1 · Data controller
Changer.ae Limited (“Changer.ae”, “we”, “our”) is the Data Controller of your personal information with respect to the Platform. Registered address: 2105, Level 21, Al Tamouh Tower, Al Reem Island, Abu Dhabi, United Arab Emirates. We are registered as a Data Controller with the ADGM Office of Data Protection.
Responsibilities we owe you: process personal data fairly, lawfully and securely; keep it for specified, explicit and legitimate purposes; keep it adequate, relevant and not excessive; keep it accurate and up-to-date; and keep it identifiable only for as long as necessary.
2 · Changes to this notice
We may update this notice at our sole discretion; the platform version governs. We will not use your information in a materially new way without notifying you and giving the option to opt out. Keep us informed if your personal information changes.
3 · What we collect
- Identity data — name, identifiers, marital status, date of birth, gender, citizenship/residence, proof of ID (passport/driver's license), second nationality/passport if applicable, plus face data, liveness videos/photos via TrueDepth-class APIs during onboarding (regulatory requirement).
- Contact data — email, telephone numbers, residential address.
- Financial data — bank/wallet details, CRS/FATCA details, annual income, net worth, external account details, source of funds.
- PEP status — your status as a politically exposed person.
- Investment data — objectives, experience, prior investments.
- Transaction data — payments to/from you, trades, deposits, withdrawals and counterparties.
- Technical data — IP address, login data, browser type/version, time zone, location, plug-ins, device/platform, timestamps, clickstream.
- Profile & usage data — username/password, orders, interests, feedback, session data linked to your account.
- Marketing/communications data — your preferences.
Some data arrives from third parties — sanctions screening services, verification providers — to supplement what you give us. Where the law or the contract requires personal data that you do not provide, we may be unable to perform or maintain the account.
4 · Why we process it
To create and secure your account; verify identity with providers; comply with AML/CTF obligations; perform our contracts; provide and improve the platform; process payments, fees and charges; send transactional and security notices; detect/report suspicious or fraudulent activity; respond to your inquiries; and notify you of agreement changes.
Log-file data is used to analyze trends, administer the platform, track movement and demographics in aggregate. Aggregated/de-identified records may be created and used for any lawful purpose; we may disclose them at our sole discretion.
5 · Sharing your data
We share personal data with our affiliates (some outside ADGM), external third parties, sub-processors, sanctions-screening and public agencies to the extent required by law, and financial institutions connected to virtual asset transfers — only the minimum necessary. Non-ADGM transfers are protected by adequacy decisions or approved contractual clauses; details are obtainable from the DPO.
6 · Retention
Account data is retained while the account is open; transactions on record for up toseven years to defend legal claims; account information retained up to 7 years after closure — unless legal need requires otherwise. Marketing opt-outs keep a suppression record for your address.
7 · Cookies & technologies
Cookies (functional + analytical, session-limited) help us secure the platform and keep preferences. Third-party SDKs/APIs may collect data for analytics. Public blockchain, blogs, forums and social widgets are public by their nature. Do Not Track signals are not currently honored. Details in the Cookies Policy.
8 · Security
Physical, technological and organizational safeguards apply; we use industry-standard encryption; storage/access restrictions are enforced; our servers and business operations are entirely located in ADGM. Third-party processors must present sufficient security guarantees. No internet transmission is ever 100% secure.
9 · Your rights
Depending on your jurisdiction: access to processing info and your data; withdraw consent; receive data in structured, machine-readable format / request transfer; rectify inaccuracies; erase (subject to legal entitlement to retain); object or request restriction; object to purely automated decisions with legal effects; lodge a complaint with the regulator. We may request identity confirmation before acting. Response target: within one month (potentially longer for complex matters, with updates).
10 · Children
We do not knowingly collect data from anyone under 18; if found, it is deleted immediately.
11 · Questions & complaints
Privacy questions: dp@changer.ae. Complaints about processing: support@changer.ae first; you may also approach the data protection authority where you live or work.