Kraken Privacy Policy & Data Protection Notice

This Privacy Policy applies to all services, applications, websites, and digital properties operated by Kraken, including our mobile applications, API interfaces, and institutional trading platforms. By accessing or using our services, you acknowledge that you have read, understood, and agreed to the data protection practices described in this comprehensive document.

If you do not agree with any provision of this Privacy Policy, you must immediately cease using our services and contact our support team to initiate the closure of your account. We periodically review and update this policy to reflect changes in our technological infrastructure, legal obligations, and industry best practices. Significant modifications will be communicated to all active users via email and prominent platform notifications at least 30 days prior to their implementation.

Our commitment to privacy extends beyond mere compliance; we actively participate in industry working groups to develop forward-thinking privacy standards for the broader cryptocurrency ecosystem. Your trust is our most valuable asset, and we are dedicated to protecting it.

What Information We Collect

Personal information collection involves acquiring data such as your name, contact details, government-issued identification, and transaction history. This data is strictly utilized for identity verification and anti-money laundering compliance required by global financial authorities.

When you register for a Kraken account, we collect direct identifiers including your full legal name, date of birth, residential address, email address, and phone number. To satisfy rigorous Know Your Customer (KYC) regulations, we also mandate the submission of high-resolution images of government-issued identity documents, such as passports or driver's licenses, alongside biometric facial recognition data for liveness verification.

Furthermore, we automatically collect technical data regarding your interaction with our platform. This includes your IP address, browser type, operating system, device identifiers, and granular logs of your trading activities. We also monitor blockchain transaction data associated with the wallet addresses you utilize to deposit or withdraw digital assets, utilizing advanced chain-analysis tools to ensure platform integrity and prevent illicit activities.

How We Use Your Information

Data utilization refers to the specific operational, security, and legal purposes for which your personal information is processed. We use your data to authenticate your account, process complex trades, and proactively detect fraudulent activities before they impact your portfolio.

The primary purpose of processing your data is the execution of our core financial services. When you place a trade, we utilize your account information to match orders, calculate fees, and settle balances across our internal ledgers. Without this essential data processing, the operation of a high-frequency cryptocurrency exchange would be technically impossible and highly insecure.

Additionally, we leverage sophisticated machine learning algorithms to analyze user behavior patterns and transaction histories. This processing is dedicated entirely to risk management and security enforcement. By establishing a baseline of your typical platform activity, our systems can automatically flag anomalous login attempts or suspicious withdrawal requests, triggering secondary authentication protocols to protect your assets from unauthorized access.

Information Sharing and Disclosure

Information sharing describes the limited circumstances under which we may transmit your data to trusted third-party service providers or legal authorities. We never sell your personal information to marketing agencies, data brokers, or unauthorized external entities under any circumstances.

We share your data strictly with vetted enterprise partners who provide essential infrastructure for our platform. This includes cloud hosting providers, identity verification services, banking partners facilitating fiat currency transfers, and cybersecurity firms conducting continuous threat monitoring. All third-party vendors are bound by stringent data processing agreements that prohibit them from using your information for any purpose other than fulfilling their contractual obligations to Kraken.

In certain situations, we are legally compelled to disclose personal information to law enforcement agencies, regulatory bodies, or tax authorities. We only comply with such requests when presented with a valid subpoena, court order, or formal regulatory directive. Our legal team meticulously reviews every external data request to ensure it is legally sound and appropriately narrow in scope before any information is released, actively challenging overly broad demands.

Your Data Protection Rights

Data protection rights are the legal entitlements granted to users, allowing them to control, access, or delete their personal information held by our organization. You have the right to request a comprehensive copy of your data or demand its erasure under applicable privacy laws such as the GDPR and CCPA.

Depending on your jurisdiction, you possess the right to access the personal information we hold about you, the right to rectify any inaccuracies in that data, and the right to object to specific types of automated processing. You may also request the restriction of processing while a dispute regarding data accuracy is being resolved. We are committed to honoring these rights globally, regardless of your specific country of residence, applying the highest standards of data protection universally across all our markets.

To exercise any of these rights, users must submit a formal request through our secure privacy portal. Our dedicated compliance team will verify your identity to ensure that sensitive data is not inadvertently disclosed to malicious actors, and will process your request within 30 calendar days, entirely free of charge.

International Data Transfers

International data transfers occur when your personal information is routed through or stored on servers located outside of your primary country of residence. We employ standard contractual clauses, binding corporate rules, and end-to-end encryption to protect your data during cross-border transit.

As a global cryptocurrency exchange, Kraken operates data centers and support facilities across multiple continents. Consequently, your personal information may be transferred to, and processed in, the United States, the European Union, and other jurisdictions where our enterprise infrastructure is located. These regions may have data protection laws that differ from those in your home country.

To ensure continuous protection during these transfers, we implement robust legal and technical safeguards. For users residing in the European Economic Area (EEA) or the United Kingdom, we rely on the European Commission's approved Standard Contractual Clauses to legitimize the transfer of personal data to our global affiliates and service providers, guaranteeing that your data receives an equivalent level of protection regardless of its physical location.

Data Retention Periods

Data retention periods define the specific duration for which we are legally required to store your personal information after your account is closed. Financial regulations mandate that we retain certain transaction records and identity verification documents for a minimum of five years to prevent financial crimes.

We do not retain your personal data indefinitely. Our retention schedules are strictly aligned with our statutory obligations under global anti-money laundering (AML) and counter-terrorism financing (CTF) laws. Once an account is formally closed and all pending transactions are settled, your data enters a highly restricted archive state, rendering it inaccessible to general customer support staff.

During this archiving period, your information is isolated from our active production databases and is accessible only to a select group of compliance officers for the sole purpose of responding to lawful regulatory inquiries. Upon the expiration of the legally mandated five-year retention period, your personal data is permanently and cryptographically destroyed, ensuring it can never be recovered or reconstructed by any party.