Privacy Policy

1.Preamble

BOB Labs Inc., The BOB Foundation, together with their parent companies, affiliates, directors, officers, employees, contractors, consultants, advisors and agents (collectively, “BOB”, “we,” “our,” or “us”) value your privacy.

Thank you for taking the time to read our Privacy Policy (“Privacy Policy” or “Policy”). This Policy explains how BOB processes personal data collected through its website, gobob.xyz, including subdomains, and through any products provided via our sites or apps. It does not cover third-party websites that may be accessed from this Website, including, but not limited to, any links to social media platforms.

If our privacy practices for certain products differ from those explained in this Privacy Policy, we will let you know at the time we ask for or collect your information.

Please read this Privacy Policy carefully to understand our policies and practices regarding your information and how we will treat it. We may make changes to the Privacy Policy from time to time. We, therefore, encourage you to check the Privacy Policy periodically for updates.

2.Definitions and Interpretation

In this Privacy Policy, the following definitions are used:

“Data” and “Personal Data” - collectively, all information that you submit to BOB via the website; any information about an individual from which that person can be identified, directly or indirectly. This definition includes, where applicable, the definitions provided in the Data Protection Laws. It does not include data where the identity has been removed (anonymized data), which we can use for any purpose.

“Cookies” - small text files placed on your computer by this Website when you visit certain parts of the Website and/or use certain features.

“Data Protection Laws” - any applicable law relating to the processing of Personal Data, including but not limited to:

• The British Virgin Islands Data Protection Act, 2021 (or most current version);
• The EU General Data Protection Regulation (GDPR);
• The UK GDPR and Data Protection Act 2018;
• Other applicable data protection laws, regulations, and secondary legislation.

“User or you” - any individual or third party that accesses the Website.

“Website” - the website that you are currently using, www.gobob.xyz, and any sub-domains of this site unless expressly excluded by their own terms and conditions.

“Messaging Identifier” - a username, handle, user ID or equivalent identifier for a third-party messaging platform (including Telegram) that you provide to us so that we can communicate with you on that platform.

“VIP Services” - the premium features of our products made available to eligible users who apply for or are invited to them, including dedicated support and direct communications.

3.Data Controller

BOB Labs Inc. is the data controller responsible for the Personal Data described in this Privacy Policy. Although this Privacy Policy refers to “BOB” for ease of reading, BOB Labs Inc. is the entity that determines the purposes and means of the processing described here.

BOB Labs Inc. is incorporated in the British Virgin Islands, with its registered office at Trinity Chambers, Ora et Labora Building, Wickhams Cay II, Tortola VG1110, British Virgin Islands.

If you have any questions about this Privacy Policy, including any request to exercise your legal rights, please contact us at legal@gobob.xyz.

EU Representative (Article 27 GDPR)

BOB Labs Inc. has appointed Engage Data Consulting B.V., trading as Engage Compliance, as its representative in the European Union under Article 27 of the GDPR. You may contact the representative on any matter relating to the processing of your Personal Data:

• By email: boblabsinc@engagecompliance.co
• Online: https://www.engagecompliance.co/representatives/boblabsinc

Engage Compliance maintains a public record of this appointment. You can verify the representative’s status at https://www.engagecompliance.co/representatives/verify?id=3cNmPACVBUbK9mnHOuxdrEoy.

UK Representative (Article 27 UK GDPR)

BOB Labs Inc. has appointed Engage Compliance UK Ltd, trading as Engage Compliance, as its representative in the United Kingdom under Article 27 of the UK GDPR. You may contact the representative on any matter relating to the processing of your Personal Data:

• By email: boblabsinc@engagecompliance.co
• By post: Engage Compliance UK Ltd, 124 City Road, London, EC1V 2NX, United Kingdom
• Online: https://www.engagecompliance.co/representatives/boblabsinc

Engage Compliance maintains a public record of this appointment. You can verify the representative’s status at https://www.engagecompliance.co/representatives/verify?id=PVSRqb8SqD97DgJF0U786uFO.

4.What Data We Collect About You

We may collect the following personal and non-personal data from you:

