Privacy Policy

Last updated: 13 June 2025

1. Introduction

Ethereal Tech Pte. Ltd. (operating as “BitFuFu,” “we,” “us,” or “our”), a Singapore company, operates the websites at bitfufumininggroup.com and related domains, mobile applications, and services (collectively, the “Platform” or “Services”). BitFuFu is a Bitcoin mining and mining-services provider offering cloud mining, miner sales, hosting, mining pool services, and related products.

We are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you visit or use our Platform, register an account, purchase cloud mining contracts or miners, use our mining pool or apps, or otherwise interact with us.

This Policy complies with applicable laws, including the Singapore Personal Data Protection Act 2012 (PDPA), the EU General Data Protection Regulation (GDPR) where applicable, and other relevant data-protection frameworks. By using our Services, you acknowledge that you have read and understood this Policy.

If you provide personal data of third parties (e.g., family members or colleagues), you must ensure they are aware of this Policy and that you have the right to share their data.

2. Data Controller / Responsible Party

The data controller is:

Ethereal Tech Pte. Ltd.
Singapore

For data-protection inquiries, contact:
Email: [email protected]

3. Personal Data We Collect

We collect the following categories of personal data:

3.1 Information You Provide Directly

• Account registration and profile data: name, email address, username, password (hashed), phone number, date of birth, nationality, residential address, and other identification details.
• KYC / AML verification data: government-issued ID (passport, national ID, driver’s license), selfie/photo, proof of address, source-of-funds or source-of-wealth information, and related documents required for compliance.
• Transaction and service data: purchase history of cloud-mining contracts or miners, wallet addresses (for BTC payouts), payment details (crypto or fiat), order information, and communication records with support.
• Communications: messages, inquiries, feedback, or support tickets you send us.
• Event or promotional registrations (if any): name, email, company details, and related information.

3.2 Information Collected Automatically

When you visit or use the Platform (website or app):

• Technical and device data: IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, time spent, clickstream data, and approximate location (derived from IP).
• Log data and usage data: server logs, access times, error logs, and interaction data with features (e.g., hashrate dashboards, pool statistics).
• Cookies and similar technologies: See Section 8 (Cookies and Tracking Technologies).

3.3 Information from Third Parties

• Identity-verification and KYC/AML service providers.
• Payment processors or crypto-on/off-ramp partners.
• Public blockchain data linked to wallet addresses you provide (transaction history is public on-chain).
• Analytics or marketing partners (in aggregated or anonymized form where possible).
• Business partners or affiliates in connection with miner sales, hosting, or pool services.

We do not intentionally collect special-category (sensitive) personal data unless required for KYC/AML or legal compliance and with appropriate safeguards.

4. How We Use Your Personal Data and Legal Bases

We process personal data for the following purposes and legal bases (primarily under GDPR Art. 6 and equivalent PDPA bases):

We do not use personal data for automated decision-making that produces legal or similarly significant effects without appropriate safeguards or human review where required.

5. Sharing and Disclosure of Personal Data

We do not sell your personal data.

We may share personal data with:

• Service providers / processors: Hosting providers, cloud infrastructure, KYC/AML verification providers, payment processors, analytics providers, customer-support tools, and email service providers. These parties process data only on our instructions and under confidentiality obligations.
• Bot protection: Cloudflare, Inc. provides bot protection (Cloudflare Turnstile) on our registration and sign-in forms. When those forms load, Cloudflare receives browser, device, and connection signals, including your IP address, so it can tell people from automated traffic.
• Mining-related partners: Mining-pool operators or hosting partners as necessary to deliver services (e.g., hashrate attribution or payout routing). Wallet addresses and related on-chain data may be visible publicly.
• Corporate group / affiliates: Related entities under common control for internal administrative purposes.
• Legal and regulatory authorities: When required by law, court order, or to protect rights, safety, or prevent fraud/money laundering.
• Business transfers: In connection with a merger, acquisition, restructuring, or sale of assets (data would remain subject to equivalent protections).
• With your consent: Other parties when you explicitly authorize sharing.

International transfers (including outside Singapore or the EEA) are protected by appropriate safeguards such as standard contractual clauses, adequacy decisions, or equivalent measures under applicable law.

6. Data Retention

We retain personal data only as long as necessary for the purposes described, including:

• Account and transaction data: for the duration of the relationship plus a period required for legal, accounting, tax, or regulatory obligations (typically several years after account closure or last activity).
• KYC/AML records: as required by anti-money-laundering laws (often 5–7 years or longer).
• Technical logs and analytics: shorter periods, usually anonymized or deleted after a few months to years.
• Marketing data: until you withdraw consent or unsubscribe.

When data is no longer needed, we securely delete or anonymize it.

7. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit and at rest where appropriate, access controls, secure authentication (including 2FA options), regular security assessments, and staff training.

No method of transmission over the Internet or electronic storage is 100% secure. You are responsible for keeping your account credentials confidential. We are not responsible for breaches resulting from your failure to protect login information or from public blockchain transparency of wallet addresses and transactions.

8. Cookies and Tracking Technologies

We and our service providers use cookies, web beacons, pixels, and similar technologies to:

• Enable core Platform functionality and security.
• Remember preferences and login sessions.
• Analyze traffic and usage (analytics).
• Support marketing (with consent where required).

You can manage cookie preferences via your browser settings or any cookie-consent tool we provide. Disabling certain cookies may limit Platform functionality. For more details, refer to any separate Cookie Policy or banner on the site.

9. Your Rights

Depending on your location and applicable law (PDPA, GDPR, etc.), you may have the following rights:

• Access – Request a copy of your personal data.
• Rectification – Correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) – Request deletion in certain circumstances.
• Restriction – Limit processing in certain cases.
• Data portability – Receive data in a structured, machine-readable format.
• Objection – Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent – Where processing is based on consent (does not affect prior lawful processing).
• Lodge a complaint – With a supervisory authority (e.g., Singapore PDPC or an EU data-protection authority).

To exercise these rights, contact [email protected]. We may need to verify your identity before responding. We will respond within the timeframes required by law.

10. Children’s Privacy

Our Services are not directed to individuals under 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from children. If we learn that we have collected such data, we will delete it promptly. Parents or guardians who believe a child has provided data should contact us.

11. Third-Party Links and Services

The Platform may contain links to third-party websites, wallets, exchanges, or services. This Policy does not apply to those third parties. We are not responsible for their privacy practices. Review their policies before providing data.

Blockchain transactions and public wallet addresses are inherently transparent and outside our control once broadcast.

12. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The “Last Updated” date at the top will be revised. Material changes will be notified via the Platform, email, or other appropriate means. Continued use of the Services after changes constitutes acceptance of the updated Policy.

13. Contact Us

For questions, requests, or concerns about this Privacy Policy or our data practices:

Email: [email protected]

We will respond as promptly as possible in accordance with applicable law.