Last updated: 1 October 2026
Cryptox ([LEGAL ENTITY], "we", "us") runs cryptox.ge and the exchange service behind it. This policy explains what personal data we collect when you use the site, open an account or exchange currency with us, why we collect it, how long we keep it and what rights you have. We process personal data under the Law of Georgia on Personal Data Protection and, where it applies, the EU General Data Protection Regulation.
1. Who is responsible
The controller of your personal data is [LEGAL ENTITY], registered in Georgia, Tbilisi. Questions about this policy and requests about your data go to legal@cryptox.ge.
2. What we collect
Account data: your name, e-mail address, username and password (stored only as a hash).
Identity data: your personal number or passport number, your date of birth, a photo of you taken during verification, and the results of that verification from our verification partner.
Questionnaire data: your address, occupation, source of income, expected use of the account and the declarations the law requires (for example political exposure).
Transaction data: every exchange you make with us, its amount, rate, fee, time and the balances it changes.
Technical data: your IP address, device and browser, the pages you open, and the cookies that keep you signed in and remember your language.
3. Why we use it
To provide the service: open and run your account, quote and execute exchanges, show your balances and history, and answer your requests.
To meet the law: verify your identity and monitor transactions under Georgian anti-money-laundering and counter-terrorist-financing rules, keep the records the law requires and report to the authorities where we must.
To keep the service safe: detect fraud and abuse, protect accounts and investigate incidents.
To improve the service: understand how the site is used, in aggregate, and fix what does not work.
The legal bases are the contract with you, our legal obligations, our legitimate interest in a safe and working service, and, for anything else, your consent, which you can withdraw at any time.
4. Who sees it
Our identity verification partner, which checks your document and your photo on our behalf.
Payment and banking partners, to the extent needed to settle an exchange in GEL.
Hosting and infrastructure providers that store and process data for us under contract.
State authorities, when the law requires it: the Financial Monitoring Service of Georgia, the National Bank of Georgia, courts and law enforcement.
We do not sell personal data and we do not share it for advertising.
5. How long we keep it
Identity, questionnaire and transaction records are kept for as long as you have an account and for the period the anti-money-laundering law requires after it closes, currently at least five years.
Technical logs are kept for up to twelve months. Cookies expire as described below.
When a retention period ends, the data is deleted or anonymised.
6. Your rights
You can ask us what data we hold about you, receive a copy, have inaccurate data corrected, and, where the law does not require us to keep it, have it deleted or its processing restricted. You can object to processing based on legitimate interest and withdraw consent you have given.
Write to legal@cryptox.ge. We answer within ten working days. You can also complain to the Personal Data Protection Service of Georgia.
7. Cookies
We use only the cookies the service needs: one that keeps you signed in (deleted when you sign out or after twelve hours) and one that remembers your language (one year). We do not use advertising or tracking cookies.
8. Security
Data travels over encrypted connections. Passwords are stored as salted hashes. Access to personal data inside the company is limited to staff who need it for their work and is logged. Two-factor sign-in is available in your profile and we recommend turning it on.
9. Changes
When this policy changes, the new version is published here with a new date. If a change affects how we use your data in a material way, we tell you in the account before it takes effect.