PredExchange

1. Introduction

1.1. This Privacy Policy describes how Forecast Harbor N.V., the operator of predxchange.xyz (the "Company", "we", "us" or "our"), collects, uses, discloses and otherwise processes personal data of users of the Website and Services (the "Trader", "User", "you" or "your").

1.2. This Privacy Policy applies to all personal data processed by the Company in connection with predxchange.xyz, including the Website, mobile interface, APIs, smart-contract interfaces, customer-support channels and related communications.

1.3. By using the Services on predxchange.xyz, you acknowledge that you have read, understood and consent, where applicable, to the processing of your personal data as described in this Privacy Policy.

1.4. If you do not agree with this Privacy Policy, you must not use the Website or Services.

2. Data Controller

2.1. The data controller for personal data processed in connection with predxchange.xyz is Forecast Harbor N.V., Company Number 168942, with its registered office at Kaya Isla di Futuro 27, Willemstad, Curaçao.

2.2. The Company may appoint affiliates, processors and subprocessors to process personal data on its behalf in accordance with this Privacy Policy and applicable law.

2.3. The Data Protection Officer may be contacted at [email protected], marked for the attention of the DPO.

3. Categories of Personal Data We Collect

3.1. We collect and process the following categories of personal data, as applicable to the Services you use:

3.1.1. Account Data

email address, username, password hash, account preferences, account status;
connected wallet addresses, public keys and on-chain identifiers;
communication preferences, language, time zone.

3.1.2. Identification and Verification Data (KYC)

full name, date of birth, nationality, gender, residential address;
government-issued identification documents (passport, ID card, driving licence);
selfie or live-video data used for biometric matching;
proof of address documents (utility bill, bank statement);
tax identification numbers where required by law.

3.1.3. Financial and Transactional Data

deposits, withdrawals, balances, orders, trades, positions, settlement events;
payment-method identifiers, wallet provenance, blockchain transaction hashes;
source-of-funds and source-of-wealth information and supporting documents;
fee, rebate and promotional credit history.

3.1.4. Technical and Device Data

IP address, geolocation derived from IP, device identifiers, device model, operating system;
browser type, language, screen resolution, time zone;
device fingerprint, behavioural biometrics, cookie identifiers, log files;
API keys, session tokens, two-factor authentication data.

3.1.5. Communications Data

customer-support tickets, chat transcripts, email correspondence, call recordings (where lawful);
feedback, surveys and other communications you send to us.

3.1.6. Marketing Data

marketing preferences, opt-in and opt-out signals;
campaign engagement data, referral data, leaderboard participation.

4. How We Collect Personal Data

4.1. We collect personal data directly from you when you register, verify your account, connect a wallet, place orders, trade, withdraw funds or contact customer support.

4.2. We collect personal data automatically when you use the Website, including technical and device data captured through cookies, log files, analytics tools and security tools.

4.3. We collect personal data from third parties, including identity-verification providers, blockchain-analytics providers, sanctions and PEP screening providers, payment providers, advertising and analytics partners and public sources, where lawful.

5. Purposes and Legal Bases of Processing

5.1. We process personal data for the following purposes, relying on the legal bases indicated:

5.1.1. Provision of the Services

creating and maintaining your account, processing orders and trades, settling markets, executing withdrawals;
legal basis: performance of a contract with you and our legitimate interest in operating the Services.

5.1.2. Identity Verification and AML / KYC

verifying your identity, screening against sanctions, PEP and watchlists, monitoring transactions, reporting suspicious activity;
legal basis: compliance with legal and regulatory obligations to which the Company is subject.

5.1.3. Fraud Prevention and Security

detecting and preventing fraud, market manipulation, multi-accounting, abusive use of promotions, account takeover and other security incidents;
legal basis: our legitimate interest in protecting the Services, Traders and third parties, and compliance with legal obligations.

5.1.4. Communication and Customer Support

responding to enquiries, providing customer support, sending service notifications and material updates to these Terms or the Privacy Policy;
legal basis: performance of a contract and our legitimate interest in maintaining the relationship with you.

5.1.5. Product Improvement and Analytics

analysing how the Website and Services are used, building aggregated insights, improving features and stability;
legal basis: our legitimate interest in improving the product, with privacy-preserving controls where appropriate.

5.1.6. Marketing

sending promotional communications about the Services, where permitted by law and consistent with your preferences;
legal basis: your consent, where required, and our legitimate interest in promoting the Services to existing Traders.

5.1.7. Compliance with Legal Process

responding to lawful requests from regulators, courts, law-enforcement agencies and tax authorities;
legal basis: compliance with legal obligations and our legitimate interest in cooperating with authorities.

6. Cookies and Similar Technologies

6.1. The Website uses cookies and similar technologies to operate, secure and improve the Services. Cookies fall into the following categories:

Strictly necessary cookies, required for the Website to function;
Functional cookies, which remember preferences and settings;
Analytics cookies, which help us understand how the Website is used;
Security cookies, which help detect fraud and abusive activity;
Marketing cookies, where applicable and subject to your consent.

6.2. You can manage non-essential cookies through your browser settings or any cookie-consent banner shown on the Website. Disabling certain cookies may affect the operation of the Website.

