UAB Lawrence OAMP Privacy Policy

UAB Lawrence OAMP (Rain, we or us) is committed to maintaining the confidentiality, integrity, and security of any information about our users and clients. This privacy policy (Privacy Policy) set forth by Rain explains your privacy rights and how Rain collects, stores, and uses information collected in connection with your use of Rain’s products and services set out in the Client Agreement, which may be accessible through this website (Site) and the associated mobile application (Application) (collectively, the Services). Capitalized terms not otherwise defined in this Privacy Policy shall have the meanings ascribed to them in our Client Agreement. 

BY USING AND/OR OPENING AN ACCOUNT OR SIGNING IN TO RAIN, YOU CONFIRM AND UNDERSTAND THAT YOUR PERSONAL DATA WILL BE PROCESSED BASED ON THIS PRIVACY POLICY, AS IT MAY BE AMENDED FROM TIME TO TIME. YOU ARE NOT PERMITTED TO ACCESS THE PRODUCTS AND/OR SERVICES ON OUR SITE OR APPLICATION IF YOU DO NOT FULLY AGREE TO THE PRIVACY POLICY. BY ACCESSING THE SERVICES, YOU BECOME LEGALLY BOUND BY THIS PRIVACY POLICY.

We process your Personal Data in accordance with applicable legislation, including the Regulation (EU) 2016/679 (General Data Protection Regulation) (GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.  

This Privacy Policy describes what Personal Data we collect, how we obtain it, on what basis and for what purposes we use your Personal Data, how we use it, how long we store your Personal Data, who we share your Personal Data with, how we protect your Personal Data and your rights regarding your Personal Data. By using the Services, you acknowledge and understand that your Personal Data will be processed as described in this Privacy Policy. 

What is Personal Data

Personal Data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collectively can lead to identification of a particular person, also constitute Personal Data. 

We distinguish between information that does not directly or indirectly identify you, including anonymized information that we collect to inform us how others use the Services (non-Personal Data), and personally identifiable information that identifies you as an individual (Personal Data). Once you register and give us your Personal Data, you are no longer anonymous to us. If you choose to provide personal, payment processing or business information, you understand and agree that your Personal Data will be transferred and stored on third-party servers. These servers are located in Frankfurt, Germany. However, in certain situations we may need to use servers located in other areas due to the legal requirements of the specific jurisdictions. We will notify you of additional server locations by updating this Privacy Policy. We may use third-party services to collect and store personal, payment processing and business information. 

How we process your Personal Data:

For management and administration of the Account created to access Services or parts of the Services.

• Categories of Personal Data: email address; phone number; full legal name; date of birth; nationality; dual nationality (if applicable); residential address; domicile address (if separate to residential address); purpose of relationship/primary use of rain; experience in trading or virtual asset trading; expected transaction frequency/size; place of birth; IP address (geo location); employment status; business activity (if self employed business owner or non-business owner); jurisdiction of business incorporation (if self employed business owner); name of legal entity (if self employed business owner); source of funds; source of wealth (verification document required) (if applicable); source of funds (verification document required) (if applicable); approximate annual income (if applicable).

• Retention period: this Personal Data will be stored for up to 5 years after last usage of the data. Personal data collected for the implementation of the obligations under the Law on the Prevention of Money Laundering and Terrorist Financing of the Republic of Lithuania (PMLTF) shall be stored in accordance with the PMLTF for up to 8 years. The retention period may be extended for a period not exceeding 2 years, provided there is a reasoned request from a competent authority. 

• Legal basis for processing: necessary for the provision of the Services; complying with legal requirements; and/or in some instances, based on your consent.

We may, through our third-party service providers, collect and store Personal Data. 

• Categories of Personal Data: name, email address, telephone number, fax number, mailing address, billing address; date of birth, government and/or tax identification number(s) or other proof of identity (e.g., driver’s license, passport, etc.); transactional information and metadata based on your use of Rain (such as orders, trades, fiat currency account balances, Virtual Asset account balances, transaction history, correspondence submitted by you to us and other content that you generate that relates to your Account); information from your interaction with Rain (such as computer and connection information, page views, keywords searched, IP address, and other statistics on site usage); information from third parties (for example, if you incur a debt to us as a seller, we may run a credit check by obtaining additional information about you from a credit bureau, as permitted by law); and/or other data required for the proper customer identification for AML/CTF purposes.

• Retention period: this Personal Data will be stored for as long as necessary to fulfill the purposes for which the Personal Data was collected.

