1inch Business Privacy Policy

This Privacy Policy is intended to inform you about the processing of your personal data when you access and/or use 1inch Business, business.1inch.com (“1inch Business”, “Website”), a website operated by Degensoft Ltd., a BVI company registered at: c/o Walkers Corporate (BVI) Limited, 171 Main Street, PO Box 92, Road Town, Tortola VG1110, British Virgin Islands (“Degensoft Ltd.” or “we”). Degensoft Ltd. acts as the data controller of the processing of your personal data within the scope of this Privacy Policy. It means that we decide “why” and “how” your personal data is processed in connection with the 1inch Business. If you have additional questions or require more information about this Privacy Policy, do not hesitate to contact privacy@1inch.com.

This Privacy Policy applies to the processing of your personal data in connection with your use of 1inch Business and your related interactions with us, including where you communicate with us or otherwise engage with us in relation to 1inch Business through our communications or other business channels. It does not apply to services, applications or websites operated by third parties that are not controlled by us, for which the relevant third-party privacy policies apply. We advise you to carefully read this Privacy Policy to understand how we collect and process your personal data and for which purposes.

This Privacy Policy forms an inalienable part of the 1inch Business Terms of Service. Capitalized terms used but not otherwise defined herein shall have the meanings given to them in the 1inch Business Terms of Service.

We have a designated Data Protection Officer (DPO) supported by a dedicated data protection team. The team holds recognized privacy and security certifications including IAPP CIPP/E, CIPM, FIP, and ISACA CISM and CGEIT. You may reach the DPO at privacy@1inch.com.

1. Changes to this Privacy Policy

If our data processing practices change, we will update this Privacy Policy accordingly to let you know of them upfront and give you a possibility to either provide your consent, object to a particular processing, or undertake other action you are entitled to under the applicable regulation. Please keep track of any changes we may introduce to this Privacy Policy.

Your continued access to and use of the Website constitutes your awareness of all amendments made to this Privacy Policy as of the date of your accessing and use of the Website. Therefore, we encourage you to review this Privacy Policy regularly as you shall be bound by it.

2. Categories of Personal Data We Process

When you use the Website, the categories of personal data that we collect about you are the following:

Personal Data You Provide When Using the Website:

• Any identification and contact data such as your email address, name, surname, and any other personal data you provide to us when signing up to 1inch Business, creating your profile and/or requesting access to the API;
• Any payment information that you may need to submit to process the payment for commercial use of 1inch API (e.g., billing information, your full name, billing address, or any additional information that may be required to facilitate the payment);
• Any personal data required to complete due diligence, verification or compliance screening when accessing and/or using the API;
• Any other personal data you provide directly to us when communicating with us.

Personal Data Automatically Collected When You Use the Website:

We use cookies, web beacons and similar tracking technologies to collect personal data from and store information on your device when you use, access, or otherwise interact with the Website. The categories of personal data that we may automatically collect are the following:

• Personal data collected by log files including internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks;
• Analytics and data related to your use of the Website (e.g., IP address, MAC address, log files, domain server, data related to usage, performance, website security, traffic patterns, location information);
• Behavioral data related to your use of the Website (including, in particular, and depending on the case, data related to your use of the Website and how you interact using the Website, content viewed, features accessed, your status on the Website, such as taps, clicks, scrolling data, etc.).

3. How and Why We Use Your Personal Data

In the table below, you will find the various purposes for which we may process your personal data and the corresponding legal basis. Depending on the circumstances, we may use different legal bases to process the same personal data for different purposes.

We will not process your personal data for any purpose that is incompatible with the purposes listed above.

4. Sharing Your Personal Data

In the context of processing your personal data in accordance with this Policy, we may communicate your personal data to the following recipients, if necessary:

• our subsidiaries or affiliates (if any) only if necessary for operational purposes.
• service providers, external suppliers, contractors, agents to the extent that they assist us in carrying out the purposes set out in this Privacy Policy (e.g., we use analytics providers to assist us in the improvement and optimization of the Website; marketing providers to promote the use of the Website; IT service providers and technical maintenance vendors to host your personal data and ensure proper functioning of the Website on our behalf, payment service providers and financial institutions to process payments for commercial use of the 1inch API and to comply with related record-keeping obligations, customer relationship management, business development, productivity, automation and artificial intelligence service providers to support the operation and improvement of our services and related sales and marketing activities, AML compliance and screening service providers to comply with AML laws, regulations and procedures);
• competent courts, public authorities, government agencies and law enforcement agencies to the extent required by law or if we have a good-faith belief that such disclosure is necessary in order to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, or private parties, including but not limited to in response to subpoenas, search warrants, or court orders;
• third parties in connection with a merger, division, restructuring, change of control or bankruptcy or other association change.

