1.Data Controller
The sole data controller responsible for all personal data processed through the Platform, including KYC/AML and transaction monitoring data, is:
ESTX Georgia LLC
Avtomshenebeli St. N 88 (Plot N01/298)
Free Industrial Zone
Kutaisi, Georgia
Registration number 412800036
For privacy-related inquiries, please use the contact details and support channels published on ESTX.Exchange.
2.Personal Data We Collect
We collect the following categories of personal data:
Account data, including your name, email address, phone number, date of birth, nationality, residential address, and account credentials.
Identity verification (KYC) data, including government-issued identification documents, photographs, selfies or liveness checks, proof of address, and information about the source of your funds where required.
Financial and transaction data, including deposit and withdrawal history, trading activity, order history, wallet addresses, linked payment details, and account balances.
Technical data, including IP address, device identifiers, browser type and version, operating system, time zone, and log data generated by your use of the Platform.
Usage data, including pages visited, features used, session duration, and interaction patterns on the Platform.
Communication data, including messages you send to our support channels, survey responses, and marketing preferences.
We collect this data directly from you, automatically through your use of the Platform, and from third-party verification and compliance providers.
3.How We Use Your Personal Data
We use your personal data for the following purposes:
To create, maintain, and secure your account.
To provide trading, wallet, deposit, and withdrawal services.
To verify your identity and comply with anti-money laundering (AML), counter-terrorist financing (CTF), sanctions, and know-your-customer (KYC) obligations.
To monitor transactions for fraud, market abuse, and suspicious activity.
To comply with legal and regulatory obligations, including reporting to competent authorities where required.
To communicate with you about your account, security events, service changes, and support requests.
To send you marketing communications where you have consented, with the ability to opt out at any time.
To analyze and improve the performance, safety, and usability of the Platform.
To establish, exercise, or defend legal claims.
4.Legal Bases for Processing
Where the GDPR applies, we process your personal data on the following legal bases:
Performance of a contract, where processing is necessary to provide the services you have requested.
Compliance with legal obligations, including AML/CTF, sanctions, tax, and regulatory requirements.
Legitimate interests, including securing the Platform, preventing fraud, improving our services, and managing our business, provided these interests are not overridden by your rights.
Consent, for optional processing such as marketing communications, which you may withdraw at any time.
6.International Data Transfers
You submit your personal data directly to ESTX Georgia LLC, a controller established in Georgia, which is outside the European Union and the European Economic Area. Your personal data is therefore collected and processed in Georgia.
Georgia is not currently covered by a European Commission adequacy decision. Where we process the personal data of users located in the EU/EEA, we do so in accordance with Georgian data protection law and the applicable requirements of the GDPR, and we apply technical and organizational safeguards aligned with recognized international information security standards.
Your personal data may also be transferred to and processed by our service providers in other countries. Where such transfers occur, we implement appropriate safeguards, such as standard contractual clauses or other lawful transfer mechanisms, to ensure your data remains protected.
7.Data Retention
We retain your personal data only for as long as necessary for the purposes described in this Privacy Policy.
In particular, identity verification and transaction records are retained for the period required by applicable AML/CTF legislation, which is generally at least five (5) years after the end of the business relationship or the date of the relevant transaction.
Where data is no longer required, it is securely deleted or anonymized.
8.Data Security
We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit, access controls, network security measures, segregation of duties, logging, and regular security reviews.
No system is completely secure. You are responsible for keeping your account credentials and two-factor authentication devices safe and for notifying us immediately of any suspected unauthorized access to your account.
9.Your Rights
Subject to applicable law, you have the following rights regarding your personal data:
The right to access the personal data we hold about you.
The right to rectification of inaccurate or incomplete data.
The right to erasure of your data, where no legal retention obligation applies.
The right to restriction of processing in certain circumstances.
The right to data portability for data you have provided to us.
The right to object to processing based on legitimate interests, including profiling.
The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
The right to lodge a complaint with a supervisory authority, in particular the Personal Data Protection Service of Georgia. If you are located in the European Union or the European Economic Area, you may also lodge a complaint with the supervisory authority of your country of residence.
Please note that certain rights may be limited where we are subject to legal retention or compliance obligations, including AML/CTF requirements.
11.Third-Party Services
The Platform may contain links to or integrations with third-party services, including payment providers, fiat on/off-ramps, and analytics tools.
These third parties operate under their own privacy policies, and we are not responsible for their data practices. We encourage you to review their policies before using their services.
12.Children
The Platform is not intended for individuals under the age of 18 or below the legal age of majority in their jurisdiction.
We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will take steps to delete it and close the related account.
13.Automated Decision-Making
We may use automated systems to support identity verification, fraud prevention, and transaction monitoring.
Where automated decisions produce legal or similarly significant effects, you have the right to request human review of the decision, to express your point of view, and to contest the decision.
14.Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
Updated versions become effective upon publication on the Platform or on the date specified in the updated version. Material changes will be communicated through the Platform or by email where appropriate.
15.Contact
ESTX Georgia LLC
Avtomshenebeli St. N 88 (Plot N01/298)
Free Industrial Zone
Kutaisi, Georgia
Registration number 412800036
For privacy-related inquiries, data subject requests, or questions about this Privacy Policy, please use the contact details and support channels published on ESTX.Exchange.