Privacy Policy

1. Controller and contact

The controller responsible for your personal data is Guaranza Ltd, 18 Soho Square, London W1D 3QN, United Kingdom, registration number 16057424.

Our registration with the data protection supervisory authority: Information Commissioner's Office (ICO), registration number ZB137463.

For questions about this policy or your personal data, or to exercise your rights, contact us at support@guaranza.com or write to us at the address above. For matters relating to identity verification and anti-money laundering checks, you can also contact compliance@guaranza.com.

2. Personal data we process

We process the following categories of personal data:

• Account data: name, email address, password (stored only as a secure one-way hash), country, optional phone number, account type (individual or business), business details where applicable, language preference and account settings.
• Transaction data: the Transactions you create or join, your role as Buyer or Seller, titles, categories, descriptions and terms, amounts, currencies, inspection periods, fee arrangements, status history, delivery and access details, and dispute information.
• Deal Room data: messages you send and receive in the Deal Room and the files you attach, such as receipts, photos and other evidence.
• Payment and payout data: bank account details (such as account holder name and IBAN or account number), card details needed for a card transfer, cryptocurrency wallet addresses and transaction hashes, payment confirmations and receipts, and refund details.
• Verification (KYC) data: identity data such as full name, date of birth, nationality and address; copies of identity documents and proof of address; a selfie with your identity document and a short verification video, which our staff review manually (we do not use automated facial recognition; if you record the video on our website, your browser checks only the position of your head to guide you — this check runs on your device and no data from it is sent to us or to third parties); for businesses, company documents and information on directors, authorised representatives and beneficial owners; information on the source of funds and on the ownership of wallets; politically exposed person status; and the results of sanctions and other compliance screening.
• Contact form data: your name, email address, the topic and the content of your message.
• Technical data: IP address, browser user agent, date and time of access, security logs (such as sign-in events and failed login attempts), and data used for rate limiting to protect the platform against abuse.

We do not use analytics, advertising or tracking technologies. We do not intentionally collect special categories of personal data; if documents you provide contain such data, we process it only as far as necessary for the purposes described in this policy.

3. Where we get personal data from

We collect most personal data directly from you. We also receive personal data:

• from the Counterparty, for example your email address when you are invited to a Transaction, and the messages and evidence they share in the Deal Room;
• from banks, payment providers and blockchain networks, for example the name of the payer, payment references or public blockchain data;
• from identity verification and screening providers, sanctions lists and public registers used in our compliance checks;
• automatically from your device when you use our website.

4. Purposes and legal bases

We process personal data only where we have a legal basis under Article 6(1) GDPR:

• Performance of a contract (Art. 6(1)(b)): to create and manage your Account, provide the escrow Services, process Transactions, operate the Deal Room, receive payments, make payouts and refunds, handle disputes, send service notifications and respond to your support requests.
• Compliance with legal obligations (Art. 6(1)(c)): to verify identity, perform customer due diligence and sanctions screening, monitor Transactions, keep records, report to the Financial Intelligence Unit and other authorities, comply with accounting and tax rules, and respond to lawful requests and court orders.
• Legitimate interests (Art. 6(1)(f)): to protect the security and integrity of the platform, prevent fraud and abuse (including rate limiting and security logging), establish, exercise or defend legal claims, answer enquiries sent through our contact form, and notify our staff of new activity. Our legitimate interests are the secure and lawful operation of our business and the protection of our users.
• Consent (Art. 6(1)(a)): where we ask for your consent for a specific purpose. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Providing the data needed to register, use the Services and complete verification is necessary to enter into and perform our contract with you and to meet our legal obligations. If you do not provide it, we cannot offer you the Services.