1. Information You Provide
   1. Personal Identification Data: First and last name, email address, billing address, home country, digital wallet address, IP address, Telegram handle or other Messaging Identifier or similar identifiers.
   2. Communication Data: Feedback you provide via email, social media, messaging platforms (including Telegram) or through our products, and the content of the communications you exchange with us on those channels.
   3. Marketing Data: Names and email addresses, and, where you have separately consented to being contacted on that channel, Messaging Identifiers (including Telegram handles).
   4. Questions or Queries: Any questions, queries, or feedback you leave, including your email address if you contact us.
   5. VIP Services Data: Where you apply for or use the VIP Services, the information you submit through the application or onboarding form, including your Telegram handle and the wallet address(es) you associate with your account.
   6. Linked Identifiers: We link the Messaging Identifier you give us to the wallet address(es) and other account data we hold about you, so that we can identify you when you contact us and provide the VIP Services. This means that activity associated with your wallet address, which is publicly visible on a blockchain in pseudonymous form, may be linked by us to you as an identified individual.
2. Information Collected Automatically
   1. Technical Information: IP address, web browser type and version, operating system, device information, and browser fingerprinting data.
   2. Usage Data: Patterns, preferences, and interactions with our products.
   3. Location Data: If applicable, based on your device or browser.
3. Information from Third Parties
   1. Data we may receive from third-party services that interact with our website or our products, such as publicly available blockchain data linked to your wallet.
4. Aggregated Data
   1. Statistical or demographic information derived from your data but not personally identifiable.
   2. Important: If aggregated data is combined with personal data in a way that identifies you, it will be treated as personal data.

What We Do Not Collect

• Sensitive personal data, such as:
  • Race or ethnicity
  • Religious or philosophical beliefs
  • Sexual orientation or sex life
  • Political opinions or trade union membership
  • Health, genetic, or biometric data

We do, however, process your IP address in order to determine the approximate country or region from which you access the Website, so that we can comply with legal and regulatory restrictions on the availability of our products in certain jurisdictions. We also screen wallet addresses and transactions against sanctions lists and financial-crime risk data sources. Where that screening returns information relating to suspected criminal activity, we process it only to the extent necessary to comply with our legal obligations and to prevent fraud and financial crime.

Non-personal data may be used for any purpose.

5.How We Collect Data

We collect data in three ways:

1. Data You Provide:
   1. When you contact us via the Website, email, or post.
   2. When you sign up for marketing communications.
   3. When you use the website features.
   4. When you apply for or use the VIP Services, including when you submit your Telegram handle through a VIP application or onboarding form.
   5. When you communicate with us on a third-party messaging platform such as Telegram, whether in a direct chat or in a group chat that we create or administer.
   6. When you interact with ads or apps on third-party sites.
2. Data From Third Parties:
   1. Analytics providers
   2. Advertising networks
   3. Search information providers
   4. Our service providers
3. Data Collected Automatically:
   1. Information about your visits to the Website, such as IP address, visit dates and times, and how you interact with content
   2. Data collected via cookies, based on your browser settings

6.How We Use Data

We may use the data we collect to provide you with the best possible experience on our Website, including to:

• Maintain internal records
• Improve our products
• Enhance site features and usability
• Analyse trends, traffic, and user behavior
• Respond to questions and provide customer support
• Communicate with you about the products and services you use, including support, transaction and swap-related queries and service messages, using the channel you have given us for that purpose (email or Telegram)
• Operate the VIP Services, including verifying that a person contacting us controls the relevant wallet address, and administering direct and group communications with VIP users
• Send technical notices and security alerts
• Comply with legal, regulatory, or investigative requirements

Where we rely on your consent, data may also be used to:

• Send marketing materials, offers, promotions, and event information by email or, where you have separately opted in to that channel, by Telegram message
• Communicate product or service updates

You can withdraw consent at any time. In some cases, we may send marketing materials based on our legitimate interests, but you can always opt out.

Legal bases. Where the GDPR or the UK GDPR applies to you, we rely on the following legal bases: (i) performance of steps taken at your request, in order to provide the Website, our products and the VIP Services; (ii) our legitimate interests in operating, securing and improving our products, in responding to your queries and in communicating with you about the products you use, including service messages sent to you on Telegram; (iii) your consent, for non-essential cookies and for marketing communications, including any marketing message we send you on Telegram; and (iv) compliance with a legal obligation, for sanctions, anti-money-laundering, fraud prevention, tax and other regulatory requirements.

Communications on Telegram. If you give us your Telegram handle, we will use it to contact you directly on Telegram. Service and support messages (for example, help with a swap or with the VIP Services) are sent on the basis of our legitimate interests or in order to perform our contract with you. Marketing messages (for example, information about new or upcoming features) are sent only where you have given us your prior consent to receive marketing on that channel; consent to marketing by email does not extend to Telegram. You may withdraw your consent, or object to service messages on that channel, at any time by telling us in the chat or by emailing legal@gobob.xyz, and we will then stop contacting you there.

Group chats. We may create group chats on Telegram for VIP users or for particular product topics. If we add you to a group chat, your Telegram handle, your profile name and picture and the messages you send in that group will be visible to every other member of that group, including other users and any third parties we invite. We will add you to a group chat only with your agreement, and you may leave a group chat at any time.

Telegram is a third-party platform. Telegram is operated by a third party and is not controlled by us. Your use of Telegram, and the messages exchanged on it, are also subject to Telegram’s own terms and privacy policy, and Telegram processes that data as an independent controller. We are not responsible for Telegram’s processing of your data. We will never ask you for your seed phrase, private keys or passwords, and we will never ask you to transfer funds, whether on Telegram or on any other channel.

