Privacy Policy

1General provisions

The personal data controller is the TrustEx.best service. Contact details for data-related enquiries are provided in section 12 of this Policy.

This Policy applies to all visitors of the website, registered users and clients of the Service, regardless of whether they have completed any transactions.

The Policy governs the processing of personal data carried out by the Service directly or with the involvement of third parties acting as data processors.

The Service processes the minimum amount of personal data necessary to provide exchange services and meet AML / KYC obligations.

2What data we collect

The categories of personal data collected depend on the purpose of processing and the type of service. We may collect and process the following categories of data:

• identification data — full name, date of birth, citizenship, ID document series and number (for KYC verification);
• contact data — email address, Telegram username, phone number (optional);
• financial data — bank card / account details, cryptocurrency addresses and wallets, transaction hashes, amounts, currencies;
• technical data — IP address, device identifier, browser type, operating system, referrer, visit parameters;
• AML data — Risk Score results, blockchain analytics, Source of Funds information, data received from AML / KYT providers;
• KYC documents — photo or scan of an identity document, selfie with the document, proof of address (if required);
• other information voluntarily provided by the user when contacting support or filling in Service forms.

3Purposes and legal grounds for processing

Personal data is processed for the following purposes and on the following legal grounds:

• provision of exchange services and performance of the user agreement — Article 6(1)(b) GDPR;
• compliance with legal requirements, including AML / CTF and sanctions law — Article 6(1)(c) GDPR;
• protection of the Service's legitimate interests, including fraud prevention, system security, protection of rights and property — Article 6(1)(f) GDPR;
• user consent — for marketing communications, bonus programmes, analytics, use of optional cookies — Article 6(1)(a) GDPR;
• protection of vital interests of the user or third parties — in exceptional cases, Article 6(1)(d) GDPR.

4Cookies and analytics

The Service uses cookies and similar technologies to enable the website to operate, maintain user sessions, prevent fraud and collect anonymised statistics.

Types of cookies in use:

The Service does not use third-party cookies for advertising targeting without explicit user consent.

The user can manage cookies through their browser settings. Disabling necessary cookies may limit the functionality of the Service.

• strictly necessary (technical) — required for site operation, authentication, form protection, language and theme selection;
• analytics — anonymised visit statistics (e.g. Google Analytics);
• functional — saving interface settings and user preferences;
• marketing — only with explicit user consent.

5Sharing data with third parties

The Service does not sell or share personal data with third parties for marketing or other commercial purposes. Data may be shared only in the following cases:

All engaged third parties are required to provide a level of data protection no lower than that set out in this Policy and applicable law.

• AML / KYT providers (including but not limited to Chainalysis, Crystal and similar blockchain analytics services) — for verifying the source of funds;
• infrastructure partners (including GetBlock, hosting / email / SMS / database providers) — to the extent necessary to provide services;
• payment processors and partner banks — when carrying out payouts to bank details;
• competent authorities, regulators and law-enforcement bodies — on the basis of a lawful request or to comply with AML / CTF and sanctions law;
• legal, audit and tax consultants — under confidentiality obligations.

6Retention and processing periods

Personal data retention periods are determined by the purpose of processing and statutory requirements:

After the established periods, data is deleted or anonymised in a manner that prevents its recovery.

• data on completed transactions and related AML materials — at least 5 years from the completion of the transaction, in accordance with AML / CTF requirements;
• KYC documents and user records — 5 years from the end of the business relationship;
• technical logs and cookies — up to 12 months;
• support enquiries — up to 3 years from the date the case was closed;
• marketing consents — until the user withdraws consent.

7Data protection and security

The Service applies organisational and technical measures to protect personal data against unauthorised access, modification, disclosure or destruction:

The Service never asks users for passwords, seed phrases, private keys or 2FA codes. Any such requests are fraudulent.

• encryption of data in transit using HTTPS / TLS;
• storage of passwords in hashed form using strong algorithms (bcrypt / argon2);
• two-factor authentication (2FA) for the user's account;
• access to data restricted under the principle of least privilege;
• regular security audits and infrastructure updates;
• encrypted backups;
• monitoring of suspicious activity and security incident response.

8User rights

Under applicable law, including GDPR, the user has the following rights in relation to their personal data:

Some data cannot be deleted before the mandatory retention period established by AML / CTF and tax law expires.

Requests should be sent to privacy@ecash.expert or via the contact form. The Service will respond within 30 calendar days.

• right of access — to obtain confirmation of processing and a copy of the data;
• right to rectification — to request correction of inaccurate or incomplete data;
• right to erasure (right to be forgotten) — to request deletion when processing is no longer required;
• right to restriction of processing in certain cases;
• right to object to processing based on legitimate interests or for marketing purposes;
• right to data portability — to receive a copy in a machine-readable format;
• right to withdraw consent — at any time, without giving reasons;
• right to lodge a complaint with a data protection supervisory authority.

9International data transfers

Some of the infrastructure and analytics providers engaged by the Service may be located outside the European Economic Area and Ukraine.

Personal data is transferred to such jurisdictions only where appropriate safeguards are in place — including Standard Contractual Clauses, European Commission Adequacy decisions, or other legal grounds under applicable law.

10Minors

The Service is not intended for persons under 18 and does not provide services to minors.

We do not knowingly collect personal data of persons under 18. If we become aware of such data, it will be deleted promptly.

If you are a parent or legal guardian and believe a minor has provided personal data to the Service, please contact us — we will delete it promptly.

11Policy updates

The Service may amend and supplement this Policy at its discretion. The current version is always available at /privacy-policy and in the website footer.

Material changes are published with the effective date. The Service may also send an additional notice to the email address provided at registration.

Continued use of the Service after publication of an updated Policy constitutes user agreement to its new provisions.

12Contacts

For matters relating to the processing of personal data and exercising rights granted by applicable law, please contact:

• E-mail: privacy@ecash.expert;
• General support: support@ecash.expert;
• Telegram: @ecash_expert;
• Through the contact form at /contact.

Last updated: 2026