5. Who receives your data

We share personal data only as necessary for the purposes described above:

• The Counterparty: in a Transaction, the other party sees your name, email address and the Transaction data, Deal Room messages and delivery details relevant to that Transaction. The Counterparty does not see your payment, payout or refund details or your verification documents.
• Our staff: authorised employees, including your Escrow Agent and our compliance team, access data only as needed for their role.
• Banks, payment service providers and cryptocurrency service providers that process payments into escrow, payouts and refunds.
• Identity verification and screening providers that help us verify identity and screen against sanctions and other lists.
• IT service providers acting as our processors, such as hosting, data storage, email delivery and IT support providers, bound by data processing agreements under Article 28 GDPR.
• Telegram, which we use for internal notifications to our staff. These notifications contain only limited operational information, such as a Transaction reference and the type of event, and never contain payment, payout or verification details.
• Professional advisers, such as lawyers, auditors and accountants, who are bound by confidentiality obligations.
• Public authorities, including the Financial Intelligence Unit, law enforcement, tax authorities, supervisory authorities and courts, where we are required or permitted by law to disclose data.
• A purchaser or successor in the event of a merger, acquisition or reorganisation of our business, subject to appropriate safeguards.

We do not sell personal data and do not share it for advertising purposes.

6. International data transfers

Some of our service providers may process personal data outside the European Economic Area (EEA). We transfer personal data outside the EEA only where the European Commission has adopted an adequacy decision for the country concerned, or where we have put in place the Standard Contractual Clauses approved by the European Commission, together with supplementary measures where needed.

You can request information about these safeguards, including a copy of the relevant clauses, by contacting support@guaranza.com.

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes for which it was collected:

• Account data: for the duration of our business relationship and afterwards only as far as it forms part of the records described below.
• Transaction data, Deal Room messages and attachments, payment and payout details, and verification (KYC) data: 5 years after the end of the business relationship, as required by EU anti-money laundering rules, or longer where a competent authority requires it or legal proceedings are pending.
• Contact form messages: up to 2 years.
• Security logs and rate-limit data: up to 12 months.
• Accounting records: for the period required by applicable accounting and tax laws.

When the retention period ends, we delete or anonymise the data.

8. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including:

• encrypted connections (HTTPS) for all traffic to and from our website;
• passwords stored only as secure one-way hashes;
• encryption at rest of Deal Room messages and attachments, delivery and access details, and payment, payout and refund details;
• role-based access controls, so that staff can access only the data they need for their role;
• security logging, rate limiting and other measures against unauthorised access and abuse;
• confidentiality obligations for our staff and data processing agreements with our processors.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by law.

9. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased where there is no legal reason for us to keep it;
• restrict the processing of your data in certain cases;
• receive the data you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller (data portability);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests;
• withdraw your consent at any time where processing is based on consent.

You can export your personal data in JSON format and request the deletion of your Account in your account settings. Deletion requests are processed within 30 days. Please note that we must keep the records required by anti-money laundering and other laws for the retention periods described above, and that messages you have sent in a Deal Room form part of the Transaction record and may remain visible to the other participants of that Transaction.

To exercise your other rights, contact us at support@guaranza.com. We may need to verify your identity before responding. We respond within one month; for complex or numerous requests, this period may be extended by two further months, in which case we will inform you.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority competent for us is Information Commissioner's Office (ICO).

10. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

We use automated tools to detect possible fraud or abuse, such as rate limits and security alerts. Temporary technical measures, such as limiting the number of requests, may apply automatically to protect the platform, but any decision to refuse, suspend or restrict an Account or a Transaction is reviewed by a member of our staff.

11. Cookies

We use only strictly necessary cookies and local storage. Details are set out in our Cookie Policy.

12. Children

Our Services are intended only for adults aged 18 or over. We do not knowingly collect personal data from children. If we learn that a person under 18 has registered, we will close the Account and delete their data, unless we are legally required to keep it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will publish the updated version on guaranza.com and, for material changes, notify you by email or on the platform before they take effect.

14. Contact

For privacy questions or requests, contact support@guaranza.com or write to Guaranza Ltd, 18 Soho Square, London W1D 3QN, United Kingdom.