We will only communicate your personal data to any recipient on a need-to-know basis and only when the processing by the recipient is strictly limited to the purposes identified in this Privacy Policy. We do not sell your personal data.

AI-assisted processing. We may use artificial intelligence tools to operate and improve our services and to support related business development, sales and marketing activities. Where we engage AI providers to process personal data on our behalf, they act as our processors under our instructions and applicable law. Such processing may include the analysis of data held in our customer relationship management systems. In particular, we may use Anthropic PBC’s Claude platform to support the analysis of data held in our customer relationship management systems for business development, sales and marketing purposes. In that context, Anthropic may process contact data, company and role information, deal and pipeline data, support content, communication metadata and related CRM information on our behalf, subject to a data processing agreement and applicable international transfer safeguards. You have the right to object to this processing under Article 21 GDPR. To object, contact us at privacy@1inch.com.

5. Data Retention Period

We retain your personal data only for as long as necessary for the purposes for which it has been collected, as specified in this Policy, and in accordance with applicable laws. The retention periods we apply may vary depending on the purpose for which we process your personal data. When determining the appropriate retention period, we take into account the category and amount of personal data, the potential risks and harm that may arise from unauthorized access or disclosure, the specific purposes for which the data is processed, the availability of alternative means to achieve those purposes, and the applicable legal requirements. In some situations, we may anonymize personal data so that it can no longer be used to identify you; in such cases, we may use this information without further notice to you.

Sometimes legal requirements oblige us to retain certain data, for specific purposes, for an extended period of time. Reasons we might retain some data for longer periods of time include:

• Security, fraud & abuse prevention;
• Financial monitoring and record-keeping;
• Complying with legal or regulatory requirements;

6. Transfer of Personal Data

As we operate globally, we may process your personal data around the world where our facilities or providers are located. Therefore, for the purpose of processing your personal data as described in this Policy, we may have to transfer your personal data outside the European Economic Area (“EEA”).

In these cases, we implement appropriate transfer mechanisms and safeguards to ensure that the personal data transferred benefit from the same level of protection within the EEA. In practice, this means that each of the envisaged transfers is based on at least one of the following mechanisms:

• the existence of an adequacy decision issued by the European Commission for the country to which your personal data is transferred; or, failing that;
• the conclusion of the European Commission's Standard Contractual Clauses (EU SCCs 2021), combined with supplementary technical, contractual and/or organizational measures where required following a Transfer Impact Assessment, which confirms the level of protection is essentially equivalent to that in the EEA; or, failing that;
• the existence of an exemption linked to one of the specific situations exhaustively provided for by the General Data Protection Regulation n°2016/679 ("GDPR"). For example, where you have explicitly given your consent to the proposed transfer after having been informed of the absence of safeguards, where the transfer is necessary for the performance of a contract between you and us, where the transfer is necessary for the conclusion or performance of a contract concluded, in your interest, between us and a third party, or where the transfer is necessary for the establishment, exercise or defence of our legal claims, etc.

7. Cookies and Automatically Collected Data

As you navigate through and interact with the Website, we may ask your consent to use cookies, which are text files that can be stored on your devices when you visit an online service such as an application or a website to collect certain information about devices you use, browsing actions, and patterns. Cookies are used to store information on your device so that it can be accessed later.

The data automatically collected from cookies and similar tracking technologies may include information about your web browser (such as browser type and browser language) and details of your visits to the Website, including traffic data, location data and logs, page views, length of visit, and website navigation paths as well as information about your device and internet connection, including your IP address and how you interact with the Website. We collect this data in order to help us improve the Website and interaction with it.

The information we collect automatically may also include statistical and performance information arising from your use of the Website. This type of data will only be used by us in an aggregated or pseudonymized manner. Except for cookies that are strictly necessary for the proper functioning of the Website, we will ask for your consent before placing cookies on your device, and you are free to refuse or withdraw your consent at any time. If you refuse cookies, a refusal cookie will be stored on your device so that we can keep track of your choice; if you delete this cookie, we will no longer be able to know that you have refused the use of cookies. Similarly, when you consent to cookies, a consent cookie is placed on your device. You can also choose to disable cookies at any time through your individual browser options.

The settings for each browser are different. They are described in the help menu of your browser, which will enable you to know how to change your cookies preferences. For example:

• in Microsoft Edge please refer here.
• in Safari please refer here.
• in Chrome please refer here.
• in Firefox please refer here.
• in Opera please refer here.

