Effective Date: November 4, 2025
Our commitment to transparency and data privacy
The Bitkey team has a strong commitment to transparency and open communication with our customers and the community. Since we started building the product, we’ve openly shared details about our product principles, our progress, and how we make the decisions in our product. Part of this commitment also means being clear and upfront about the data we’ll collect from our customers, and why.
Like our product roadmap, our approach to data privacy and protection will evolve over time — but one thing will remain constant: we'll always be transparent about what data we’re collecting, why we need it, how it’s protected, and try to offer our customers choices when possible (while also keeping a high bar on safety and experience) on how it’s used.
The following Privacy Notice details your privacy rights, what types of information we’ll collect from you, why we need it, how we protect it, and how long we retain it for, so you can decide whether or not you want to use our product.
This Privacy Notice describes how Block, Inc., its affiliated and associated entities, including Block Global B.V., as further detailed below (collectively, ‘Block’, ‘we’, and ‘us’) collects, uses, discloses, transfers, stores, retains, or otherwise processes your personal data in association with your purchase and/or use of Bitkey, a self-custody bitcoin wallet, including the associated websites, mobile application (“App”), a hardware device (“Hardware”), and a set of recovery tools (collectively the “Service(s)”).
I. Information Collection & Use
We will collect information about you when you provide it to us directly, when you purchase a Bitkey, and we collect some data when you interact with the Services.
If you decline to provide us with your personal data, or do not consent where we rely upon it, we may not be able to proceed with entering into and fulfilling some of our Services. This includes providing your personal data to ship our product to you, or to respond to a support request.
The following table provides more information about the different categories and examples of personal data that we collect from you or through interaction with our services, how we use such data, and who we share your data with. We have also outlined the lawful bases that apply as prescribed under the General Data Protection Regulation and UK General Data Protection Regulation:
In order to safeguard your personal data, we have implemented stringent access controls that limit the number of individuals within our team who can directly access any of your directly identifiable personal information, such as your name and email. This restriction is limited to a specific subset of our team, who require this information to communicate with you and help fulfill your order and provide ongoing services to you (e.g. Customer Support); or who require the information to comply with applicable laws (e.g. Compliance).
We share any data specified in the table above with the following third parties/platforms for the purposes specified here:
- Our affiliates and group companies: Bitkey is part of Block, Inc. and its affiliated and associated entities. We have offices and we carry out daily business operations from various locations in Europe and in the United States. We may share your data with our affiliated companies, which we rely on to provide, maintain, and improve our services for the purposes outlined in this Privacy Notice.
- Processors (service providers): We engage third party service providers (as outlined in the table above) which process personal data on our behalf and according to our instructions. Our written agreements set out our mutual obligations and responsibilities, including technical and organizational measures which the processors need to adopt to adequately protect the personal data they process on our behalf.
- Law enforcement and other public and private agencies: We may share your personal data with law enforcement agencies, government agencies, officials, or other authorities or third parties pursuant to a subpoena, court order, or other legal process requirement if we believe that disclosure is necessary to comply with any applicable law, regulation, legal process or governmental request.
The table in Section I above further outlines which categories of personal information we share with different third party processors.
We may also de-identify your data, and combine and aggregate your de-identified information with other information in a way that it no longer enables your identification and share that de-identified, aggregated information publicly with other third parties not mentioned above (e.g. we may publically share statistics around how many people use Bitkey in various countries). Although we disclose your personal information to third parties as described above, we do not sell your personal information to third parties.
III. How long we will keep your information
We will store your personal information, in a form which permits us to identify you, for no longer than is necessary for the purpose for which the personal information is processed, and in any case, no longer than 7 years. We may retain your personal information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements and rights, or if it is not technically and reasonably feasible to remove it. Once the retention periods applicable to your personal information expires, we will otherwise take steps to delete or anonymize personal data where we no longer have a lawful basis to retain your personal information. Otherwise, we will seek to delete your personal information within a reasonable timeframe upon request.
