Privacy Policy

This Privacy Policy ("Policy") describes how Bitcitizen LLC ("Bitcitizen," "we," "us," or "our") collects, uses, shares, and protects personal information when you access or use the Bitcitizen website (bitcitizen.io) and any related pages, forms, scheduling links, or communications (collectively, the "Website"), and when you engage any services we offer, including services marketed or delivered under brand names including OffshoreGuy, 21 CBI, GoSRRV, and Exitly (collectively, the "Services").

This Policy is part of the Bitcitizen legal framework, which also includes our Terms of Service, Legal Disclaimer, and Cookie Policy. As set forth in Section 2 of the Terms of Service, this Policy controls for all matters relating to the collection, use, sharing, retention, and protection of personal information. If there is any inconsistency between this Policy and the Terms of Service or Legal Disclaimer regarding privacy or data-handling matters, this Policy controls.

Capitalized terms not defined here have the meanings given in the Terms of Service or Legal Disclaimer. By accessing the Website or engaging our Services, you acknowledge that you have read and understood this Policy. If you do not agree with our data practices, please do not use the Website or our Services.

1. Data Controller

The data controller responsible for your personal information is:

• Bitcitizen LLC
• 30 N Gould St, Ste R
• Sheridan, WY 82801
• United States
• Email: contact@bitcitizen.io

If you are located in the European Economic Area ("EEA"), United Kingdom ("UK"), or Switzerland, Bitcitizen is the data controller for the purposes of the General Data Protection Regulation ("GDPR"), the UK GDPR, and the Swiss Federal Act on Data Protection ("FADP"), respectively.

1.1 EU and UK Representative (GDPR Article 27)

Bitcitizen is established in the United States. Based on the current nature and scale of our processing activities, including the volume of data subjects located in the EEA and UK, we have determined that the appointment of a representative under GDPR Article 27 and UK GDPR Article 27 is not yet required. We monitor this assessment on an ongoing basis and will designate such representative(s) and publish their contact details in this section promptly if and when our activities require it.

Until then, you may direct any privacy-related questions or requests to us at contact@bitcitizen.io.

2. Information We Collect

We collect personal information in several ways, depending on how you interact with us. The categories below describe the types of information we may collect.

2.1 Information You Provide Directly

• Contact and inquiry information: When you submit a form on the Website, request a call through a scheduling link (if enabled), or email us directly, we collect your name, email address, and any information you include in your message.
• Service engagement information: When you engage our Services, we may collect additional information depending on the service, including:

OffshoreGuy (Company Formation):

OffshoreGuy provides company formation across 29 jurisdictions, paid in BTC, Lightning, or USDT via BitSettle. In connection with a formation engagement, we may collect:

• Identity: Full legal name, date of birth, nationality, government-issued ID or passport details
• Contact: Email address; optional phone number or mailing address (if provided)
• Financial: Payment information (for service fees); tax identification details where the chosen jurisdiction requires them
• Ownership and management: Information about company members, shareholders, directors, or managers, where the entity has more than one
• Background: Generally not required; some jurisdictions require additional identity or due diligence documentation

21 CBI (Citizenship/Residency):

• Identity: Full legal name, date of birth, place of birth, nationality (current and prior), government-issued ID, passport copies, photographs
• Contact: Email address; optional phone number or mailing address (if provided); optional secondary contact (if provided)
• Financial: Source-of-funds documentation, proof of investment funds, bank statements or equivalent, payment information
• Family: Spouse and dependent information (names, dates of birth, passport details, and photographs) for family applications
• Background: Criminal history declarations, professional background, and prior immigration or visa history, as required by the relevant program

• Payment information: BTC, Lightning, and USDT are our payment rails. Credit cards and bank transfers are also accepted as needed. Cryptocurrency payments are processed via BitSettle; if you pay by cryptocurrency, we collect your wallet address and transaction ID. If you pay by an alternative method we have agreed to accept, we collect the payment details necessary to process your transaction. We do not store full credit card numbers on our systems.
• Communications: We retain records of emails, messages, and other communications between you and Bitcitizen for the purpose of providing and improving our Services.

