Cloudswap1. Who is responsible for your data
The controller of the personal data described in this policy is [legal entity: to be completed before launch], [registration number and address: to be completed before launch] (“Cloudswap”, “we”, “us”). The controller decides why and how your personal data is processed and is responsible for it under data protection law.
For any question about this policy or about your personal data, or to exercise your rights, write to [contact email: to be completed before launch].
This policy is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and of equivalent laws, such as the UK GDPR. If the data protection law of your country gives you additional rights, we respect them as well.
2. What this policy covers
This policy applies to personal data that we process when you:
- visit the Cloudswap site or use the installed web application;
- create or carry out a swap, with or without an account;
- register for and use an optional account, including the cashback programme;
- go through identity verification at our request;
- contact our support team or otherwise write to us.
It should be read together with our Terms of Service, our AML and KYC Policy and our Cookie Policy. It does not cover third-party sites, wallets or services that we link to or that you use to send and receive coins. Those are governed by their own policies.
3. The data we collect
We collect only what we need to carry out swaps, keep the service secure and meet our legal obligations. You can make a swap without creating an account and without giving us your name or email address, unless identity verification is required.
Swap data
For each swap: the coins and networks selected, the amounts, the deposit address, your payout address, your refund address if you give one, any memo or tag, the transaction hashes, timestamps, the rate applied, the swap ID and status, and the result of the AML screening of the deposit.
Technical data
When you use the site: your IP address, the user agent of your browser or device, your language setting, the approximate country derived from your IP address, and server logs of requests. We do not determine your precise location.
Device and visit data
To protect the service from fraud and abuse, we record a random label stored in your browser and a device fingerprint: a code calculated from technical properties of your browser and device, such as screen size, time zone, language, graphics hardware and how the browser draws a test image. We also record which pages of the site you open, which part of a page is on your screen and how far you scroll, the buttons and links you press, what you type into the fields of the swap form (such as amounts, coins, wallet addresses, memos and promo codes, including before you submit the form), the time, and the page you came from. We never record passwords, email addresses or payment card details, and never record that you are typing into such fields. We use this to stop one person from reusing offers that are limited to one use, such as promo codes, to detect automated abuse, and to see how many visitors are on the site. A fingerprint does not contain your name or contact details, but it can single out your device, so we treat it as personal data. The detailed record of steps on the site is deleted after 30 days and other records of visits after 90 days; the label, fingerprint and IP address attached to a swap are kept with that swap.
Account data
If you register: your email address, your password (stored only as a salted hash, never in readable form), the history of swaps made while signed in, your cashback level and balance, and the dates of registration and sign-in.
Identity verification (KYC) data
Only if we ask you to verify your identity, as described in our AML and KYC Policy: your full name, date of birth, nationality, country of residence, images and details of a government-issued identity document, a selfie or liveness check (which may involve the processing of biometric data to compare your face with your document), and, in some cases, information and documents about the source of your funds. This data is collected through a specialised verification provider, and we receive the result of the check and the supporting records.
Communications
If you contact us: your email address or other contact details, the content of your messages, any attachments, and our replies.
Where the data comes from
Most data comes directly from you or from your device. We also receive data from public blockchains, from our payment processing provider and liquidity partners (about the status of transactions), from our blockchain analytics provider (risk assessments of deposits and addresses) and from our verification provider (results of identity checks).
What we do not collect
We never ask for or store the private keys or seed phrases of your wallets. We do not handle bank or card details, because the service is crypto-to-crypto only.
4. Purposes, legal bases and retention
The table below sets out why we process each category of data, the legal basis we rely on under Article 6 GDPR, and how long we keep it.
