This Privacy Policy is part of and should be read alongside the Coins Trade Hub Terms and Conditions and Cookie Policy. It outlines how we collect, create, process, store, protect, disclose, share, and transfer your Personal Data as part of providing our services and conducting our business operations.

Certain terms are defined throughout this Privacy Policy. You can find the meaning of capitalized terms in Section 19: Definitions below or as defined elsewhere in this document.

Personal Data refers to any information that directly or indirectly identifies an individual, such as a name, identification number, online identifier, or other identifiable characteristics, as well as other information associated with an identified or reasonably identifiable person.

Coinstradehub may also collect, create, process, store, protect, disclose, share, and transfer Non-Personal Data as part of providing our services or for other business purposes. For example, we may use anonymized and aggregated transactional data to review or analyze transaction patterns for commercial insights.

Please note that Coinstradehub provides services to both individual consumers and businesses. This Privacy Policy applies to both and should be interpreted accordingly.

This Notice

This Notice is issued by Coinstradehub Ltd (“Coinstradehub,” “we,” “us,” or “our”) and is directed to individuals outside our organization with whom we interact, including customers, visitors to our websites, users of our apps, other service users, and visitors to our premises (collectively referred to as “you”). For the purposes of this Notice, Coinstradehub acts as the Data Controller.

This Notice may be amended or updated periodically to reflect changes in our Personal Data processing practices or to comply with applicable laws. We encourage you to read this Notice thoroughly and regularly check this page for any updates. The most current version of this Privacy Policy is always available here.

Collection of Personal Data

Collection of Personal Data

We obtain Personal Data about you from the following sources:

• Data you provide: We collect Personal Data when you provide it directly to us (e.g., when you contact us via email, phone, or other means, provide identity documents, submit wage slips or proof of funds, share your contacts or address book, or supply other information as required by applicable laws or for our services).
• Third-party data: We may receive Personal Data from third parties such as credit reference agencies, law enforcement authorities, identity service providers, or global PEP and sanctions watchlists.
• Relationship data: We collect Personal Data during the normal course of our interactions with you (e.g., when we provide you with a service).
• Public data: We collect Personal Data that you make public, including on social media (e.g., if you publicly post about us or share information from your social media profiles).
• Registration information: We collect Personal Data when you register for or use any of our websites, apps, or services.
• Content and advertising data: We collect Personal Data when you interact with third-party content or advertising on our websites or apps (e.g., via third-party plugins or cookies), and we receive this data from the relevant third-party provider.
• Site data: We collect Personal Data when you visit our websites or use any available features or resources.

Please be aware that third parties you interact with may have their own privacy policies. We are not responsible for their operations or how they handle the data they collect. Data collected by third parties is governed by their own privacy practices, and we encourage you to review their privacy policies to understand their practices.

Creation of Personal Data

In certain cases, we create Personal Data, including records of your past interactions with us. We may also combine Personal Data collected from our websites or services, including data gathered from different devices.

Categories of Personal Data We process

 We process the following types of Personal Data about you:

• Personal Identity Information: This includes your full name, preferred name(s), gender, date of birth, age, nationality, title, and language preferences.
• Formal Identity Information: This refers to government-issued documents such as identity cards, passports, driving licenses, and any other public or government-issued documentation required for compliance with legal obligations, including financial or anti-money laundering regulations.
• Employment Information: This includes job title, employer, workplace location, proof of salary, and any other employment-related data.
• Financial Information: This encompasses details like bank account numbers, card details, routing numbers, billing addresses, invoices, payment history, transaction details, and other relevant financial data.
• Correspondence Information: This refers to details like your account registration information, email addresses, phone numbers, and home addresses.
• Contact Information: If you choose to sync, upload, or import your contacts or address book to our site, we collect the details of your contacts.
• Transaction Information: This covers the specifics of your transactions on our platform, including sender and receiver information, transaction amounts, dates, times, and eWallet addresses.
• Sensory Information: This includes any audio or visual data, such as call recordings, CCTV footage, and selfies used for identity verification.
• Additional Information: Information collected to meet legal and compliance requirements at our discretion.
• Data Related to Our Sites: This includes details like device type, operating system, browser information, IP address, language settings, session dates and times, app usage statistics, location data, and other technical information.
• Consent Records: This covers any records of consents you have provided, including the date, time, method of consent, and the relevant context.
• Service Information: This includes data about your usage of our services, such as transaction frequency, average transaction volumes, eWallet balances, and the people or merchants you transact with.

Sensitive Personal Data

We do not actively seek to collect or process Sensitive Personal Data as part of our regular business operations. However, if it becomes necessary to process such data, we do so based on one or more of the following legal bases:

• Compliance with Applicable Law: We may process your Sensitive Personal Data if required or permitted by law, such as for fulfilling diversity reporting obligations.

• Consent: We may process Sensitive Personal Data with your explicit consent, in accordance with applicable law. This legal basis is used only for processing that is entirely voluntary, not for processing that is necessary or mandatory.

