Privacy Policy

Magma Exchange S.A., a company incorporated under the laws of Panama (“Magma”), is the controller of your personal data. Contact: [email protected]

Magma collects the following categories of data:

• Identity data: email address and/or blockchain wallet address;
• Connection data: IP address, timestamps, browser type, session data;
• Financial data: transaction history, balances, orders placed;
• Compliance data: acceptance of the terms, accepted version, cryptographic signature;
• KYC data (where applicable): identity document, proof of address, selfie.

Your data is processed for the following purposes:

• Providing and securing the Platform’s services;
• Verifying identity and preventing fraud (anti-money laundering and counter-terrorist financing);
• Complying with legal and regulatory obligations;
• Communicating about your account (security alerts, one-time codes);
• Improving the Platform (aggregated and anonymized data).

• Performance of a contract: processing required to provide the services;
• Legal obligation: regulatory compliance and anti-money laundering;
• Legitimate interest: Platform security and fraud prevention;
• Consent: for non-essential cookies (see the cookie policy).

Your data is kept for the duration of your relationship with Magma and afterwards as required by applicable law (5 years for financial and compliance data, under Panamanian rules and FATF standards).

After your account is closed, identifying data may be pseudonymized in our audit systems.

Magma does not sell your data. Your data may be shared with:

• Service providers: hosting, email, and KYC providers, under confidentiality agreements;
• Competent authorities: when required by law or regulation;
• Public blockchains: blockchain transactions are public by nature.

Magma may transfer your data to third countries. Those transfers are protected by appropriate safeguards (standard contractual clauses or an adequacy decision, as applicable).

You have the following rights over your personal data:

• Right of access and rectification;
• Right to erasure (subject to legal retention duties);
• Right to restrict processing;
• Right to data portability;
• Right to object.

To exercise your rights: [email protected]. You may also lodge a complaint with the data protection authority in your country of residence.

Magma applies appropriate technical and organizational measures to protect your data, including encryption in transit (TLS 1.3), encryption at rest, access limited on a need-to-know basis, and continuous monitoring of systems.

Magma may change this policy at any time. Material changes will be notified by email or through the Platform.