7. Sharing of Personal Data

7.1. We share personal data with the following categories of recipients, where necessary for the purposes set out in this Privacy Policy:

identity-verification, KYC, AML, sanctions-screening and blockchain-analytics providers, including VeriGate Compliance Ltd. and ChainTrace Analytics Ltd.;
payment providers, banks, card networks, virtual-asset custodians and remittance providers;
hosting, cloud-infrastructure, content-delivery, security and monitoring providers;
customer-support, communications and ticketing platforms;
analytics, attribution and product-experimentation providers;
professional advisers, including auditors, lawyers, accountants and tax advisers;
regulators, courts, law-enforcement agencies, financial-intelligence units and tax authorities, where required by law;
affiliates of the Company and successors in the context of a merger, acquisition, reorganisation, asset sale or financing.

7.2. We do not sell personal data to third parties.

7.3. Where we engage processors and subprocessors, we contractually require them to apply appropriate technical and organisational measures and to process personal data only in accordance with our instructions and applicable law.

8. International Transfers

8.1. Personal data may be processed in jurisdictions outside your country of residence, including jurisdictions whose data-protection laws may differ from those of your home jurisdiction.

8.2. Where required by applicable law, we rely on appropriate safeguards for international transfers, including standard contractual clauses, equivalent contractual safeguards, certifications, codes of conduct or your explicit informed consent.

8.3. By using the Services, you acknowledge that your personal data may be transferred internationally as described in this Privacy Policy.

9. Retention

9.1. We retain personal data only for as long as necessary for the purposes for which it was collected, to comply with legal, regulatory, accounting, tax, audit, AML and litigation-hold obligations, and to defend legal claims.

9.2. KYC and AML records are generally retained for a minimum of five (5) years after the end of the business relationship, or longer where required by law.

9.3. Transaction, order, trade and settlement records are retained for the period required by applicable law and our internal control framework.

9.4. Marketing data is retained until you withdraw consent or object to further processing.

9.5. Once retention periods expire, personal data is deleted, anonymised or further restricted in accordance with internal procedures.

10. Security

10.1. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing.

10.2. Security measures include encryption in transit and at rest, access control, network segmentation, monitoring, vulnerability management, secure software development, incident response and regular review.

10.3. Despite these measures, no system is completely secure. You are responsible for keeping your login credentials, wallet credentials, private keys, seed phrases and authentication devices secure.

10.4. In the event of a personal-data breach, we will notify affected Traders and competent authorities to the extent required by applicable law.

11. Your Rights

11.1. Subject to applicable law, you have the following rights in relation to your personal data:

Access: to obtain confirmation as to whether we process your personal data and a copy of that data;
Rectification: to have inaccurate or incomplete personal data corrected or completed;
Erasure: to have personal data erased, where the legal grounds for processing no longer apply and no overriding legal obligation requires retention;
Restriction: to obtain restriction of processing in certain circumstances;
Portability: to receive personal data that you provided to us in a structured, commonly used and machine-readable format;
Objection: to object to processing based on legitimate interests or for direct marketing;
Withdrawal of consent: where processing is based on consent, to withdraw that consent at any time, without affecting prior lawful processing;
Complaint: to lodge a complaint with a competent supervisory authority.

11.2. Some rights may be restricted where the Company is required to retain personal data for legal, regulatory, AML, audit, tax or litigation-hold purposes, or where the request would adversely affect the rights and freedoms of others.

11.3. To exercise your rights, contact us at [email protected]. We may require additional information to verify your identity before responding.

12. Automated Decision-Making and Profiling

12.1. PREDEXCHANGE may use automated tools to support identity verification, sanctions screening, fraud detection, market-integrity monitoring and risk scoring.

12.2. Where automated decision-making produces legal effects or similarly significant effects on you, we provide human review on request, subject to applicable law and security considerations.

12.3. You acknowledge that automated tools may apply rule-based or machine-learning models and may, in certain circumstances, result in delays or restrictions on access to the Services pending human review.

13. Children's Data

13.1. The Services are not directed to persons under the age of legal majority in their jurisdiction. We do not knowingly collect personal data from such persons.

13.2. If we become aware that we have collected personal data from a person under the age of majority, we will delete that data as soon as reasonably practicable, subject to retention obligations applicable to that data.

14. Third-Party Links and Integrations

14.1. The Website and Services may contain links to, or integrations with, third-party websites, applications, wallets, payment providers, bridges, oracles, analytics providers and social-media platforms.

14.2. The processing of personal data by such third parties is governed by their own privacy policies and is outside the control of PREDEXCHANGE.

14.3. We encourage you to review the privacy notices of any third party before sharing personal data with them.

15. Changes to this Privacy Policy

15.1. We may update this Privacy Policy from time to time to reflect changes in the Services, applicable law or our processing practices.

15.2. Material changes will be brought to your attention through the Website or other reasonable means. The "last updated" date at the bottom of this Privacy Policy indicates when it was most recently revised.

15.3. Your continued use of the Services after publication of the updated Privacy Policy constitutes acceptance of the changes, to the extent permitted by applicable law.

16. Contact

16.1. For any questions, concerns or requests regarding this Privacy Policy or our processing of your personal data, please contact us at [email protected].

16.2. Postal correspondence may be addressed to Forecast Harbor N.V., Kaya Isla di Futuro 27, Willemstad, Curaçao, marked for the attention of the Data Protection Officer.