This Privacy Notice is effective as of 18 September 2026.

This Privacy Notice explains how Coinspaid processes the personal data of customers, users and website visitors (referred to in this Notice as “you” or “your”).

Our contact detail

All references to “Coinspaid Solutions”, “we”, “us” or “our” in this Privacy Notice mean Coinspaid Solutions, a software company registered in Estonia.

Depending on the context, Coinspaid Solutions may act as a data controller or as a data processor on behalf of a client. Where Coinspaid Solutions acts solely as a data processor, the relevant client determines the purposes and means of the processing and is primarily responsible for providing the applicable privacy information and handling data subject requests, unless applicable law provides otherwise.

For questions about how we process personal data, please contact our Data Protection Officer at: [email protected]

The categories of personal data subject to processing

When acting as a data processor, we may process the following categories of personal data on behalf of our clients:

IP addresses, browser and operating system details, device fingerprints and other technical data used to access or interact with the Services;
Email addresses of account operators or individuals authorized to access or manage an account;
Data related to the version of the API used for integration with the Services;
Account and authentication information, which may include user IDs, passwords, access keys, other authentication mechanisms and information about authorized users;
Data used for technical support, service optimization, troubleshooting and performance analysis.

When acting as a data controller, we may process the following categories of personal data:

Contact information, including name and email address;
Signatures and authorization information;
Professional and role information, including job title, role and business contact details;
Business and corporate information required to enter into and administer agreements with clients and partners;
Business location information, including country and business address, where relevant;
IP addresses and other technical identifiers;
Website usage information, including logs and activity on the website.

Website Analytics and User Experience

We use Microsoft Clarity and Microsoft Advertising to understand how users interact with our website through behavioral metrics, heatmaps and session replay. Website usage data may be collected through first- and third-party cookies and similar technologies. We may use this information for website optimization, security and fraud prevention, and, where applicable, marketing and advertising. For more information about these technologies and available choices, please refer to our Cookie Policy and the Microsoft Privacy Statement.

Purpose of the processing

We process personal data for the purposes described below.

When acting as a data processor, we process personal data on behalf of our clients to provide services such as:

Providing API integrations that enable clients to offer services to their end customers;
Setting up and administering client accounts.

When acting as a data controller, we may process personal data for purposes such as:

Legal and operational integrity, including regulatory compliance, audits, recordkeeping and dispute resolution;
Risk and security management, including evaluating risk profiles, protecting assets and accounts from unauthorized access, and preventing fraud and scams;
Business administration, including billing, invoicing and accounting in connection with our software services;
Communication and assistance, including responding to requests, providing service information, news and updates, and supporting lawful investigations and regulatory requests;
Protection of rights and interests, including establishing, exercising or defending legal claims and safeguarding users and the organization;
Website analytics and optimization, including understanding website usage and improving user experience and service performance.

We may use automated tools, including profiling, to support activities such as onboarding, account management, risk assessment and fraud prevention. Where a decision is based solely on automated processing and produces legal effects or similarly significantly affects you, we will provide the additional information and safeguards required by applicable law.

Legal basis of the processing

The legal basis for processing depends on the personal data concerned, the purpose of the processing and the context in which it takes place. Where applicable, we may rely on:

Contractual necessity — where processing is necessary to enter into or perform an agreement or to provide requested services;
Compliance with legal obligations — where processing is necessary to comply with regulatory, statutory, accounting or other legal requirements;
Legitimate interests — where processing is necessary for the operation, security, protection or improvement of our services or for other legitimate business purposes, provided that those interests are not overridden by your rights and freedoms;
Consent — where we ask for your specific permission to process personal data for a particular purpose, including where consent is required for certain cookies or similar technologies;

Sources of the personal data we process

We primarily process personal data provided directly by you or by our clients and their authorized users. We may also obtain personal data from publicly available sources and from third-party service providers, including screening databases, identity verification services, anti-fraud solutions, transaction monitoring systems and website analytics tools such as Microsoft Clarity.

The categories of recipients of the personal data we process

Where necessary for the purposes described in this Privacy Notice, we may share personal data with the following categories of recipients:

Affiliates, agents, contractors and representatives that support our operations;
Professional advisers and service providers that support our business operations;
Cloud computing, hosting, IT and security service providers;
Website analytics providers, including Microsoft Clarity;
Law enforcement, courts, regulators or other public authorities, where required or permitted by law.

