Privacy Policy

1. Who we are

This Privacy Policy describes how Emoney Service ("we", "us" or "our") processes personal data of Customers and visitors of this digital service (the "Service").

Questions about privacy can be sent through the support channels published in the Service.

2. Categories of personal data we process

Depending on how you use the Service, we may process the following categories of personal data:

• Account data — email address, password (stored as a hash), preferred language, two-factor authentication settings.
• Identity and KYC data — full name, date of birth, nationality, identity-document number and image, selfie and liveness check, residential address. Collected only when Customer Due Diligence is required.
• Transaction data — Order IDs, source and destination addresses, amounts, timestamps, deposit transaction hashes, network confirmations and the identity of the relevant liquidity partner.
• Communication data — content of support enquiries (email, chat, Telegram), the channel used and the time of contact.
• Technical data — IP address, browser type and version, language preferences, timezone, device fingerprint information used for security purposes, authentication session cookies.
• OTC meeting data — Telegram username or phone number provided in an OTC request, agreed meeting location and time.

3. Sources of personal data

We collect personal data (a) directly from you when you register, create an Order, complete KYC, or contact us, (b) automatically when you use the Service (technical data), and (c) from third parties where required for security or compliance, including screening and identity-verification providers.

4. Purposes of processing and legal bases

We process personal data for the following purposes:

• To provide the Service and execute Orders requested by you — legal basis: performance of a contract.
• To comply with anti-money-laundering, sanctions and tax obligations — legal basis: compliance with a legal obligation.
• To prevent fraud and protect the security of the Service — legal basis: our legitimate interest in operating a secure exchange.
• To respond to support enquiries and complaints — legal basis: performance of a contract or our legitimate interest.
• To send marketing communications — legal basis: your consent, which you may withdraw at any time.

5. Recipients and subprocessors

Personal data may be shared with the following categories of recipients:

• Service providers supporting the Service, such as hosting, security, communication, analytics, screening, and identity-verification providers.
• Law enforcement and supervisory authorities, where required by law or by a binding order from a competent authority.
• Professional advisers, including lawyers and auditors, under appropriate confidentiality obligations.

We do not sell personal data to third parties.

6. International transfers

Some service providers may process data outside your country of residence. Where transfers require safeguards under applicable data-protection rules, we use appropriate contractual and technical measures to help keep your data protected.

7. Retention

We retain personal data only as long as necessary for the purposes set out above, including security, dispute handling, fraud prevention, and record-keeping needs. After the applicable retention period expires, we either delete or anonymise the relevant personal data.

8. Your rights

Subject to the applicable law, you have the following rights:

• Right of access — to obtain confirmation of whether we process your personal data and a copy of that data.
• Right of rectification — to have inaccurate data corrected and incomplete data completed.
• Right of erasure — to have your data deleted, subject to exceptions for legal obligations such as AML record-keeping.
• Right to restriction — to limit the way we process your data while a dispute is being resolved.
• Right to data portability — to receive your data in a structured, commonly used machine-readable format.
• Right to object — to processing based on our legitimate interests or for direct marketing.
• Right to withdraw consent — for processing based on consent, at any time, without affecting the lawfulness of prior processing.

You may also have the right to lodge a complaint with the supervisory authority responsible for personal-data protection in the country where you reside.

9. How to exercise your rights

To exercise any of the rights set out in section 8, please contact us through the support channels published in the Service. We will respond within a reasonable period after receipt of your request and may request additional information to verify your identity. There is no fee for exercising these rights, except in cases of manifestly unfounded or excessive requests.

10. Automated decision-making

We do not make decisions producing legal effects on you based solely on automated processing, except for automated transaction-monitoring rules used for AML and fraud prevention. In such cases you have the right to obtain human review of the decision.

11. Security

We apply technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, encryption in transit, regular security reviews, and staff training. No system is perfectly secure; we cannot guarantee the security of data transmitted to or from the Service.

12. Cookies

We use a minimal set of cookies to operate the Service. Details, including how to refuse non-essential cookies once we introduce them, are set out in our Cookie Policy.

13. Children

The Service is not directed at persons under 18 and we do not knowingly process personal data of children. If you believe a child has provided personal data to us, please contact us so we can delete it.

14. Updates

We may amend this Privacy Policy from time to time. The current version is always available in the Service. Material changes will be notified through the Service.

15. Contact

For any question about this Privacy Policy or how we process your data, please use the support channels published in the Service.