1Scope
1.1This Policy applies to personal data processed by Gabbar Exchange Corp. in connection with visitors to our websites and applications, holders of a Platform profile, business contacts and suppliers, and applicants for employment.
1.2It does not describe Binance’s processing. Your identity documents, verification images, source of funds evidence, account balances, custody records and regulatory reporting are handled by Binance as controller. We do not collect or hold your identity documents or biometric verification data.
1.3Where processing is subject to Regulation (EU) 2016/679 (GDPR) or an equivalent regime, this Policy is provided to satisfy the applicable transparency obligations.
2Controller and Contacts
| Role | Details |
|---|---|
| Controller | Gabbar Exchange Corp., 2nd Floor, Ritter House, Wickham’s Cay II, Tortola, British Virgin Islands |
| Independent controller | Binance, in respect of identity verification, account, custody, transaction, AML and regulatory processing arising from your Binance account |
| Data protection contact | Privacy Lead, Gabbar Exchange Corp., privacy@gabbarex.com |
| Rights requests | privacy@gabbarex.com |
| Website | gabbarex.com |
3Personal Data We Process
| Category | Examples |
|---|---|
| Profile data | Name or display name, email address, telephone number, country of residence as declared, password hash, two-factor settings, language and display preferences |
| Integration data | The API Key you connect (stored encrypted), its permission scope, connection and revocation events, and the identifier linking your Platform profile to your Binance account |
| Activity data received from Binance | Order and trade records, executed prices, balances and positions, account status flags and limits, retrieved through the API to display your activity to you and to calculate commission |
| Technical data | IP address, approximate location derived from IP, device and browser identifiers, operating system, session and login records, error and performance logs, cookie identifiers |
| Screening data | Sanctions and restricted-jurisdiction screening results relating to Platform access, and records of any access restriction applied |
| Communications data | Support tickets, emails, in-Platform messages, chat transcripts and, where used, call recordings |
| Marketing data | Preferences, consent records and engagement with our communications |
3.1We do not knowingly collect special categories of personal data. Please do not send us identity documents, selfies or source-of-funds evidence; those are submitted to Binance through Binance’s own flow, and we will delete any such material sent to us in error.
3.2We never ask for, and you must never disclose to us, your Binance password, recovery phrase, two-factor codes, or an API Key with withdrawal permissions.
4Sources
- directly from you, at registration, in support interactions and through your use of the Platform;
- automatically, through cookies and Platform telemetry;
- from Binance’s API, in respect of the account and transaction data listed in section 3;
- from sanctions and restricted-jurisdiction screening providers;
- from fraud prevention, security, hosting and analytics providers acting on our behalf.
5Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Creating and operating your Platform profile and providing the interface | Performance of a contract (Art. 6(1)(b)) |
| Connecting your API Key and transmitting your Instructions to Binance | Performance of a contract (Art. 6(1)(b)) |
| Displaying your balances, orders, positions and history retrieved from Binance | Performance of a contract (Art. 6(1)(b)) |
| Calculating, verifying and reconciling commission payable to us by Binance | Legitimate interests in operating our business and verifying amounts due (Art. 6(1)(f)); legal obligation for accounting records (Art. 6(1)(c)) |
| Sanctions screening and enforcement of geographic access restrictions | Legal obligation (Art. 6(1)(c)); legitimate interests in preventing financial crime and sanctions breaches (Art. 6(1)(f)) |
| Fraud prevention, security monitoring, abuse detection and incident response | Legitimate interests in protecting the Platform and its users (Art. 6(1)(f)) |
| Support, complaint handling and dispute resolution | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Service improvement, analytics, testing and product development | Legitimate interests in improving the Platform (Art. 6(1)(f)); consent where non-essential cookies are used (Art. 6(1)(a)) |
| Responding to lawful requests from authorities and to requests from Binance in connection with its regulatory obligations | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)), or legitimate interests for existing users in respect of similar services (Art. 6(1)(f)), with an unconditional right to object |
5.1Where we rely on legitimate interests, we have carried out a balancing assessment, available on request. Where we rely on consent, you may withdraw it at any time without affecting prior processing.
5.2Providing profile and integration data is necessary to use the Platform. If you do not provide it, we cannot give you access.
6Automated Processing
6.1We apply automated sanctions and geographic screening to Platform access, and automated fraud and abuse detection. These may result in access being blocked or restricted.
