Privacy Policy

Effective date: 28/07/2026

Controller: Portfolium X AG, a company registered in Switzerland, with registration number CHE-470.466.759, and registered address at Gubelstrasse 11, 6300 Zug, Switzerland, (trading as “Klidi”) (“Klidi”, “we”, “us”, “our”).

Portfolium X AG is a member of VQF, a Self-Regulatory Organisation (SRO) recognised by FINMA under AMLA. As a member of VQF – with VQF/SRO registration number 101323, Portfolium X AG is a Swiss financial intermediary within the meaning of Art. 2 para. 3 AMLA, and it is only subject to the application of the AMLA.

Contact (privacy): hello@klidi.io

1. Scope and application

This Privacy Policy explains how we collect, use, disclose, retain, and protect Personal Data when you use our website, applications, and services as a Virtual Asset Service Provider (“Services”). It also explains your rights and choices.

This Policy is designed primarily for the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, including where we offer Services to individuals in the EU/EEA or monitor their behaviour within the EU/EEA, we process Personal Data in accordance with GDPR requirements. In such cases, references to Swiss-law justifications should be read together with the GDPR legal bases described in this Policy.

  • If you are acting on behalf of a legal entity, this Policy applies to Personal Data relating to the entity’s directors, officers, authorised persons, shareholders, and beneficial owners that we process for onboarding, compliance, and service provision.
  • If you provide Personal Data about another person, including directors, officers, authorised signatories, shareholders, beneficial owners, controllers, employees, or transaction counterparties, you must ensure that you are authorised to do so and that the person has been informed of this Privacy Policy.
  • If you do not provide required data, we may be unable to provide the Services.
  • This Privacy Policy may be made available in multiple languages. In case of inconsistency, the English version prevails, unless mandatory law requires otherwise.
  • This Policy applies to: website visitors, app users, registered customers, prospective customers, legal-entity representatives, directors, officers, authorised signatories, shareholders, beneficial owners, transaction counterparties, and persons contacting support.
  • During onboarding, users are required to acknowledge that they have read this Privacy Policy. Where consent is required, we request it separately and record the date, method, scope, and version of the notice accepted.
  • We primarily process Personal Data electronically, but some documents may be processed or retained in paper form where necessary.
  • We process Personal Data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, proportionality, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. We take reasonable steps to ensure that Personal Data we process is accurate, complete, and up to date, having regard to the purposes of processing.

2. Definitions

2.1. Personal Data is any information relating to an identified or identifiable person.

2.2. Sensitive Personal Data or Special Categories of Data means Personal Data that is treated as sensitive under applicable law, including biometric data that uniquely identifies a natural person and any other sensitive data under the FADP or, where applicable, special categories of personal data under GDPR Article 9.

2.3. Virtual Assets means blockchain-based assets or other digital assets supported by the Services.

2.4. On-chain refers to transactions or data recorded on public or permissioned distributed ledgers.

2.5. Processing is any operation performed on Personal Data, irrespective of the means and procedures used (including but not limited to the collection, storage, keeping, use, modification, disclosure, archiving, deletion or destruction of data).

2.6. Controller: The natural or legal person, public authority, agency, or other body that determines the purposes and means of the processing of Personal Data. In this Privacy Policy, the Controller is Portfolium X AG.

2.7. Processor: A natural or legal person, public authority, agency, or other body that processes Personal Data on behalf of the Controller. Processors may include service providers, cloud providers, and other entities that handle Personal Data under the Controller’s instructions.

2.8. Recipient: A natural or legal person, public authority, agency, or another body to which Personal Data is disclosed, whether a third party or not. Recipients may include financial institutions, compliance providers, regulatory authorities, and other entities as necessary for the purposes outlined in this Privacy Policy.

2.9. Data Subject: An identified or identifiable natural person whose Personal Data is processed by the Controller. Data Subjects include users, potential users, and representatives of legal entities.

2.10. Consent: Any freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which they signify agreement to the processing of Personal Data relating to them. Consent may be required for certain processing activities, such as marketing communications or processing of sensitive data.

2.11. KYC/KYB: Know Your Customer (KYC) and Know Your Business (KYB) refer to the processes used to verify the identity of individuals and legal entities, respectively, to prevent fraud, money laundering, and other illicit activities. This includes collecting and verifying Personal Data as required by law.

