Privacy Policy

This Privacy Policy came into force on the 10th of July 2026.

1. General information

1.1.SimpleSwap respects your privacy and is committed to protecting your personal data. This Privacy Policy aims to give you information on what personal data we collect, how we process and protect it, and tell you about your privacy rights and how the law protects you. Please read this Privacy Policy carefully as it explains our practices regarding your personal data and how we will treat it, and the basis on which any personal data will be processed by us.

1.2.We may revise this Privacy Policy from time to time in our sole discretion. The updated version of this Privacy Policy will be indicated on our website https://simpleswap.io/privacy-policy with the exact date. If there are any material changes to this Privacy Policy, we will notify you to the extent required by applicable law. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your data.

1.3.By using our Service, or otherwise howsoever providing us with your Personal data, you acknowledge that you have read and understood this Privacy Policy and, where your consent is required under applicable data protection law, you consent to the processing of your personal data on the terms described therein.

1.4.Our activities as processor. Our customers are companies that integrate our Services into their business operations through software applications (via API). By using our software, our customers are able to transfer users’ orders to liquidity providers. When they do this, we act as the processor on behalf of our customers, and process the relevant data for the sole purpose of providing our Services to them. We do that within limits and according to customers’ instructions and in line with our public Terms of Service, agreement for Services, or data processing or similar agreement concluded with the customer.

1.5.Our activities as controller. Our customers are also individuals who use our Service for personal purposes. This Privacy Policy describes the activities which SimpleSwap undertakes as controller. SimpleSwap is a controller when we process personal data for our own purposes and do not act on behalf of someone else. We are committed to processing that data as described in this Privacy Policy and respecting all obligations arising from the applicable privacy law.

1.6.Children under 18 cannot use our products and services. If we learn or are notified that it is the case, we will immediately take reasonable steps to delete that information from our records as quickly as possible. If you think a child under 18 is using our products or services, please contact us. If we need to rely on consent as a legal basis for processing your information and your country requires consent from a parent, we may require your parent's consent before we collect and use that information.

1.7.This Privacy Policy should be read together with the Terms of Service available at https://simpleswap.io/terms-of-service. Unless otherwise defined in this Privacy Policy, capitalised terms shall have the meanings assigned to them in the Terms of Service.

1.8.If you have any questions about this Privacy Policy, you can contact us: by email: dpo@simpleswap.io.

2. Use of Your Personal Data

2.1.We process personal data when we provide our Services to our customers.

While we provide Services to our customers, we may process your personal data if you:

• as an individual are our customer;
• are working for or on behalf of our customer, in which case you are either:

• an “account user” (an individual authorised by the customer to log into their account and utilise the Service);
• a “business contact” (a customer’s representative or any other individual acting as a contact point between the customer and SimpleSwap);
• are our customer’s “end-user” (an individual that engaged by our customer).

As we provide services to our customers, we process their personal data for the following purposes:

2.1.1.to enter into an agreement, create the customer’s account, and provide the necessary support to enable the customer to use our Service

What personal data do we collect?

SimpleSwap collects “account data”, which is all data essential for successfully maintaining a business relationship with a customer such as information needed to create customer’s account, to allow customer to use the Service, or to make payments to the customer accordingly. Specific data types include:

• Registration details of a customer and account users (e.g. name and surname, (business) address, phone number, email address, company’s name and industry, business role, as well as login details)
• Payment details of a customer (e.g. payment address, order of payments, bank account details, VAT number, information about creditworthiness and payment behaviour, and other additional information as required under applicable laws)
• Business contacts’ details (e.g. name and surname, (business) address, phone number and email address, company’s name and industry, and business role)
• “Customer support data” (i.e. customer support communication including the content of customer support tickets).

How do we collect it?

• Directly from you or from our due diligence provider, if you are an individual.
• Directly from you or via your organisation, if your organisation is our customer.

Why do we collect it, under which legal basis, and how do we use it?

We collect and use account data to:

• Sign and administer agreements with our customers
• Create customers’ accounts and enable their account users to use our Service
• Keep customers’ accounts secure and provide customer care and support
• Share relevant information about our products and services, maintain and improve our business relationships with customers, and exercise our rights and fulfil our obligations arising from these business relationships
• Assess, by conducting a due diligence process, whether we can enter into a contractual agreement with a prospective customer. We might use your identification data as part of the process. Whenever due diligence is conducted, we will separately inform you of precise details about the processing.

