Privacy Policy

1 About this policy

BOLDHASH IBC (the "Company", "we", "us", "our") operates boldhash.io, a non-custodial platform for exchanging fiat currency and virtual assets. This policy explains what personal data we collect when you visit the website or use our services, why we process it, who we share it with, how long we keep it, and what you can ask us to do with it. We are the controller of that data.
BOLDHASH IBC is licensed as a Virtual Asset Service Provider by the Kuna de Wargandí International Services Authority (KUNAISA) under licence number V0062026, and is registered at Central Street, Kunaisa Building, Nurrá-Wala-Mortí, Kuna de Wargandí Territory, Republic of Panama. For any question about this policy, or to exercise the rights in section 9, write to support@boldhash.io.
Read this policy together with our Terms and Conditions, AML and KYC Policy, Cookie Policy and Restricted Jurisdictions Notice.

2 What we collect, and where it comes from

Most of what follows is collected because we are required to collect it: we cannot open an account, execute an order or keep a relationship open without it. The rest is generated automatically when you use the Platform.
Registration data — name, surname, email address, password. From you.
Identity data — a photograph of your passport or identity card and the data it contains; date of birth; nationality; a liveness check confirming your physical presence and matching your face to the document. From you, through our identity-verification provider.
Due diligence data — country of residence, income, origin of assets, professional or business activity, expected account turnover, and the purpose of the relationship. Where enhanced due diligence applies, documentary evidence of source of wealth and source of funds, such as payslips, bank or brokerage statements, or sale and investment contracts. From you, through our identity-verification provider.
Due diligence data — country of residence, income, origin of assets, professional or business activity, expected account turnover, and the purpose of the relationship. Where enhanced due diligence applies, documentary evidence of source of wealth and source of funds, such as payslips, bank or brokerage statements, or sale and investment contracts. From you, through our identity-verification provider.
Screening results — matches and risk indicators from sanctions, politically-exposed-person and adverse-media screening, and the risk classification we assign to you. From our screening provider and our own review.
Transaction data — orders, amounts and currencies; the bank account used for the fiat leg; wallet addresses used for the virtual asset leg; blockchain transaction identifiers; and originator and beneficiary information for transfers subject to the Travel Rule. From you, and from payment and blockchain records.
Wallet risk data — screening results for incoming and outgoing wallet addresses, including exposure to darknet markets, stolen-asset and exchange-hack wallets, mixing services and sanctioned addresses. From our blockchain-analytics provider.
Technical data — IP address, geolocation indicators, device and browser information, and access and activity logs. Collected automatically.
Correspondence — your communications with our support and compliance teams, and any complaint you submit. From you.

3 Why we process it

We process personal data for the following purposes, and not for others:
\(a\) to register and operate your account and to execute the orders you place;
\(b\) to verify your identity before the relationship begins and to keep your information current while it continues;
\(c\) to screen you, and where relevant your counterparties, against United Nations, OFAC, European Union and United Kingdom sanctions lists, and for politically-exposed-person status and adverse media, on an ongoing basis;
\(d\) to obtain, hold and where applicable transmit originator and beneficiary information for virtual asset transfers subject to the Travel Rule;
\(e\) to monitor transactions and screen wallet addresses for exposure to illicit sources;
\(f\) to confirm that the bank account and wallet used for an order belong to you, and to detect fraud, impersonation and unauthorised access;
\(g\) to determine whether our services are available in your jurisdiction and to enforce the restrictions in our Restricted Jurisdictions Notice;
\(h\) to keep the records we are required to keep, to handle complaints, and to respond to lawful requests from KUNAISA and other competent authorities; and
\(i\) to maintain the security, availability and integrity of the Platform.
Where the law that applies to you requires your consent for a particular activity, we will ask for it and you may withdraw it. Withdrawing consent does not affect processing we must carry out to meet a legal or regulatory obligation.

