Privacy Policy
Version 1.0 — 24 July 2026
This policy explains how personal data is processed when you use the client verification portal at kyc.cryptolisting.ws (the "Portal") to request access to the cryptolisting.ws information service. It is provided under Articles 12 and 13 of Regulation (EU) 2016/679 ("GDPR").
1. Data controller
The data controller is CLW.
Privacy contact: privacy@cryptolisting.ws. No Data Protection Officer has been designated; privacy matters are handled by an internal privacy contact reachable at the address above.
2. Data we collect
- Identity & contact — first name, last name, email address, Telegram username (optional).
- Address & country — address line, city, postal code, country.
- Source of funds — declared category and optional free-text detail.
- Attestations & acceptance proof — your ticked attestations (origin of funds, sanctions, accuracy), acceptance of the Terms of Sale, the document versions shown to you, the submission timestamp (UTC), your IP address and browser user-agent string.
- Technical / security data — a session cookie (see Section 9) and authentication logs (timestamp, IP address, event type, success/failure).
- Approximate country from your IP — derived locally from your IP address using an offline database, at country level only, to help prevent fraud and comply with sanctions measures.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Review of your access request and management of your account | Art. 6(1)(b) — steps at your request prior to entering into a contract, and performance of the contract |
| Invoicing and accounting | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligations (tax and accounting law) |
| Attestation of the licit origin of funds | Art. 6(1)(f) — legitimate interest in preventing fraud (see Recital 47 GDPR) |
| Proof of acceptance of the Terms of Sale (timestamp, IP address, document version) | Art. 6(1)(f) — legitimate interest in establishing evidence of contractual consent |
| Security of the site and of your account (session cookie, authentication logs) | Art. 6(1)(f) — legitimate interest in securing the service |
| Deriving an approximate country from your IP address (fraud and sanctions screening; flagged for a human review, never an automated decision) | Art. 6(1)(f) — legitimate interest in preventing fraud and complying with restrictive measures |
4. Is providing your data mandatory?
All form fields except the Telegram username are required to process your access request. If you do not provide them, we cannot review your request and access to the service cannot be granted.
5. Recipients and processors
- Authorised staff only — one to two administrators of CLW review submissions. Every access to a submission is logged.
- Processor — Amazon Web Services EMEA SARL provides hosting. Data is stored on servers located in Frankfurt, Germany (EU), under the AWS GDPR Data Processing Addendum.
Your data is not sold, shared with advertisers, or disclosed to any other third party, except where disclosure is required by law or by a competent authority. No transfers of your data outside the European Union are initiated by the company.
6. Retention periods
| Data | Retention |
|---|---|
| Rejected applications | Deleted 12 months after the decision |
| Applications left without a decision | Deleted 12 months after submission |
| Client data (approved applications) | Duration of the contractual relationship, then restricted archive for 5 years (statute of limitations) and 10 years for accounting records |
| Proof of acceptance of the Terms of Sale | Duration of the contract + 5 years |
| Connection and authentication logs | 6 months |
7. Your rights
Under the GDPR you have the right to:
- Access your personal data and obtain a copy;
- Rectify inaccurate or incomplete data;
- Erase your data, within the limits of our legal obligations;
- Restrict processing in the cases provided by Art. 18;
- Object to processing based on our legitimate interests, on grounds relating to your particular situation;
- Portability of the data you provided under the contract, in a structured, machine-readable format;
- Define directives concerning the fate of your personal data after your death, to the extent provided by applicable law, which we will apply once notified.
To exercise these rights, write to privacy@cryptolisting.ws. We answer within one month of receiving your request. We may ask you to confirm the email address and access code associated with your file to verify your identity.
You also have the right to lodge a complaint with a data protection supervisory authority — in particular in the EU member state where you live or work, or where you consider the alleged infringement occurred.
8. No automated decision-making
No decision producing legal effects concerning you is taken by fully automated means. Every application is reviewed by a human operator.
9. Cookies
The Portal uses a single strictly-necessary session cookie
(kyc_session) to authenticate your access code while you fill the form.
Its lifetime does not exceed 2 hours. As a cookie strictly necessary for the provision
of a service you expressly requested, it is exempt from consent under applicable
e-privacy rules. The Portal sets no analytics cookies, no trackers, and no
third-party cookies — which is why no cookie banner is shown.
10. Changes to this policy
Any material change to this policy will be published on this page with a new version number and date. The version in force at the time of your submission is recorded with your file.