Privacy Policy

1. Data controller

The data controller for the processing carried out within the framework of the Service, within the meaning of Article 4(7) of the GDPR, is TradeX, publisher and operator of the Service.

2. Categories of data processed

The Publisher processes only the data strictly necessary for the purposes pursued, in application of the principle of data minimisation set out in Article 5(1)(c) of the GDPR. The following categories of data may, depending on the case, be processed:

• account and authentication data: email address, hashed password, authentication tokens, connection logs;
• transaction data: deposits, cashback and withdrawals carried out through the Service, together with the wallet addresses used;
• usage data: actions carried out on the Service and preferences of the Data Subject;
• technical data: IP address, browser and device identifiers, operating system, language, cookies and similar technologies.

The Publisher does not collect identity documents, proof of address, biometric data or any special category of data within the meaning of Article 9 of the GDPR.

3. No identity verification

Use of the Service does not require the Data Subject to undergo any identity verification (KYC) procedure. The Publisher does not request, collect or store any identity document, proof of address or biometric data in order to access the Service or to take part in a program. Access relies solely on the account credentials chosen by the Data Subject, who is responsible for keeping them confidential.

4. Purposes and legal bases

Each processing operation pursues a determined, explicit and legitimate purpose, based on one of the legal bases provided for in Article 6(1) of the GDPR:

• management of the Account, provision of the Service and execution of the contract: Article 6(1)(b) (performance of the contract);
• processing of deposits, cashback and withdrawals: Article 6(1)(b) (performance of the contract);
• security of the Service, prevention of fraud and abuse, audit logs: Article 6(1)(f) (legitimate interest of the Publisher in ensuring the integrity of the Service);
• compliance with accounting and legal obligations: Article 6(1)(c) (legal obligation);
• measurement of audience and improvement of the Service: Article 6(1)(a) (consent), with the right to withdraw it at any time.

5. No sharing of data with third parties

The Publisher does not sell, rent, exchange or share the personal data of Data Subjects with third parties for advertising, marketing or any other purpose of their own. The data are accessed only by the duly authorised members of the Publisher's staff.

The sole external party involved in the processing is the payment service provider, acting strictly as a processor on the documented instructions of the Publisher within the meaning of Article 28 of the GDPR, for the sole purpose of processing payments. Personal data may be disclosed beyond this only where the Publisher is legally compelled to do so by a competent authority.

6. Payments

Payments made through the Service are processed exclusively by the payment service provider NowPayments. NowPayments processes the data strictly necessary to execute the cryptocurrency transactions, under its own responsibility and in compliance with the GDPR. The Publisher does not store the Data Subject's wallet credentials or private keys.

7. Hosting, security and backups

The Service and its data are hosted on secure servers located in several regions around the world, in order to ensure the availability, performance and resilience of the Service. The Publisher implements appropriate technical and organisational measures within the meaning of Article 32 of the GDPR, including the encryption of data in transit (TLS) and at rest, strict access control, the segregation of environments, the regular updating of components and continuous monitoring.

Regular and encrypted backups are performed and stored redundantly so that the data can be restored in the event of an incident. Where data are hosted or transferred outside the European Economic Area, the Publisher ensures that the transfer is subject to appropriate safeguards within the meaning of Articles 44 et seq. of the GDPR, in particular the standard contractual clauses adopted by the European Commission.

8. Retention periods

The personal data are kept for a period not exceeding that necessary in view of the purposes for which they are processed, in accordance with Article 5(1)(e) of the GDPR:

• account and transaction data: for the duration of the contractual relationship, then archived for the duration of the applicable legal limitation periods;
• accounting data: for the legal retention period applicable to accounting records;
• connection logs and technical data: for a maximum period of one (1) year;
• consent and proof of consent: for the duration during which the processing concerned is carried out.

9. Rights of Data Subjects

In accordance with Articles 15 to 22 of the GDPR, Data Subjects have the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw their consent at any time where processing is based on consent.

These rights may be exercised at any time and free of charge directly from the settings of the Account, which allow the Data Subject in particular to access their data and to close their Account. Where a request cannot be satisfied directly through the Account, the Publisher shall respond within a maximum period of one (1) month, which may be extended by two (2) months in view of the complexity and number of requests, in accordance with Article 12(3) of the GDPR. The Data Subject also has the right to lodge a complaint with the competent supervisory authority.

10. User responsibility and absence of marketing

The Service carries out no advertising and no marketing on social networks or any other public channel, and the Publisher sends no unsolicited commercial communication.

The Data Subject is solely responsible for the use they make of the Service and of any program, and remains the sole judge of the trust they place in it. Any decision to create an Account, to deposit capital or to take part in a program is taken by the Data Subject at their own discretion and under their full responsibility.

11. Cookies and similar technologies

Cookies strictly necessary for the operation of the Service are exempt from consent. Any other cookie, in particular those used for audience measurement, is deposited only subject to the prior, free, specific, informed and unambiguous consent of the Data Subject, expressed via the dedicated banner. The Data Subject may withdraw consent at any time, with the same ease as it was given.

12. Changes to the Privacy Policy

The Publisher reserves the right to amend the Privacy Policy at any time, in particular in order to comply with regulatory or technical developments. Any substantial modification shall be notified to the Data Subject by any appropriate means before its entry into force.