Privacy Policy
==============

Last update: April 2025

This privacy policy describes the guidelines and principles of Taler Operations AG (hereinafter **TOPS**), with
headquarters of the company in Biel/Bienne, Switzerland, in relation to the collection, processing, storage and
disclosure of personal data of visitors to our websites and users of the applications and products provided by TOPS. By
using the websites, applications and products users automatically consent to the legal validity of this privacy policy.

You can find information about our company on the website at www.taler-ops.ch. If you have any questions or concerns
about this privacy policy, please contact us by sending a message to privacy@taler-ops.ch.


Principles
----------

The explicit aim of the payment system based on GNU Taler is to protect the private data of its users. TOPS is
committed to the principles of ‘Privacy by design’ and ‘Privacy by default’ and does not collect any personal data when
using the Taler payment service, nor does it request any personal data or specific personal information for other
purposes. You can therefore rest assured that data protection is guaranteed from the very first use of our applications
(Privacy by design) and remains in place if you retain the applications' default settings (Privacy by default).

No personal data of the payer is required or collected with the payment service provided by TOPS. For technical
reasons, it is not possible to identify individual persons among the payers. Neither the transaction numbers nor the
cryptographic signatures used to authorise transactions allow conclusions to be drawn about the persons who initiate
a payment to the beneficiaries.

If users wish to contact us personally, telephone numbers, email addresses or postal addresses are recorded and stored
only for the purpose and for the duration of the exchange of information. If you would like to report bugs,
improvement requests or errors in applications (e.g. Taler wallets, Taler Merchant Backend, Taler Cashier or Taler
Point-of-sales apps) respectively on our web pages, please use our bug tracker (https://bugs.gnunet.org). You will leave
an email address so that we can get in touch with you if necessary. In the case of support services, we may also need to
collect your contact details such as email addresses, telephone numbers or postal addresses. However, TOPS does not
share this information to third parties unless it is strictly necessary while providing you with our applications and
products or to comply with state or federal laws.


Compliance with data protection legislation
-------------------------------------------

TOPS undertakes to comply with the provisions of applicable data protection law when obtaining, processing and utilising
the personal data of users. Personal data is only collected, processed or passed on by us within the scope of legal or
regulatory obligations. TOPS ensures that the data is handled in accordance with Swiss data protection regulations,
particularly the Federal Act on Data Protection (FADP/DSG) and the Data Protection Ordinance (DPO/DSV).

All system data is primarily hosted in Switzerland, stored redundantly on encrypted hard drives, i.e. with backup
storage, and only accessible to authorised personnel. Authorised personnel are subject to regular security checks.

Know-Your-Customer (KYC) procedures to identify beneficial owners of bank accounts are carried out by external service
providers authorised by TOPS. These service providers are also obliged to process and store the data securely in
accordance with the laws and regulations of the respective country or territory in which the payment service is offered.

TOPS provides users with technical support upon their explicit request. The provision of this support may involve third
parties who have access to the personal data required for communication and are also obliged to comply with data
protection law.


Purpose of data processing
--------------------------

TOPS processes and stores the data absolutely necessary for the provision of the services and in particular personal
data only if this is required for legal or regulatory reasons. Account-holding banks are required by law to implement
Know-Your-Customer (KYC) procedures in order to be aware of the beneficial owners of the bank accounts that transfer
funds to the payment service operated by TOPS for the purpose of topping up Taler wallets, and also to know the
beneficial owners of the bank accounts to which the payment service transfers funds for the purpose of payment to
beneficiaries. TOPS only processes and stores the account numbers and names of the account owners who transfer money to
the payment service and of the account owners to whom the payment service transfers funds. TOPS also learns the
withdrawal amount wired to the payment service for the purpose of topping up Taler wallets and the amount of aggregated
transfers wired to the beneficiaries' bank accounts.

Duration of data storage
------------------------

The business relationship between TOPS and beneficiaries (merchants, businesses and other regular recipients of
transfers from the payment service to the beneficiary accounts) is concluded for an indefinite period. If no
transactions are made to the beneficiaries for more than 12 months, the business relationship is automatically
considered terminated. In addition, TOPS retains the collected data of the beneficiaries for the duration required by
legal or regulatory provisions such as Anti-Money Laundering (AML) laws, fiscal code and laws regulating the
identification of beneficial owners.

If users are unable to make a withdrawal to a Taler wallet or if wallet funds are to be balanced and deposited, TOPS
will transfer funds back to the original bank account. TOPS also stores the data required for this purpose for the
duration prescribed by legal or regulatory provisions.


Forwarding of data
------------------

TOPS assumes that Taler wallets do not transmit any personal data, at least not without the conscious and informed prior
consent of the user. If TOPS forwards personal data, then only the names of account owners, bank account numbers and
the amount of transfers wired to beneficiary accounts. If necessary, TOPS may pass this data on to the competent
authorities and auditors. Beneficiaries must assume that their personal data will be processed, stored and disclosed by
TOPS on the basis of legal or regulatory provisions, and that their data is processed and passed on on the basis of
legal or statutory provisions, e.g. to comply with the fiscal code and statutory retention obligations.

If users contact us personally or make use of support services, TOPS reserves the right to pass on the personal data
required for this purpose to employees, contracted service providers or authorized contractors.


Updating this privacy policy
----------------------------

TOPS may amend and update this privacy policy at any time, the date at “Last update” will then change. Updates are
made, for example, as a result of changes in legal or regulatory provisions or due to developments in the industry.

TOPS cannot directly inform users about updates to the privacy policy because, in principle, no personal contact data is
collected that could be used to inform users of websites, applications and products. However, the Taler wallets may
inform you when they notice an update to the privacy policy.

Please read this privacy policy carefully and repeatedly to stay informed about its existing content and any changes.

This privacy policy and its updates are not part of any contract, but are implied by the use of our websites,
applications and products. If you have any questions or concerns about this privacy policy, please contact us by
sending a message to privacy@taler-ops.ch.


Applicable law and place of jurisdiction
----------------------------------------

To the extent permitted by law, all legal relationships between TOPS and users shall be governed exclusively by
substantive Swiss law, excluding conflict of laws and international treaties. Subject to any mandatory statutory
provisions to the contrary, Biel is the exclusive place of jurisdiction and the place of performance. For users and
beneficiaries domiciled outside Switzerland, Biel/Bienne is also the place of debt collection.
