Privacy Policy
A standard crypto-to-crypto order needs no account or routine identity document. Fiat payouts and specific risk reviews may require additional details as described below. We hold the technical record of your order: the addresses, assets, amounts and times involved. We keep that to complete your order, resolve disputes and meet legal obligations. We do not sell order data or use it for advertising.
1. Who is responsible for your data
The controller of your personal data is buysellcrypto AG, a Swiss Aktiengesellschaft registered under CHE-400.102.429, with its registered office at Badenerstrasse 47, 8004 Zürich, Switzerland, trading as BuySellCrypto Exchange.
Data protection contact: legal@buysellcrypto.cc. Rights requests and privacy questions are handled at that address.
This policy covers buysellcrypto.cc and every order created through it. It should be read with our Terms of Service and Cookie Notice.
2. What we collect
Some cryptoasset data is personal data when it can be linked to you, so we treat all of the following as personal data.
2.1 Order data, collected because you gave it to us
| Data | Where it comes from |
|---|---|
| Sending asset, network, and amount | You, in the exchange form |
| Receiving asset, network, and estimated amount | You, in the exchange form |
| Your receiving (payout) address, and memo or destination tag | You |
| For a fiat payout: country, currency, payout rail, recipient name, provider or bank name, and the destination reference accepted by the selected rail | You, in the Buy/Sell form |
| Promotional code, if you enter one | You |
| Rate type selected (floating or fixed) | You |
| Order ID, order status, and the deposit address assigned to your order | Generated by us |
| Creation, update, and completion timestamps | Generated by us |
| Deposit and payout transaction hashes, and on-chain data associated with them | The relevant blockchains and our order records; what the public can see depends on the network |
2.2 Technical data, collected automatically
- IP address, and the approximate country derived from it.
- Date and time of requests, the pages and endpoints requested, HTTP status, and referrer.
- Browser type and version, operating system, device type, and screen size.
- Language preference.
This is standard server-log data generated by our hosting provider for every website request. We use it to operate the site, diagnose faults, enforce rate limits, detect abuse, and apply the geographic restrictions described in our Restricted Jurisdictions list.
2.3 Support and chat data
- Email support. If you email us, we hold your email address, your message, any attachments, and our replies.
- Site chat. The messages you type into the chat window on our site are sent to our chat provider so a reply can be produced. Do not type your private key, seed phrase, or any information you would not want recorded into that window, or into any chat window anywhere. Chat transcripts are retained as described in section 7.
2.4 Compliance data, only if section 12 of the Terms applies
If an order triggers the review conditions in section 12 of our Terms, we may ask you for additional information such as the source of the funds, or identity or address documents. We ask for this only when a specific condition is met, we tell you why at the time, and we hold it under the retention rule in section 7. We do not request it for standard orders.
We also run deposit and destination addresses against blockchain-analytics and sanctions-screening sources. The result of that screening is held against the order record.
3. What we do not collect
Stated plainly, because it is the reason many people use this service:
- No account. There is no registration, no username, and no password.
- No date of birth, phone number, or postal address for a standard crypto swap. A fiat payout requires the recipient name used by the payout provider.
- No email address required to create or complete an order. You only give us one if you choose to contact support.
- No identity documents, selfies, or biometric data for a standard order.
- No CVV, card expiry or PIN. For a card payout, we do collect the full card number you enter to make the payout.
- No advertising or cross-site tracking cookies, no advertising identifiers, and no data sold or shared with data brokers, ad networks, or affiliate trackers.
- No profiling that produces legal effects for you, and no automated decision-making of that kind. Address screening flags an order for a human to look at; it does not decide anything about you by itself.
4. Why we use it, and our legal basis
Where the UK GDPR or EU GDPR applies to you, our legal bases are as follows.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating, executing, and paying out your order | Order data (2.1) | Performance of a contract |
| Refunding an order we cannot complete | Order data; a return address requested by support only when the originating address cannot be determined | Performance of a contract |
| Answering your support request | Support and chat data (2.3) | Performance of a contract; legitimate interests |
| Operating, securing, and debugging the site; rate limiting; preventing abuse | Technical data (2.2) | Legitimate interests in a secure, functioning service |
| Sanctions and blockchain-analytics screening | Addresses, amounts, IP-derived country | Legal obligation; legitimate interests in preventing financial crime |
| Applying geographic restrictions | IP-derived country | Legal obligation; legitimate interests |
| Retaining records of transactions | Order data, compliance data | Legal obligation |
| Handling a dispute, complaint, or legal claim | Whatever is relevant to it | Legitimate interests; establishment or defence of legal claims |
| Responding to a lawful request from an authority | Whatever is lawfully required | Legal obligation |
| Non-essential cookies, if and when we use any | See Cookie Notice | Consent |
Where we rely on legitimate interests, we have considered your interests and rights and concluded ours do not override them. You may ask us for that assessment.
