Privacy and AML notice
Escrow requires identity. This explains what we collect, who sees it, how long it is kept and what you can ask us to do about it.
In short: we collect identity and deal data to run escrow and meet AML law. We do not sell it. We keep it for statutory periods and share it only with the payment partner, verifiers and authorities where required.
1. Controller
TrustDeal Ltd., Company No. 20481937, 12 Vitosha Boulevard, 1000 Sofia, Bulgaria. Data protection contact: [email protected] with “Privacy” in the subject.
2. What we collect
- Identity: name, date of birth, nationality, address, photo ID, liveness imagery, specimen signature where required.
- Contact: WhatsApp number, email, telephone, preferred language.
- Deal: item details, value, currencies, bank details of the payer and payee, transit records, inspection reports, messages in the deal room.
- Company data: registration extracts, directors, beneficial owners, corporate bank details.
- Technical: IP address, device and browser data, page interactions for site security and analytics.
3. Why we collect it
Lawful bases under GDPR:
- Contract — to scope, administer and settle your deal.
- Legal obligation — KYC, AML, sanctions, PEP and record-keeping duties.
- Legitimate interests — fraud prevention, deal security, service analytics, proportionate marketing to existing counterparties.
- Consent — optional cookies and any non-essential updates, withdrawable at any time.
We do not make solely automated decisions with material effect; verification flags are reviewed by an analyst.
4. Who sees it
The other party sees your name, verified status, country and the deal details needed to perform. Full identity documents sit with us and our regulated payment institution. We also share with:
- Payment and banking partners, for funding and payout.
- Independent authenticators, gemologists or inspectors, for the item only.
- Insured carriers, for transit and claims.
- KYC, sanctions and fraud-screening providers, under contract.
- Professional advisers, auditors and competent authorities where law requires.
We do not sell personal data.
5. Retention
Deal and KYC records are kept for five years after the transaction or the end of the relationship, as required by EU AML rules. Verification data that fails onboarding is deleted within 24 months unless a legal hold applies. Site analytics is retained for 14 months. Deleting early is possible only where no statutory duty overrides it.
6. International transfers
Some providers process outside the EEA. Transfers rely on an adequacy decision or Standard Contractual Clauses plus supplementary safeguards. Deal data itself stays within the EEA unless the parties and their banks require otherwise.
7. Your rights
You may request access, correction, portability, restriction or erasure, and object to legitimate-interest processing. Consent-based processing can be withdrawn. Identity must be verified before we act. Some data is exempt from erasure while AML retention applies.
Write to [email protected]. We respond within one month. You may also complain to the Bulgarian Commission for Personal Data Protection or your local supervisory authority.
8. Security
Encryption in transit and at rest, role-based access, MFA on administrative systems, vendor due diligence and daily reconciliation of client funds. Access to identity files is logged and limited to compliance and your assigned desk.
9. Cookies
The site uses essential cookies for security and session integrity. Analytics cookies are optional and aggregate. No advertising trackers are embedded. A cookie preference is stored locally after your first choice.
10. Contact
[email protected] · +359 89 645 3914 · 12 Vitosha Boulevard, 1000 Sofia, Bulgaria. For deal-specific questions, quote your reference. For complaints, see our terms of service.