This Privacy Policy explains how we process personal data when you use the EX5 Wallet app for iOS, Android, Windows and macOS (the “App”) and the website ex5wallet.com (the “Website”). It is provided under Articles 13 and 14 of the General Data Protection Regulation (the “GDPR”).
1. Who we are
The controller of your personal data is EX5 CRYPTO EXCHANGE sp. z o.o., Aleja Jana Pawła II 61/212, 01-031 Warszawa, Poland, KRS 0001121024, NIP 5214081211, REGON 529358189 (“EX5”, “we”, “us”). For any privacy question or request, write to info@ex5.com or to our postal address. We have not appointed a data protection officer. Your EX5 Wallet account is separate from any other EX5 service, and we do not combine their data.
2. Data we collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: e-mail address; password (stored only as a hash); user ID (UID); language; account status; 2FA setting and secret key (stored encrypted). | Opening and running your account, sign-in, service e-mails. | Contract; legitimate interest (account security). | While your account is open, then Section 6. A registration not confirmed within 5 days is closed automatically. |
| Devices and security records: device ID issued by our server; device name or model; platform; IP address and the country derived from it (coarse location); user agent; time and type of security events (sign-in, password or 2FA change, send, account deletion). PIN and device sign-in key are stored only as hashes. | PIN and biometric sign-in; device list; protecting accounts; preventing fraud and use from restricted countries; legal claims. | Contract; legitimate interest (security, compliance with the Terms, legal claims). | Devices: while your account is open. Security records: Account Records period (Section 6). |
| Wallet and transactions: balances; deposit addresses; deposits (including the sending address) and sends (asset, network, amount, fee, destination address, transaction hash, status, your note); address book (address, network, name and note). | Providing the Service and your history; reviewing flagged sends; preventing fraud and sanctions breaches; accounting and tax records; legal claims. | Contract; legal obligation (accounting, tax and sanctions law); legitimate interest (fraud prevention, legal claims). | Transactions: Account Records period. Address book: while your account is open. |
| Eligibility: country of residence or nationality, if we ask for it. | Checking that you may use the Service, including sanctions restrictions. | Legal obligation (EU sanctions law); legitimate interest. | Account Records period. |
| Notifications (Mobile App): in-app inbox; notification preferences; push subscription ID and push token. | Notifying you about deposits, sends and security events. | Contract. | Inbox: 90 days. Other: while your account is open. |
| App usage statistics (Mobile App, via OneSignal): number and length of sessions; delivery and opening of notifications; device model, operating system, network type. Recorded each time the App is opened, whether or not notifications are on; linked to your UID after sign-in. | Reliable delivery of notifications; statistics on App use. | Legitimate interest. | While your account is open. |
| Technical data: IP address, time, requested resource and user agent recorded by our servers and Cloudflare; for App updates, App version, platform and installation ID. | Delivering the Website, the App and updates; protection against attacks; troubleshooting. | Legitimate interest. | Web server logs: 14 days. System logs: up to 12 months. |
| Correspondence: your e-mail address, messages and attachments. | Answering questions, complaints and requests. | Contract; legal obligation; legitimate interest (legal claims). | Until the matter is closed and while claims are possible, at most the Account Records period. |
| Website sign-up list: e-mail address; language; sign-up and confirmation times; a salted hash of your IP address. | Telling you when the product you signed up for is available; preventing abuse. | Consent (withdraw any time via the link in each e-mail); legitimate interest (abuse prevention). | Unconfirmed: 30 days. Confirmed: until you unsubscribe or the list closes; then only a do-not-contact record. |
The legal bases are those of Article 6(1) GDPR: consent (a), performance of our contract with you (b), legal obligation (c) and our legitimate interests stated above (f).
An e-mail address and a password are required to open an account, and 2FA is required to send; without them we cannot provide these functions. Other data is optional or arises from your use of the Service. We receive data from you, your device and the App, public blockchains and our providers (such as OneSignal). If you add information about other people, such as a name in your address book, we use it only to provide the Service to you.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Automatic security limits may delay a send; decisions to refuse a send or suspend an account are made by our staff.
3. Your device and permissions
Some data stays on your device: your device sign-in key and, if you turn on biometric unlock, a copy of your PIN (in the secure storage of the operating system), and settings such as language. When you sign in with your PIN or biometrics, the key and PIN are sent to our server, which stores them only as hashes. The Desktop App keeps diagnostic logs on your computer; we receive them only if you send them to us.