2.2 Information Collected Automatically

When you visit the Website, we and our service providers automatically collect certain technical information, including:

• Device and browser information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage data: Pages viewed, time spent on pages, referring URL, click patterns, and navigation paths.
• Cookies and similar technologies: We use cookies and similar technologies as described in our Cookie Policy. Our website platform sets cookies necessary to operate and secure the site and, where enabled, to provide basic site analytics and performance features. We do not currently use third-party analytics or marketing pixels on the Website.

2.3 Information from Third Parties

We may receive information about you from third parties in connection with the Services, including:

• Due diligence and background check providers engaged as part of a CBI application process.
• Government agencies or program administrators processing your application.
• Registered agents or filing offices in connection with company formation.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

Providing and delivering Services: Filing company formation documents, coordinating CBI applications, and communicating with government agencies and third-party providers on your behalf. Legal basis (GDPR): Performance of a contract; legitimate interests.

Processing payments: Invoicing, processing cryptocurrency or fiat payments, and issuing receipts. Legal basis (GDPR): Performance of a contract.

Communicating with you: Responding to inquiries, providing service updates, scheduling calls, and sending engagement agreements. Legal basis (GDPR): Performance of a contract; legitimate interests.

Compliance and legal obligations: AML/KYC screening, sanctions checks, identity verification, beneficial ownership reporting (as may be required under applicable law), and responding to lawful requests from authorities. Legal basis (GDPR): Legal obligation; legitimate interests.

Marketing and communications: Sending newsletters, service announcements, or promotional content (with your consent or where permitted by law). For individuals located in the EEA or UK, direct marketing is consent-based unless an applicable exemption applies (such as the existing customer exemption for similar products or services under the ePrivacy Directive or PECR). Legal basis (GDPR): Consent; legitimate interests (where applicable).

Improving our Website and Services: Analyzing Website usage, understanding user behavior, and improving content and user experience. Legal basis (GDPR): Legitimate interests.

Protecting our rights and safety: Detecting fraud, enforcing our Terms of Service and Legal Disclaimer, and protecting against misuse of our Services. Legal basis (GDPR): Legitimate interests; legal obligation.

4. How We Share Your Information

We do not sell your personal information. We share personal information only in the following circumstances and with the following categories of recipients:

• Service providers and processors: We share information with third-party service providers who perform functions on our behalf, including: website hosting and infrastructure providers (hosting, forms, consent management, and CRM/contact management); email and cloud storage providers (document storage and internal communications); and payment processors, including BitSettle for cryptocurrency transactions and fiat payment processors as needed.
• Third parties involved in service delivery: Depending on the Services you engage, we may share your information with: company registries, filing offices, and registered agent providers in the relevant jurisdiction (for company formation); licensed CBI agents and government program administrators (for citizenship applications); due diligence and background check providers (as required by CBI programs); local counsel and licensed immigration professionals in relevant jurisdictions; translation, apostille, and notarization service providers; banks and financial institutions (where required for program compliance); and courier and shipping services (for document delivery).

These disclosures are made only to the extent necessary to deliver the Services you have engaged and in accordance with the Legal Disclaimer (Section 6). We enter into data processing agreements with third-party providers that process personal information on our behalf, as required by applicable data protection law.

• Legal and regulatory disclosures: We may disclose your information where required by law, regulation, legal process, or governmental request, including in response to court orders, subpoenas, or requests from law enforcement or regulatory authorities.
• Protection of rights: We may disclose information where we believe it is necessary to protect the rights, property, or safety of Bitcitizen, our clients, or others, including to enforce our Terms of Service, Legal Disclaimer, or engagement agreements.
• Business transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, your personal information may be transferred as part of that transaction. We will make reasonable efforts to notify you of any such change in ownership or control of your personal information, consistent with Section 21 of the Terms of Service (Assignment).

5. International Data Transfers

Bitcitizen is based in the United States. If you are located outside the United States, including in the EEA, UK, or Switzerland, your personal information will be transferred to and processed in the United States and potentially other countries where our service providers and third-party partners operate.

These countries may not provide the same level of data protection as your home jurisdiction. Where required by applicable law (including the GDPR and UK GDPR), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK equivalent, the International Data Transfer Agreement or UK Addendum), as incorporated into our data processing agreements with service providers that process personal information outside the EEA/UK on our behalf. Where SCCs are not available or appropriate for a specific transfer, we may rely on your explicit consent, a derogation under GDPR Article 49, or another lawful transfer mechanism as applicable.

