Privacy Policy

Digital Access, LLC

Purpose and Objectives

This policy reaffirms and formalizes Digital Access, LLC’s (“DA”) realization of and respect for the privacy expectations and rights of our customers regarding financial information and other related information, which DA has or gathers in the normal course of business. It is intended to provide guidance to DA personnel with respect to the physical safeguarding of information, as well as assurance to our customers. The rules apply only to information about individuals who obtain financial products or services to be used for personal, family or household purposes. Therefore, the rules do not apply to information about businesses, corporations, partnerships or similar entities or about individuals who obtain financial products or services for business purposes. Attempts to identify all customers or signers will be made prior to the release of information. We will also act in compliance with all applicable laws and regulations.

This policy applies to:

Employees
Any organization or individual with whom we have a contractual or fiduciary relationship
Information in all forms, including oral, written, image and electronic
Physical and logical (non-physical) protection
All modes of information processing, including but not limited to, manual methods, hardware and software networks, other devices and information disposal techniques
Information used by DA which originates outside including, but not limited to, vendors, contractors, customers, regulators, other enterprises and the public domain.
DA’s information resources used by, shared by or in the custody of others
Proper disposal of customer information and consumer information

NOTE: This statement of scope should not be interpreted to mean that all information resources must be protected equally.

DA expects that our processing partners will provide no less a level of customer privacy protection than that provided by DA. Conversely, DA will make every reasonable effort to apply the required level of customer privacy protection to partner information resources in our custodianship. These agreements should be concluded before accepting information resources from third parties.

RESPONSIBILITY

The Board of Directors has the ultimate responsibility to appropriately establish and maintain this policy and assure that it is being observed in the daily operations of DA. The Compliance Team is responsible for carrying out this policy and making recommendations to the Chief Executive Officer (“CEO”) as to necessary or desirable changes to the policy.

PRIVACY PRINCIPLES

DA recognizes the following eight elements of its privacy policy:
Recognition of Costumer’s Expectation of Privacy
Use, Collection and Retention of Customer Information
Maintenance of Accurate Information
Limiting Employee Access to Information
Protection of Information via Established Security Procedures
Restrictions on the Disclosure of Consumer Information
Maintaining Customer Privacy in Business Relationship with Third Parties
Disclosure of Privacy Principles to Customer

RECOGNITION OF CUSTOMER’S EXPECTATION OF PRIVACY

Customers are entitled to the absolute assurance that the information concerning their financial circumstances and personal lives, which DA has obtained through various means, will be treated with the highest degree of confidentiality and respect. Certain expectations of privacy also contain legal rights of customers which are either granted or confirmed to them through various federal and state laws and regulations. All employees are directed by this policy to assure customers of DA’s commitment to preserving the privacy of their information. DA will post a notice on its website, which contains an abbreviated version of this policy. A notice will be given to any potential customer or current customer upon request.

STANDARDS OF ADMINISTRATIVE, TECHNICAL & PHYSICAL SAFEGUARDS

Each department will secure information from unauthorized viewers or recipients by keeping open work areas free from customer or consumer information when areas are unattended. This includes removing and securing information on computer terminals, written documents on desks or counters or any other means information may be available to unauthorized persons.

USE, COLLECTION AND RETENTION OF CONSUMER INFORMATION

It is the policy and practice of DA to collect, retain and use information about consumers and customers (both individually and corporate) only where DA reasonably believes the gathering of such information would be useful and allowed by law to administer DA’s business and/or to provide products, services or opportunities to its customers.

MAINTENANCE OF ACCURATE INFORMATION

Management is directed to establish procedures to ensure that, to the extent practicable, all customer financial information is accurate, current and complete in accordance with reasonable commercial standards. DA will respond promptly and affirmatively to any legitimate customer request to correct inaccurate information, including forwarding of corrected information to any third party who had received the inaccurate information. DA will further undertake to record such corrective action was requested by the customer and follow up with any third party to ensure that they have received notice of the required correction.

