11.1 Rights Available to All Users
Regardless of your jurisdiction, you may contact us at privacy@ferm.trade to:
(a) Request information about the Personal Data we hold about you;
(b) Request correction of inaccurate Personal Data;
(c) Request deletion of your Personal Data, subject to legal retention requirements;
(d) Withdraw consent for Processing where consent is the legal basis.
11.2 California Residents - CCPA/CPRA
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
(a) Right to Know. You have the right to request disclosure of the categories and specific pieces of Personal Data we have collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share it.
(b) Right to Delete. You have the right to request deletion of your Personal Data, subject to certain legal exceptions (e.g., fraud prevention, legal compliance, transaction completion).
(c) Right to Correct. You have the right to request correction of inaccurate Personal Data.
(d) Right to Opt-Out of Sale/Sharing. You can disable advertising measurement through Privacy settings at any time. Global Privacy Control also disables it. These choices apply without a sign-in requirement. Contact privacy@ferm.trade for other applicable sale/sharing opt-out requests, requests to limit sensitive-information processing, or authorized-agent requests. Verification requirements depend on the request and applicable law.
(e) Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.
(f) Categories of Personal Data Collected. In the preceding twelve (12) months, we have collected the following categories of Personal Data as defined by the CCPA: Identifiers (name, email, IP address, device ID); Commercial Information (purchase history, transaction records); Internet or Electronic Network Activity (browsing history, interactions with the Platform); Geolocation Data (country code); and Biometric Information (collected by Persona for KYC, not by Ferm directly).
(g) Authorized Agents. You may designate an authorized agent to submit requests on your behalf by providing written authorization.
11.3 European Economic Area and United Kingdom - GDPR / UK GDPR
If you are located in the EEA or the United Kingdom, the following provisions apply:
(a) Lawful Bases for Processing. We Process your Personal Data under the following lawful bases:
| Lawful Basis | Applicable Processing |
|---|
| Performance of a contract | Providing the Service, processing transactions, managing your account and necessary non-biometric eligibility verification |
| Compliance with legal obligations | Specific applicable sanctions, tax-record and other legal duties; we do not treat every contractual identity check as a statutory AML obligation |
| Legitimate interests | Necessary and proportionate fraud prevention, platform security and enforcing Terms, subject to applicable balancing and objection rights |
| Consent | Optional analytics, advertising/referral measurement and marketing email; biometric processing only when the applicable ordinary and special-category conditions and required separate permission have been established |
(b) Your Rights. You have the right to:
(i) Access - request confirmation of whether we Process your Personal Data and obtain a copy thereof;
(ii) Rectification - request correction of inaccurate or incomplete Personal Data;
(iii) Erasure - request deletion of your Personal Data where there is no compelling reason for continued Processing;
(iv) Restriction - request restriction of Processing in certain circumstances;
(v) Data Portability - receive your Personal Data in a structured, commonly used, machine-readable format;
(vi) Object - object to Processing based on legitimate interests or for direct marketing purposes;
(vii) Withdraw Consent - withdraw consent at any time where Processing is based on consent, without affecting the lawfulness of Processing prior to withdrawal.
(c) Supervisory Authority. You have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/board/members_en. The relevant UK authority is the Information Commissioner's Office (ICO) at https://ico.org.uk/.
(d) International Transfers. Article X describes international transfers and how to request details of applicable safeguards. This notice does not replace the required transfer mechanism.
11.4 Canadian Residents - PIPEDA
If you are a Canadian resident, the following rights apply under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws:
(a) Right to Access. You have the right to request confirmation of whether we Process Personal Data relating to you and to obtain a copy thereof.
(b) Right to Correct. You have the right to request correction of inaccurate, outdated, or incomplete Personal Data.
(c) Right to Withdraw Consent. You may withdraw consent for the collection, use, or disclosure of your Personal Data at any time, subject to legal or contractual restrictions and reasonable notice.
(d) Contact. If you have questions or concerns about our privacy practices, please email privacy@ferm.trade. You may also contact the Office of the Privacy Commissioner of Canada at (800) 282-1376.
11.5 Australian Residents - Privacy Act 1988
If you are an Australian resident, the following rights apply under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs):
(a) Right to Access. You have the right to request access to the Personal Data we hold about you.
(b) Right to Correct. You have the right to request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading Personal Data.
(c) Complaints. If you believe we have breached the APPs, you may lodge a complaint with us at privacy@ferm.trade. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au/.
11.6 U.S. State Biometric Privacy Laws
(a) Illinois Biometric Information Privacy Act (BIPA). Where applicable, you receive written notice of biometric collection, purpose, disclosures and retention before providing the separate written release. Article VI states the retention/destruction policy and circumstances in which capture is unavailable. You may contact privacy@ferm.trade about the notice, release or destruction.
(b) Texas Capture or Use of Biometric Identifier Act (CUBI). If you are a Texas resident, the same protections apply. Biometric identifiers are collected solely for identity verification, are not sold or disclosed except as permitted by law, and are destroyed within a reasonable time after the purpose is fulfilled.
(c) Washington State Biometric Privacy Law (RCW 19.375). If you are a Washington resident, you are hereby notified that Biometric Data is collected for the commercial purpose of identity verification. You may request deletion by contacting privacy@ferm.trade.
(d) Additional U.S. State Laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA). Residents of these states may exercise rights to access, correct, delete, and opt-out of certain Processing as applicable under their respective state privacy laws by contacting privacy@ferm.trade.