Conducting these activities is our legitimate interest in the sense of providing our Services to your organisation. However, if you personally are our contractual counterparty, we process your data because it is necessary for the performance of an agreement for Services or to provide assistance at your request prior to entering into the agreement.

How long do we keep it?

• Personal data of account users and business contacts are retained for twelve (12) months after the end of our business relationship with the customer.
• Personal data of individuals who are our customers are retained for seven (7) years after the end of our business relationship.
• Customer support data is retained for seven (7) years after the resolving of the support request.

Account data will be generally kept as per the stated deadlines. However, we might be required to retain this data for a different time period in certain circumstances if prescribed by specific local laws, when requested by authorities, or if needed to defend our legal rights.

2.1.2.to enable customers to exchange their virtual assets through our Service, ensure the security of our network and compliance with applicable rules

What personal data do we collect?

SimpleSwap collects “transactions-related data”: data that is processed while maintaining transactions made with to the Service. That includes information on the transaction itself (e.g. amount, virtual asset type, address of destination) and information provided additionally by the customer or the user for treating the exchange (including the customer’s or end-users’ e-mail address, other contact information, KYC documents).

We also collect “usage data”, which is information created during your use of our Services. This includes information communicated by the website or application to SimpleSwap (e.g. IP addresses, information on your usage, routing information), as well as logs of your activities on our platform.

How do we collect it?

• Transactions-related data is mainly received from our customers or end-users.
• Some transactions-related data is automatically generated or unveiled during the process of Service usage.
• Usage data is received directly from you or generated automatically when you use our Service.

Why do we collect it, under which legal basis, and how do we use it?

Transactions-related datais generally kept in the form of detail records, and we collect it and use it to:

• Routing transactions toward or from liquidity providers and handling user’s enquiries.

If you, as our customer, are an individual, the processing of your personal data is necessary for the performance of our agreement for Services. If our customer is a legal person, we rely on our legitimate interest to provide Services to our customers.

• Troubleshoot and detect problems with the network, prevent fraud and other illicit activities, and keep our Services secure. When conducting these activities, we might also leverage account and usage data. The latter is especially relevant for investigating fraudulent activities as it allows us to construct the timeframe of account user’s activities in the case of security-related incidents and be able to take adequate steps for mitigation.

The security of our Services is crucial for us, so for these activities we rely on our legitimate interest to maintain and improve the security of our network and Services.

• Calculate charges and settle payments with liquidity providers or resolve a billing dispute with our customer or our provider. In some cases we might also utilise account data as part of this activity.

The carrying out of these activities is our legitimate interest in the sense of handling payments and resolving financial disputes.

Please note that in order to comply with our legal obligations, we may be obliged to retain records containing transactions-related data as stipulated in the relevant national data retention provisions regulating law enforcement matters, and to share them upon government request.

How long do we keep it?

• Transactions-related data containing end-users’ personal data is deleted from detail records twelve (12) months after the end of the month in which the transaction took place.
• Other transactions-related data (such as time, type, amount, currency, address of destination, routing details) which do not contain end-users’ personal information is retained in communication detail records for up to ten (10) years following the year of communication.
• Usage data may be retained for up to three (3) years.

transactions-related and usage data will be generally kept as per the stated deadlines. However, we might be required to retain this data for a different time period in certain circumstances if prescribed by specific local laws, when requested by authorities, or if needed to defend our legal rights.

2.1.3.to improve our products and Services

What personal data do we collect?

SimpleSwap collects “behaviour analytics data”, which is data you generate as our customer’s account user during your activity on our website and our platform (e.g. your behaviour records inside our web interface, such as time spent, pages visited, history of your visits and features used as well as your IP address and information about your browser).

How do we collect it?

Behaviour analytics data is received directly from you or generated automatically when you use our Services by placing cookies and trusted tracking technologies on your browser. For more information on how we collect your data through cookies on our website, please see Section 6.

Why do we collect it, under which legal basis, and how do we use it?

We collect and use behaviour analytics data to:

• Gain insight into the way our current customers are using our platform and Services. Specifically, we take partially automated measurements that include human intervention in order to analyse the way you use the features and tools available on our platform to give you recommendations to improve your performance (e.g. how to better access some feature) and to better satisfy the business needs of our customers
• Create statistics on the use of our tools to understand which tools have a user-friendly design and which should be enhanced.

