CRX, a product of CRX Digital Asset Services, respects your privacy as a visitor to our site crx.ie. It is important for you to understand what information we collect about you during your visit and what we do with that information. This Privacy Policy covers all data collection and processing activities across our platform including cryptocurrency trading, KYC verification, payment processing, portfolio management, and referral programs.

Information Collection and Use

We collect your account data, which may include personal identification information such as your name, date of birth, age, nationality, gender, signature, utility bills, photographs, phone number, home address, and/or email address, and formal identification information such as Tax ID number, passport number, drivers license details, national identity card details, photograph identification cards, and/or visa information (collectively, Account Data). The Account Data may be processed for the purposes of providing to you our Services, satisfying anti-money laundering and know-your-customer obligations, and ensuring the security of the Services, maintaining back-ups of our databases and communicating with you. This information is necessary for the adequate performance of the contract between you and us and to allow us to comply with our legal obligations. Without it, we may not be able to provide you with all the requested Services. We process financial information such as bank account, credit card or UPI information when you order Services in order to facilitate the processing of payments (Payment Information). The legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract and our legitimate interests, namely our interest in the proper administration of our website and business.

KYC Data Processing and Third-Party Sharing

When you provide KYC documentation for identity verification, we collect, process, and share your identity verification data with authorized third-party KYC service providers including but not limited to Persona and other compliance verification services. This includes sharing your personal identification documents, photographs, address verification documents, and biometric data with these third-party providers for verification purposes. We retain KYC data for a minimum of 5 years after account closure as required by anti-money laundering regulations. Third-party KYC providers may process your data in accordance with their own privacy policies and may be located outside your jurisdiction. By using our KYC services, you consent to the international transfer and processing of your identity verification data by our authorized third-party providers for compliance and verification purposes.

Cryptocurrency Transaction Data Collection and Retention

We collect and retain comprehensive cryptocurrency transaction data including but not limited to: transaction amounts, cryptocurrency wallet addresses (both sending and receiving), transaction timestamps, blockchain transaction hashes, market prices at time of transaction, fee calculations, and settlement amounts. This transaction data is retained indefinitely for regulatory compliance, tax reporting obligations, and audit purposes. We may share transaction data with regulatory authorities, tax authorities, and law enforcement agencies as required by applicable laws. Transaction data may also be shared with blockchain analytics providers for compliance monitoring and fraud prevention. All cryptocurrency transactions are recorded on public blockchains and may be permanently visible to third parties regardless of our data retention policies.

UPI Payment Data Processing for Indian Compliance

For users utilizing UPI (Unified Payments Interface) payment methods, we collect and process UPI-specific data including UPI ID, Virtual Payment Address (VPA), bank account details linked to UPI, transaction reference numbers, and payment authentication data. This UPI payment data is processed in compliance with Reserve Bank of India (RBI) guidelines and Payment and Settlement Systems Act, 2007. UPI payment data is shared with authorized payment service providers, banks, and the National Payments Corporation of India (NPCI) as required for transaction processing and regulatory compliance. We retain UPI payment data for a minimum of 10 years as required by Indian banking regulations. UPI payment data may be processed and stored within India and may be subject to Indian data localization requirements.

Referral Program Data Collection and Social Connections

When you participate in our referral programs, we collect referral-specific data including referral codes, referee information, referral rewards earned, social media connections used for referrals, and referral relationship mapping. We may collect contact information of individuals you refer to our platform, including their email addresses, phone numbers, and social media profiles. Referral data is used to track program participation, calculate rewards, prevent fraud, and improve our referral services. We may share aggregated referral program statistics with marketing partners while maintaining individual privacy. Referral data is retained for the duration of your account plus 3 years for reward calculation and tax reporting purposes. You are responsible for obtaining appropriate consent from individuals before referring them to our platform.

Portfolio and Investment Data Processing

We collect and process comprehensive portfolio and investment data including cryptocurrency holdings, portfolio valuations, investment performance metrics, trading history, profit/loss calculations, asset allocation data, and investment preferences. This portfolio data is used to provide portfolio management services, generate investment reports, calculate tax obligations, and provide personalized investment insights. Portfolio data may be shared with authorized financial service providers, tax preparation services, and regulatory authorities as required. We retain portfolio and investment data for a minimum of 7 years after account closure for tax reporting and regulatory compliance purposes. Portfolio data accuracy depends on market data feeds and blockchain information, and we disclaim responsibility for data accuracy beyond our reasonable control.

Third Parties and Retention of Information

We may retain other companies and individuals to perform functions on our behalf. Examples include KYC verification providers (such as Persona), payment processors, UPI service providers, blockchain analytics firms, data analysis companies, and web hosting services. Such third parties may be provided with the information described above including personal identification data, transaction information, and payment details. Third-party service providers may process your data in their own jurisdictions and in accordance with their privacy policies. We require third-party providers to maintain appropriate data protection standards, but we cannot guarantee their data handling practices. A list of current third-party service providers may be provided upon request where permitted by applicable law. We retain personal information and sensitive personal information only as long as necessary for the purposes for which it has been collected, subject to minimum retention periods required by applicable laws and regulations including anti-money laundering, tax, and financial services regulations.

Data Security

We have implemented measures designed to secure your personal data from accidental loss and from unauthorized access, use, alteration and disclosure. However, cryptocurrency transactions, blockchain data, and digital asset holdings involve inherent security risks that cannot be eliminated. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of the Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Unfortunately, the transmission of information via public networks such as the internet is not completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted through the Services. Any transmission of personal data is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained on the Services. You acknowledge that cryptocurrency transactions are irreversible and that we cannot recover funds lost due to security breaches, user error, or unauthorized access to your account.

Data Subject Rights and Access Procedures

Subject to applicable data protection laws, you may have certain rights regarding your personal data including the right to access, correct, delete, or restrict processing of your personal data. However, these rights may be limited by regulatory requirements for data retention in the financial services and cryptocurrency sectors. To exercise your data subject rights, please contact us at support@crx.ie with your specific request and appropriate identity verification. We will respond to valid requests within the timeframes required by applicable law. Please note that certain data deletion requests may not be possible due to regulatory compliance requirements, ongoing legal obligations, or the immutable nature of blockchain transactions. We may charge reasonable fees for processing complex or repetitive data access requests as permitted by applicable law.

International Data Transfers and Jurisdictional Compliance

Your personal data may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home country. This includes transfers to third-party service providers, regulatory authorities, and blockchain networks that operate internationally. By using our Services, you consent to the international transfer of your personal data for the purposes described in this Privacy Policy. We implement appropriate safeguards for international data transfers where required by applicable law, but cannot guarantee that foreign jurisdictions will provide equivalent data protection standards.

Contact Us

If you have any queries regarding our policies please contact us via e-mail at support@crx.ie. For data protection inquiries specifically, please include 'Privacy Policy' in your subject line and provide detailed information about your request including appropriate identity verification.