In the context of CBI applications, your personal information will necessarily be transferred to government agencies and service providers in the country whose citizenship you are applying for (e.g., Vanuatu, São Tomé and Príncipe, or Argentina). These transfers are essential to the performance of the Services and are made in accordance with the requirements of the relevant program.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. The specific retention period depends on the nature of the information and the context in which it was collected:

• Service records and engagement files: We retain records related to your engagement for at least seven (7) years following the completion of the Services, or longer if required by applicable tax, corporate, or immigration law.
• CBI application files: Due to the nature of citizenship matters, which may involve future renewals, audits, or government inquiries, we may retain CBI-related records for an extended period, typically for at least ten (10) years following completion of the Services, and longer where required by program rules, legal obligations, or to establish, exercise, or defend legal claims.
• Company formation and compliance records: We retain formation documents, filing confirmations, and compliance records for as long as the company remains in existence and for a minimum of seven (7) years after dissolution or termination of our services.
• Marketing and communications data: We retain your email address and marketing preferences for as long as you remain subscribed to our communications. You may unsubscribe at any time (see Section 9).
• Website analytics and cookie data: Automatically collected data (such as device data, usage data, and cookie data) is retained in accordance with our website platform's settings and our internal retention practices. We periodically review and delete or anonymize data that is no longer necessary for the purposes described in this Policy.
• Communications: Emails and messages are retained for the duration of the client relationship and for a reasonable period thereafter for record-keeping and dispute resolution purposes.

When personal information is no longer needed for the purposes described in this Policy and no legal retention obligation applies, we will securely delete or anonymize it.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Use of encrypted cloud storage for sensitive client documents.
• Access controls limiting who within Bitcitizen can view client files.
• Use of secure, encrypted email where sensitive documents are transmitted.
• Regular review of our data handling practices and third-party provider security.

As noted in Section 2 of the Legal Disclaimer and Section 6 of the Terms of Service, you should not send sensitive personal information (such as passport scans, bank details, private keys, or seed phrases) through unsecured channels. We will provide you with a secure method for transmitting sensitive documents when you engage our Services.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. This is consistent with Section 12 of the Legal Disclaimer.

8. Data Breach Notification

In the event of a personal data breach that affects your personal information, we will notify you and any applicable regulatory authorities as required by applicable law. In particular:

• GDPR (EEA/UK/Switzerland): Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by GDPR Article 34, unless an exception applies (for example, where appropriate technical safeguards have been applied that render the personal data unintelligible).
• Wyoming and other US state laws: We will notify affected individuals as required under the Wyoming breach notification statute (Wyo. Stat. §40-12-501 et seq.) and any other applicable state breach notification laws in the most expedient time possible and without unreasonable delay.

If a breach occurs, we will provide you with information about the nature of the breach, the categories and approximate number of records affected (where known), the likely consequences, and the measures we are taking or propose to take in response, including measures to mitigate possible adverse effects.

We maintain internal incident response procedures designed to detect, investigate, and respond to personal data breaches in a timely manner.

9. Your Rights and Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information. This section describes those rights.

9.1 All Users

• Access and correction: You may request access to the personal information we hold about you and ask us to correct any inaccuracies.
• Marketing opt-out: You may unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at contact@bitcitizen.io. Opting out of marketing does not affect transactional or service-related communications.
• Cookie preferences: You may manage cookie preferences through your browser settings or through the cookie consent tool available on the Website. See our Cookie Policy for details.

9.2 EEA, UK, and Swiss Residents (GDPR Rights)

If you are located in the EEA, UK, or Switzerland, you have the following additional rights under the GDPR, UK GDPR, or FADP:

• Right of access: You have the right to request a copy of the personal information we process about you.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal information.
• Right to erasure ("right to be forgotten"): You have the right to request deletion of your personal information, subject to certain exceptions (such as where retention is required by law or necessary for the performance of a contract).
• Right to restriction of processing: You have the right to request that we restrict processing of your personal information in certain circumstances.
• Right to data portability: You have the right to receive your personal information in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing performed before withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority. You may also contact our EU or UK representative (see Section 1.1).

