Politique de confidentialité

This Privacy Policy explains how Gaduin Inc. (the “Company”, “GADUIN”, “we”, “us”, “our”) collects, uses, shares and retains personal data when you visit our website, use the GADUIN platform (the “Platform”) or otherwise interact with us. It applies to everyone who uses the Platform, worldwide.

We are the controller of your personal data for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the equivalent regimes in the United Kingdom, Switzerland, Brazil and other jurisdictions with comparable protections.

2.1 Account data

When you create an account we collect your email address, the timestamp of registration, an account identifier we generate for you, the locale and timezone of your client, the country you select during onboarding, and — for business accounts — the legal entity name and the company registration number you provide.

If you choose to sign in with Google or Apple, we receive your provider-specific account identifier and verified email address and use them to create, authenticate or connect your account. If you choose Apple’s Hide My Email, we receive the relay address Apple supplies instead of your personal address. We do not receive your Google or Apple password or request access to your email inbox. The provider processes your sign-in under its own privacy policy. Connecting a provider to an existing email account requires verification of that account, including its two-factor authentication where enabled.

2.2 Identity and compliance data

We ask you to verify your identity after your first trade: before any further trade, and before a withdrawal from an account that has traded. The check is carried out on our behalf by our identity verification processor, currently Didit. It collects an image of your government-issued photo identity document, the data printed on it (such as your legal name, date of birth, document number, nationality and expiry date), and a selfie with a liveness check. From the selfie and the document photo it derives biometric data (a facial template) to confirm that the document is yours and that you are present. The processor may also use your IP address and device information during the check to detect fraud.

We receive and keep the outcome of the check, its status and the verification session identifier. We do not store your document images, your selfie or any biometric data. The processor handles and retains that data as described in its verification privacy notice. Before the check starts we tell you who runs it and ask for your explicit consent.

Where required by law or our risk-based KYC programme, we may also request source-of-funds information and proof of address.

2.3 Trading and wallet data

We record every order, trade, deposit, withdrawal, market settlement and balance change associated with your account. For on-chain transactions we additionally record the blockchain network, transaction hash, source/destination address and the timestamp of confirmation.

2.4 Device and connection data

We log the IP address used to access the Platform, the user-agent string, the country and timezone derived from the IP, and the timestamp of each request. We also process a short-lived bot-protection challenge issued by our content delivery partner; the challenge does not identify you individually.

During sign-in and promotional claims, we use FingerprintJS to derive a browser identifier from device and browser characteristics. We combine this identifier with connection IP and country information to detect repeated account creation and bonus abuse. FingerprintJS runs locally in your browser with vendor telemetry disabled; the identifier is sent to our API for fraud prevention, not advertising.

2.5 Cookies and similar technologies

We use cookies and equivalent storage mechanisms for four purposes. Essential cookies keep the Platform working: a session cookie that keeps you signed in and a locale cookie that remembers your language choice. A first-party sign-up attribution cookie remembers how you reached us until you sign up (see 2.6). Analytics cookies, set by our web-analytics provider, give each browser a pseudonymous identifier so we can measure which pages and markets people use. An advertising-measurement tag, set by the social network on which we advertise, records the pages you visit so we can tell which of our advertisements brought you to the Platform; that network processes this data under its own privacy policy.

We also record, in our own systems, the pages you view and what you do on them: taps on buttons, how far you scroll, how long a page takes to load, and each step of sign-up, onboarding and deposit. These records carry how you reached us (the details described in 2.6) and are linked to a random identifier stored in your browser’s local and session storage and, once you sign in, to your account. We use them to understand and improve how people use the Platform. No IP address is stored with these records.

We use Microsoft Clarity to record how visitors interact with our pages — pointer movements, taps, scrolling and the page content shown — and study it as session recordings and heatmaps. Microsoft processes this data on our behalf as our processor and sets its own analytics cookies to recognise a browser across visits. Anything you type into a form, and every part of the Platform that shows your balance, positions, wallet addresses, email address, two-factor codes or identity details, is masked in your browser before anything is sent, and the pages that complete a sign-in link are never recorded. Microsoft handles this data as described in the Microsoft Privacy Statement.

The analytics and advertising-measurement cookies are set for every visitor, from the first page viewed. By continuing to use the Platform you agree to their use. You can block or delete them at any time in your browser settings; the Platform keeps working without them.

