Privacy Policy

Last updated: 1 October 2026. This Privacy Policy explains how Aridika Research Lab OÜ (“Aridika,” “we,” “us,” “our”) collects, uses, discloses, transfers and protects personal data of visitors, prospective clients and account holders of aridika.com/ and the Aridika autonomous AI crypto trading platform (the “Service”). This policy complies with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (collectively, “CCPA/CPRA”), the Estonian Personal Data Protection Act of 2019, and other applicable data protection laws.

Sections

1. Who the controller is

The data controller for personal data processed under this policy is Aridika Research Lab OÜ, incorporated under the laws of the Republic of Estonia, registration no. 14982200, with registered office at Rotermanni 12, Tallinn 10111, Estonia. Our Data Protection Officer is reachable at [email protected].

2. The categories of personal data we collect

We collect only data that is strictly necessary for the purposes listed in Section 4. The categories include:

Identity data — full legal name, date of birth, nationality, country of residence, national identifier or passport number, a liveness selfie, and (where required by the law of the country of residence) tax identification number.
Contact data — email address, telephone number, physical address, preferred communication language.
Financial & transactional data — funding method, deposit source, withdrawal destination, counterparty bank or wallet address, transaction history on your Aridika account.
Account data — Aridika username, hashed password, two-factor authentication binding, API keys you generate.
Technical & device data — IP address, device fingerprint, browser type and version, operating system, time zone, access timestamps, language settings.
Usage data — pages visited, buttons clicked, dashboard sessions, support chat transcripts, calculator interactions, A/B-test assignments.
Marketing & preferences — subscription status to the Signal Letter, consent to marketing emails, preferred frequency.
Compliance data — results of sanctions screening, politically-exposed-person (PEP) screening and adverse-media checks performed as part of KYC/AML obligations.

3. How we collect personal data

We collect personal data directly from you (when you open an account, use the dashboard, contact the desk, subscribe to the Signal Letter), automatically (through cookies, server logs, device fingerprinting as described in our Informativa sui cookie) and from third parties where lawfully permitted (KYC verification providers, sanctions-list databases, your funding bank for payment confirmations, our exchange venue partners for execution reporting).

4. The purposes for which we process personal data

To open and administer your Aridika account.
To comply with our KYC, AML and counter-terrorist-financing obligations under EU AMLD6 and the laws of other jurisdictions where you are resident.
To route trades on your behalf through our exchange venue partners.
To settle deposits and withdrawals.
To provide customer support.
To detect, investigate and prevent fraud, abuse, and security incidents.
To improve the Aridika engine and the dashboard — including training and re-weighting the trading model (we use aggregated, pseudonymised transaction data for this, never named client identities).
To send operational notices (balance alerts, security notifications, policy updates) — these are not opt-outable because they are necessary for the Service.
To send marketing communications where you have consented — these are always opt-outable with one click.
To comply with legal obligations, respond to lawful requests from public authorities, and defend our legal rights.

5. Our legal bases under the GDPR

Performance of a contract (Art. 6(1)(b) GDPR) — processing necessary to deliver the Service to you.
Legal obligation (Art. 6(1)(c)) — processing necessary to comply with KYC/AML, tax reporting, sanctions and record-keeping obligations.
Legitimate interests (Art. 6(1)(f)) — processing necessary for fraud prevention, security, service improvement, aggregated analytics and defending our legal rights, provided those interests are not overridden by your rights.
Consent (Art. 6(1)(a)) — processing for optional marketing communications, non-essential cookies, and voluntary features such as the Signal Letter.

Aridika never sells personal data. We share only the minimum data necessary with the following categories of recipients, under contractual safeguards aligned with Art. 28 GDPR:

Exchange venue partners — your account identifier, order parameters and settlement details are routed to the venues the engine selects for execution.
Custody partners — your account identifier and balance movements are relayed to our segregated-custody counterparties.
KYC & AML providers — your identity, contact and compliance data are shared with regulated providers for identity verification and sanctions screening.
Payment processors & banks — your name, bank/wallet details and transaction amounts are shared with payment processors to settle deposits and withdrawals.
Infrastructure providers — our data-centre, CDN, email, logging and analytics providers process technical and usage data under GDPR-compliant Data Processing Agreements.
Professional advisers — auditors, lawyers, tax advisers, under contractual confidentiality.
Public authorities — only in response to a legally binding request we have verified to be lawful (court orders, tax authority subpoenas, financial-regulator requests).

7. International data transfers

Aridika operates infrastructure in the European Economic Area, the United Kingdom, the United States and Singapore. When personal data is transferred outside the EEA, we rely on the European Commission’s Standard Contractual Clauses (2021/914) or an adequacy decision where available. A copy of the applicable transfer safeguards is available on request from the DPO.

8. How long we retain personal data

Account data is retained for the duration of your relationship with Aridika plus five years from account closure (longer where mandated by local KYC/AML law — up to seven years in Estonia, ten in some other jurisdictions). Server logs and dashboard-usage data are retained for 24 months. Support chat transcripts are retained for 36 months. Marketing preferences are retained for the lifetime of the account plus one year.

9. Your rights

Where the GDPR or an equivalent applies, you have the right to:

Access — obtain a copy of the personal data we hold about you.
Rectification — have inaccurate personal data corrected.
Erasure — ask us to delete personal data, subject to our legal retention obligations.
Restriction — ask us to limit processing in specific circumstances.
Portability — receive your personal data in a structured, machine-readable format.
Objection — object to processing based on legitimate interests, including profiling.
Withdraw consent — where processing is based on consent, you can withdraw it at any time.
Lodge a complaint — with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.

To exercise any of these rights, email the DPO at [email protected]. We respond within 30 days of receiving a verified request.

10. How we protect personal data

We maintain technical and organisational measures aligned with ISO/IEC 27001 principles and the EU’s NIS2 directive, including: AES-256-GCM encryption of data at rest; TLS 1.3 for data in transit; passkeys / hardware FIDO2 keys and TOTP for employee access; principle-of-least-privilege IAM; mandatory multi-factor authentication for client accounts; annual third-party penetration testing; a documented incident-response runbook; and segregation of production and research environments.

11. Children

Aridika is not directed at persons under 18 years of age, and we do not knowingly collect personal data from a minor. If you believe we have collected personal data from a minor, email the DPO and we will delete the data within 72 hours.

12. California residents (CCPA/CPRA)

California residents have additional rights under the CCPA as amended by the CPRA, including the right to know, the right to delete, the right to correct, the right to limit use of sensitive personal information, and the right to opt out of sale or sharing. Aridika does not sell personal information as the term is defined by CCPA/CPRA. To exercise your rights, email [email protected] with “California request” in the subject line.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced by email to account holders at least 14 days before taking effect. The “Last updated” date at the top of this page reflects the most recent revision.

14. How to reach the Data Protection Officer

Postal: Data Protection Officer, Aridika Research Lab OÜ, Rotermanni 12, Tallinn 10111, Estonia. Email: [email protected].