8. Your Rights

In accordance with the applicable personal data protection regulation, including the GDPR, you have the following rights: access, rectification, deletion, objection, restriction of processing, and data portability of your personal data.

Please note that some of these rights are subject to specific conditions set out in the applicable personal data protection regulation. Therefore, if your particular situation does not meet these conditions, we will unfortunately not be able to respond to your request. In this case, we will inform you of the reasons for our refusal.

• Right of access – You may request access to your personal data at any time. If you exercise your right of access, we will provide you with a copy of the personal data we hold about you as well as information relating to its processing.
• Right of rectification – You have the right to ask us to rectify or complete any personal data in our possession that you consider to be inaccurate or incomplete.
• Right to erasure / to be forgotten – You can ask us to delete your personal data if, for example, it is no longer necessary for the processing we carry out. We will use our best efforts to comply with your request. Please note, however, that we may have to retain some or all of your personal data if we are required to do so by applicable law or if the personal data is necessary for the establishment, exercise or defence of our rights.
• Right to restriction of processing – You may also request that we restrict the processing of your personal data on grounds relating to your particular situation. For example, if you dispute the accuracy of your personal data or object to the processing of your personal data, you may also request that we do not process your personal data for the time necessary to verify and investigate your claims.

  In such cases, we will temporarily refrain from processing your personal data until necessary verifications have been made or until we comply with your requests.

• Right to data portability – You may request portability of the personal data you have provided us with. At your request, we will provide you with your personal data in a readable and structured format, so you can easily re-use it.

  The portability of your personal data applies only to personal data that you have provided to us or that result from your activity on the Website, under the condition that the disclosure of your personal data does not infringe the rights of third parties. If we are unable to comply with your request, we will inform you of the reasons for our refusal.

• Right to object - You may object at any time, on grounds relating to your particular situation, if we use your personal data. We will then stop processing of your personal data unless there are overriding legitimate grounds for continuing to process your personal data (for example, if your personal data is necessary for the establishment, exercise or defence of our rights or the rights of third parties in court proceedings). If we are unable to comply with your request to object, we will inform you of the reasons for our refusal. You can also object at any time to our processing of your personal data for commercial prospection purposes.
• Right to withdraw consent – You have the right to withdraw consent at any time for processing of your personal data based on consent. Withdrawing your consent prevents us from processing your personal data but does not affect the lawfulness of the processing carried out before the withdrawal.

Your rights under the California Consumer Privacy Act ("CCPA") – If you are a resident of California, you have specific rights concerning your personal information under the CCPA. The CCPA provides you with the right to: know the categories and specific pieces of personal information we collect about you, the categories of sources from which it is collected, the purposes for which it is used, and the categories of third parties with whom it is shared or disclosed (please see the sections "Categories of Personal Data We Process", "How and Why We Use Your Personal Data" and "Sharing Your Personal Data"); access a copy of the personal information we maintain about you; correct inaccurate personal information we hold about you; delete your personal information, subject to certain statutory exceptions; limit the use and disclosure of sensitive personal information, if applicable; and opt out of the "sale" or "sharing" of your personal information, including for cross-context behavioral advertising purposes. Please note that we do not sell your personal information as defined under California law. You may designate an authorized agent to submit requests on your behalf. The agent must present signed written permission from you authorizing them to act on your behalf. We will take steps to verify your identity, and if applicable, the authority of your agent, before fulfilling any request. These rights are subject to limitations as described in the relevant law. If we are unable to comply with your request, we will notify you and explain the reasons.

Country Specific Rights: You may also be granted specific rights as regards our processing of your personal data depending on the law applicable in the country you are residing in. You may contact us should you have any question in that regard.

9. How to Exercise Your Rights

If you wish to exercise your rights, you may contact us by using the contact information provided in Section 10 of this Policy (Contact Us). To be able to process your request efficiently, we may ask you additional information to confirm your identity and/or to help us retrieve the personal data related to your request.

Please note that you can lodge a complaint with a data protection regulator in one or more of the European Union member states. You can find a list of data protection authorities in Europe here.

10. Contact Us

If you have any question regarding the processing of your personal data under this Policy, including the exercise of your rights as detailed above, you can contact us (i) by email at privacy@1inch.com; or (ii) by post at the following address: Degensoft Ltd., c/o Walkers Corporate (BVI) Limited, 171 Main Street, PO Box 92, Road Town, Tortola VG1110, British Virgin Islands.