Privacy policy

Who is responsible

The controller of the data collected on cryptoiban.com is the company operating the CryptoIBAN brand, whose full legal identity (company name, registration number, registered office) is set out in the contractual documents provided before any account is opened.

To exercise your rights or ask a question about your data, write to us from the Support section of your client area or through the contact page.

What we collect

• Your login: email address, country of residence, language, and your password as a one-way hash (Argon2id): we never know it.
• Opening your account: your first and last name, your chosen country of residence and the account details you choose to provide.
• Your use of the account: payees you save, operations, messages exchanged with support.
• Account security: open sessions and security log (date, type of device and browser, country of connection), encrypted two-factor secret, backup codes stored as hashes.
• Abuse prevention: a one-way keyed fingerprint (HMAC) of your IP address — never the address itself — to limit repeated attempts.
• Server logs: date, requested page, response code and browser type, without your IP address or the page you came from, for security and troubleshooting.
• On your device only: if you dismiss the language suggestion, that choice is kept in your browser’s local storage and never sent to us.

What we never do

• No advertising or audience-measurement tools, no tracking cookies.
• No sale or rental of your data.
• No fonts or scripts loaded from third parties: everything is served from our own domain.

Why, and on what basis

• Opening and running your account, answering your requests: performance of the contract and steps taken at your request before a contract (Art. 6(1)(b) GDPR).
• Processing the information needed to provide your account and payment services, and to meet applicable legal obligations.
• Protecting your account and the website against fraud and abuse: our legitimate interest (Art. 6(1)(f) GDPR).

How long we keep it

• An application that does not lead to an account: deleted automatically 12 months after your last activity, or immediately if you delete your login from your settings.
• An open account: for the whole relationship, then for the period required by law (in particular anti-money-laundering rules).
• Sessions: 12 hours at most, 30 minutes without activity. Security log: 24 months.
• Abuse-prevention fingerprints: one hour. Server logs: a short period, for security purposes only.

Who receives it

The CryptoIBAN team and the technical providers needed to operate the service, including hosting, Cloudflare network and security, and the payment orchestrator. Payment information is shared as necessary to process and track your transactions.

Transfers outside the EU

Your account data is stored in the European Union. Cloudflare may process technical connection data outside the European Union, under the safeguards provided by the GDPR (EU–US Data Privacy Framework and standard contractual clauses).

Your rights

You can access, correct or delete your data, restrict or object to its use, and receive it in a portable format: the full export is available at any time in the settings of your client area. You can also lodge a complaint with your data protection authority — in Belgium, the Data Protection Authority (dataprotectionauthority.be).

Security

Encrypted connection (HTTPS with HSTS), strict security headers, passwords never stored in clear, two-factor authentication, automatic logout, IP addresses never stored in clear, access to data limited to the team.