Privacy policy
General information
How do we collect information about you?
We may collect personal data about you – meaning any information that can identify you – in several ways:
1. Information you provide directly
You share information with us when you:
Register on our website.
Enter into an agreement with us for services.
Install and use our applications.
Subscribe to newsletters or other communications.
Participate in surveys.
Contact us by phone or other channels.
2. Information we collect automatically
We automatically collect certain information when you:
Submit inquiries through our registration system or social media accounts.
Use our website (via cookies and similar technologies – see Cookies Policy below).
Make public posts on social media platforms that we monitor.
3. Information from third parties and public sources
Where allowed by law, we may also obtain information about you from:
Business partners or marketing agencies.
Publicly available profiles (e.g., LinkedIn, Facebook, Twitter, Instagram).
Company websites or other public and commercial sources.
We may combine this data with information you provide directly or that we collect automatically.
4. Other contexts
We may also collect personal data in situations not described in this Privacy Notice. If that happens, we will inform you at the time of collection.
What information (personal data) about you do we process?
Although we aim to collect as little of your personal information as possible, we may collect the following types of data:
1. Information you provide directly
This includes:
Data necessary to provide our services (e.g., details in contracts or registration forms).
Information shared in surveys or during calls with us.
Your preferences and interests.
Data required to verify your age and identity.
Contact details such as phone number and email.
Examples: when we provide services to you, we may process your name, surname, address, passport details, payment method, credit card number and expiry date, and contact details such as email (for confirmations) or phone number.
2. Information we collect automatically
This generally relates to your use of our website and includes:
Device information: IP address, operating system version, and device settings.
Log data: time and duration of sessions, search queries, and cookie data (see our Cookies Policy below).
Location data: general location of your device when accessing our content or services.
3. Information from third parties and public sources
We may also obtain information such as:
Your name, surname, email address, country.
Your preferences and interests.
Publicly available data from platforms like LinkedIn or your company’s website.
4. Important note
You may choose not to provide certain information (for example, requested in the registration form). However, without it, you may not be able to register on our website or access our services.
Purposes and legal basis of data processing
We use the information we collect for the following purposes:
Providing services – including payment services and information you request.
Marketing – delivering personalized ads, sponsored content, and sending promotional communications.
Research and analysis – assessing our market, clients, products, and services; requesting your feedback; running surveys, competitions, or promotions (where permitted by law).
Legal protection – safeguarding our interests before courts or other institutions.
With your consent – for specific purposes requiring it.
You can opt out of our direct marketing communications at any time. To do so, simply email us at support@crimsonexchange.io or click the unsubscribe link included in our newsletters.
We process your personal data based on one or more of the following legal grounds:
Compliance with legal obligations.
Performance of a contract with you.
Our legitimate interests, provided they are not overridden by your rights and freedoms.
Your consent, in cases where this is required.
To whom we disclose your personal data?
We may share your personal data with the following categories of recipients:
Service providers – companies that deliver services on our behalf.
Financial institutions – banks and payment service providers.
Other parties – when required by law or when necessary to protect our legitimate interests.
In certain cases, we may also disclose information to third parties such as government authorities, payment sector regulators, investigative bodies, or courts, if such disclosure is required by law or is necessary to safeguard our legitimate interests.
How do we protect information about you?
Rights that you have
The data subject whose personal data are processed by the Data Controller has the following rights, depending on the situation:
Right to be informed – to know about the processing of their personal data.
Right of access – to access their personal data and receive information on how it is being processed.
Right to rectification – to request corrections to inaccurate data or completion of incomplete data, considering the purposes of processing.
Right to erasure (“right to be forgotten”) – to request deletion of personal data or suspension of its processing (except storage).
Right to restriction of processing – to request limitation of data processing if there are legitimate grounds.
Right to object – to object at any time to the processing of personal data carried out for public interest tasks or legitimate interests of the Controller or a third party. In such cases, the Controller must demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject.
Right to data portability – to request transfer of personal data to another controller.
Right to lodge a complaint – to submit a complaint to the State Data Protection Inspectorate.
We provide simple ways to exercise these rights: you can contact us at support@crimsonexchange.io or use the links included at the end of our promotional messages.
Please note that in some cases, these rights may be limited by law in order to ensure the prevention, investigation, and detection of crimes, breaches of official or professional ethics, as well as to protect the rights and freedoms of the data subject or other individuals.