Privacy

1. Who we are

Orthyrus Ltd, trading as Eiva, is the controller of the personal data described in this policy. We’re registered in England and Wales under company number 15177133.

Eiva Receivables 1 Ltd (company number 17372071), which issues the notes behind the vaults, acts as a joint controller with us for the data it needs to run them.

Questions about this policy or your data go to partnerships@eiva.co.

2. Who this policy covers

• People who visit eiva.money.
• People who email or otherwise contact us.
• People who register interest in, or deposit into, a vault once the vaults open.

3. What we collect

Technical. IP address, browser and device information, and how you use the site.

Communications. Emails and messages between you and us.

Once the vaults open, if you deposit, we also collect:

Identity and contact. Name, email address, postal address and date of birth.

Verification. Copies of identity documents, proof of address, the results of identity and sanctions checks, investor certification statements, source of funds information and the results of wallet screening.

Financial. Wallet addresses, amounts deposited and withdrawn, and interest paid.

4. Where it comes from

Most of it comes from you and from your device when you use the site. If you deposit, we also receive data from verification and wallet screening providers, from public registers and from public blockchains.

5. Why we use it and our legal basis

To run and protect the site. Keeping it working and secure, and fixing problems. Basis: our legitimate interests.

To answer you. Replying to your messages. Basis: our legitimate interests, or steps at your request before entering a contract.

To run the vaults. Confirming eligibility, verifying depositors, managing deposits, paying interest, returning capital and reporting. Basis: performance of a contract with you, and legal obligation.

To comply with the law. Identity, sanctions and anti-money laundering checks, keeping records and responding to lawful requests from authorities. Basis: legal obligation.

To prevent fraud and manage risk. Screening wallets and checking for misuse. Basis: our legitimate interests in protecting the site, the vaults and their depositors, and in some cases legal obligation.

We don’t sell your data and we don’t send marketing on behalf of anyone else. Where we rely on legitimate interests, we have considered the effect on you and concluded that our interests are not overridden by your rights.

6. Who we share it with

Eiva Receivables 1 Ltd. It receives the data needed to run the vaults.

Service providers. Cloud hosting, email and communications providers, and verification and wallet screening providers. Each acts under a contract that restricts how it can use your data.

Professional advisers. Lawyers, accountants, auditors and insurers, where needed.

Authorities. Regulators, law enforcement and courts, where we are required to.

A buyer or funder of the business. If Eiva is sold, merged or refinanced, data may be shared with the counterparty and its advisers, under confidentiality.

7. International transfers

Some of our service providers process data outside the UK. Where they do, we rely on the UK’s adequacy regulations or on standard contractual clauses approved for use in the UK, and we take steps to protect your data to the same standard as here.

8. How long we keep it

• Technical data is kept for up to two years.
• Messages that don’t lead to a deposit are kept for up to two years.
• Identity and anti-money laundering records are kept for at least five years after the relationship ends, as the law requires.
• Depositor records are kept for at least six years after the note ends.

We delete or anonymise data when it is no longer needed.

9. Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete data, where we no longer have a reason to keep it;
• restrict how we use data, in certain circumstances;
• give you your data in a portable format, where we process it by automated means on the basis of contract or consent; and
• stop using data on the basis of legitimate interests, where your situation gives you grounds to object.

To exercise any of these, email partnerships@eiva.co. We’ll respond within one month. We may need to verify your identity first, and some rights are limited where we have a legal obligation to keep or use data.

10. Cookies

This site doesn’t use advertising or analytics cookies. If that changes, we’ll update this policy and ask for your consent where the law requires it.

11. Security

We protect your data with access controls, encryption in transit and at rest, and contractual and organisational measures with our providers. No system is completely secure. If we become aware of a breach that affects you, we’ll tell you and, where required, the Information Commissioner’s Office.

12. Children

The vaults are for adults. We don’t knowingly collect data from anyone under 18.

13. Changes

We may update this policy. We’ll post the new version here with a new date, and where a change materially affects you we’ll tell you by email.

14. Complaints

If you’re unhappy with how we have handled your data, contact us first at partnerships@eiva.co. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.