2.12. AML/CTF: Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) refer to the legal and regulatory frameworks designed to prevent money laundering and the financing of terrorism. Compliance with AML/CTF regulations may require the collection and processing of Personal Data.

2.13. VASP: VASP means a virtual asset service provider as defined under applicable AML/CTF, financial services, or virtual asset laws, including entities that exchange, transfer, safeguard, administer, or provide services relating to virtual assets.

2.14. Travel Rule: A regulatory requirement that mandates the collection and transmission of specific information about the originator and beneficiary of virtual asset transfers, ensuring compliance with AML/CTF obligations.

2.15. Wallet: Wallet means software, infrastructure, or an address/key-management arrangement used to hold, send, receive, or control Virtual Assets.

2.16. External Wallet: A wallet that is not controlled by the Controller, where virtual assets may be sent or received. External wallets may be used for transactions involving virtual assets.

2.17. Personal Data Breach: A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored, or otherwise processed.

2.18. Blockchain Analytics: The process of analysing blockchain data to assess risk, compliance, and transaction history. This may involve tracking on-chain transactions, identifying patterns, and detecting suspicious activities.

Note: The definitions from Swiss FADP apply accordingly – especially those from Art. 5 “Definitions”

3. What Personal Data we collect

We collect Personal Data from (a) you, (b) your device and usage of the Services, and (c) third parties (e.g., compliance providers), as described below.

3.1. Identity and onboarding data (KYC/KYB)

Individuals (KYC)

3.1.1. Full name, date of birth, nationality/citizenship
3.1.2. Residential address and proof of address
3.1.3. Email, phone number
3.1.4. Government identifiers and documents (ID card, passport, residence permit), document images and metadata
3.1.5. Occupation, employer/business activity, education (where relevant), income/source of funds/source of wealth (as required by law/risk)
3.1.6. Verification data. Where biometric processing occurs, we treat this as special category data where applicable under FADP.
3.1.7. Social Media Data. Social media handles, messages, comments, interactions, and profile information visible to us when you interact with our social media pages or communities.

Legal entities (KYB)

3.1.8. Company name, registration number, incorporation details, registered address
3.1.9. Corporate documents
3.1.10. Business activities and structure, beneficial ownership information
3.1.11. Personal Data of directors, authorised signatories, beneficial owners, and controllers
3.1.12. Contact details for relevant representatives

3.2. Financial, payment and transaction data

3.2.1. Bank account details (e.g., IBAN), card/payment details (where applicable)
3.2.2. Klidi account identifiers
3.2.3. Transaction details and instructions (recipient/sender details where applicable, reference information)
3.2.4. Compliance-related transaction context (anticipated volume/value, source of funds/wealth, purpose of transactions where required)

3.3. Wallet and blockchain data (on-chain)

3.3.1. Wallet addresses, wallet identifiers, public keys
3.3.2. On-chain transaction hashes/IDs, timestamps, amounts, token/asset identifiers
3.3.3. On-chain counterparties (as visible on the blockchain)
3.3.4. Risk signals derived from blockchain analytics

3.4. Device, usage and technical data

3.4.1. IP address, device identifiers, browser/app version, operating system
3.4.2. Log-in data, time zone, language, approximate location (derived from IP)
3.4.3. Activity logs (pages/screens visited, actions taken, error logs)
3.4.4. Cookies and similar technologies (see Section 12)
3.4.5. Push notification tokens and notification preferences, where enabled.

3.5. Communications and support

3.5.1. Messages you send to support, complaint handling records
3.5.2. Call/chat logs where applicable
3.5.3. Preference data (including marketing opt-in/out)
3.5.4. Event registrations, webinar participation,
3.5.5. Survey responses, feedback
3.5.6. Demo requests
3.5.7. Campaign interactions
3.5.8. Marketing preferences.
3.5.9. appointment details, webinar/event registrations, CRM notes, onboarding call records, and correspondence with legal-entity representatives

3.6. Data from third parties

3.6.1. Identity verification results from KYC providers
3.6.2. AML/sanctions/PEP screening results
3.6.3. Fraud and security signals
3.6.4. Public sources and registries where required for compliance
3.6.5. Adverse-media, sanctions, PEP, fraud-risk, and compliance-risk information from screening providers, public sources, commercial databases, blockchain analytics providers, financial institutions, other VASPs, regulators, law-enforcement authorities, courts, or other competent authorities.
3.6.6. Information relating to suspected fraud, misuse of the Services, suspicious activity, or potential breaches of law, regulation, sanctions requirements, or our terms.

