1. Overview
This Privacy Policy explains how Gaduin Inc. (the “Company”, “GADUIN”, “we”, “us”, “our”) collects, uses, shares and retains personal data when you visit our website, use the GADUIN platform (the “Platform”) or otherwise interact with us. It applies to everyone who uses the Platform, worldwide.
We are the controller of your personal data for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the equivalent regimes in the United Kingdom, Switzerland, Brazil and other jurisdictions with comparable protections.
2. Data we collect
2.1 Account data
When you create an account we collect your email address, the timestamp of registration, an account identifier we generate for you, the locale and timezone of your client, the country you select during onboarding, and — for business accounts — the legal entity name and the company registration number you provide.
2.2 Identity and compliance data
We ask you to verify your identity after your first trade: before any further trade, and before a withdrawal from an account that has traded. The check is carried out on our behalf by our identity verification processor, currently Didit. It collects an image of your government-issued photo identity document, the data printed on it (such as your legal name, date of birth, document number, nationality and expiry date), and a selfie with a liveness check. From the selfie and the document photo it derives biometric data (a facial template) to confirm that the document is yours and that you are present. The processor may also use your IP address and device information during the check to detect fraud.
We receive and keep the outcome of the check, its status and the verification session identifier. We do not store your document images, your selfie or any biometric data. The processor handles and retains that data as described in its verification privacy notice. Before the check starts we tell you who runs it and ask for your explicit consent.
Where required by law or our risk-based KYC programme, we may also request source-of-funds information and proof of address.
2.3 Trading and wallet data
We record every order, trade, deposit, withdrawal, market settlement and balance change associated with your account. For on-chain transactions we additionally record the blockchain network, transaction hash, source/destination address and the timestamp of confirmation.
2.4 Device and connection data
We log the IP address used to access the Platform, the user-agent string, the country and timezone derived from the IP, and the timestamp of each request. We also process a short-lived bot-protection challenge issued by our content delivery partner; the challenge does not identify you individually.
During sign-in and promotional claims, we use FingerprintJS to derive a browser identifier from device and browser characteristics. We combine this identifier with connection IP and country information to detect repeated account creation and bonus abuse. FingerprintJS runs locally in your browser with vendor telemetry disabled; the identifier is sent to our API for fraud prevention, not advertising.
2.5 Cookies and similar technologies
We use cookies and equivalent storage mechanisms for four purposes. Essential cookies keep the Platform working: a session cookie that keeps you signed in and a locale cookie that remembers your language choice. A first-party sign-up attribution cookie remembers how you reached us until you sign up (see 2.6). Analytics cookies, set by our web-analytics provider, give each browser a pseudonymous identifier so we can measure which pages and markets people use. An advertising-measurement tag, set by the social network on which we advertise, records the pages you visit so we can tell which of our advertisements brought you to the Platform; that network processes this data under its own privacy policy.
The analytics and advertising-measurement cookies are set for every visitor, from the first page viewed. By continuing to use the Platform you agree to their use. You can block or delete them at any time in your browser settings; the Platform keeps working without them.
2.6 Sign-up attribution
When you create an account we store how you reached us: the page you arrived on, the domain of the site that referred you (not its full address), any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the ad network’s click identifier when you arrive from one of our advertisements, your site language, the time of that visit, the sign-up page and the page you were returning to. We use this to understand which pages and campaigns lead people to sign up. Before sign-up these details are kept in a first-party cookie in your browser for up to 30 days; a later visit through a campaign link replaces them. They are saved once, with your new account, and never on later sign-ins. If you arrived from an advertisement, we may tell that ad network, using only its click identifier, when you sign up, make your first deposit (with its amount) and place your first trade; we never send it your name, email address or other account details. We do not track you across other sites and we do not otherwise share this data with third parties.
3. Why we process your data
We process your personal data for the following purposes:
- To provide the Platform — authenticate you, execute and settle your trades, custody your USDT balance, and pay out settlement proceeds (Art. 6(1)(b) GDPR — performance of a contract);
- To comply with our anti-money-laundering, counter-terrorist-financing, sanctions, tax-reporting and prudential obligations (Art. 6(1)(c) GDPR — legal obligation);
- To verify your identity after your first trade (Art. 6(1)(c) GDPR — legal obligation). The biometric data derived from your selfie is processed only to match you to your identity document, on the basis of your explicit consent given before the check starts (Art. 9(2)(a) GDPR), or where applicable law provides for it, the substantial public interest in preventing money laundering and fraud (Art. 9(2)(g) GDPR);
- To detect, investigate and prevent fraud, market abuse, security incidents and other unlawful activity (Art. 6(1)(f) GDPR — legitimate interest);
- To improve and secure the Platform — capacity planning and latency monitoring (Art. 6(1)(f) GDPR — legitimate interest);
- To understand how visitors use the Platform and which of our advertisements bring them to it — web analytics and advertising measurement (Art. 6(1)(a) GDPR — consent, which you give by continuing to use the Platform after our cookie notice);
- To respond to your support enquiries and to send service communications (Art. 6(1)(b)/(f) GDPR).
5. International transfers
Personal data may be transferred to, stored or processed in countries outside your country of residence, including jurisdictions that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data out of the European Economic Area or the United Kingdom we rely on Standard Contractual Clauses approved by the European Commission or the United Kingdom Information Commissioner’s Office, or another lawful transfer mechanism.
6. Retention
We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, to satisfy our legal and regulatory obligations, and to resolve disputes. Indicative retention periods are:
- Account, trading and wallet data — for the duration of the account plus seven (7) years after closure, in line with prevailing record-keeping obligations;
- Identity verification results — for the duration of the account plus five (5) years after closure. We do not keep identity document images, selfies or biometric data; the verification processor retains them only as described in its verification privacy notice;
- Connection and access logs — twelve (12) months;
- Support correspondence — twenty-four (24) months from the last interaction.
7. Your rights
Depending on your jurisdiction, you may have the right to: access your personal data; have it rectified or erased; object to or restrict its processing; receive it in a portable format; and lodge a complaint with the supervisory authority in your country of habitual residence. We will respond to verified requests within one (1) month, extendable by two (2) further months for complex cases.
You may exercise any of these rights by emailing [email protected]. We may need to verify your identity before acting on the request.
8. Security
We take appropriate technical and organisational measures to protect your personal data, including transport-layer encryption, per-environment secrets management, role-based access controls, audited admin actions and periodic penetration testing. No system is impervious to attack; if we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by law.
9. Children
The Platform is not directed at and may not be used by persons under the age of eighteen (18). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will take prompt steps to delete the information.
10. Changes to this Policy
We may amend this Privacy Policy from time to time. Material changes will be communicated to you by email or by a prominent notice on the Platform. The current version is always available at this URL.
11. Contact
Questions about this Privacy Policy or our data practices generally should be directed to [email protected].
Change log
- §2.5, §2.6 and §4: sign-up attribution is kept in a first-party cookie for up to 30 days, includes the ad network’s click identifier, and that network may be told when you sign up, first deposit and first trade.
- §2.6 added: the sign-up attribution we store when an account is created.
- §3: payouts are described as settlement proceeds.
- §2.4: added the browser identifier we derive during sign-in and promotional claims to detect repeated account creation and bonus abuse.
- §10 no longer refers to a “Last updated” date: the current version is always the one available at this URL.
- §1: the controller of your personal data is Gaduin Inc. (Republic of Panama).
- §2.5 and §4: the product-analytics provider is described by its role rather than by name.
- First version.