Consistent with local law, we and our third party partners may collect information about your activities on our website, as outlined in the table in Section I. We may do so by the use of cookies and similar technologies, such as APIs, pixels, web beacons, and web server logs (together “web tracking technologies”). We use these web tracking technologies to help us:
- Remember your information so you do not have to re-enter it;
- To provide safe and functional services;
- Track and understand how you use and interact with our online services and emails to improve our product and services or to tailor our online services to your preferences; and
- Understand who is interested in Bitkey so that we can tailor our advertising to customers that are interested in purchasing Bitkey.
We set some of these web tracking technologies ourselves, but others are set by third parties who deliver services on our behalf. For example, we may use other companies’ web analytics services (described in the “Third-Party Analytics Services” section below), which use web tracking technologies to help us evaluate how customers use our website. Some of these technologies may also be set by third parties that help us advertise our products and services to you as informed by your interests, based on information collected from your activity on the web, including but not limited to, browsing or purchasing products on or through our website or on third party websites or your activity on mobile sites and applications. This advertising approach is called “interest-based advertising”.
You can manage how cookies and similar web tracking technologies are set from our website and the websites of our third party partners by visiting our Cookie Settings here. Your browser can also alert you when cookies are placed on your device, and how you can stop or disable them via your browser settings. More information on how to manage these settings on common browsers and devices are below.
- Manage cookie settings in Chrome and Chrome Android and Chrome iOS
- Manage cookie settings in Firefox
- Manage cookie settings in Internet Explorer
- Manage cookie settings in Microsoft Edge
- Manage cookie settings in Safari and Safari iOS
Please note, however, that without cookies some features of our online services may not work properly. If you use a mobile device, you can manage how your device and browser share certain device data by changing the privacy and security settings on your mobile device.
Within mobile applications, you may also go to your device settings and select “Limit Ad Tracking” (for iOS devices), or “Opt out of Interest-Based Ads” (for Android devices), which will allow you to limit our use of information collected from or about your mobile device (such as precise location data) for the purposes of serving online behavioral advertising to you.
Please also see the Interest-Based Advertising and Third Party Analytics sections below for other ways to opt-out.
V. Interest-Based Advertising.
We use this information to advertise to you and to tailor our products and services to your interests. You may see certain ads on other websites because we use third-party services to advertise our services to you. We use these services to target our ads to you and others based on your demographics, interests, and context. These third party ad services track your online activities over time and across multiple websites by collecting your information through Web Tracking Technologies. The ad services use this information to show you Bitkey ads that may be tailored to your individual interests. The information our ad services may collect on our behalf includes data about your visits to websites that serve Bitkey ads, such as the pages or ads you view and the actions you take on those websites. This data collection takes place both on our online services, and on third-party websites that serve our ads to you. This process also helps us figure out if our ads to you are effective and helps us avoid sending you Bitkey ads if you’ve already purchased our Services or you’re not interested in our Services.
You can manage your interest-based ads preferences from Bitkey by clicking “Your Privacy Choices” in the footer of this page.
You can also opt-out of receiving interest-based ads from other third party advertisers who are members of the Network Advertising Initiative (NAI) or members who follow the Digital Advertising Alliance’s (DAA) Self-Regulatory Principles for Online Behavioral Advertising, by visiting their respective opt-out pages:
- For those In the US, you can opt-out via NAI website and the DAA website.
- For those in the EU, you can opt-out via EDAA’s website.
- For those in Canada, you can opt-out via the DAAC’s website.
VI. Third Party Analytics Services.
Our analytics providers help us with our online services, such as Google Analytics. The analytics providers that administer these services use technologies such as cookies, web beacons, and web server logs to help us analyze how you use our online services. We may disclose your information (as outlined in the table in Section I) to these analytics providers, and other service providers who use the information to help us figure out how you and others use our website.
You can manage your third party analytics services preferences from Bitkey by clicking “Your Privacy Choices” in the footer of this page.
You can also learn more about Google Analytics and to opt-out directly via Google, read more here and here.
VII. Your Rights and Choices
Depending on the jurisdiction in which you reside, you may be entitled under applicable law to request:
- To be provided with access to your personal data held by us;
- To request that your data be transferred to a third party (data portability);
- To request the rectification or erasure of your personal data held by us;
- To request that we cease or restrict processing your data;
- To request to ask us to correct your personal information held by us, including where you believe it is not accurate, complete, up to date, or relevant.