Procedures to ensure customer records are accurate and regularly updated will be maintained. Every opportunity will be given to customers to correct information held at DA. All attempts to have changes of information, addition or deletion will be done in writing whenever possible. Attempts to detect identity theft through unauthorized means will be strictly adhered to.

LIMITATION ON EMPLOYEE ACCESS

Management will take all steps necessary to ensure that only employees with a legitimate business reason for knowing personally identifiable customer information shall have access to such

information. To the extent practicable, access will be limited by computer access codes and grating limited access to areas in which sensitive customer information is retained. Employees will be informed at the time of their initial employment of these standards and will periodically be reminded of these standards during training sessions at least once during each calendar year. Willful violation of this element of this policy will result in disciplinary action against the offending individual. Inadvertent violations will be dealt with in a manner to ensure that such violations are not repeated.

PROTECTION OF INFORMATION

DA will maintain appropriate security standards and procedures to prevent unauthorized access to customer information. Such procedures should prevent access by not only unauthorized employees, but others as well. Such other include but are not limited to, all non-employees with otherwise legitimate reasons for being on DA premises, computer “hackers” and any intruders on DA premises. Unauthorized use of non-public personal information by non-DA employees will be reported under a Suspicious Activity Report (“SAR”) and appropriate notification to law enforcement.

Properly disposing of customer information and consumer information

Customer or consumer Non-public personal information (“NPPI”) will be safeguarded from unauthorized persons during its use within DA. This may be by keeping documents in non-public areas or in locked drawers, locked cabinets, locked offices or locked rooms when these areas could be assessable to non-authorized persons. Documents will be retained for the proper retention period as outlined in DA’s retention schedule and will be destroyed using proper disposal methods either within DA using shredders or placed in locked shred bins for pick up and disposal by our third-party shred/disposal company.

ACCESS OF INFORMATION BY CUSTOMERS AND CONSUMERS

Customers or consumers may access their information only after sufficient identification has been made. When requesting information in person, visual identification documents will be requested, and ownership rights will be verified prior to releasing information.

Customers and consumers who request information over the phone may be refused the information and requested to personally appear so identification may be made or if sufficient information may be obtained to verify the identity which would be any information a customer would know but a thief or other unauthorized person would have to guess.

ATM information access requires a customer-initiated PIN number as well as other authentication information. This PIN is the personal information of the customer and is not to be requested by an employee.

GENERAL RESTRICTION ON THE DISCLOSURE OF CUSTOMER INFORMATION

DA will not, except in cases allowed or required under the law, reveal specific information about customer account or other nonpublic personal information to any nonaffiliated third parties unless the customer has been provided the required privacy disclosure and is given opportunity to decline or opt out.

INCIDENT RESPONSE PROCEDURES

In the event of a breach of customer or consumer non-public information, a report will be submitted to the CEO. The CEO may designate another employee to research and notify the effected customer or consumer of the breach. Refer to DA’s Incident Response Plan for additional information.

BUSINESS RELATIONSHIPS WITH THIRD PARTIES

If DA is requested to provide personally identifiable information to a third party, from which the consumer has no right to opt out, and that request is in all respects consistent with other elements of this policy, DA will accede to the request only if DA believes that the party adheres to similar privacy principles, no less stringent than set forth in this policy, that provide for the keeping of such information confidential.

DA will not enter into an agreement with any entity covered under the first category of exceptions, listed below, without first requiring the entity to maintain the confidentiality of the information to at least the same extent that DA must maintain that confidentiality and limit the third party’s use of the information solely to the purposes for which it is disclosed or as otherwise permitted by law.

DISCLOSURES OF PRIVACY PRINCIPLEAS TO CUSTOMERS

Disclosures of the privacy notice shall be provided to customers initially. The notice may be delivered by hand, by mail, or electronically. If the notice is provided electronically, the consumer must be required to acknowledge receipt as a necessary condition for obtaining a financial product or service.

