GDPR | TBSO

Last updated: 4 December 2025

This Privacy Policy is intended to inform users of The Bitcoin Society website (the “Site”) about how Société de Tayninh, a public limited company (société anonyme à conseil d'administration) with its registered office at 10 Rue de la Bourse, 75002 Paris, France, registered with the Paris Trade and Companies Register under number 562 076 026, acts as data controller in the processing of personal data.

This Privacy Policy describes the information collected, the purposes for which it is processed, the retention periods, users’ rights, and the measures implemented to ensure the protection of personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French legislation.

1. Information We Collect

We may collect and process the following categories of personal data:

1.1 Information You Provide Directly

This includes, in particular, the following personal data:

Information required for registration to the services provided on our Site. This includes your first and last name, postal address, date of birth, email address, and a password.
This information is mandatory. If you do not provide it, The Bitcoin Society will be unable to provide the services offered, and you will not be permitted to create an account on the Site.

‍1.2 Cookie Usage Policy

The following types of cookies may be placed on the user’s browser (Internet Explorer, Google Chrome, Firefox, Safari, Opera, etc.):

Session cookies, enabling the retention of information entered into any forms made available by the Data Controller;
Authentication cookies, enabling the tracking of user login credentials;
Personalisation cookies, enabling the adaptation of the Site’s display according to the user's preferences;
Analytics cookies, enabling us to understand Site usage and performance, and to improve its content.

If the user refuses the use of cookies, they may not be able to access or use all services available on the Site.

‍2. Legal Bases and Purposes of Personal Data Processing

We collect and process your data for the following purposes:

Provision of services, based on the performance of a subscription contract you have entered into;
Access to and use of our websites;
Operation and security of the Site: we process your data to adapt the Site display to your device, preferences, and browsing behaviour, and to improve its features. These processing activities are necessary for our legitimate interests in providing you with a personalised and optimal experience and ensuring the Site’s proper functioning and security;
Responding to information requests and complaints, based on our legitimate interest in responding to inquiries relating to our services or those of Group companies in accordance with the Site’s terms of use;
Sending newsletters, based on our legitimate interest in retaining and informing our customers of the latest news from the Company and/or Group entities;
Communicating updates, features and special offers;
Maintaining a client and prospect database, based on our legitimate interest in developing and promoting our activity and that of Group companies;
Managing GDPR rights requests, in order to comply with our legal and regulatory obligations.

3. Data Retention Periods

3.1 General Retention Rules

Except for the categories of personal data referred to in sections 3.2 and 3.3 below, your personal data will be archived as follows:

5 years after your last use of our Site, if you have not closed your account;
1 year after you close your account, unless a report has been filed, in which case your personal data will be retained for 2 years following the last report, if this period is longer.

3.2 Financial Data

Financial information (e.g., payments, refunds) is retained for the period required by applicable tax and accounting laws.

3.3 Suspended or Blocked Accounts

If your account has been suspended or blocked, we retain your personal data for 2 to 10 years from the date of suspension in order to prevent attempts to circumvent the Site’s rules.

Personal data relating to a prospect (non-customer) may be retained for 3 years from collection or the last contact from the prospect. At the end of this 3-year period, we may contact you again to determine whether you wish to continue receiving marketing communications.

4. Where Your Data Is Processed

As of the date of this Privacy Policy’s update, your personal data is processed within the European Union.

However, because some of our service providers (such as Circle or Stripe for online payments) are located outside the European Union (“third countries”), we may transfer certain personal data to third countries.

This may include transfers to countries that the European Commission has not recognised as providing an adequate level of protection. In such cases, we ensure that transfers comply with applicable regulations and guarantee an adequate level of protection of privacy and fundamental rights (notably through the use of the European Commission’s Standard Contractual Clauses).

5. Your Rights Regarding Your Data

You have the following rights with respect to your personal data:

Right to information: as set out in Articles 13 and 14 of the GDPR;
Right of access: at any time, in accordance with Article 15 GDPR;
Right to rectification: to correct inaccurate, incomplete, or outdated data, in accordance with Article 16 GDPR;
Right to restriction of processing: in the cases set out in Article 18 GDPR;
Right to erasure (“right to be forgotten”), under Article 17 GDPR;
Right to lodge a complaint with a competent supervisory authority (in France, the CNIL), under Article 77 GDPR;
Right to define instructions regarding the retention, erasure, and communication of your data after death, pursuant to Article 40-1 of the French Data Protection Act;
Right to withdraw consent at any time, where processing is based on consent, under Article 7 GDPR. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal;
Right to data portability, under Article 20 GDPR, allowing you to receive your data in a structured, commonly used and machine-readable format and to request its transmission to another controller;
Right to object, under Article 21 GDPR. Note that processing may still be maintained if justified by compelling legitimate interests or for the establishment, exercise, or defence of legal claims.

You may exercise these rights by contacting us at the details provided below. We may request additional information or documentation to verify your identity.

We must respond within one month from receipt of your request. If the request cannot be fulfilled immediately, you will receive an acknowledgment of receipt. If the request is incomplete, we may request further information, in which case the response period will be suspended until the information is provided.

Access to these rights is free of charge. In certain cases, reasonable fees may be charged (e.g., additional copies or complex requests).

If you are not satisfied with the resolution of your request, you may lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés).

6. Contact for Data Protection Matters

Data Protection Officer contact email: society@tbso.com
Legal entity: Société de Tayninh
Company registry: Paris Trade and Companies Register
Registration number: 562 076 026
Head office: 10 Rue de la Bourse, 75002 Paris
General contact email: society@tbso.com

7. Changes to This Policy

We may amend this policy at any time, particularly to comply with regulatory, case law, editorial, or technical developments. Such amendments will apply as of the effective date of the updated version.
You are therefore invited to consult the latest version regularly. However, we will inform you of any significant changes to this Privacy Policy.