2.6 Origine de l’inscription

Lorsque vous créez un compte, nous enregistrons la façon dont vous êtes arrivé chez nous : la page sur laquelle vous êtes arrivé, le domaine du site qui vous a redirigé vers nous (pas son adresse complète), les éventuelles balises de campagne du lien (utm_source, utm_medium, utm_campaign, utm_content et utm_term), l’identifiant de clic du réseau publicitaire lorsque vous arrivez depuis l’une de nos publicités, la langue du site, l’heure de cette visite, la page d’inscription et la page vers laquelle vous reveniez. Nous utilisons ces informations pour comprendre quelles pages et quelles campagnes amènent les gens à s’inscrire. Avant l’inscription, ces informations sont conservées dans un cookie interne de votre navigateur pendant 30 jours au maximum ; une visite ultérieure via un lien de campagne les remplace. Elles sont enregistrées une seule fois, avec votre nouveau compte, et jamais lors des connexions suivantes. Si vous êtes arrivé depuis une publicité, nous pouvons indiquer à ce réseau publicitaire, en utilisant uniquement son identifiant de clic, quand vous vous inscrivez, effectuez votre premier dépôt (avec son montant) et réalisez votre première opération ; nous ne lui transmettons jamais votre nom, votre adresse e-mail ni d’autres informations de votre compte. Nous ne vous suivons pas sur d’autres sites et ne partageons pas autrement ces données avec des tiers.

We process your personal data for the following purposes:

• To provide the Platform — authenticate you, execute and settle your trades, custody your USDT balance, and pay out settlement proceeds (Art. 6(1)(b) GDPR — performance of a contract);
• To comply with our anti-money-laundering, counter-terrorist-financing, sanctions, tax-reporting and prudential obligations (Art. 6(1)(c) GDPR — legal obligation);
• To verify your identity after your first trade (Art. 6(1)(c) GDPR — legal obligation). The biometric data derived from your selfie is processed only to match you to your identity document, on the basis of your explicit consent given before the check starts (Art. 9(2)(a) GDPR), or where applicable law provides for it, the substantial public interest in preventing money laundering and fraud (Art. 9(2)(g) GDPR);
• To detect, investigate and prevent fraud, market abuse, security incidents and other unlawful activity (Art. 6(1)(f) GDPR — legitimate interest);
• To improve and secure the Platform — capacity planning and latency monitoring (Art. 6(1)(f) GDPR — legitimate interest);
• To understand how visitors use the Platform and which of our advertisements bring them to it — web analytics and advertising measurement (Art. 6(1)(a) GDPR — consent, which you give by continuing to use the Platform after our cookie notice);
• To respond to your support enquiries and to send service communications (Art. 6(1)(b)/(f) GDPR).

We do not sell your personal data. We share it only with categories of recipient that are necessary to provide the Platform or to comply with our obligations:

• Infrastructure providers: managed hosting, database, object-storage, CDN and DNS providers under binding processor agreements;
• Identity verification: our identity verification processor (currently Didit), which collects your identity document, selfie and biometric data on our behalf and returns the outcome of the check to us;
• Email delivery: a transactional email provider that delivers magic-link sign-in and account notifications;
• Analytics and advertising measurement: our web-analytics provider, which receives a pseudonymous identifier and the pages and events of your visit; Microsoft (Clarity), which receives masked session recordings of your visit as described in 2.5; the social network on which we advertise, which receives the pages you visit through its measurement tag; and the ad networks we advertise on, which receive their own click identifier back with your sign-up, first deposit (with its amount) and first trade, as described in 2.6;
• Blockchain explorers: public on-chain data is by its nature visible to anyone with the address — we do not control this and we do not share off-chain identity data with blockchain explorers;
• Authorities and regulators: where compelled by valid legal process, court order or applicable regulatory requirement.

Personal data may be transferred to, stored or processed in countries outside your country of residence, including jurisdictions that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data out of the European Economic Area or the United Kingdom we rely on Standard Contractual Clauses approved by the European Commission or the United Kingdom Information Commissioner’s Office, or another lawful transfer mechanism.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, to satisfy our legal and regulatory obligations, and to resolve disputes. Indicative retention periods are:

• Account, trading and wallet data — for the duration of the account plus seven (7) years after closure, in line with prevailing record-keeping obligations;
• Identity verification results — for the duration of the account plus five (5) years after closure. We do not keep identity document images, selfies or biometric data; the verification processor retains them only as described in its verification privacy notice;
• Connection and access logs — twelve (12) months;
• Support correspondence — twenty-four (24) months from the last interaction.

Depending on your jurisdiction, you may have the right to: access your personal data; have it rectified or erased; object to or restrict its processing; receive it in a portable format; and lodge a complaint with the supervisory authority in your country of habitual residence. We will respond to verified requests within one (1) month, extendable by two (2) further months for complex cases.

You may exercise any of these rights by emailing [email protected]. We may need to verify your identity before acting on the request.

We take appropriate technical and organisational measures to protect your personal data, including transport-layer encryption, per-environment secrets management, role-based access controls, audited admin actions and periodic penetration testing. No system is impervious to attack; if we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by law.

The Platform is not directed at and may not be used by persons under the age of eighteen (18). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will take prompt steps to delete the information.

We may amend this Privacy Policy from time to time. Material changes will be communicated to you by email or by a prominent notice on the Platform. The current version is always available at this URL.

Questions about this Privacy Policy or our data practices generally should be directed to [email protected].