The general goal of such activities is to enhance your and your organization’s messaging execution when communicating with your end-users, and we rely on our legitimate interest when conducting them.

How long do we keep it?

Behavior analytics data is retained for up to twenty-five (25) months after it was generated.

2.2.For the purpose of our cooperation with suppliers, the following description applies:

What personal data do we collect?

If you as our supplier (also known as vendor or service provider) are an individual, we may collect:

• Your name and surname, (business) address, phone number, email address, company’s name and industry, business role, as well as your billing information (e.g. billing address, your VAT number, bank account details, and further information if we are legally required to and in accordance with applicable national legislation).

When doing business with our suppliers, we may also collect:

• Personal data related to “business contacts” (supplier’s representatives and other individuals acting as a contact point between the supplier and SimpleSwap) such as name and surname, (business) address, phone number, email, company name and industry, and business role.

How do we collect it?

• Directly from you, if you as an individual are our supplier.
• Directly from you or via your organization, if your organization is our supplier.

Why do we collect it, under which legal basis, and how do we use it?

We collect and will use this data to:

• Sign and administer an agreement with you or your organization
• Get relevant information about your product or services or share relevant information about our business and services with you
• Maintain and improve our business relationship with you or your organization as well as exercise our rights and fulfil our obligations arising from the business relationship.

Conducting these activities is our legitimate interest in the sense of purchasing products or services from or collaborating with a supplier that is a legal person. However, if you personally are our contractual counterpart, we process your personal data because it is necessary for the performance of an agreement or for entering into an agreement.

How long do we keep it?

• Personal data about business contacts will be deleted twelve (12) months after the end of our business relationship with the supplier.
• Personal data of individuals who are our suppliers will be deleted seven (7) years after the end of our business relationship.

If prescribed by specific local laws, when requested by authorities, or if needed to defend our legal rights, we might be required to retain this data for a different time period than listed above.

2.3.For the purpose of our cooperation with potential customers and partners, the following description applies:

What personal data do we collect?

We may collect your name and surname, contact details (e.g. email address, phone number, country), and business details (e.g. company’s name and industry and your business role). We will also collect any other information you choose to provide to us, depending on the nature of our communication.

How do we collect it?

• Directly from you when you register on our website to learn more about our business and services (e.g. through Contact form), start chatting with us via our chat channel, take steps to enter into a business relationship with us, and when you provide to us your contact details when requesting further information.
• Indirectly through business and professional networks and databases (such as LinkedIn) or third parties we might employ that supply us with information collected from publicly available sources and data enrichment providers. We only retain the information that will help us reach potential customers or suppliers that could benefit from our services and products, or if we are interested in their products and services.

Why do we collect it, under which legal basis, and how do we use it?

We collect and use this data to:

• Communicate with you, answer your questions, and find out if you or your organization are interested in further cooperation with us, either by using our products and services or by providing your products or services to us
• Ensure adequate support within the presales and purchasing process if there is a mutual interest in entering into an agreement. 

Such activities represent our legitimate interest to conduct our business. If you personally are our contractual counterpart, we process your data because it is necessary for the performance of a contract or for entering into a contract.

How long do we keep it?

Personal data collected for this purpose will be deleted six (6) months after our last communication unless we enter into a business agreement with you or your organisation.

2.4.When we send you our informing email or other marketing communications, the following description applies:

What personal data do we collect?

We collect your name and surname, and contact details (e.g. email address or phone number). We also gather simple statistics around email openings and clicks.

How do we collect it?

• Directly from you if you subscribe to receive our newsletters, blogs or our other marketing communications through the webforms available on our website
• Directly from you or via your organization as part of business-to-business (B2B) marketing if we have an existing business relationship with your organization

Simple statistics around email openings and clicks are generated automatically via industry standard technologies.

Why do we collect it, under which legal basis, and how do we use it?

Our purpose for collecting this data is to:

• Inform you about our Services, company news, webinars and upcoming events
• Gather statistics (email opening and clicks) to help us improve our direct marketing initiatives.