| Data category | Purposes | Legal basis | Retention |
|---|---|---|---|
| Swap data | Creating and executing your swap, showing its status, making refunds, handling support requests and disputes | Performance of a contract with you | At least five years after the swap, or longer if the law requires |
| Swap data and AML screening results | Screening deposits for links to illicit activity, sanctions compliance, record keeping and reporting to authorities | Compliance with a legal obligation. Where no statutory obligation applies to us, our legitimate interest in preventing money laundering, sanctions breaches and misuse of the service | At least five years after the swap, or longer if the law requires |
| Technical data | Delivering the site, protecting it against attacks, bots and abuse, preventing fraud, enforcing restricted jurisdictions, diagnosing faults | Our legitimate interests in the security and proper functioning of the service. Legal obligation where technical data forms part of a transaction record | Up to 12 months in server and security logs. Technical data attached to a swap record is kept with that record |
| Account data | Creating and securing your account, signing you in, showing your swap history, running the cashback programme, sending service emails such as password resets | Performance of a contract with you | For as long as the account exists. Deleted or anonymised within 30 days after the account is closed, except swap records that must be retained |
| Identity verification (KYC) data | Verifying your identity and the source of funds when a swap is under review, deciding whether the swap can be completed | Compliance with a legal obligation and, where no statutory obligation applies, our legitimate interest in preventing financial crime. For biometric data, your explicit consent or another ground permitted by law | At least five years after the swap to which the verification relates, or longer if the law requires |
| Communications | Answering your requests, resolving complaints, improving our support | Performance of a contract with you and our legitimate interest in handling enquiries | Up to three years after the request is closed, or with the swap record where the request concerns a swap |
| Cookie choice and optional cookies | Remembering the choice you made in the cookie banner. Using any optional categories if they are introduced in future | Strictly necessary storage: our legitimate interest and the exemption for essential storage. Optional categories: your consent | As set out in the Cookie Policy |
| Any of the above | Establishing, exercising or defending legal claims, and responding to lawful requests from courts and authorities | Our legitimate interests and compliance with a legal obligation | For the limitation period of the claim or the duration of the proceedings |
Where we rely on legitimate interests, we have weighed them against your rights and interests. You can ask us for more information about that assessment and you have the right to object, as described in section 10.
Where the data is needed to perform a contract or to meet a legal obligation, you are not obliged to provide it, but without it we cannot carry out the swap or, where verification is requested, complete it.
5. What we do not do, and automated screening
- No sale of personal data. We do not sell or rent your personal data to anyone.
- No advertising profiling. We do not build marketing or advertising profiles and we do not share your data with advertising networks.
- No marketing emails without permission. We use your email address for service messages about your account and your swaps. We will send marketing messages only where the law allows it or you have agreed, and you can opt out at any time.
Automated screening
Every incoming deposit is screened automatically by a blockchain analytics provider, which assigns a risk assessment based on the public blockchain history of the funds. A low-risk result lets the swap continue without human involvement. A higher-risk result does not by itself lead to a refusal: it pauses the swap and sends it to a person on our team for manual review. A decision not to complete a swap is therefore not based solely on automated processing.
If you believe a screening result is wrong, you can contact us at [contact email: to be completed before launch], give your point of view and ask for the review to be reconsidered. We may be legally restricted in what we can tell you about the reasons for a hold.
6. Public blockchain data
Swaps are carried out by transactions on public blockchains. Wallet addresses, amounts, transaction hashes and timestamps recorded on a blockchain are public, are visible to anyone, and are stored permanently by a decentralised network that we do not control.
This means that:
- we cannot erase, correct or restrict data that has been written to a blockchain, and your rights under section 10 apply only to the records that we hold ourselves;
- third parties may be able to link blockchain data to you using information obtained elsewhere;
- each swap has its own page, opened by its swap ID, which shows the status of the swap and the addresses involved. Anyone who has the link or the ID can view it, so keep them private.
7. Who receives your data
We share personal data only with the following categories of recipients, and only to the extent needed for the purpose stated.
- Payment processing provider. Issues the deposit address for your swap and detects the incoming payment. Receives swap data needed for that purpose.
- Liquidity and exchange partners. Execute the swap and deliver the purchased coins to your payout address. Receive the coins, amounts and addresses needed to do so, and may carry out their own compliance checks as independent controllers.
- Blockchain analytics (AML screening) provider. Assesses deposits and addresses for links to illicit activity. Receives wallet addresses and transaction hashes.
- Identity verification (KYC) provider. Collects and checks your identity documents and selfie or liveness check when verification is requested.
- Hosting and content delivery and security provider. Hosts the service and protects the site against attacks and bots. May process IP addresses and other technical data and may set security cookies.
- Email delivery provider. Sends service emails to account holders and to people who write to us. Receives the email address and the content of the message.
- Professional advisers. Lawyers, auditors and similar advisers, under duties of confidentiality, where needed.
- Authorities. Financial intelligence units, law enforcement, regulators, tax authorities and courts, where the law requires or permits disclosure, for example when reporting a suspicious transaction or answering a lawful request.
- Successors. A buyer or successor of our business in the event of a merger, acquisition or reorganisation, subject to this policy.
Providers that process personal data on our behalf act as our processors. They are bound by a written agreement, may use the data only on our instructions and must protect it appropriately. Some recipients, such as liquidity partners that run their own compliance checks, the verification provider in respect of its own legal duties, and public authorities, act as independent controllers and handle data under their own policies.