REQUESTS

All requests for our Privacy Policy will be provided in person upon request if requested in person. If requested by phone, DA will send Privacy Policy within 10 days of the call.

DA will keep the full Privacy Policy Notice posted on our website at https://www.cash2bitcoin.com

Potential customers will receive a Privacy Notice upon request either orally, by mail, fax, e-mail or any other method used to request such policy. Policy will be delivered electronically, by mail, in person or any other means considered reasonable based on the request no later than 10 days of receipt of request.

EXCEPTIONS TO THE OPT OUT REQUIREMENTS FOR

The opt out requirements do not apply if DA chooses to provide nonpublic personal information about a consumer to a nonaffiliated third party to perform services for DA or functions on DA’s behalf, if DA provides the initial notice as required and enters into a contractual agreement with the third party that requires the third party to maintain the confidentiality of the information to at least the same extent that DA must maintain that confidentiality and limits the third party’s use of the information solely to the purposes for which it is disclosed or as otherwise permitted by law.

EXCEPTIONS TO THE OPT OUT REQUIREMENTS FOR PROCESSING AND SERVICING TRANSACTIONS

The requirements for initial notice, for opt out, and for service providers and joint marketing do not apply if DA discloses nonpublic personal information:

As necessary to effect, administer, or enforce a transaction requested or authorized by the consumer.
To serviced or process a financial product or service requested or authorized by the consumer.
To maintain or service the consumer’s account with DA.
In connection with a proposed or actual securitization or similar transaction related to a transaction of the customer.

OTHER EXCEPTIONS TO NOTICE AND OPT OUT REEQUIREMENTS

There are additional exceptions to the “opt out” requirements. The requirements for initial notice, for opt out, and for service providers and joint marketing do not apply when DA discloses nonpublic personal information in the following circumstances:
With the consent or direction of the consumer, provided that the consumer has not revoked the consent or direction.

For the following protective or legal situations:
To protect the confidentiality or security of DA’s records pertaining to the consumer, service, product, or transaction.
To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
For required institutional risk control or for resolving consumer disputes or inquires.
To persons holding a legal or beneficial interest relating to the consumer.
To persons acting in a fiduciary or representative capacity on behalf of the consumer.
To provide information to agencies or person that are assessing DA’s compliance with industry standards, and DA’s attorneys, accountants, and auditors.
To the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978 (12 USC 3401), to law enforcement agencies (including government regulators), self-regulatory organizations, or for an investigation on a matter related to public safety.
In connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of that business or unit.
To comply with federal, state, or local laws, rules, and other applicable legal requirements, specifically:
- To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons be federal, state, or local authorities; or
- To respond to judicial process or government regulatory authorities having jurisdiction over DA for examination, compliance, or other purposes as authorized by law.

EMPLOYEE EDUCATION AND TRAINING

Management is directed to provide a copy of this policy to all DA employees as posted on the website. After any amendments or modifications to this policy have been adopted, a copy of the amended policy will be made available on DA’s website.

RECORD KEEPING AND REPORTING

The Compliance team will maintain a separate file for the purpose of retaining any customer complaints which relate to this policy. The information regarding any complaint should include the exact nature of the complaint, describe the corrective actions taken, and confirm that the corrective actions resolved the complaint.

The Compliance Team will make an annual report, or more frequent, to the CEO concerning customer complaints related to privacy concerns which shall include the frequency and nature of such complaints and corrective action taken. Complaint of nature sufficient to present a risk of regulatory enforcement action and/or civil money penalties are required to be reported if and when they occur.

VERSION HISTORY
VERSION	APPROVED BY	REVISION DATE	DESCRIPTION OF CHANGE	AUTHOR
1.0		02.22.2022	Initial Privacy Policy
1.1		06.14.24	Review and update	Deb Miller