The Mobile App may ask for these permissions, which you can withdraw at any time in your device settings:
- Camera: only to scan QR codes. The image is processed on your device and is not stored or sent to us. On Android, scanning uses Google ML Kit, which sends Google technical data (device model, operating system, App name and version, installation ID and scanner performance).
- Face ID, Touch ID or fingerprint: checked by your device; we receive no biometric data.
- Photos (iOS, add only): only to save an image you choose, such as your deposit QR code. The App cannot see your library.
- Notifications: about your account only, never for marketing.
The Desktop App does not use the camera, photos or biometrics, reads the clipboard only when you paste and saves files only where you choose.
4. What we do not collect
- We do not ask for your name, phone number, date of birth, home address, identity documents or photos of your face.
- The App does not access your contacts, messages, photo library, microphone or device location.
- There is no advertising and no tracking across other companies’ apps or websites, and no analytics or crash-reporting tools other than the OneSignal statistics described above. We do not sell personal data.
- The Website uses no analytics or advertising cookies. It stores your theme and language choice in your browser; Cloudflare may set cookies strictly necessary for security.
5. Who receives data
These providers process data on our behalf, under our instructions and data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, databases and backups | Germany |
| Cloudflare, Inc. | Delivery of the Website, App connections and updates; DNS; protection against attacks | Global, including the USA |
| Twilio Inc. (SendGrid) | Sending e-mails | USA |
| OneSignal, Inc. | Push notifications and App usage statistics (Mobile App): UID, subscription ID, push token, IP address and notification content | USA |
| 650 Industries, Inc. (Expo) | Mobile App updates | USA |
| Google (Google Workspace) | Our info@ex5.com mailbox | EU and USA |
Other recipients process data under their own terms: Apple and Google push services, which deliver notifications to your device; Google, for ML Kit on Android (Section 3); Binance, which receives your device’s IP address when the Mobile App loads public market prices; block explorers, if you open a transaction link; public authorities, where the law requires; our professional advisers; and a buyer or successor of our business.
Deposits and sends are recorded on public blockchains together with addresses and amounts. Anyone can see these records, and nobody, including us, can change or erase them.
Our servers are in Germany. Some providers above process data outside the European Economic Area, in particular in the USA. Transfers to our processors are protected by the standard contractual clauses of the European Commission; you can request a copy at info@ex5.com.
6. How long we keep data
- Account Records (e-mail address, UID, transactions and security records): five years from the end of the calendar year in which your account is closed, to comply with accounting and tax law and for legal claims; longer only while proceedings or an authority’s request are pending.
- Other account data (password hash, 2FA key, devices, push subscriptions, preferences, address book, language): no longer used after closure; erased within one month of your request (see Account deletion) and at the latest at the end of the Account Records period.
- Inbox messages: 90 days. Web server logs: 14 days. System logs: up to 12 months. Backups are overwritten within about one month after erasure.
- Other periods are stated in Section 2. Records on public blockchains are permanent.
7. Your rights
You have the right to access your data and receive a copy, to rectify it, to have it erased (unless we must keep it, Section 6), to restrict its processing, to data portability and to object to processing based on our legitimate interests; we will then stop unless we have compelling grounds or need the data for legal claims. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing.
Write to info@ex5.com, preferably from your registered e-mail address. We may ask you to confirm your identity, but never for your password, PIN or 2FA codes. We reply free of charge within one month; for complex requests this may be extended by two months, and we will tell you. You can delete your account yourself in the App (Account deletion).
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, where the alleged infringement took place, or in Poland, where we are established.
8. Security
We use technical and organisational measures appropriate to the risk, including encrypted connections (TLS), storing passwords and PINs only as hashes, encrypted storage of 2FA keys and restricted access to our systems. If a personal data breach is likely to pose a high risk to you, we will inform you without undue delay.
9. Children
The Service is only for people aged 18 or over. We do not knowingly collect data from anyone under 18; if we learn that such a person has opened an account, we will close it.
10. Changes
We may update this Policy when the Service, our providers or the law change. The current version and its date are published on this page, and we will tell you about significant changes in the App or by e-mail before they take effect. This Policy is also available in Turkish, Russian and Polish; in case of discrepancy, the English version prevails.