3.7. Suitability and eligibility data

3.7.1. Experience with virtual assets
3.7.2. Investment knowledge
3.7.3. Risk tolerance
3.7.4. Investment objectives
3.7.5. Previous virtual asset activity
3.7.6. Eligibility confirmations
3.7.7. Responses to appropriateness or suitability questions.

4. Why we use your data (purposes)

We process Personal Data for the following purposes:

4.1. Provide the Services (account creation, onboarding, executing transactions, customer support)

4.2. Compliance and legal obligations (KYC/KYB, AML/CTF, sanctions, fraud prevention, Travel Rule and regulatory reporting where applicable)

  • For deposits and withdrawals, we may process bank account details, wallet addresses, destination/source information, ownership/control verification data, counterparty information, and risk-screening results.
  • For Travel Rule compliance, we may collect, verify, transmit, and receive originator and beneficiary information, including name, account/wallet identifiers, address, date/place of birth, customer identification number, transaction amount, asset type, transaction hash, and VASP counterparty details, where required by applicable law or industry compliance standards.
    Note: We may exchange Travel Rule data with sending and receiving VASPs, custodians, wallet infrastructure providers, banks, payment institutions, Travel Rule messaging or interoperability providers, identity-verification providers, AML/CTF screening providers, blockchain analytics providers, sanctions-screening providers, fraud-prevention providers, regulators, law-enforcement authorities, financial intelligence units, courts, and other competent authorities where required or permitted by law.
    Some recipients process Travel Rule data as our Processors under our instructions and written agreements. Other recipients, including counterparty VASPs, banks, payment institutions, custodians, regulators, financial intelligence units, courts, and competent authorities, may process Travel Rule data as independent controllers under their own legal obligations, privacy notices, and retention requirements.
    Where Travel Rule data is transmitted to or received from a counterparty VASP or other recipient outside Switzerland or the EEA, the data may be subject to the laws and data-protection standards of that recipient’s jurisdiction. We apply appropriate transfer safeguards where required by applicable data-protection law.
  • For compliance, sanctions, fraud-prevention, and risk-management purposes, we may process information relating to sanctions exposure, PEP status, adverse media, suspected fraud, suspicious activity, alleged unlawful conduct, blockchain-risk indicators, and other compliance-risk signals, where permitted by applicable law and subject to appropriate safeguards.

4.3. Security and platform integrity: authentication, access control, monitoring, incident response

4.4. Risk management: credit/fraud risk, suspicious activity detection, blockchain analytics

  • We may use fraud-prevention databases where permitted by law. We may use credit reference agencies only if necessary for a specific Service and where permitted by law.

4.5. Improve and develop Services (debugging, performance, feature improvements, analytics)

4.6. Communications (service messages, security alerts, legal notices)

4.7. Marketing (where permitted) (subject to consent/opt-out rules and local law)

  • We may process contact and preference data to manage demos, appointments, webinars, events, surveys, feedback, and market research, where permitted by law or based on consent where required.

4.8. Protect legal rights (claims, disputes, audits, corporate transactions)

4.9. Suitability and eligibility assessments: we may process information about your experience, knowledge, investment objectives, risk tolerance, previous virtual asset activity, and responses to eligibility or appropriateness questions where required to determine whether a Service is suitable or available to you.

4.10. If we operate referral, affiliate, ambassador, rewards, beta-user, or community programs, we may process referral codes, invite links, campaign participation, reward eligibility, wallet/payment details, community contributions, social handles, and related communications.

Purpose Data used Swiss justification GDPR basis where applicable
Account creation Identity / contact / account data Contract / requested services Article 6(1)(b)
AML / KYC / Travel Rule KYC/KYB, transaction, wallet, screening data Law / statutory duties Article 6(1)(с)
Security / fraud Device, transaction, risk data Overriding private interest Article 6(1)(f)
Marketing Contact / preference data Consent / marketing rules Article 6(1)(a) or 6(1)(f) where allowed
Optional cookies Cookie identifiers Consent where required Article 6(1)(a)

5. Legal bases / justifications for processing under the Swiss Federal Act on Data Protection, where relevant.

We rely on one or more of these legal bases / justifications:

5.1. Swiss FADP processing principles and justifications

Under the Swiss FADP, private-sector processing of Personal Data is generally governed by the FADP processing principles, including lawfulness, good faith, transparency, proportionality, purpose limitation, accuracy, data security, and storage limitation. Where processing may infringe personality rights or where a justification is otherwise required, we rely on an applicable justification, such as your consent, an overriding private or public interest, or a basis provided by law.