5. Who we share it with
We do not sell your data and we do not share it for anyone else's marketing. We share it only with the service providers we need to run the exchange, and with authorities where the law requires it.
| Recipient | What it receives | Why |
|---|---|---|
| Hosting and infrastructure providers | Technical data (2.2) and order data required in transit or storage | Hosting, content delivery, serverless functions, and database operations |
| Operations and notification providers, including Telegram | Order reference, assets, amounts, deposit instructions, and the full payout card number for a card payout; support messages where needed | Order operations, manual card payouts, internal notifications, and support handling |
| Market-data providers | No direct customer identity; server-side requests for reference prices | Reference market prices |
| Analytics and advertising | None. We collect no analytics or advertising data. | No provider in use |
| Our sanctions-screening and blockchain-analytics provider | Deposit and destination addresses, amounts | Sanctions and stolen-funds screening under section 12 of the Terms |
| Our email hosting provider | Support correspondence | Delivering and storing support email |
| Professional advisers, auditors, and insurers | Only what is relevant | Legal, accounting, and audit obligations |
| Law enforcement, regulators, and courts | Only what is lawfully required | Legal obligation |
| A purchaser of our business | Order records | Only on a sale or reorganisation, and subject to this policy |
Our order notification flow and our site chat both involve third-party services outside our infrastructure. Your payout address and, for a card payout, your full card number pass through Telegram's systems to our operator. Telegram bot messages are not end-to-end encrypted. Anything you type into the chat window passes through our chat provider's systems. Do not put a private key, seed phrase, CVV, card expiry or PIN into either.
6. International transfers
Some infrastructure or operations processing may take place outside your country of residence. Where personal data is transferred out of the UK or EEA, we rely on:
- an adequacy decision, where the destination has one; or
- the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with a transfer risk assessment; or
- another lawful transfer mechanism.
You can ask us which mechanism applies to a given processing activity at legal@buysellcrypto.cc.
7. How long we keep it
| Data | Retention period | Reason |
|---|---|---|
| Order records (2.1) | 5 years from order completion | Transaction record-keeping and defence of claims |
| Server and access logs, including IP where collected (2.2) | 6 months | Security and fault diagnosis |
| Support email and chat transcripts | 1 year from last contact | Continuity of support and dispute history |
| Compliance and screening data (2.4) | 5 years from the order | Statutory record-keeping obligations |
| Consent record for this site's notice | Stored in your own browser until you clear it | So the banner does not reappear on every visit |
After the applicable period we delete the data or irreversibly anonymise it. We may keep it longer where a specific legal obligation, investigation, or live claim requires it, and only for as long as that lasts.
8. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you, and get a copy.
- Rectify data that is inaccurate or incomplete.
- Erase data, where we have no overriding obligation to keep it. Note that transaction records subject to a statutory retention period cannot be erased before that period ends, and nothing can erase a transaction from a public blockchain.
- Restrict or object to processing based on legitimate interests.
- Receive the data you gave us in a machine-readable form, and have it ported elsewhere.
- Withdraw consent at any time, where we rely on consent. This does not affect processing already carried out.
- Complain to a data protection authority.
To exercise a right, email legal@buysellcrypto.cc. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.
Identifying you is the hard part. Because we do not hold your name or email, we usually cannot link a request to your order without help. To make a request actionable, give us your order ID and, ideally, the deposit transaction hash. If we cannot verify that a request relates to your own data, we must refuse it. That refusal protects other customers from someone else requesting their records.
If you are in California, you additionally have the rights to know, delete, correct, and opt out of “sale” or “sharing” under the CCPA/CPRA, and not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined, and we do not process sensitive personal information for inferring characteristics.
9. A note about blockchains
On transparent networks such as Bitcoin and Ethereum, transaction details are visible on a public ledger we cannot alter or delete. Third parties can analyse those records and infer relationships between addresses. Monero conceals sender, recipient and amount from public observers on its own chain. A swap between Monero and a transparent network still has a visible transaction on the transparent-network side.
No account limits the identity information you give us; it does not eliminate the order and technical data we process under this policy. Network privacy also does not make an exchange order completely anonymous to us or to every other party involved in the transaction.
10. Security
Measures we apply:
- TLS encryption in transit for all site and API traffic.
- Encryption at rest on our database provider.
- Server-side handling of every credential and API key. No secret required to operate the exchange is exposed to your browser.
- Least-privilege access to the order database, restricted to the personnel who need it.
- Rate limiting and abuse detection on our public endpoints.
- Dependency and vulnerability monitoring.
No system is perfectly secure. If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and we will notify affected customers where the risk is high and we have a means of reaching them.
We will never ask you for your private key, seed phrase, or recovery words, by any channel, for any reason.
11. Cookies and local storage
We use a small number of strictly necessary storage items and, at present, no advertising or analytics cookies. The full list, and how to control them, is in our Cookie Notice.
12. Children
The service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has used the service, contact legal@buysellcrypto.cc and we will delete what we can.
13. Changes to this policy
We will post any change here with a new date. Where a change materially affects how we use your data, we will highlight it on the site for at least 14 days before it takes effect, and we will seek fresh consent where consent is the basis.
14. Contact and complaints
Privacy questions and rights requests: legal@buysellcrypto.cc
General support: support@buysellcrypto.cc
Order review and sanctions: compliance@buysellcrypto.cc
If you are unhappy with our response you can complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EEA it is the authority in your country of residence. You can complain to the authority where you live, where you work, or where the issue arose.