If you subscribe to our email marketing communications, we rely on your consent provided to us when submitting such webforms. For B2B (business-to-business) marketing, we rely on our legitimate interest to maintain and improve our business relationships by informing our existing business partners (e.g. customers and suppliers) about our Services, company news, webinars, and upcoming events via email or other forms of communications.

In any case, you may proactively manage your preferences or opt-out of communications (unsubscribe) with SimpleSwap at any time. When you unsubscribe from our marketing communications (i.e. withdraw your consent or object to the processing), we will stop sending you any marketing materials. However, we maintain a so-called “suppression list” that contains only your email address or phone number just to be sure that we do not contact you with unwanted content in the future. We retain this information relying on our legitimate interest to respect the choices of our newsletter recipients.

How long do we keep it?

Your personal data (name and surname, contact details) are kept for our marketing activities during your or your organization’s business relationship with us unless you object (B2B).

If you have subscribed directly, then your personal data will be kept for our marketing activities until you unsubscribe.

If you unsubscribe or object, we will only keep a suppression list that includes your contact details (e.g. email address or phone number) to ensure you do not receive any further marketing communication.

2.5.When you visit our website, the following description applies:

What personal data do we collect?

When visiting our website, by placing cookies, we may collect your IP address, your browser type and associated information, the pages you have visited and the order you visited them, as well as whether you are a new or returning visitor.

How do we collect it?

Directly from you when you browse our website by placing cookies on your browser. The cookies are either placed automatically (necessary cookies) or only once you have consented to them (functional, analytical, and advertising cookies). Please review Section 6 for more information.  

Why do we collect it, under which legal basis, and how do we use it?

We collect and use this data to:

• Maintain and improve our website and overall business.

When doing so, we rely either on our legitimate interest to ensure the functioning of the website (for necessary cookies) or on your consent (for functional, analytical, and advertising cookies). Please review Section 6 for more information on how you can manage (including to withdraw) your cookie consent.

How long do we keep it?

This depends on the specific types of cookies that were either placed automatically (necessary cookies) or that you have consented to be placed (other categories). Please review Section 6 for more details on the retention periods for specific types of cookies.

3. Personal data sharing and international transfers

3.1.We may engage suppliers (also known as vendors or service providers) to help us in the processing of your personal data for the activities that we conduct as a controller and that we describe in this Privacy Policy. Since we are a global company, we may also share your personal data with our subsidiaries and affiliates as part of our daily operations. Any such sharing is regulated by intercompany agreements on personal data processing and transfer.

3.2.Before engaging any new supplier, we perform a security and privacy assessment. Where such supplier acts as our processor, we ensure that the processing of personal data is governed by a written data processing agreement.

3.3.Notwithstanding the foregoing, as a rule, we do not share personal data with third parties except when strictly necessary and on a need-to-know basis, such as with:

• Liquidity providers for maintaining transactions.
• Service and technology providers to the extent strictly necessary for them to perform specific actions on our behalf. These might be related both to our Services and to our other processes.
• Third parties when required to comply with our legal obligations. We may share your personal data with authorised legal authorities due to relevant legislation, such as a judicial proceeding, court order, or legal process served on us (e.g. for criminal procedures) or because of threats to public security, regulatory requirement, or in the context of investigations or bankruptcy. As a communications provider, we are required to retain certain communications-related data for law enforcement purposes and will be required to share that data with authorised law enforcement authorities upon their request. Also, if we are under an obligation to demonstrate compliance with relevant accounting, financial and tax legislation, your data can be shared with auditors and tax authorities for those purposes.
• Advertising partners that we might use as part of our marketing activities.
• Third-party analytics services.
• Merger and acquisition stakeholders as part of disclosure in the event of a merger, sale, or other asset transfer. Your information may be transferred as part of such a transaction, as permitted by law or contract.

3.4.We conduct our business operations globally, and sometimes we need to carry out international transfers of your personal data by providing your personal data to the parties specified in the section above. All international transfers are carried out while ensuring the confidentiality and security of your personal data and in line with the applicable privacy law.

4. Retention of Your Personal data

4.1.Your personal data that has been collected based on your consent will be kept for a period specified in this Policy. If you wish to withdraw your consent for the processing of your personal data for any purpose and to delete your data, you can do that at any time by sending an email to our contact dpo@simpleswap.io. Regarding your personal data that is not subject to your consent, we will only keep it for as long as necessary to fulfil the purposes for which it was collected before making it non-identifiable (anonymous) or deleting it, as required by law.

