Skip to content
xChange.bg

xChange.bg Privacy Policy

Last revised: 13 September 2026

xChange.bg is owned by GLOBAL XCHANGE JSC („Глобал Ексчейндж“ АД), a company registered in Bulgaria with UIC 208656898 and address: 66 Vitosha Blvd., floor 4, 1463 Sofia (the "Company", "we"), which is a data controller within the meaning of Regulation (EU) 2016/679 (GDPR).

This document describes how we collect, process and use your personal data. Personal data is information that identifies you — for example your name, email address, identity details and bank account information.

The Company treats the protection of your personal data as a priority and is responsible for strict compliance with the policies set out in this document — lawfully, transparently and in good faith.

What information we collect

We collect information you provide directly when creating a profile and using the services:

  • email address — for signing in to the Platform (one-time codes, no passwords);
  • names, date of birth, address and identity document details — required for your identification (KYC/KYB). Identity verification is performed by our partner Bridge and its providers; document photos and the biometric check (selfie) are collected and stored by them, and we receive the result of the verification;
  • for legal entities — company details and ultimate beneficial owners;
  • details of bank accounts you register for withdrawals and payments, including the name, IBAN or account number and address of third-party recipients; by providing them you confirm you have a basis to do so;
  • your crypto wallet addresses and data about your transactions through the Platform.

We also automatically collect technical data: IP address, browser and device information, pages visited, date and time of access.

How we use the data

  • to identify you in accordance with legal requirements;
  • to execute your operations and notify you about them (transactional emails);
  • to comply with our legal obligations, including anti-money-laundering measures;
  • for the security of the Platform and prevention of abuse;
  • to answer your enquiries;
  • to inform you of changes to the services and policies;
  • for news and promotions — only with your explicit consent.

Sharing your personal data

The Company does not sell your personal data. We do not use advertising networks or marketing pixels. Data is shared only with providers necessary for delivering the service:

  • Bridge Ventures, Inc. and Bridge Ventures International (USA/EEA) — payment services, virtual accounts, identification (KYC/KYB) and anti-money-laundering checks;
  • Privy Inc. (USA) — authentication and self-custodied wallet infrastructure;
  • Stripe, Inc. and Lead Bank (USA/EEA) — card issuing and servicing if you request a card: identification, payment authorisation, disputes;
  • Card top-up providers (Stripe, MoonPay or Meld, depending on your country) — only if you top up your balance with a card;
  • Twilio SendGrid (USA) — email delivery;
  • DigitalOcean (data centre in Frankfurt, EU) — hosting of the Platform;
  • blockchain infrastructure and exchange-routing providers — they process wallet addresses and technical data, but not your names;
  • state and judicial authorities — where we are obliged by applicable law, a court order or an act of a competent authority.

All providers process the data only for the agreed purpose. If the Company's business is transferred to a third party, we will require your personal data to be treated in accordance with this Policy.

Transfers outside the EEA

Some of our providers are located in the USA. Transfers to them are carried out under GDPR safeguards, including standard contractual clauses.

Cookies and local storage

The Platform uses only technically necessary means: browser local storage for your session and chosen language. We do not use marketing cookies and do not track users across websites. You can restrict local storage in your browser settings, but some functions of the Platform will then not work.

Links to other websites

This policy applies only to the Platform. It may contain links to third-party websites, including those of our partners. The Company is not responsible for how those websites handle your personal data — please review their policies.

Your rights

You have the right of access to your personal data, and the rights to rectification, erasure, restriction of processing, data portability and objection to processing. To exercise them, contact us at [email protected]. Erasure requests are subject to our statutory retention obligations — where a legal ground exists, we may be unable to satisfy your request before the relevant period expires. You also have the right to lodge a complaint with the Commission for Personal Data Protection.

Protection of your personal data

  • encrypted data transfer (TLS) and encrypted storage;
  • access to information is restricted to authorised persons bound by confidentiality;
  • multi-factor authentication for operations with funds.

Retention period

The Company keeps your personal data and the information about your operations for the purposes and in the ways set out in this document for 5 years after the relationship ends, in accordance with the requirements of applicable anti-money-laundering legislation.

Email communications

We use your email address for messages related to your profile and operations — these are part of the service. News and promotional messages are sent only with your consent, and you can unsubscribe from them via the link at the end of each such message.

Changes to this Policy

The Company may periodically amend, supplement or repeal this Policy and undertakes to notify the users of the Platform. Continued use is deemed acknowledgement of the changes.

Commission for Personal Data Protection

Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Tel.: +359 2 915 3580, fax: +359 2 915 3525
Email: [email protected]
Website: www.cpdp.bg

Terms