Privacy Policy
What HarbourX collects about you, why we are allowed to hold it, who else sees it, and what you can make us do with it.
1. Who controls your data
The controller of your personal data is [registered company name], registered in [jurisdiction] under number [company number], at [registered address].
Our data protection contact is [name or role] at privacy@harbourx.org. [If a Data Protection Officer is required in your jurisdiction, name them here.]
2. What we collect, and why
We collect what we need to run the account and what the law requires us to keep. Nothing on this list is optional decoration.
3. Why we are allowed to hold it
- To perform our contract with you — running the account, converting, settling to your bank.
- To meet a legal obligation — identity verification, sanctions screening, transaction monitoring, record keeping and reporting.
- Our legitimate interests — keeping the platform secure, preventing fraud, and improving the service. We do not let this override your interests where they weigh more heavily.
- Your consent — where we ask for it specifically, such as for marketing. You can withdraw it at any time without affecting anything else.
[Name the specific articles or sections of the legislation that applies in your jurisdiction.]
4. Who else sees it
We do not sell your personal data. We share it only where the service or the law requires:
- Identity verification providers — [name them], to check the documents you submit.
- Banks and payment providers — to settle money to your account.
- Our custody and blockchain infrastructure providers — [name them].
- Regulators, law enforcement and courts — where we are legally required to report or to answer a lawful request.
- Professional advisers — auditors and lawyers, under a duty of confidence.
5. Third-party services on this site
Three third parties are loaded by pages you visit. This list is exhaustive and is kept accurate against what the site actually loads.
6. Cookies and what is stored in your browser
We use a session cookie to keep you signed in. It is marked HttpOnly and SameSite, and on a secure connection it is marked Secure. Without it the portal cannot tell one signed-in client from another, so it cannot be refused.
We also use your browser's local storage to remember your display preferences and to hold your own account record between pages. It never leaves your device and we cannot read it.
[Tidio sets its own cookies. If your jurisdiction requires a consent banner before non-essential third-party scripts load, that banner has to gate the chat widget — it is not covered by the session-cookie exemption.]
7. How long we keep it
Identity and transaction records are kept for [number] years after the account closes, because anti-money-laundering law requires it. We cannot delete them sooner even if you ask.
Support tickets and chat transcripts are kept for [number] years. Technical logs are kept for [number] months. Anything we no longer have a reason to hold is deleted.
8. Sending data abroad
[List the countries your providers operate in, and the safeguard relied on for each transfer — an adequacy decision, standard contractual clauses, or another lawful mechanism. If no data leaves your jurisdiction, say that instead; it is a better answer.]
9. How we protect it
Traffic between your browser and HarbourX is encrypted. Accounts are protected by two-factor authentication. Access to client records inside HarbourX is limited to staff who need it, and what they do with it is logged.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your rights we will tell you and the regulator within the time the law allows.
10. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete data we no longer have a lawful reason to keep;
- restrict or object to how we use it;
- hand it to you, or to someone else, in a portable format; and
- withdraw consent where consent is what we relied on.
Write to privacy@harbourx.org. We answer within [number] days. Where a legal obligation stops us doing what you ask — record-keeping duties usually — we will tell you which one and why.
You can also complain to [the supervisory authority and its contact details]. You do not have to come to us first, though we would rather you did.
11. Changes to this policy
We will post any change here and update the version and date at the top. Where a change materially affects you we will tell you by email before it takes effect.