LEGAL · DOCUMENTS

Legal & compliance

One template for every document — versioned, dated, per language. Select a document; the full text is published from the CMS.

PRIVACY · v3.2UPDATED 2026-09-01

What we collect, why, how long we keep it and your rights.

01Data we collectAccount data, verification data on the exchange only, device and usage data.

02Why we process itProviding the service, security and fraud prevention, legal obligations.

03RetentionHow long each category is kept and when it is deleted.

04Your rightsAccess, correction, deletion and how to contact the data protection officer.

05Device recognition and security cookieWhen you visit ex5.com or use the exchange we set a cookie named `ex5_did` (a random 32-character identifier, valid for 2 years, HttpOnly, shared across *.ex5.com). It lets us recognise the same browser profile across visits and sign-ins so that we can spot account takeover attempts, credential-stuffing attacks and the abuse of multiple accounts. It is a security signal only: it never logs you in and is never used for advertising. With the same purpose we may compute a browser signature ("fingerprint") from technical characteristics of your browser — screen size, time zone, language, fonts, graphics and audio capabilities (FingerprintJS, open source) — together with your IP address, its approximate country and network operator, and the technical user-agent string. In the EEA, the United Kingdom and Switzerland the browser signature is collected only after you accept it in the cookie bar; the `ex5_did` cookie and server-side login records are kept on the basis of our legitimate interest in protecting accounts and funds (GDPR art. 6(1)(f)). No automated decision is taken on this data alone: alerts are reviewed by our staff. Raw event records are deleted after 180 days; aggregated links between a browser profile and an account are kept for as long as the account exists. You can request a copy or erasure of this data through the channels listed under "Your rights".