Privacy Policy

This Privacy Policy explains how PallyX (“PallyX”, “we”, “us”) collects, uses, shares, and protects your personal data when you use our website, applications, and services (the “Platform”). As a custodial crypto marketplace, we are subject to financial-services and anti-money-laundering obligations that require us to collect and retain certain information.

We collect:

• Account data — name, email, phone number, country, and password credentials.
• Identity (KYC) data — government ID, selfie/liveness, proof of address, date of birth, and nationality, collected through our verification provider.
• Transaction data — deposits, withdrawals, trades, conversions, balances, wallet/deposit addresses, and counterparties.
• Compliance data — sanctions/PEP screening results and on-chain risk signals.
• Communications — trade-chat messages and dispute evidence you submit.
• Technical data — IP address, approximate location, device and browser information, and usage logs.

We use your data to operate the Platform and provide custody and escrow; to verify your identity and meet KYC/AML and sanctions obligations; to process deposits, withdrawals, trades, and conversions; to detect and prevent fraud and abuse; to enforce geographic restrictions; to provide support and resolve disputes; and to comply with legal and regulatory requirements.

Where applicable law requires a legal basis, we rely on performance of our contract with you, compliance with legal obligations, our legitimate interests in operating a safe Platform, and your consent where relevant. You may withdraw consent where processing is based on it, without affecting prior processing.

We share personal data with:

• Service providers — identity verification, custody, liquidity/conversion, payments, sanctions screening, cloud hosting, analytics, and communications providers, acting on our instructions.
• Other users — limited trade information necessary to complete a trade (e.g. within the trade room).
• Authorities — regulators, law enforcement, and tax authorities where legally required.

We do not sell your personal data.

Your data may be processed in countries other than your own. Where we transfer data internationally, we use appropriate safeguards as required by applicable data-protection law.

We retain your data for as long as your account is active and for the period required to meet our legal, regulatory, and AML record-keeping obligations after your account is closed, after which we delete or anonymise it.

We use technical and organisational measures to protect your data, including encryption in transit, access controls, and segregation of custody keys. No system is perfectly secure; you are responsible for safeguarding your credentials and enabling available account-security features.

Subject to applicable law, you may have the right to access, correct, delete, or port your data, and to object to or restrict certain processing. Some rights are limited where we must retain data to meet legal obligations (for example, AML records). To exercise your rights, contact us using the details below.

We use cookies and similar technologies that are necessary to operate the Platform, keep you signed in, and understand usage. You can control non-essential cookies through your browser settings.

The Platform is not directed to anyone under 18, and we do not knowingly collect data from minors.

We may update this Policy from time to time. We will post the updated version with a new effective date and, where required, notify you.

For privacy questions or to exercise your rights, contact our privacy team at privacy@pallyx.com.