Privacy Policy

1. Who is responsible for your data

The data controller is To be confirmed: legal name, To be confirmed: registered office. Our privacy contact is To be confirmed: data protection officer, reachable at [email protected].

Where we are required to appoint one, our supervisory authority is To be confirmed: data protection regulator.

2. What we collect

• Identity data: your name, date of birth, nationality and the identity documents you upload for verification.
• Contact data: email address, telephone number and postal address.
• Financial data: your account balance, deposits, withdrawals, investments and transaction history.
• Verification data: the images and results of identity checks, and records of sanctions and politically-exposed-person screening.
• Technical data: IP address, browser type, device information and the pages you visit.
• Communications: support tickets, emails and chat messages you send us.

3. Why we use it, and our legal basis

• To provide the service and perform our contract with you — legal basis: performance of a contract.
• To verify your identity and to prevent money laundering, terrorist financing and fraud — legal basis: compliance with a legal obligation.
• To keep the platform and your account secure — legal basis: our legitimate interest in preventing unauthorised access.
• To send service messages such as verification codes, statements and account notices — legal basis: performance of a contract.
• To send optional updates about the service — legal basis: your consent, which you can withdraw at any time.
• To meet record-keeping, tax and regulatory obligations — legal basis: compliance with a legal obligation.

4. Who we share it with

We do not sell your personal data, and we do not share it for third-party advertising.

• Identity verification and sanctions screening providers: To be confirmed: identity verification provider.
• Payment and blockchain infrastructure providers: To be confirmed: payment providers.
• Cloud hosting and email delivery providers: To be confirmed: hosting and email providers.
• Regulators, tax authorities, law enforcement and courts, where we are legally required to disclose.
• Professional advisers such as auditors and lawyers, under a duty of confidence.

5. Where your data is held

Your data is stored in To be confirmed: data hosting location. Where data is transferred outside that territory, we rely on To be confirmed: transfer safeguard used to protect it.

6. How long we keep it

We keep identity and transaction records for To be confirmed: AML retention period after your account closes, because anti-money-laundering law requires it. Support correspondence is kept for To be confirmed: correspondence retention period. Technical logs are kept for To be confirmed: log retention period. After those periods the data is deleted or irreversibly anonymised.

7. Your rights

Write to [email protected] to exercise any of these. We respond within one month. Note that we cannot delete records we are legally obliged to retain for anti-money-laundering purposes.

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is wrong or incomplete.
• Ask us to delete data, where we are not legally required to keep it.
• Object to, or ask us to restrict, certain processing.
• Ask us to send your data to another provider in a portable format.
• Withdraw consent for optional messages at any time.
• Complain to your data protection regulator if you are unhappy with how we have handled your data.

8. Automated decisions

Identity verification and sanctions screening use automated checks. If an automated check declines your application you can ask for it to be reviewed by a person, and we will do so.

9. Security

Passwords are stored hashed and are never readable by our staff. Access to personal data is limited to staff who need it. Sign-in and withdrawal both require a code sent to your registered email address. Security events on your account are logged and visible to you in your settings.