This Privacy Policy explains how Vela Digital AG (“Vela”, “we”) processes personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Controller
The controller responsible for processing is Vela Digital AG, Bahnhofstrasse 65, 8001 Zürich, Switzerland. You can reach our data protection team through the contact form, selecting “Privacy”.
2. Data we collect
- Account data — name, email address, password (stored only as a salted hash).
- Identity data — legal name, date of birth, residential address, country, identity document images and a selfie, collected during verification.
- Financial data — balances, deposits, withdrawals, conversions, bank details used for transfers.
- Technical data — IP address, device and browser information, session cookies, security logs.
- Communications — messages you send us.
3. Why we use it
- To open and run your account and execute your transactions (performance of contract).
- To verify your identity and meet anti-money-laundering, sanctions and record-keeping duties (legal obligation — Swiss Anti-Money Laundering Act, AMLA).
- To protect the Services against fraud and abuse (legitimate interest).
- To answer your requests and send service messages (contract / legitimate interest).
- To improve the Services using aggregated statistics (legitimate interest).
We do not sell your personal data and we do not use it for automated decisions with legal effect other than fraud and sanctions screening, which is always reviewable by a person.
5. International transfers
Data is stored primarily in Switzerland and the European Economic Area. Where data is transferred to a country without an adequate level of protection, we rely on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission.
6. How long we keep it
Verification and transaction records are kept for 10 years after the end of the business relationship, as required by AMLA. Other data is deleted or anonymised when no longer needed, usually within 24 months after account closure.
7. Security
Identity documents are stored encrypted, outside publicly accessible systems, with access limited to authorised compliance staff. Passwords are hashed with scrypt. All traffic is encrypted with TLS.
8. Your rights
Subject to legal limits, you have the right to access, rectify, delete or receive a copy of your data, to object to or restrict processing, and to withdraw consent. Where we must keep data under AMLA, deletion is postponed until the retention period ends.
You may lodge a complaint with the FDPIC (edoeb.admin.ch) or, in the EEA, with your local supervisory authority.
9. Changes
We will publish any update on this page and notify you of material changes.