5.1.1. Contract / requested Services: to provide the Services you request, including account operations and executing transactions. Under the Swiss FADP, private-sector processing is generally permitted where it complies with the processing principles in Article 6 FADP and does not unlawfully infringe your personality rights. Where a justification is required, processing may be justified by your request for the Services and our overriding private interest under Article 31(1) FADP and Article 31(2)(a) FADP.

5.1.2. Legal obligation / statutory duties: To meet AML/CTF, sanctions, Travel Rule, fraud-prevention, tax, accounting, and regulatory obligations. Where a justification is required, processing may be justified because it is provided for by law under Article 31(1) FADP, including obligations arising under applicable Swiss financial crime, regulatory, tax, and record-keeping laws.

5.1.3. Legitimate interests / overriding private interests: to secure our Services, prevent fraud, improve reliability, defend legal claims, and manage risk, balanced against your rights. Where a justification is required, we rely on our overriding private interests under Article 31(1) FADP, including the cases recognized under Article 31(2) FADP, provided your interests and fundamental rights do not override those interests.

5.1.4. Consent: where required, including but not limited to certain marketing communications, certain optional cookies, and where applicable law requires consent. Consent is governed by Article 6 (6) FADP and must be freely given for specific processing after appropriate information has been provided. Where we rely on consent under FADP, consent must be given voluntarily for one or more specific processing activities after appropriate information has been provided. Where required under Article 6(7) FADP, including for certain sensitive personal data or high-risk profiling, consent must be expressed. You may withdraw consent at any time, without affecting processing carried out before withdrawal or processing that is required or justified on another lawful basis or justification.

5.2. Where we process biometric data for identification/verification, this may constitute sensitive personal data under Article 5(c)(4) FADP, where the biometric data uniquely identifies a natural person.

Where required, we process such biometric data under an applicable justification, such as:

5.2.1. Explicit consent: under Article 6(7)(a) FADP, explicit consent is required for the processing of sensitive personal data where consent is relied upon; and/or

5.2.2. Overriding private or public interest / statutory basis: under Article 31(1) FADP, including where processing is necessary for AML/CTF-related identity assurance, fraud prevention, compliance, security, risk management, or legal/regulatory obligations, together with suitable safeguards and compliance with the processing principles in Article 6 FADP.

5.3. Where GDPR applies, we rely on the following legal bases:

5.3.1. Contract under Article 6(1)(b) GDPR: to create and manage accounts, provide the Services, execute transactions, and provide support.

5.3.2. Legal obligation under Article 6(1)(c) GDPR: to comply with AML/CTF, sanctions, tax, accounting, regulatory reporting, record-keeping, and Travel Rule obligations.

5.3.3. Legitimate interests under Article 6(1)(f) GDPR: to secure the Services, prevent fraud, manage risk, improve reliability, defend legal claims, conduct internal analytics, and protect our business, provided your interests and fundamental rights do not override those interests.

5.3.4. Consent under Article 6(1)(a) GDPR: for optional marketing, optional cookies, push notifications where required, and other processing where consent is required by law.

5.4. Where GDPR applies, biometric data used for unique identification is processed only where a valid Article 9 GDPR condition applies. This may include explicit consent under Article 9(2)(a) GDPR. In limited cases, another Article 9 condition may apply, such as legal claims under Article 9(2)(f) GDPR or substantial public interest under Article 9(2)(g) GDPR, where applicable law expressly permits it and appropriate safeguards are in place.

Note: If you do not want to provide biometric verification and an alternative is available, we will offer it where feasible. If no suitable alternative is available, we may be unable to onboard you or provide certain Services due to regulatory, security, or fraud-prevention requirements.

5.5. GDPR Article 10 and compliance-risk data, where applicable

Where the GDPR applies, Personal Data relating to criminal convictions, offences, alleged offences, related security measures, sanctions, politically exposed persons (PEPs), adverse media, suspected fraud, suspicious activity, or other compliance-risk indicators is processed only where permitted by applicable law and subject to appropriate safeguards. We process such data for KYC/KYB, AML/CTF, sanctions screening, fraud prevention, Travel Rule compliance, transaction monitoring, blockchain analytics, regulatory reporting, internal investigations, legal claims, and cooperation with competent authorities. Access is restricted to authorised personnel and service providers on a need-to-know basis, and the data is retained only as long as necessary for the relevant compliance, security, legal, regulatory, or risk-management purpose.