• Legal basis for processing: necessary for the provision of the Services; complying with legal requirements; and/or based on Rain’s legitimate interest.

We may, directly or through our third-party service providers, collect and store financial information relating to individual or institutional users.

• Categories of Personal Data: institutional legal name and proof of legal existence (e.g., government-approved incorporation, formation or other organizational documents); employer identification number (EIN) or any comparable identification number issued by a government; Personal Data set forth above relating to all account signatories and beneficial owners; and/or the name of your financial institution, account types, routing numbers and account numbers.

• Retention period: Personal Data collected for the implementation of the obligations under the PMLTF shall be stored in accordance with the PMLTF for up to 8 years. The retention period may be extended for a period not exceeding 2 years, provided there is a reasoned request from a competent authority.

• Legal basis for processing: necessary for the provision of the Services; complying with legal requirements; and/or based on Rain’s legitimate interest.

We may, directly or through our third-party service providers, collect and store the following additional information relating to your Account.

• Categories of Personal Data: Account activity, including order activity, trading activity, deposits, withdrawals, and Account balances; correspondence and information you provide to us or other users, including opening an Account, ongoing customer support or other correspondence transmitted on Rain; and/or electronic communications data and voice data.

• Retention period: this Personal Data will be stored for up to 3 years following the receipt of such data.

• Legal basis for processing: based on Rain’s legitimate interest; and/or in some instances, based on your consent.

To improve the quality of the Services and ensure their proper operation and security. 

• Categories of Personal Data: device properties, including, but not limited to, type, IP address, media access control (MAC) address and unique device identifier or other persistent or non-persistent device identifier (Device ID); device software platform, operating system, type of Internet browser, and firmware; and/or the way in which you use the Services, including frequency and duration of usage.

• Retention period: this Personal Data will be stored for up to 3 years following the receipt of such data from our third-party service providers.

• Legal basis for processing: Rain’s legitimate interest.

Purpose of processing, use and disclosure of Personal Data

Our primary purpose in collecting Personal Data is for performance of the Services, including to provide you with a safe, smooth, efficient, and customized experience. Rain processes, uses and discloses your Personal Data only as follows: 

• To analyze Rain usage and improve the Services, based on the ground of Rain’s legitimate interest;

• To deliver to you any administrative notices, alerts and communications relevant to your use of the Services, based on the ground of performance of the contract concluded between you and Rain or your consent;

• To fulfill your orders and settle trades, including to receive or distribute fiat currency to and from your financial institution, on the ground of performance of the contract concluded between you and Rain;

• For market research, project planning, troubleshooting problems, and detecting and protecting against error, fraud or other criminal activity, based on the ground of Rain’s legitimate interest;

• To third-party contractors that provide services to Rain and are bound by privacy restrictions, based on the ground of Rain’s legitimate interest and performance of a contract;

• To enforce Rain’s Client Agreement, AML Procedures, or other contracts to which you have agreed to be bound by, either in writing or by virtue of your use of the Services, based on the ground of Rain’s legitimate interest and performance of a contract; and/or

• As otherwise set forth in this Privacy Policy. 

Rain will not aggregate and share your information for profit, or with non-profit organizations for research, analysis, or other uses. Rain reserves the right to retain your records, including Personal Data and non-Personal Data, following termination of your Account for regulatory compliance. 

Any information that you provide, including any data collected by using cookies, may be shared with third parties (data processors), which provide Rain with services and act on its behalf (e.g. companies providing marketing / advertising services, IT service providers, accounting service providers, etc.). Rain will ensure that processing of Personal Data by such third parties will be based on legitimate legal grounds and will be performed in accordance with the lawful instructions of Rain and in compliance with the GDPR and other applicable legal and regulatory requirements.

Rain may share Personal Data with the following categories of third parties (data processors/sub-processors, data recipients or individual data controllers) as necessary:

• our affiliates (i.e. subsidiaries, joint venture partners or group companies);

• courts, arbitrators, mediators, opposing party and their lawyers (if needed for legal proceedings);

• police, law enforcement authorities, tax authorities, other government, or municipal institutions;

• our professional advisers such as lawyers or accountants (if needed for the protection of our legitimate interests);

• service providers who provide information technology and system administration services, marketing, accounting, postal or courier or other services;

• other natural or legal persons where this is related to and necessary for the organizational changes of Rain (e. g. in the event of merger, acquisition, or sale of Rain assets (as a whole or in part), your Personal Data could be shared with auditors or other representatives of the potential acquirers and transferred to the final acquirer. Please note that in the latter situation the data controller of your Personal Data could become the final acquirer; and/or 

• other persons or entities if needed to provide you with Services as effectively as possible.