4.2.Specific retention periods are listed under the respective activities in Section 2 of this Privacy Policy. The retention periods listed are the standard default periods. In some cases, exceptions apply due to local laws related to law enforcement, tax, or other purposes. Additionally, if legal matters such as litigation, law enforcement requests, or government investigations require us to preserve records, including those containing personal information, for longer periods than listed in Section 2, then we will delete the records in question when we are no longer legally obligated to retain them.

5. Your rights in respect of your Personal data

5.1.Depending on the applicable privacy law, you may have certain rights with respect to your personal data. Where granted by the applicable privacy law, you have the right to:

• Withdraw your consent to our processing of your personal data (to the extent such processing is based on your consent and consent is the only permissible basis for processing), without affecting the lawfulness of processing based on consent before its withdrawal
• Request from us to access your personal data, which means requesting a copy of the personal data we hold about you
• Ask us to rectify (correct) your personal data that you think is inaccurate and to complete your personal data that you think is incomplete
• Ask us to erase your personal data in certain circumstances
• Ask us to restrict the processing of your personal data in certain circumstances
• If we process your personal data by automated means based on your consent or upon a contractual relation with you, you can exercise the right of data portability
• If we process your personal data upon our legitimate interest, you have the right to object to the processing
• If you want to object to the processing of your data for marketing purposes, you can do it at any time by using the unsubscribe link provided in our marketing communications
• You may also have specific rights in exceptional cases when we may carry out automated decision-making operations, including profiling.

5.2.If you have any questions on how we use your personal data or if you wish to exercise a certain right or resolve a complaint regarding the processing of your personal data, you can contact us by sending an email to dpo@simpleswap.io.

6. Tracking Technologies andCookies

6.1.Our website uses cookies. We use necessary cookies to make our websites and web-based interfaces work. With your permission we will set optional cookies to provide social media features, to show you ads relevant to your interests, and to analyse our traffic. We won't set optional cookies unless you enable them.

6.2.Cookies are small text files that we and associated third parties place on your device (e.g. computer or smartphone) when you visit our website and web-based interface. These files generally contain a string of alphanumeric characters, and they allow our servers to recognize your session in order to properly load the website for you and provide you with the requested service (e.g. to log in). Some cookies are necessary for the website to properly function, so they cannot be turned off. Other cookies are optional because they are not strictly necessary for the website to function, even though they might provide additional functionalities. Optional cookies can be turned off.

Aside from the necessary versus optional distinction, cookies are also sometimes categorized based on the domain which sets them (first vs third-party ones) and on the duration for which they are stored on your device (session vs persistent).

In addition to cookies, we might also use related technologies – such as web beacons (including tracking pixels) and HTTP requests in general – on our website. These technologies allow for standard information related to website browsing such as IP address, browser type, and the pages you have visited to be transferred to us or to associated third parties.  

6.3.SimpleSwap uses both necessary and optional (if enabled) cookies on its website. Optional cookies generally fall into one of these three categories: functional, analytical, or advertising. The data collected by cookies is used to:

• NECESSARY

Make the website work properly. Necessary cookies enable core functionalities such as security, network management, and accessibility.

• OPTIONAL

Functional: Enable specific functionalities. Functional cookies allow the website to remember your preferences and settings. For example, functional cookies will remember your language choice and display the website in your preferred language.    

Analytical: Help us understand how the website is being used. This might also include analysing how effective our campaigns are. Most of the information is in an aggregated form, but some data might be used to help us customize the website to enhance the overall experience for you.            

Advertising: Facilitate personalised and other advertising. This data might be used to make advertising relevant to you and your interests. Such ads are generally more valuable for both you and the advertisers.

6.4.When you first visit our website, you will see our cookie consent banner. As explained above, necessary cookies will always be active, but you can either enable or disable optional cookies. Once you make your choices, the website will remember your preferences and will respect them accordingly.

You can manage the cookies on this and other websites via the internet browser that you are using on your device. You can obtain more detailed information by navigating to the support pages of your browser provider such as Mozilla (Firefox), Apple (Safari), Microsoft (Edge), or Google (Chrome). A similar solution – on top of managing your choices directly through the cookie consent banner for this website – exists for Google Analytics.