6.2Decisions about your Binance account, including verification outcomes, limits, freezes and closures, are made by Binance and not by us. We cannot review, explain or reverse them; those decisions must be raised with Binance.
6.3Where an automated decision by us significantly affects you, you may request human review by writing to privacy@gabbarex.com. We may be prohibited by law from explaining the basis of a financial crime restriction.
7Recipients
- Binance, for the operation of the integration, transmission of your Instructions, and its own compliance and reconciliation purposes;
- cloud hosting, database, communications, customer support, analytics and security providers acting as processors on our documented instructions;
- sanctions and restricted-jurisdiction screening providers;
- payment and accounting providers, in respect of any charges we levy and of commission reconciliation;
- professional advisers, auditors and insurers, and prospective purchasers in a corporate transaction;
- regulators, tax authorities, law enforcement and courts, where required or permitted by law.
7.1We do not sell personal data.
7.2Public blockchains.Transfers you make through your Binance account are recorded on public, immutable ledgers that neither we nor Binance control and from which data cannot be erased.
8International Transfers
8.1Personal data may be transferred outside the European Economic Area, including to Binance entities and to service providers located in third countries.
8.2Transfers rely on an adequacy decision where one applies, or otherwise on Standard Contractual Clauses together with supplementary measures identified through a transfer impact assessment, or on another lawful mechanism. Copies of the safeguards may be requested from privacy@gabbarex.com.
9Retention
| Data | Retention |
|---|---|
| Profile and integration records | Duration of the profile, plus 12 months after deletion or last activity |
| API Key material | Deleted immediately on disconnection or profile deletion; connection and revocation events retained for 24 months as an audit record |
| Activity data received from Binance, and commission reconciliation records | Seven (7) years from the end of the relevant financial period, to satisfy accounting, audit and tax obligations |
| Screening results and access restriction records | Five (5) years from the date of the decision |
| Support communications and complaint records | Five (5) years from closure |
| Security, access and system logs | 12 to 24 months, or longer where an investigation is ongoing |
| Marketing consent records | Until withdrawal, plus three (3) years for evidential purposes |
9.1Retention is extended where data is subject to a legal hold, investigation, regulatory request or unresolved dispute. On expiry, data is securely deleted or irreversibly anonymised.
9.2Deleting your Platform profile does not delete anything held by Binance. Requests concerning Binance-held data must be made to Binance.
10Security
10.1We apply measures appropriate to the risk, including encryption in transit and at rest, encrypted storage of API Key material with restricted decryption, role-based access control and least privilege, multi-factor authentication for staff, network segregation, logging and alerting, vulnerability management and penetration testing, secure development practices, vendor due diligence and staff training.
10.2We enforce the rule that connected API Keys must not carry withdrawal permissions, which materially limits the consequences of any compromise of our systems.
10.3Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where the risk is high.
11Your Rights
11.1Subject to applicable law you may request access, rectification, erasure, restriction, portability, and may object to processing based on legitimate interests or to direct marketing at any time. You may withdraw consent where processing relies on it.
11.2Requests should be sent to privacy@gabbarex.com. We respond within one (1) month, extendable by two (2) further months for complex requests. We may need to verify your identity first.
11.3Rights are constrained where we must retain records for accounting, tax, sanctions or legal-claims purposes. Rights in respect of data held by Binance must be exercised with Binance.
11.4We do not charge for handling requests unless they are manifestly unfounded or excessive.
12Cookies
12.1Strictly necessary cookies support authentication, session management and security and do not require consent. Analytics, preference and marketing cookies are used only with your consent, which may be given, refused or withdrawn through the cookie banner or preference centre.
12.2Full details are in the Cookie Notice published on gabbarex.com.
13Children
The Platform is not directed at persons under 18 and we do not knowingly process their personal data. If we become aware that we have, we will delete it and close the profile.
14Changes
We may update this Policy. Material changes are notified by email or Platform notification at least thirty (30) days before taking effect, except where a change is required immediately by law. The current version is always published on gabbarex.com with its effective date.
15Complaints
15.1Please contact privacy@gabbarex.com first so we can try to resolve the matter.
15.2You may also lodge a complaint with the data protection supervisory authority of your habitual residence, place of work or place of the alleged infringement, or with the authority competent for Gabbar in the British Virgin Islands. Complaints about Binance’s processing should be directed to Binance and, if unresolved, to the supervisory authority identified in Binance’s privacy notice.
End of Privacy Policy.