• Detection and Prevention of Crime: We may process Sensitive Personal Data to detect or prevent criminal activities, including fraud.

• Establishment, Exercise, or Defense of Legal Rights: We may process Sensitive Personal Data to establish, exercise, or defend legal rights.

If you provide us with Sensitive Personal Data, you must ensure that it is lawful for you to disclose such data to us and that a valid legal basis exists for processing it.

Profiling

We process Personal Data for the purposes of automated decision-making and profiling as defined in Section (19). These processes are employed for the following purposes:

Purposes of Processing and legal bases for Processing

The legal basis for processing your Personal Data depends on the context of collection and the purposes for which it is used. Subject to applicable laws, our common legal bases for processing Personal Data include:

• Compliance with Legal Obligations: We may process your Personal Data when necessary to comply with legal, regulatory, or compliance obligations. (for us or a third party)

• Performance of a Contract: We process Personal Data to fulfill any contracts you have with us or to take steps prior to entering into a contract.

• Legitimate Interests: We may process Personal Data based on our legitimate interests or those of a third party, such as operating our Sites, Apps, or Services, provided that these interests are not overridden by your rights and freedoms.

• Consent: We may process Personal Data based on your explicit consent, applicable only for voluntary processing and not for mandatory or necessary processing.

Disclosure of Personal Details to third parties

We disclose Personal Data within Coinstradehub for legitimate business purposes and to operate our Sites or Services in accordance with Applicable Law. Additionally, we disclose Personal Data to:

• You and Your Representatives: To you directly and, where applicable, to individuals you have appointed.
• Legal and Regulatory Authorities: Upon request or to report any actual or suspected breaches of Applicable Law or regulations.
• Professional Advisors: Such as accountants, auditors, and lawyers, subject to strict confidentiality obligations.
• Third-Party Processors: Including payment service providers and other associated Processors, located globally, with adherence to the requirements detailed below in this section.
• Legal Proceedings: Relevant parties, law enforcement agencies, or courts, as necessary for the establishment, exercise, or defense of legal rights.
• Criminal Investigation: Entities involved in the prevention, investigation, detection, or prosecution of criminal offenses.
• Business Acquirers: In the event of a sale or transfer of all or part of our business or assets, including reorganizations, dissolutions, or liquidations.
• Third-Party Providers: Providers of advertising, plugins, or content integrated into our Sites or Apps. If you interact with such third-party content, your Personal Data may be shared with the provider. We recommend reviewing their privacy policies before engaging with their content.

When we engage third-party Processors to handle your Personal Data, they are bound by contractual obligations to:

(i) only Process the Personal Data in accordance with our prior written instructions; and (ii) use measures to protect the confidentiality and security of the Personal Data; together with any additional requirements under Applicable Law. Regularly used third-party Processors, which may change over time, include:

• Comply Advantage: For compliance checks.
• SumSub: For identification verification.

International transfer of Personal Data

Due to the international nature of our business, we transfer Personal Data within Coinstradehub and to third parties as described in this policy. This may involve transferring Personal Data to countries that have different data protection laws from those in your country of residence.

When transferring Personal Data from the European Economic Area (EEA) to recipients outside the EEA that are not located in Adequate Jurisdictions, we primarily use the European Commission’s Standard Contractual Clauses. These clauses facilitate the lawful international and onward transfer of Personal Data. You can request a copy of our Standard Contractual Clauses by contacting us using the details provided in this policy.

Please be aware that if you directly transfer Personal Data to a recipient outside the EEA, we are not responsible for that transfer. However, once we receive your Personal Data, we will process it in accordance with the provisions of this Notice.

Data Security

We have implemented appropriate technical and organizational measures to safeguard your Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and other forms of unlawful or unauthorized processing, in line with Applicable Law.

However, as the internet is an inherently open system, the transmission of information online is not entirely secure. While we strive to protect your Personal Data with reasonable measures, we cannot guarantee its security or confidentiality during transmission over the internet. Any transmission of your data is at your own risk, and you are responsible for ensuring that any Personal Data you send to us is transmitted securely.

Data Accuracy

We take every reasonable measure to ensure that:

• The Personal Data we Process are accurate and, where necessary, kept up to date.
• Any inaccuracies in your Personal Data (considering the purposes for which they are Processed) are corrected or erased without delay.

Occasionally, we may request you to confirm the accuracy of your Personal Data.

We take every reasonable step to ensure that the Personal Data we Process is restricted to what is reasonably necessary for the purposes outlined in this Notice

We take every reasonable step to ensure that your Personal Data is only processed for the minimum period necessary for the purposes outlined in this Notice. The criteria for determining how long we retain your Personal Data are as follows:

1. Ongoing Relationship or Legal Basis: We retain Personal Data in a form that allows identification for as long as:
   • We have an ongoing relationship with you (e.g., as a user of our services or if you are subscribed to our mailing list and have not unsubscribed), or
   • Your Personal Data is necessary for the lawful purposes described in this Notice, where we have a valid legal basis (e.g., as part of a contract or to fulfill our legal obligations).
2. Limitation Periods:
   • We retain Personal Data for the duration of any applicable limitation period under Applicable Law (i.e., the period during which legal claims could be made in connection with your Personal Data), plus an additional two months to address any claims brought at the end of this period.
3. Legal Claims: If any relevant legal claims are brought, we will continue to process Personal Data as necessary in connection with the claim.