4. Where GDPR applies, biometric data used for unique identification is processed only where a valid Article 9 GDPR condition applies. This may include explicit consent under Article 9(2)(a) GDPR. In limited cases, another Article 9 condition may apply, such as legal claims under Article 9(2)(f) GDPR or substantial public interest under Article 9(2)(g) GDPR, where applicable law expressly permits it and appropriate safeguards are in place.

Note: If you do not want to provide biometric verification and an alternative is available, we will offer it where feasible; if not, we may be unable to onboard you due to regulatory obligations.

6. Confidentiality and access controls

6.1. We treat verification documents, financial data, and other sensitive information as confidential. Access is limited to authorised staff on a need-to-know basis and to vetted service providers under contractual confidentiality and security obligations.

6.2. Internal recipients may include compliance/AML personnel, support, finance, legal, security, engineering, management, and authorised contractors, each subject to need-to-know access controls and confidentiality duties.

7. Who we share Personal Data with (recipients)

We share Personal Data only as necessary for the purposes above.

7.1. Categories of recipients

7.1.1. Identity verification (KYC/KYB) and AML providers (document verification, liveness/selfie checks, screening, case management)

7.1.2. Blockchain analytics and compliance providers (risk scoring, sanctions exposure detection)

7.1.3. Financial institutions and payment providers (banks, card processors, payment gateways, EMI partners)

7.1.4. VASP/Travel Rule counterparties (sending and receiving VASPs, custodians, exchanges, wallet infrastructure providers, Travel Rule messaging or interoperability providers, and other financial intermediaries – where required or permitted to exchange sender/recipient information under applicable Travel Rule regimes)

7.1.5. IT and infrastructure vendors (hosting, cloud services, logging/monitoring, customer support tools, analytics tools, email delivery)

7.1.6. Professional advisers (lawyers, auditors, accountants, insurers)

7.1.7. Authorities and regulators (financial intelligence units, courts, supervisory authorities, law enforcement) when required by law

7.1.8. Group affiliates for operations, compliance, and security under appropriate safeguards

7.1.9. Wallet infrastructure providers, exchanges, brokers, liquidity providers, and execution partners where necessary to provide Virtual Asset Services.

7.1.10. Debt collection, chargeback, tracing, recovery, and fraud-prevention service providers where necessary to recover amounts owed or protect legal rights.

7.1.11. Prospective buyers, successors, investors, insolvency practitioners, and advisers in connection with corporate transactions, restructuring, financing, or sale of assets.

7.2. What we do not do

We do not sell Personal Data to third parties for their own direct marketing purposes. We do not disclose Personal Data to third parties in exchange for payment for their independent marketing use.

7.3. A list of material outsourced service providers and processor categories is available upon request, subject to confidentiality, security, and legal restrictions. Where we use banks, payment institutions, custodians, wallet infrastructure providers, exchanges, liquidity providers, or other VASPs, those parties may process Personal Data as independent controllers under their own terms and privacy notices. Some recipients process Personal Data as our Processors under our instructions and written agreements. Others process Personal Data as independent controllers, including banks, payment institutions, custodians, VASPs, regulators, courts, professional advisers, and certain compliance providers.

7.4. In connection with a merger, acquisition, financing, restructuring, sale of assets, insolvency, or similar transaction, we may disclose Personal Data to prospective buyers, successors, advisers, and relevant counterparties under confidentiality safeguards.

8. On-chain/blockchain transparency - important information

Because we support on-chain transactions, some information is recorded on public blockchains and may be publicly visible and immutable (cannot be deleted by us). This may include wallet addresses and transaction details (amounts, timestamps, token identifiers, transaction hash).

8.1. What data is on-chain vs off-chain

8.1.1. On-chain: wallet addresses, transaction hashes, transfers, smart contract interactions (depending on chain).

8.1.2. Off chain (our systems): identity verification, account profile, contact details, support communications, risk assessments, and compliance records.

8.2. How we reduce privacy risk (where feasible)

8.2.1. We aim to minimize linking identity to on-chain addresses beyond what is necessary for compliance and service delivery.