Additionally, we may use Data to comply with applicable laws, cooperate with authorities, or monitor site security.

If we do not receive certain data from you, we may be unable to provide access to some products.

7.Cookie Management and Tracking Technologies

We use the consent management platform to give you control over how cookies and tracking technologies operate on our website. You may choose and modify your cookie choices at any time following such options:

• View all cookies and tracking technologies in use
• Accept or reject non-essential cookies
• Update your preferences at any time
• Access detailed information about each cookie’s purpose

Non-essential cookies and similar tracking technologies are placed on your device only where you have given your consent, and you may withdraw that consent at any time through the preference centre. A current list of the cookies and tracking technologies we use, together with their purpose, provider and duration, is available in that preference centre.

8.Who We Share Data With

We may share your data with:

• Employees, contractors, consultants, agents, and advisors to respond to your requests.
• Authorities when required by law or to prevent fraud.
• Third-party service providers (analytics, hosting, email delivery, marketing).
• Professional advisers such as lawyers, auditors, and insurers.
• Regulators that require reporting.
• Business partners or buyers in the event of a sale or merger.
• Third-party communication platforms, including Telegram, where you choose to communicate with us on those platforms. Your Telegram handle and the messages exchanged with us are processed by Telegram under its own privacy policy and outside our control.
• Other members of any group chat we create or administer, who will be able to see your Telegram handle, profile and messages in that group.
• Sanctions screening, anti-money-laundering and blockchain analytics providers, which we use to screen wallet addresses and transactions for sanctions and financial-crime risk.

9.Blockchain interactions

If you use features that run on or interact with a blockchain, your transaction or interaction data may be recorded on a public ledger and accessible to third parties.

10.International Data Transfers

Your Personal Data may be processed in, or transferred to, countries outside the jurisdiction in which you are located, including countries whose data protection laws differ from those of your own country.

Messages you exchange with us on Telegram are transmitted and stored on infrastructure operated by Telegram, which is located outside the European Economic Area and the United Kingdom. That transfer takes place under your own relationship with Telegram and not under arrangements put in place by us.

11.Keeping Data Secure

We protect your data through technical and organizational measures, including secure servers, encryption in transit (TLS), firewalls, access controls, and regular security reviews. If you suspect unauthorized access, contact us at legal@gobob.xyz.

Where we are required to do so under applicable Data Protection Laws, we will notify the competent supervisory authority, and any affected individuals, of a personal data breach within the time limits set by those laws.

12.Data Retention

We retain Personal Data only for as long as is necessary for the purposes described in this Privacy Policy, after which we delete or anonymise it. In practice: contact details and marketing preferences are kept until you withdraw your consent or object, and for a short period afterwards in order to record that objection.

13.Children’s Personal Information

Our Website is not intended for children under 16, and we do not knowingly collect their data. Parents or guardians may contact us if data was provided in error.

14.Your Privacy Rights

Depending on your location, you may have rights to:

• Access, correct, delete, or restrict your data
• Object to processing
• Data portability
• Withdraw consent
• Object at any time, and free of charge, to the processing of your data for direct marketing purposes, including marketing messages sent to you on Telegram
• Not be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, and to request human review of any such decision
• File a complaint with a related supervisory authority

To exercise your rights or withdraw consent: legal@gobob.xyz. We may require verification of your identity or authorization.

Withdrawing your consent does not affect the lawfulness of any processing we carried out before the withdrawal.

Automated decision-making. Access to certain products is restricted automatically on the basis of the approximate location derived from your IP address and of automated screening of wallet addresses against sanctions and financial-crime risk data. If access is restricted in this way and you consider the outcome to be incorrect, you may contact legal@gobob.xyz to obtain human review of the decision, to express your point of view and to contest the decision.

15.Links to Other Websites

We are not responsible for third-party websites. Please review their privacy policies before use.

16.Business Changes

If our business is sold or restructured, your data may be transferred to the new owner under the same privacy terms. We may also share data with potential purchasers during due diligence.

17.General

If any court or competent authority finds that any provision of this privacy policy (or part of any provision) is invalid, illegal, or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this privacy policy will not be affected.

Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.

This Policy will be governed by and interpreted according to the law of the Cayman Islands. All disputes arising under the Policy will be subject to the jurisdiction of the Cayman Islands courts, to the extent permitted by applicable law. Nothing in this Privacy Policy affects any mandatory right you have under applicable Data Protection Laws, including your right to lodge a complaint with a supervisory authority, or to bring proceedings, in the country in which you live or work.

18.Changes to this Privacy Policy

BOB reserves the right to change this privacy policy as we may deem necessary from time to time or as may be required by law. Any changes will be immediately posted on the Website.