During the retention periods mentioned in paragraphs 2(a) and 2(b), we will restrict the processing of your Personal Data to storage and maintaining its security, except where necessary to review the data in connection with legal claims or obligations under Applicable Law.

Once the applicable retention periods have concluded, we will either:

• Permanently delete or destroy the relevant Personal Data, or
• Anonymize the relevant Personal Data.

Your legal rights

You may have several rights related to the Processing of your Personal Data, which may be applicable depending on the regulations in your jurisdiction, such as the General Data Protection Regulation (GDPR) for EEA residents. Subject to Applicable Law, you may be entitled to the following rights concerning your Relevant Personal Data:

• Right to Withhold Data: You can choose not to provide your Relevant Personal Data. However, please be aware that this may limit our ability to offer you the full benefits of our Sites or Services. For instance, we may not be able to process your requests without the necessary details.
• Right of Access: You can request access to, or copies of, your Relevant Personal Data, along with information about its nature, Processing, and disclosure.
• Right to Rectification: You may request corrections to any inaccuracies in your Relevant Personal Data.
• Right to Erasure or Restriction: On legitimate grounds, you can request:
  • Erasure of your Relevant Personal Data.
  • Restriction of the Processing of your Relevant Personal Data.
• Right to Data Portability: You can request that certain Relevant Personal Data be transferred to another Controller in a structured, commonly used, and machine-readable format, where applicable.
• Right to Withdraw Consent: If we process your Relevant Personal Data based on your consent, you can withdraw that consent at any time. Note that this withdrawal does not affect the lawfulness of any Processing carried out before we receive notice of the withdrawal and does not prevent us from Processing your Personal Data based on other available legal bases.
• Right to Lodge Complaints: You have the right to lodge complaints regarding the Processing of your Relevant Personal Data with a Data Protection Authority. This may include the Data Protection Authority of the EU Member State where you reside, work, or where the alleged infringement occurred, as applicable.

This does not affect your statutory rights.

To exercise any of these rights, or to inquire about these rights or any other aspect of this Notice, or about our Processing of your Personal Data, please use the contact details provided in Section (18) below. Please be aware of the following:

• Identity Verification: In certain cases, you may need to provide evidence of your identity before we can process your request.
• Request Investigation: If your request requires establishing additional facts (e.g., determining whether any Processing is non-compliant with Applicable Law), we will investigate your request reasonably and promptly before deciding on the appropriate action.

Direct Marketing

We process Personal Data in order to contact you about our Sites or Services We contact you via different channels including email, telephone or direct mail. If we provide Sites or services to you, we may send you upcoming promotions and other information that you may be interest in. You can unsubscribe from promotional emails at any time. Unsubscribing will stop promotional emails; however, we may still contact you as needed for services you’ve requested.

• Definitions:
• Adequate Jurisdiction: A country with an adequate level of data protection, as recognized by the European Commission.
• App: Any application provided by us, including those on third-party stores.
• Applicable Laws: means any applicable statutes, laws, ordinances, orders, judgments, decrees, rules or regulations issued by any government authority, and any judicial or administrative interpretation of any of these;
• Cookie: A small file placed on your device for tracking and storing information. In this Notice, a reference to a “Cookie” includes analogous technologies such as web beacons and clear GIFs.
• Controller: The entity deciding how and why Personal Data is Processed. In many jurisdictions, the Controller has primary responsibility for complying with applicable data protection laws.
• Data Protection Authority: An independent public authority overseeing data protection compliance.
• EEA: European Economic Area.
• Non-Personal Data: information which does not enable a specific individual to be identified either directly or indirectly and that is not associated with an identified or reasonably identifiable individual.
• Personal Data: Information that identifies or could identify an individual.
• Process/Processing: Actions taken with Personal Data, such as collection, storage, or deletion.
• Processor: A third party that Processes Personal Data on behalf of the Controller.
• Profiling: any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
• Relevant Personal Data: Personal Data where we are the controller.
• Sensitive Personal Data: Personal Data about sensitive aspects like health, racial or ethnic origin, or criminal history.
• Services: As defined in our Terms and Conditions.
• Standard Contractual Clauses: Template clauses for data transfer approved by the European Commission.
• Site: Any website operated by us or on our behalf.

Cookies and similar technologies

When you visit a Site, we may place Cookies on your device or read existing Cookies, subject to obtaining your consent where required by Applicable Law. Cookies help us record information about your device, browser, preferences, and browsing habits. We process Personal Data through Cookies and similar technologies in accordance with our Cookie Policy.

Terms and Conditions

 Your use of our Sites or Services is governed by our Terms and Conditions. We recommend that you periodically review our Terms and Conditions to stay informed of any updates or changes.