- To object to profiling activities based on our own legitimate interests;
- To object to solely automated processing and ask for more information about a decision; and
- In addition, where you have provided your consent to our processing of your personal data you can withdraw this at any time. If we process your information on the basis of your consent and you withdraw your consent, this does not affect the lawfulness of the processing prior to your withdrawal.
In order to exercise your rights (including the right to withdraw your consent), you can email [email protected]. We may need to verify your identity before granting access or otherwise changing or correcting your information. You may also designate an authorized agent to make a request on your behalf as permitted under law, though before we process that request, we will require that you provide the authorized agent written permission to do so and verify your identity directly with us.
Please note that when you make a request to exercise your rights, we may require that you provide information and follow procedures so that we can verify you are making a request regarding your own data. If we are able to verify your request, we will process it.
We will assess any request to exercise these rights on a case-by-case basis to see if we are able to fulfill your request. We will respond to your request within the periods required by applicable data protection law. However, we may not always be able to comply fully with your request. We will notify you in that event.
If you are dissatisfied with our response, you have a right to make a complaint to your local privacy authority by clicking on the applicable links.
- Office of the Privacy Commissioner of Canada: here
- UK Information Commissioner’s Office: here
- EU residents can find their local privacy authority here
If you need help finding your local privacy authority and it's not linked above, please contact us for assistance at [email protected].
You may also manage your cookie preferences by clicking “Your Privacy Choices” in the footer of this page.
VIII. Automated Decision Making
Block uses automated decision-making technology without our staff being involved. We complete the following decision making by automated means, with legal or similarly significant effects on you, to enter into and perform our Services you request from us, or to comply with laws that apply to us:
- Implement sanctions restrictions on the purchase and use of Bitkey from sanctioned countries or by sanctioned individuals. This decision helps ensure we are complying with local sanctions regulations.
- Approve or decline orders when you are purchasing a Bitkey device. Fraud mitigation strategies are necessary to make sure we’re processing orders responsibly, protecting you and your money from theft, and ensuring our decisions are fair and consistent.
Automated decisions can affect whether we are able to sell you a Bitkey device. As a result of the above decisions, you may be declined our Services. We perform regular checks of our automated decision models to ensure they are operating correctly. You have a right to object to solely automated processing and to ask for more information about a decision, please see Section IV above for more information.
VII. International Data Transfers
We operate in many countries, and we (or our service providers) may move your data and process it outside the country where you live. We use third-party service providers to process and store your information in the United States, the EU, and Japan. When we transfer your personal data to our affiliates outside the EU, we make use of standard contractual clauses (which have been approved by the European Commission) to help ensure your information is afforded a high standard of protection, and that your privacy rights can be vindicated. If you wish to obtain further details regarding the contractual arrangements we enter into to protect your personal data when it is transferred outside the EU, you may do so by contacting us at [email protected]. You can also access the standard contractual clauses approved by the European Commission at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.
IX. Data Security
We do a lot to keep your data safe. We take reasonable measures, including administrative, technical, and physical safeguards, to protect your information from loss, theft, and misuse, and unauthorized access, disclosure, alteration, and destruction. Nevertheless, the internet is not a 100% secure environment, and we cannot guarantee absolute security of the transmission or storage of your information. We hold information about you both at our own premises and with the assistance of third-party service providers, as described above. Your personal information will be accessible by a limited number of our employees, contractors and service providers who require access for the purposes described in this Privacy Notice.
X. Note about Children’s Privacy
Our Services are general audience services not directed at children under the age of 18. We do not knowingly collect, share, or sell any information from children under the age of 18.
XI. Changes to this Privacy Notice
We reserve the right to change this Privacy Notice from time to time, as may be required. We will provide you with reasonable prior notice of any material changes in how we use your information, including by email if you have provided one. If you disagree with these changes, you may cancel your account at any time. Any amendments will be published by posting a revised version of the Privacy Notice and updating the “Effective Date” above. The revised version will be effective on the “Effective Date” listed.
XII. How to Contact Us
If you have any questions or concerns regarding this Privacy Notice, please reach out to us via [email protected]. If you would like to speak to the EU Data Protection Officer, please address your communication for the attention of the Data Protection Officer.