4 Who we share it with

We use a small number of specialist providers, which act on our instructions and under confidentiality and data-protection obligations:
> • Sum and Substance Ltd (Sumsub), United Kingdom — identity and > document verification, liveness checks, sanctions, > politically-exposed-person and adverse-media screening, ongoing > monitoring and case management, and our Travel Rule solution. > > • Crystal Blockchain B.V. (Crystal Intelligence), Netherlands — > blockchain analytics: wallet and transaction screening, risk scoring, > entity attribution and tracing of funds.
We also share personal data, to the extent necessary, with our banking and payment partners, our liquidity providers, and our hosting, IT security and professional advisers.
Where we rely on a third party to perform elements of customer due diligence, we obtain the resulting information from that party immediately, satisfy ourselves that it is regulated, supervised and keeps due diligence records, and remain ultimately responsible for the adequacy of that due diligence.
We do not sell personal data and we do not share it for anyone else's marketing.

5 Disclosure to authorities

We disclose personal data to KUNAISA and to other competent authorities where we are required to do so by law, by our licensing conditions, or in response to a lawful request, order or investigation. We may also disclose data to legal advisers and auditors, and to a successor entity if our business or part of it is transferred.
Where we make or consider an internal suspicious activity report, we are prohibited by law from telling you that a report has been or may be made, or that an investigation is being or may be carried out. In those circumstances we cannot explain a decision to you, and may not be able to give advance notice of it.

6 Data processed in other countries

Our providers operate outside the Kuna de Wargandí Territory, including in the United Kingdom and the Netherlands as set out in section 4, and our infrastructure may be hosted elsewhere. Your personal data may therefore be processed in countries whose laws differ from those of your own country, and may be subject to lawful access by the courts, regulators or law-enforcement authorities of those countries. Where we transfer data we do so under contractual and technical safeguards intended to keep the level of protection consistent with this policy.

7 How long we keep it

We retain due diligence records, identity and verification documents, screening results, transaction records, correspondence and supporting analysis for a minimum of five years after the end of the business relationship or the conclusion of the transaction, in line with the FATF Recommendations, and for longer where a law or a competent authority requires it. This retention continues after you close your account.
Records are stored securely and are retrievable on request by KUNAISA or another competent authority. When data is no longer required for any purpose described in this policy, we delete or anonymise it.

8 Security, and automated checks

We apply technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure and loss: role-based access on a need-to-know basis, encryption of data in transit and at rest, secure hosting, access and activity logging, confidentiality obligations on our personnel, and due diligence on the providers we engage. No system can be guaranteed secure. You are responsible for the confidentiality of your account credentials and the security of your device, and must tell us without undue delay if you suspect unauthorised access.
Identity verification, sanctions and adverse-media screening, wallet screening and transaction monitoring use automated tools that generate matches, alerts and risk scores, and we assign each client a risk classification partly on that basis. Automated output does not decide matters on its own: alerts and higher-risk cases are reviewed by the Compliance Officer, and higher-risk relationships are approved by senior management on the Compliance Officer's recommendation, with joint approval for politically exposed persons.

9 Your rights

Subject to the law that applies to you, you may ask us to:
> • confirm whether we hold personal data about you and give you access > to it; > > • correct data that is inaccurate or incomplete; > > • delete data, where we are not required to keep it; > > • restrict or object to a particular processing activity, where that > right applies; and > > • withdraw consent, where consent is the basis on which we process the > data.
These rights are limited by our legal obligations. We cannot delete or amend records we are required to retain under section 7, and we cannot disclose the content of suspicious activity reporting, the internal detail of our screening and monitoring systems, or information whose disclosure would prejudice an investigation or breach a legal prohibition.
Send requests to support@boldhash.io. We may ask you to verify your identity before we act on a request, and will respond without undue delay and in any event within thirty days. If you are not satisfied with our response, use the complaints procedure in our Terms and Conditions and, if the matter remains unresolved, refer it to the KUNAISA complaints centre.

On this page

1

About this policy

2

What we collect, and where it comes from

3

Why we process it

4

Who we share it with

5

Disclosure to authorities

6

Data processed in other countries

7

How long we keep it

8

Security, and automated checks

9

Your rights

10

Cookies

11

Age

12

Changes to this policy