PRIVACY POLICY

Updated October 7, 2026

This Privacy Policy describes the procedure for the collection, use, storage and protection of Users' personal data when using the Service casa-exchange.com (hereinafter — the “Company”).

The Company processes Users' personal data in accordance with applicable data protection legislation requirements, as well as internal security procedures.

By using the Service, the User confirms that they have read this Privacy Policy and accept its terms.
For matters related to the processing of personal data, the User may contact by email: [email protected].

1. What is personal data?

Personal data is any information relating to an identified or identifiable natural person (“User”) which, by itself or in combination with other information, allows the identity of such person to be established directly or indirectly.
Personal data may include, but is not limited to:

  • name and other identification data;

  • location data;

  • contact information;

  • technical data, such as IP address, device data, browser and operating system information;

  • other information allowing the User to be identified.

2. Lawful grounds for processing personal data

The Company processes Users' personal data on the following lawful grounds:

  • performance of the contract — processing is necessary to provide the Service in accordance with the Rules;

  • compliance with legal obligations — including AML/CTF requirements, fraud prevention and other applicable requirements;

  • legitimate interests of the Company — including ensuring the security of the Service, risk management and improving the quality of services provided;

  • User consent — in cases where such consent is required in accordance with applicable requirements.

In cases where personal data processing is carried out on the basis of consent, such consent is considered to have been provided by the User when using the Service or performing the relevant actions provided for by the functionality of the Service.

3. Collection and processing of personal data

The Company processes personal data provided by the User, as well as data automatically collected when using the Service.
The categories of data processed include, but are not limited to, the following:

  • Personal data provided by the User: first name, last name and other identification data, contact information (telephone number, email address); residential address and other information provided when using the Service or contacting support service.

  • Data for identification and verification purposes (KYC/AML): data from identity documents (for example, passport, ID card and other documents); documents confirming residential address; information and documents relating to the source of funds (SoF) and, where necessary, source of wealth (SoW).

The specified data is processed for the purposes of identifying the User, fulfilling AML/CTF requirements and preventing unlawful activity.

  • Transaction data: information about operations carried out through the Service, including dates, amounts, currencies, exchange rates and operation statuses; data on crypto addresses, wallets and other details used to conduct transactions.

  • Technical data: IP address, device and browser data; type and version of the operating system; date and time of access; interface language and other parameters of Service use.

  • Cookies files and similar technologies: the Company uses cookies and other technologies to ensure the proper operation of the Service, analyze usage and improve the user experience.Cookies may be installed both by the Company and by trusted third parties providing analytical and other services.

The User has the right to manage cookie settings through their browser settings.

4. Purposes of data processing

The Company processes Users' personal data for the following purposes:

  • Provision of the Service — processing applications for cryptoasset exchange, carrying out operations, keeping records and ensuring the proper functioning of the Service;

  • Identity identification and verification — checking and confirming the User's identity, as well as carrying out procedures in accordance with applicable requirements and internal AML/CTF procedures;

  • Compliance with applicable requirements — fulfillment of the Company's obligations, including AML/CTF requirements, prevention of fraud and other unlawful activities, as well as interaction with competent authorities;

  • Security and risk management — detection, prevention and investigation of suspicious activity, protection of the Service and Users;

  • Analytics and Service improvement — analysis of Service usage, optimization of its functionality, prevention of technical failures and improvement of the user experience;

  • Communication with the User — sending notifications related to the use of the Service, security of operations, updates and other aspects of service provision.

5. Transfer of data to third parties

The Company has the right to transfer Users' personal data to third parties in the following cases:
5.1. For the purpose of complying with applicable requirements
Personal data may be disclosed to competent government authorities, law enforcement authorities or other authorized organizations where there are lawful grounds, including compliance with legal requirements, requests within investigations or judicial proceedings, as well as for the purpose of preventing fraud and other unlawful activities.
5.2. To service providers and partners
Personal data may be transferred to third parties involved in the provision of the Service, including, but not limited to:

  • providers of identification and verification services (KYC/AML);

  • analytical and technology providers;

  • payment services and financial institutions;

  • partners involved in transaction processing.

Data is transferred to the extent necessary to perform the relevant functions and provide the Service.
5.3. Within the framework of ensuring security and risk management
The Company has the right to transfer data to third parties if such transfer is necessary to detect, prevent or investigate fraud, violations of the terms of use of the Service or other risks.
The Company takes reasonable measures to ensure the protection of personal data when transferring it to third parties, including the application of contractual, technical and organizational measures.

6. User rights regarding personal data

Depending on applicable legal requirements and jurisdiction, the User may have the following rights regarding their personal data:

  • Right of access — obtaining information about personal data processed by the Company, as well as about the purposes and methods of its processing;

  • Right to rectification — request to make changes to inaccurate or incomplete personal data;

  • Right to erasure — request to delete personal data in cases provided for by applicable requirements;

  • Right to restriction of processing — request to restrict the processing of personal data in cases established by law;

  • Right to object — objection to the processing of personal data in cases provided for by applicable requirements;

  • Right to withdraw consent — withdrawal of previously provided consent to the processing of personal data (in cases where processing is carried out on the basis of consent);

  • Right to data portability — obtaining personal data in a structured, commonly used and machine-readable format, as well as transferring it to another operator, if technically possible.

The User has the right to exercise the specified rights by sending a corresponding request using the contact details specified in this Policy.
If the User believes that their rights have been violated, they have the right to file a complaint with the competent data protection authority in accordance with applicable requirements.

7. Storage of personal data

The Company stores personal data for the period necessary to achieve the purposes of its processing, or for the periods provided for by applicable requirements.
Certain categories of data, including data obtained within the framework of identification and verification procedures (KYC/AML), may be stored for a period of at least 5 (five) years after termination of the relationship with the User, unless a longer period is provided for by applicable requirements.
The exercise of the User's rights, including the right to delete personal data, may be restricted in cases where the processing and storage of such data are mandatory in accordance with applicable requirements.

8. Transfer of personal data outside the jurisdiction

Within the framework of providing the Service, the Company may transfer personal data outside the country of residence of the User, including jurisdictions where the Company's servers, service providers or partners are located.
Such transfer is carried out for the purpose of fulfilling contractual obligations, complying with applicable requirements, as well as ensuring the functioning of the Service.
The Company takes reasonable measures to ensure an appropriate level of protection of personal data during its cross-border transfer, including the application of contractual, organizational and technical protection measures.

9. Security of personal data

The Company applies technical and organizational measures aimed at protecting personal data from unauthorized access, use, disclosure, alteration or destruction.
Despite the measures taken, the transfer of data through public networks, including the Internet, as well as its electronic storage, cannot be completely protected from all risks. The Company takes reasonable measures to ensure data security, however, it cannot guarantee absolute security of its transfer and storage.
Use of the Service implies the User's understanding of these risks.

10. Changes to the Policy

The Company has the right from time to time to make changes to this Policy. The current version of the Policy is published on the Service with the date of the last update indicated. The User is recommended to regularly review the current version of the Policy.

11. Contact Information

For matters related to this Policy and the processing of personal data, the User may contact by email: [email protected]. Requests are considered by the Company within a reasonable period in accordance with internal procedures.