Transfers of personal data to third countries

Personal data may be transferred to and processed in countries outside the country or region in which it was collected, including outside the European Economic Area (EEA). Where applicable data protection law restricts such transfers, we use a lawful transfer mechanism, which may include:

Adequate Level of Protection: The destination country provides a level of personal data protection deemed adequate by the European Commission’s decision.
Appropriate Safeguards: We implement safeguards to protect your rights as a data subject, such as Standard Contractual Clauses (SCCs) or obtaining your explicit consent for the transfer.
Legal or Public Interest Exceptions: Specific derogations may apply if the transfer is necessary for the establishment, exercise, or defense of legal claims, or is required for important reasons of public interest.

You may request information about the transfer safeguards applicable to your personal data by contacting us at [email protected].

Personal data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Notice, including to provide services, comply with legal and regulatory obligations, maintain records, resolve disputes, prevent fraud and protect our legitimate interests. Retention periods vary depending on the category of data, the purpose for which it is processed and the applicable legal requirements. Where no fixed period applies, we use these factors to determine an appropriate retention period.

You may request deletion of your personal data where applicable. In some cases, we may be required or permitted to retain certain information despite a deletion request, including for legal, regulatory, security, fraud prevention or dispute-resolution purposes.

Your rights

Subject to applicable law and the circumstances of the processing, you may have the following rights:

Right of access — to request information about and copies of your personal data;
Right to rectification — to ask us to correct inaccurate personal data or complete incomplete data;
Right to erasure — to request deletion of your personal data in applicable circumstances;
Right to restriction of processing — to ask us to limit processing in applicable circumstances;
Right to object — to object to certain processing, including processing based on legitimate interests and, where applicable, direct marketing;
Right to data portability — to request your personal data in a portable format and, where applicable, have it transmitted to another organization;
Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal;
Rights relating to automated decision-making — where applicable, to obtain information and exercise the rights available under applicable law in relation to decisions based solely on automated processing that produce legal or similarly significant effects;
Right to lodge a complaint — to complain to a competent data protection or privacy authority.

These rights are not absolute and may be subject to conditions, exceptions and limitations under applicable law. If we cannot fully comply with a request, we will explain the reason where required.

Where Coinspaid processes personal data solely as a data processor on behalf of a client, requests concerning that processing may need to be directed to the relevant client. We will support the relevant controller in responding to requests where required.

Certain services require personal data for KYC, KYB, AML and counter-terrorist financing checks, identity verification and ongoing activity monitoring. We may also need additional data or documents to meet legal and regulatory obligations. If required information is not provided, we may be unable to provide some or all of the relevant services.

To exercise your rights or withdraw consent where applicable, contact us at [email protected].

Additional rights depending on your location

Depending on where you live, applicable privacy laws may provide additional rights. These may include rights to opt out of the sale or sharing of personal data, targeted advertising or certain profiling; to receive information about third parties that receive personal data; to appeal a decision on a privacy request; and to receive non-discriminatory treatment for exercising privacy rights. Where these rights apply, we will provide the required method for exercising them.

If we introduce a financial incentive, loyalty benefit or material difference in price or service in exchange for personal data and applicable law requires a specific notice or consent, we will provide that information before you participate.

Children

Our products and services are not directed to or intended for use by children under the age of 16, and we do not knowingly collect personal data from children under 16. If you believe that a child under 16 has provided personal data through our website, please contact us at [email protected] so that we can take appropriate steps.

Personal data security

Coinspaid uses technical and organizational measures designed to protect personal data. These measures may include:

Encryption of communication channels;
Encryption at rest;
Access management controls;
Anti-malware tools;
Technical vulnerability management and remediation;
Application security testing;
Data masking.

Our platform uses SSL or TLS encryption to help protect confidential information transmitted when you send requests to us.

Changes to the Privacy Notice

We may update this Privacy Notice from time to time. Any changes will be posted on the relevant page, and where required by applicable law, we will provide additional notice through appropriate channels. The updated Privacy Notice will apply from the effective date stated in the revised version.