8.2.2. We may use pseudonymization and access controls for internal records.

8.2.3. We may use blockchain analytics to meet AML/CTF obligations and manage risk.

8.3. “Right to be forgotten” limitation

8.3.1. We can delete or anonymize off-chain Personal Data where legally possible, but we cannot remove data that is recorded on-chain by the nature of blockchain technology.

9. Automated decision-making and profiling

We may use automated tools to help us:

  • detect fraud and security threats,
  • screen for sanctions/PEP exposure,
  • assess transaction risk (including via blockchain analytics),
  • decide whether to flag activity for review.

9.1. Significant decisions

Where a decision producing legal or similarly significant effects is made solely by automated means (if applicable), we will provide the information required under FADP and, where required, offer:

9.1.1. the right to obtain human intervention,
9.1.2. the right to express your point of view,
9.1.3. the right to contest the decision.

9.2. We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects. If this changes, we will provide the information required by applicable law and implement required safeguards, including human intervention where required.

9.3. Where permitted, we may use limited profiling to personalize content, communications, product information, and user experience. We do not use marketing profiling to make decisions producing legal or similarly significant effects.

9.4. These automated decision-making and profiling tools may compare identity, device, transaction, sanctions, PEP, fraud, and blockchain-risk data against risk rules and external databases. Consequences may include manual review, request for additional information, transaction delay, rejection, account restriction, or reporting to authorities where required.

9.5. Where solely automated individual decisions producing legal or similarly significant effects are made, we provide the information and safeguards required by the Swiss FADP and, where applicable, GDPR Article 22, including the ability to request human intervention, express your point of view, and contest the decision, subject to legal, regulatory, AML/CTF, sanctions, fraud-prevention, security, and confidentiality restrictions.

10. International transfers

10.1. We may process Personal Data in Switzerland, the EEA, and other countries. Switzerland is recognized by the European Commission as providing an adequate level of protection. Where we transfer Personal Data from Switzerland to countries without adequate protection under FADP, or from the EEA to countries without adequacy under GDPR, we use standard data protection clauses within the meaning of FADP Article 16(2)(d), including clauses recognised, issued, or approved by the FDPIC and adapted for Swiss law where necessary. Where the GDPR applies, we use appropriate safeguards under GDPR Article 46, including European Commission Standard Contractual Clauses under GDPR Article 46(2)(c) or clauses approved under GDPR Article 46(2)(d), together with supplementary measures where required.

10.2. Our main hosting and infrastructure providers are in Switzerland and/or the EEA, unless otherwise stated in this Policy or in our Cookies Policy. We use cloud infrastructure, hosting, monitoring, logging, and security providers subject to contractual confidentiality, security, and transfer safeguards.

10.3. In connection with Travel Rule compliance and Virtual Asset transfers, Personal Data may be transmitted to or received from counterparty VASPs, custodians, Travel Rule messaging or interoperability providers, wallet infrastructure providers, banks, payment institutions, AML/CTF providers, blockchain analytics providers, regulators, financial intelligence units, law-enforcement authorities, courts, and other competent authorities located in Switzerland, the EEA, or other countries. Where such transfers are made to countries without adequate data protection, we use appropriate safeguards where required by applicable law.

10.4. You may request information about, or a copy of, relevant transfer safeguards by contacting us at hello@klidi.io, subject to redactions necessary to protect confidential or commercially sensitive information.

11. Data security

11.1. We implement appropriate technical and organizational measures to protect Personal Data, which may include:

  • encryption in transit (TLS) and encryption at rest where appropriate,
  • access controls, least-privilege permissions, and staff confidentiality,
  • monitoring and logging to detect suspicious activity,
  • secure development and change management practices,
  • vendor due diligence and contractual security obligations.
  • vulnerability management
  • backups
  • incident-response procedures
  • staff training, and
  • periodic access review

11.2. Privacy governance, DPIAs, and privacy by design

We apply privacy by design and privacy by default when developing, changing, or operating our Services, including by considering data minimisation, purpose limitation, access controls, retention, security, and transparency at relevant stages of product and process design.

Where required by applicable law, we assess privacy risks before launching or materially changing processing activities that may present a high risk to individuals, including biometric verification, blockchain analytics, transaction monitoring, sanctions or PEP screening, fraud detection, profiling, automated decision-support tools, new vendor integrations, or new Virtual Asset products.