As detailed above, we may disclose your Personal Data as required by law, such as to comply with a subpoena, or similar legal process and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.  

Cross-border data transfers  

Rain will not transfer your Personal Data to countries outside the EU/EEA, unless this is deemed necessary and in compliance with the requirements of the GDPR and other applicable laws. Rain makes every effort to ensure that such data transfers comply with the requirements of the GDPR and implements appropriate technical and security measures to ensure that your Personal Data remains safe. Whenever we transfer any Personal Data outside the EU/EEA, we will put in place transfer mechanisms recognized by the relevant authorities or courts as providing an adequate level of protection or appropriate safeguards for Personal Data to ensure that any such data transfers comply, and are consistent with the GDPR and applicable laws, including the use of Standard Contractual Clauses approved by the European Commission. You may find out more about such measures by contacting us directly as indicated in the “Contact us” section below. 

Virtual Assets are not anonymous

Virtual Assets are not anonymous. Virtual assets and IP addresses are published on a decentralized network ledger or blockchain. Such information may be correlated with information we and others may have, even if others were not involved in a blockchain transaction. This means that others may be able to see the balance or transaction history of any Virtual Assets using tools or third party analytical software to automatically collect and use non-Personal Data in the same manner we do. Rain uses blockchain analytics as a tool to protect its products and Services from being used for illegal uses or prohibited uses as listed in our Client Agreement and for research and development purposes.

Data storage

Rain maintains reasonable procedures to help ensure that Personal Data is reliable for its intended use, accurate, complete, and current. To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means. Also: 

• we will only retain your Personal Data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements, as well as other factors required by the GDPR, Lithuanian laws or other laws to which we are subject; 

• we may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you;

• when it is no longer necessary to retain your Personal Data, we will securely delete it, subject to applicable laws and regulations;

• we may anonymize your Personal Data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you; and

• if you exercise your user rights, we will retain the minimum required amount of data to keep a record of your requests and the action we took to resolve it.

User rights

Right of access – you have the right to obtain from Rain confirmation as to whether your Personal Data is being processed and to access the information about how Rain processes your Personal Data, as well as to receive the copy of your Personal Data;

Right to rectification – you have the right to obtain from Rain the rectification of your inaccurate Personal Data. You also have the right to have incomplete Personal Data completed, also by providing a supplementary statement;

Right to erasure – you have the right to obtain from Rain the erasure of your Personal Data, if conditions established in Article 17 of the GDPR are met. Please note that Article 17(3) of the GDPR establishes some exceptions for such cases where processing is necessary. If they are applied in your case, we will inform you about them accordingly.

Right to restriction of processing – you have the right to obtain from Rain restriction of processing if conditions established in Article 18 of the GDPR are met. Where processing has been restricted, such Personal Data shall, except for storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

Right to data portability – you have the right to receive your Personal Data, which you have provided to Rain, in a structured, commonly used, and machine-readable format and have the right to transmit this data to another controller where technically feasible, if:

• the processing is based on a consent or on a contract, and

• the processing is carried out by automated means.

Right to object – you have the right to object at any time to processing of your Personal Data for the purposes of the legitimate interests of Rain, including profiling based on those provisions.  Rain will no longer process the Personal Data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims. Where you object to processing for direct marketing purposes, the Personal Data shall no longer be processed for such purposes. 

Right to withdraw the consent – if the processing of your Personal Data is based on your consent, you have the right to withdraw this consent at any time. Your withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority – you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your Personal Data infringes the GDPR. Lithuanian supervisory authority is Lithuanian State Data Protection Inspectorate, address L. Sapiegos str. 17, 10312 Vilnius, Lithuania, e-mail ada@ada.lt, website https://vdai.lrv.lt/. Please contact us before lodging a complaint to the relevant supervisory authority and express your concerns or questions to us. We will do our best to assist you with all your queries.

Please submit your requests through the manner mentioned in the “Contact us” section. In your request, you must specify your identity (which we may ask you to confirm) and the right you wish to exercise. We may refuse to exercise your rights listed above, except for refusal to process your Personal Data for the purposes for which we need to have your explicit consent. Please bear in mind that you can always revoke your consent.