To exercise any of these rights, please contact us at contact@bitcitizen.io or contact our EU or UK representative (see Section 1.1). We will respond to your request within one month of receipt (or such shorter period as required by applicable law). This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt. We may need to verify your identity before processing your request.

Important limitation: Certain personal information submitted as part of a CBI application may be required to be retained by government program rules, regulatory obligations, or the terms of the relevant engagement agreement, even after you exercise a deletion right. We will inform you of any such limitations when responding to your request.

9.3 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), including:

• Right to know: You have the right to know what categories of personal information we collect, the purposes for which it is collected, and the categories of third parties with whom it is shared. For the categories of personal information we collect, see Section 2; for how we use it, see Section 3; for how we share it, see Section 4.
• Right to delete: You have the right to request deletion of your personal information, subject to certain exceptions. For our retention practices, see Section 6.
• Right to opt out of sale or sharing: We do not sell personal information. We also do not share personal information for cross-context behavioral advertising as defined by the CPRA. If our practices change, we will provide any required "Do Not Sell or Share" opt-out mechanisms.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your rights, contact us at contact@bitcitizen.io. We may need to verify your identity before processing your request.

10. Cookies and Tracking Technologies

The Website uses cookies and similar tracking technologies. A detailed description of the cookies we use, their purposes, and how to manage your preferences is provided in our separate Cookie Policy, which forms part of the Bitcitizen legal framework described in Section 2 of the Terms of Service.

In summary, the Website uses:

• Essential cookies: Required for the Website to function (set by our website platform). These cannot be disabled.
• Analytics cookies: Where enabled, our website platform's analytics and performance features help us understand how visitors interact with the Website (for example, pages viewed and general usage patterns) so we can improve the Website. You can manage analytics cookie preferences through the cookie consent tool and your browser settings. See our Cookie Policy for details.
• Marketing and CRM: If you voluntarily provide your name and email address (for example, to request a PDF, join a waitlist, or contact us), we store that information in our CRM/contact management system to respond to you and manage our relationship. If you opt in to marketing emails, our email platform may record basic engagement metrics such as opens and link clicks. You can unsubscribe from marketing emails at any time using the unsubscribe link in the email or by contacting us at contact@bitcitizen.io.
• Third-party cookies: If we embed third-party content or tools on the Website (for example, social media embeds or external widgets), those third parties may set their own cookies or collect data independently. Their practices are governed by their own privacy and cookie policies.

11. Children's Privacy

The Website and Services are not directed to individuals under the age of 18. Consistent with Section 5 of the Terms of Service and Section 5 of the Legal Disclaimer, you must be at least 18 years old to use the Website or engage our Services. We do not knowingly collect personal information from children under 18.

In the context of family CBI applications, we may collect information about minor dependents (such as names, dates of birth, and passport details) as provided by their parent or legal guardian. This information is collected and processed solely for the purpose of the citizenship application and is handled with the same security measures applied to all client information.

12. Third-Party Websites and Services

Consistent with Section 13 of the Legal Disclaimer and Section 9 of the Terms of Service, the Website may contain links to third-party websites and services. This Policy does not apply to those third-party platforms. We encourage you to review the privacy policies of any third-party website or service before providing personal information.

13. "Do Not Track" Signals

Some browsers transmit "Do Not Track" ("DNT") signals. There is currently no universally accepted standard for how companies should respond to DNT signals. At this time, the Website does not respond to DNT signals. However, you may manage cookies and tracking through your browser settings and through the tools described in our Cookie Policy.

14. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page. For material changes that significantly affect how we process your personal information, we will make reasonable efforts to notify you (for example, by email or by a prominent notice on the Website).

Your continued use of the Website or Services after the effective date of any changes constitutes your acceptance of the updated Policy. This is consistent with Section 25 of the Terms of Service regarding changes.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your rights described above, or have concerns about how your personal information is handled, please contact us:

• Bitcitizen LLC
• 30 N Gould St, Ste R
• Sheridan, WY 82801
• United States
• Email: contact@bitcitizen.io

For GDPR-related inquiries, please include "Privacy Request" or "GDPR Request" in the subject line of your email so we can direct your inquiry appropriately. You may also contact our EU or UK representative (see Section 1.1).