8. International transfers
Some of the recipients listed in section 7 are located, or process data, in countries other than your own, including countries outside the European Economic Area and the United Kingdom whose laws may not give personal data the same level of protection.
When we transfer personal data to such a country, we rely on one of the following safeguards:
- a decision by the European Commission, or the competent UK authority, that the country or the recipient's certification framework provides an adequate level of protection;
- standard contractual clauses approved by the European Commission, with the UK addendum where relevant, together with additional technical and organisational measures where our assessment of the transfer shows they are needed;
- in limited cases, a derogation allowed by law, for example where the transfer is necessary to perform a contract with you.
You can ask us at [contact email: to be completed before launch] for more information about the safeguards used for a particular transfer and for a copy of the relevant clauses.
9. How long we keep data
We keep personal data only for as long as it is needed for the purposes in section 4. The specific periods are shown in the table in that section. The main rules are:
- Transaction and verification records. Kept for at least five years after the swap, or longer if the law requires. This applies whether or not you have an account and continues to apply after an account is closed.
- Account data. Kept while the account exists and deleted or anonymised within 30 days after it is closed, apart from records that fall under the rule above.
- Server and security logs. Kept for up to 12 months.
- Support communications. Kept for up to three years after the request is closed.
- Legal holds. Where data is needed for an investigation, a dispute or legal proceedings, or where an authority instructs us to preserve it, we keep it until the matter is finally concluded.
When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you. Copies in backups are overwritten in the normal backup cycle.
10. Your rights
Subject to the conditions and exceptions set by law, you have the following rights in relation to your personal data.
- Access. To know whether we process your personal data and to receive a copy of it together with information about how it is used.
- Rectification. To have inaccurate data corrected and incomplete data completed.
- Erasure. To have your data deleted, for example when it is no longer needed or when you withdraw consent. This right does not apply to data that we are required to keep, in particular transaction and verification records during the AML retention period, or to data needed for legal claims. Data recorded on a public blockchain cannot be erased by us.
- Restriction. To ask us to limit the processing of your data, for example while its accuracy is being checked or while an objection is being considered.
- Portability. To receive the data you gave us in a structured, commonly used and machine-readable format, and to have it sent to another controller where technically feasible, where the processing is automated and based on a contract or on consent.
- Objection. To object, on grounds relating to your particular situation, to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests or need the data for legal claims. You can object at any time to the use of your data for direct marketing.
- Withdrawal of consent. Where processing is based on consent, to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
- Human review. To ask for human involvement, express your point of view and contest a decision that significantly affects you, as described in section 5.
- Complaint. To lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe an infringement took place. We would appreciate the chance to address your concern first.
How to exercise your rights
Write to [contact email: to be completed before launch] and tell us which right you wish to exercise. To protect your data we need to be sure that the request comes from you. If you have an account, write from the email address linked to it. If you made a swap without an account, we may ask for the swap ID and for proof that you control the wallet address involved.
We respond within one month. This period may be extended by up to two further months where a request is complex or we have received many requests, in which case we will tell you. Exercising your rights is free of charge, but we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive. In some cases the law, including the rules that prohibit disclosing the existence of an AML report, may limit what we can provide.
11. Security
We apply technical and organisational measures that are appropriate to the risk, including:
- encryption of data in transit between your device and the site;
- storage of account passwords only as salted hashes, so that we cannot read your password;
- a sign-in session cookie that is HTTP-only and cannot be read by scripts running in the page;
- protection against attacks and automated abuse provided by our hosting and security provider;
- access to personal data limited to staff and providers who need it for their role, under duties of confidentiality;
- handling of identity documents through a specialised verification provider instead of through email;
- collection of only the data needed for each purpose, and deletion when it is no longer required.
No system is completely secure. You can help by using a strong, unique password for your account, by keeping your swap links private, and by checking that you are on the genuine Cloudswap site before you make a swap. We will never ask for your private keys or seed phrase.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, the people affected, in accordance with the law.
13. Changes to this policy and contact
We may update this policy, for example when the service, our providers or the law change. The current version is always published on this page, with the date of the last update shown at the top. If a change materially affects how we use your personal data, we will give notice on the site and, where you have an account, by email before the change takes effect. Where a change requires your consent, we will ask for it.
The controller is [legal entity: to be completed before launch], [registration number and address: to be completed before launch]. For any question about this policy or your personal data, write to [contact email: to be completed before launch].