Where required, we conduct a Data Protection Impact Assessment (DPIA) or equivalent risk assessment, document appropriate safeguards, and consult competent authorities where legally required. We also review relevant service providers and vendors for privacy, security, confidentiality, data-transfer, and outsourcing risks before and during their engagement.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

12. Data breaches and incident notification

If a Personal Data Breach occurs, we will investigate, take steps to contain and remediate it, and make notifications required by applicable law. Where FADP applies, we notify the FDPIC as soon as possible if the breach is likely to result in a high risk to the personality or fundamental rights of affected persons, specifying the nature of the breach of data security, its consequences and the measures taken or planned. Where GDPR applies, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a notifiable breach. We notify affected individuals where required by applicable law, unless an exception applies.

13. Cookies and similar technologies

We use cookies, SDKs, pixels, and similar technologies to:

  • operate the Services (essential cookies: authentication, security, session management),
  • remember preferences (functional cookies),
  • measure performance (analytics cookies),
  • marketing (advertising cookies), where permitted and subject to your choices.

Note: Non-essential analytics, advertising, social media, and multimedia cookies are used only where legally permitted and, where required, based on consent. Refusing non-essential cookies does not prevent access to core services.

13.1. Your choices

13.1.1. You can manage cookie preferences via our cookie banner/settings and your browser/device controls.
13.1.2. Essential cookies are required for the Services to function.
13.1.3. For details (cookie names, providers, durations), see our Cookies Policy.

13.2. Push notifications: We may send service, security, and transactional push notifications where necessary for the Services. Marketing push notifications are sent only where permitted by law and subject to your consent or preferences where required.

13.3. The Cookies Policy forms part of this Privacy Policy by reference.

14. Data retention (FADP Art. 6(4)) - retention schedule

We keep Personal Data only as long as necessary for the purposes described and to meet legal/regulatory obligations. Retention may be extended where required to establish, exercise, or defend legal claims.
14.1. Retention table – The following retention periods generally apply, subject to applicable law, regulatory obligations, limitation periods, and case-specific circumstances:
Data category Examples Typical purpose Typical retention period
Account data Profile, contact details, account settings Provide Services, support For life of account + up to 5 years after closure
KYC/KYB records ID documents, proofs, verification results AML/CTF compliance 5 years after end of business relationship (or longer if required by law)
AML monitoring & risk records Screening results, alerts, case notes AML/CTF, fraud prevention 5–10 years depending on legal requirements and case context
Transaction records (off-chain) Deposits/withdrawals, payments, instructions Execute transactions, accounting, compliance 5–10 years (financial/regulatory)
On-chain references we store Wallet addresses, transaction hashes Service delivery, compliance As long as account is active + up to 5–10 years where required for AML/CTF, accounting, dispute, or regulatory purposes. On-chain data itself may remain public and outside our ability to delete.
Support communications Emails, tickets, chat logs Customer support, complaint handling Up to 3 years after resolution (longer for disputes)
Security logs Access logs, device data, audit logs Security, fraud prevention 6–24 months (longer if incident-related)
Marketing preferences Opt-in / opt-out status Comply with e-privacy / marketing rules Until you change your preference; suppression records may be retained as long as necessary to respect opt-outs and demonstrate compliance
Cookie data Identifiers, analytics events Operate / measure / market Per cookie duration as set out in Cookies Policy

The exact period within a range depends on applicable statutory duties, risk level, whether alerts or investigations occurred, audit requirements, limitation periods, and whether retention is needed for legal claims.

14.2. Deletion and anonymization

When retention ends, we securely delete or anonymize data, unless continued retention is required by law.

15. Your rights under FADP and, where applicable, GDPR

15.1. Subject to conditions and exceptions under applicable law, you may have the following rights. Some rights apply specifically under GDPR, some under FADP, and some under both.

