Privacy Policy
This policy explains how CashXChain UG (haftungsbeschränkt) processes personal data when you use the CashXChain platform, our website and our application programming interface (API). Our services are for business customers only.
1. Controller. The controller responsible for your data is CashXChain UG (haftungsbeschränkt), Georg-Bichler-Str. 9, 83620 Feldkirchen-Westerham, Germany. You can reach us at [email protected], which is also our contact point for data protection matters.
2. What we collect and where it comes from. From you, at signup and during the relationship, we collect details about your company and its representatives, including company name, registration details, address, the identity and role of authorised users and beneficial ownership information. Identity verification is performed by our licensed Partners under their own KYC/KYB frameworks; we receive the verification results and the data necessary to record the outcome. If you choose to sign in using a third-party provider (Google, Apple, Microsoft, GitHub or LinkedIn), we receive the basic account information you authorise that provider to share. When you send or receive payments we collect transaction data, including amounts, currencies, timestamps, references and counterparty identifiers. We also receive information about the payees your company pays.
3. Why we process your data and on what legal basis. We process your data to provide the service, on the basis of our contract with you under Article 6(1)(b) General Data Protection Regulation (GDPR) . We process it to comply with legal obligations to which we are subject, such as tax and commercial record-keeping, under Article 6(1)(c) GDPR. We process it for fraud prevention, network and platform security, the safety of the service, and to make voluntary reports to and cooperate with competent authorities where we identify indicators of serious crime, on the basis of our legitimate interests under Article 6(1)(f) GDPR. Where we rely on your consent, the basis is Article 6(1)(a) GDPR and you can withdraw it at any time. The anti-money-laundering, sanctions and transfer-information obligations that apply to the regulated steps are met by our licensed Partners under their own regulatory obligations; where information must accompany a transfer, it is used only to prevent, detect and investigate money laundering and terrorist financing and for no other purpose.
4. Who receives your data. We share data with providers who process it on our instructions, including our identity-verification, hosting and analytics providers, listed in our Sub-processor List. We use Cloudflare Web Analytics, a cookieless tool that processes limited data such as your IP address for country-level geolocation (not stored), on the basis of our legitimate interests under Article 6(1)(f) GDPR. We share data with the licensed Partner that performs the conversion, custody and settlement steps, which is responsible for that data in its own right and which meets the applicable regulatory reporting obligations, including any reporting to the German Financial Intelligence Unit. We may also disclose data to competent authorities where we make a voluntary report of suspected serious crime or are otherwise required to do so by law.
5. The blockchain. Settlement uses regulated stablecoins on public blockchains — Solana plus multiple EVM-compatible chains, including Polygon PoS, with additional networks added over time. Only technical transaction data and wallet addresses reach the blockchain, not your customers’ names or contact details. Because entries on a public blockchain cannot be changed or deleted, your right to have data erased cannot extend to anything recorded on the blockchain. It still applies to the data we hold off the blockchain.
6. Payees who are not our customers. When your company pays a payee, we hold some personal data about that payee even though they are not our customer. We make the information in this policy available to them here. Contacting every payee individually would involve disproportionate effort, so we rely on the exemption the GDPR allows in that situation.
7. Sending data outside Europe. Where we or our partners process data outside the European Economic Area, we use the safeguards European data protection law requires. For countries without an adequacy decision we use the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment and any further measures needed. Destinations and their safeguards are in our Sub-processor List.
8. How long we keep it. We keep accounting records for the periods German tax and commercial law require. Where we make a voluntary report to an authority, we keep the related records for as long as necessary for that purpose and to establish, exercise or defend legal claims. The five-year retention of anti-money-laundering and transfer records that applies to the regulated steps is met by our licensed Partners as the obliged entities. Otherwise we keep data only as long as we need it, then delete or anonymise it.
9. Your rights. You have the rights to access your data, to have it corrected or erased, to restrict or object to its use and to receive it in a portable form, subject to data we must keep by law. You may also complain to a data protection supervisory authority under Article 77 GDPR. The authority for our seat is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) , Promenade 18, 91522 Ansbach, Germany.
10. Automated decisions. Our systems may flag a transaction or account for review. Where a decision to restrict or suspend your access to the platform, or to decline a transaction, would significantly affect you, it is not made by automated means alone. A person reviews it before it is final and you may ask us to review it, unless the law prevents us from explaining the reason. Any freezing of funds is a matter for the licensed Partner that holds the funds, under its own obligations.
11. Cookies. How we use cookies and how you control them is set out in our Cookie Policy.
12. Security. We protect your data with technical and organisational measures suited to the risk, summarised in our Security Statement.
13. Changes. We publish the current version in our Legal Center and keep earlier versions in our Versioned Terms Archive with the dates each applied.