analytics and wallet screening providers;

5. fraud prevention providers;

6. banks;

7. payment providers;

8. settlement providers;

9. liquidity providers;

10. execution providers;

11. technology, cloud, CRM, communication and support providers;

12. auditors, lawyers, tax advisers and professional advisers;

13. regulators, courts, law enforcement authorities, tax authorities and financial intelligence units;

14. Fiat Republic or other partners, where a Fiat Republic-supported or partner-supported route applies.

Where a product or service is supported by a partner, that partner may act as a processor, independent controller, joint controller, regulated provider or service provider depending on the facts and the applicable partner framework.

Product-specific privacy or partner data-sharing disclosures will provide additional information where relevant.

12. International Transfers

Goat Finance SAGL is based in Switzerland.

If you are located outside Switzerland, or if a service involves cross-border systems, partners, providers or shared resources, your personal data may be transferred to, accessed from or processed in Switzerland, the EU/EEA, the United Kingdom, the United States or other countries.

International transfers may occur because Goat Finance SAGL uses group resources, shared systems, vendors, service providers, compliance tools, payment providers, banking providers, blockchain analytics tools, liquidity providers, settlement providers or infrastructure partners located abroad.

Where required, Goat Finance SAGL will use appropriate safeguards, such as:

1. adequacy decisions;

2. standard contractual clauses;

3. UK transfer safeguards;

4. Swiss-recognized transfer safeguards;

5. transfer assessments;

6. contractual safeguards;

7. technical and organizational measures;

8. access restrictions;

9. encryption, minimization or pseudonymization where appropriate.

Further information on Goat Finance’s general transfer framework is available in the Goat Finance Global Privacy Policy.

13. Retention

Goat Finance SAGL retains personal data for as long as necessary for onboarding, service provision, AML/CFT, sanctions, transaction monitoring, tax, audit, legal, regulatory, security, dispute resolution, recordkeeping and governance purposes.

Unless a shorter or longer period applies under applicable law or a specific retention notice, onboarding, customer due diligence and transaction records may generally be retained for up to 10 years after the end of the relationship, the relevant transaction or the relevant decision.

Rejected, declined or incomplete applications may be retained where necessary for compliance, fraud prevention, risk management, legal, regulatory, audit or recordkeeping purposes.

14. Automated Screening, Profiling and Risk Assessment

Goat Finance SAGL may use automated or semi-automated tools to support:

1. identity verification;

2. document verification;

3. liveness checks;

4. sanctions screening;

5. PEP and adverse media screening;

6. fraud detection;

7. wallet screening;

8. blockchain analytics;

9. transaction monitoring;

10. customer risk rating;

11. eligibility and routing review;

12. jurisdiction-aware product controls.

These tools may generate alerts, matches, scores, recommendations or risk indicators.

Goat Finance SAGL may use these outputs to support human review, compliance decisions, onboarding decisions, transaction review, suspension, rejection or escalation.

Goat Finance SAGL does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects unless permitted by applicable law and appropriate safeguards are applied.

15. Your Rights

Depending on applicable law, you may have rights to:

1. access your personal data;

2. receive information about processing;

3. correct inaccurate data;

4. request deletion;

5. restrict processing;

6. object to processing;

7. receive data portability;

8. withdraw consent where processing is based on consent;

9. challenge or request review of certain automated decisions where applicable;

10. lodge a complaint with a supervisory authority.

These rights may be limited where processing is required or permitted for AML/CFT, sanctions, fraud prevention, legal obligations, regulatory compliance, legal claims, security, audit, tax, partner requirements, transaction monitoring or recordkeeping purposes.

To exercise your rights, contact:

[email protected]

We may need to verify your identity before responding.

16. Supervisory Authorities and Complaints

Depending on your location and applicable law, you may have the right to lodge a complaint with:

1. your local EU/EEA data protection authority;

2. the UK Information Commissioner’s Office;

3. the Swiss Federal Data Protection and Information Commissioner;

4. another competent privacy or data protection authority, where applicable.

We encourage you to contact us first so we can try to resolve your concern.

17. EU and UK Representative

If EU GDPR or UK GDPR applies and Goat Finance SAGL is required to appoint a representative in the EU or the United Kingdom, the relevant representative details will be made available here:

EU Representative: Carlos Arias Reggeti. Head of Compliance
UK Representative: [insert if appointed / if required]

18. Contact

For privacy questions, rights requests or complaints relating to Goat Finance SAGL:

Goat Finance SAGL
Via Pasquale Lucchini 4
Lugano, Ticino 6900
Switzerland
Email: [email protected]