  • Information (as provided by FADP Articles 25 to 27)
  • Access. Subject to legal and security restrictions, users may request copies of their account, orders, transactions, and service records.
  • Rectification (correct inaccurate data)
  • Erasure (delete data) (note: limitations for AML and on-chain data)
  • Restriction of processing
  • Data portability. Data portability does not apply to all data, including certain compliance records, internal risk assessments, third-party data, public blockchain data not controlled by us, or data where portability would adversely affect others’ rights or legal obligations.
  • Objection (including objection to processing based on legitimate interests; and to direct marketing at any time)
  • Withdraw consent (where processing is based on consent).
    Withdrawal of consent does not affect processing carried out before withdrawal. Withdrawal of optional marketing, profiling, or non-essential cookie consent does not affect core services. Withdrawal or refusal of data required for KYC/KYB, AML/CTF, sanctions, fraud prevention, Travel Rule, security, or service execution may prevent onboarding, restrict transactions, or require account closure.
  • Complaint. Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, EU/EEA users may also lodge a complaint with the supervisory authority in their country of residence, place of work, or place of alleged infringement.

15.2. How to exercise your rights
Contact us at hello@klidi.io or at Portfolium X AG, Gubelstrasse 11, 6300 Zug, Switzerland. To protect your data, we may need to verify your identity before fulfilling a request.

  • Please avoid sending sensitive documents by unsecured email unless we request it through an approved channel. If a request is made through a representative, we may require proof of authority and verification of both the requester and the data subject. We may refuse to act on requests where we cannot verify the requester’s identity or the security of communication.
  • Requests are generally free of charge. Where permitted by applicable law, we may charge a reasonable fee or refuse requests that are manifestly unfounded, excessive, repetitive, or abusive.

15.3. Typical response time
We aim to respond to rights requests within 30 days. Where GDPR applies, we respond within one month and may extend this by up to two further months for complex or numerous requests, as permitted by GDPR. Where FADP applies, we respond within the period required by Swiss law and will inform you if additional time is needed.

15.4. Where required by applicable law, we will notify any recipients to whom Personal Data has been disclosed of any rectification, erasure, or restriction of processing that data. This notification will be made unless it is impossible or would involve a disproportionate effort. We will not disclose information where doing so would constitute unlawful tipping-off, prejudice AML/CTF or sanctions investigations, reveal monitoring rules, or undermine platform security.

15.5. We may refuse, restrict, or defer a request where permitted by law, including where disclosure would affect the rights and freedoms of others, reveal confidential security/compliance methods, prejudice investigations, conflict with AML/CTF duties, or require retention for legal claims.

16. Marketing preferences and opt-out

16.1. Where we send marketing communications:

  • you can opt out at any time via the unsubscribe link or by contacting hello@klidi.io.
  • opting out does not affect service/transactional communications, including but not limited to security alerts, legal notices.

16.2. Mandatory and optional data

  • Mandatory: Data required for onboarding, AML/CTF, sanctions screening, Travel Rule, fraud prevention, transaction execution, security, and account administration is necessary to provide the Services.
  • Optional: Data for marketing, optional cookies, optional surveys, and optional product feedback is voluntary.

16.3. We send direct marketing only where permitted by applicable law, including Article 3(1)(o) of the Swiss Federal Act against Unfair Competition (UCA/UWG), based on consent or, where allowed, to existing customers for similar services subject to an opt-out.

17. Children

Our Services are not intended for individuals under 18. We do not knowingly collect Personal Data from children. If we learn we have collected such data, we will delete it where legally possible.

18. Changes to this Privacy Policy

  • We may update this Privacy Policy from time to time. We will post the updated version with a new effective date.
  • If changes are material, we will take reasonable steps to notify you, consistent with the significance of the change.

19. Miscellaneous

19.1. Social media clause: We maintain pages/channels on third-party social media platforms. When you interact with us there, both we and the platform may process Personal Data. Platform processing is governed by the platform’s own privacy policy.

19.2. Our Services may contain links or integrations to third-party websites, applications, wallets, payment providers, KYC providers, blockchain explorers, or other services. Their privacy practices are governed by their own notices.

19.3. If our Services involve non-custodial wallets, we do not have access to your private keys or recovery phrase. You are responsible for keeping them confidential. If our Services involve custodial wallets or custody providers, we or those providers may process wallet, transaction, security, and control-related data necessary to provide custody services, subject to applicable safeguards and contractual arrangements.

19.4. If you download our app through an app store, the app store provider may process Personal Data under its own privacy terms.

19.5. This Privacy Policy is governed by Swiss law, without prejudice to any mandatory rights you may have under applicable data protection laws, including GDPR where applicable.

20. Contact us

For questions, requests, or complaints regarding privacy, contact: hello@klidi.io. You may also write to us at: Portfolium X AG, Gubelstrasse 11, 6300 Zug, Switzerland.