Upon receipt of your request or instruction regarding the processing of Personal Data,  we will provide a response and perform the actions specified in the request or inform you why we refuse to perform them no later than within 1 month from the date of the request. If necessary, the specified period may be extended by a further 2 months, considering the complexity and number of requests. In such a case, we will inform you of such extension within 1 month from the date of receipt of the request.

If the Personal Data or other Account information on file for you changes, or if you no longer desire our Services, you may correct or update it by making the change on your Account information page or by emailing us at the contact information provided in the “Contact us” section below. 

Cookies and tracking technologies

A cookie is a small text file that is stored on a user’s computer for record-keeping purposes. We use cookies, tags, web beacons, local shared objects, files, tools, and programs to obtain the foregoing information for use in our records, to store your preferences, and improve our advertising. You can disable cookies in your web browser at any time, but some functionality of our Site and/or Application may be impaired if you disable cookies. To collect such Personal Data, we may use tools or third-party analytical software to automatically collect and use such Personal Data. 

We do not link the information we store in cookies to any Personal Data you submit while on Rain. We use both session ID cookies and persistent cookies. A session ID cookie expires when you close your browser. A persistent cookie remains on your hard drive for an extended period. You can remove persistent cookies by following directions provided in your Internet browser’s “help” directory. 

Necessary cookies are necessary for the proper functioning of the Site and unnecessary cookies are optional. If you reject unnecessary cookies, you will still be able to use Rain. The use of cookies by our partners, affiliates, tracking utility company, service providers is not covered by our Privacy Policy. We do not have access or control over these cookies. Our partners, affiliates, tracking utility company, service providers use session ID cookies to make it easier for you to navigate our site. To get more information on how to manage cookies please visit https://www.allaboutcookies.org/verify.  

Third parties

Except as otherwise expressly included in this Privacy Policy, this document addresses only the use and disclosure of information we collect from you. If you disclose your information to others, whether they are members or partners of Rain or other sites throughout the Internet, different rules may apply to their use or disclosure of the information you disclose to them. Rain does not control the privacy policies of third parties, and you are subject to the privacy policies of those third parties where applicable. We encourage you to ask questions before you disclose your Personal Data to others.

Closing an Account

Upon your request and if you do not have an outstanding balance due on your Account, we will close your Account as soon as reasonably possible, based on your Account activity and in accordance with Applicable Laws and the terms of our Client Agreement. We do retain Personal Data from closed Accounts to comply with law, prevent fraud, collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigations, enforce our Client Agreement, and take other actions otherwise permitted by law. 

Security

We follow generally accepted physical, electronic, and procedural safeguards consistent with the type of Personal Data or non-Personal Data that we collect, process and maintain. We use various technical and organisational security measures to protect the information we collect, as appropriate to the type of information, including encryption, firewalls, and access controls. We also limit access to this information to authorized employees and contractors who need to know that information in order to operate, develop or improve our products and Services. However, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security. If you have any questions about security on our products and Services, please contact us. 

Changes to this Privacy Policy

We may modify or update this Privacy Policy from time to time. Where changes to this Privacy Policy will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you notice of this. We encourage you to periodically review this page for the latest information on our privacy practices. 

Contact us

The data controller under this Policy is UAB Lawrence OAMP (legal code: 305999113, address: Upės g. 23-1, Vilnius). If you have any questions about our Privacy Policy, you may contact us at support.rain.com. Please be aware that any unsolicited information or communications you submit to us will not be considered confidential or proprietary and we will not have any obligations with respect to such under this Privacy Policy.

Children’s privacy

Rain does not knowingly solicit data from or market to children under the age of 14. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us at the information provided in the “Contact us” section above. Rain will delete such information from our files within a reasonable time.  

Disputes and legal proceedings

Rain may process all the above Personal Data for the purpose of presenting, enforcing or defending against legal claims. For this purpose, we will process Personal Data based on our legitimate interest of presenting, enforcing or defending against legal claims. We will process them for this purpose for 1 year following the full end of the relevant legal proceedings (for example, the final decision of court or arbitration).

We regularly review our compliance with this Privacy Policy. If we receive a formal written complaint from you, we will attempt to contact you directly to address any of your concerns. We will cooperate with the appropriate governmental or regulatory authorities to resolve any complaints regarding the collection, use, transfer, or disclosure of information that cannot be amicably resolved between you and Rain. The Services are governed by the laws of Lithuania. Any dispute, controversy or claim arising out of or relating to this Privacy Policy, or the breach, termination or validity thereof shall be finally settled pursuant to the terms of the Client Agreement.