Privacy

1. Introduction and Scope

Cambeon Global is the trading name of Cambeon Global S.A., a cryptocurrency brokerage incorporated in the Republic of Panama under registration No. 155791256, with its registered office at Calle 50, Plaza 2000, Floor 17, Panama City, Republic of Panama (“Cambeon”, “we”, “us”, or “our”).

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit this website and any related digital channels we operate (together, the “Website”), when you contact us, and when you engage with us as a prospective or existing client.

This Policy applies to personal data we process about visitors to the Website, individuals who submit inquiries, and the representatives, beneficial owners, and authorized users of institutional clients. It does not apply to third-party websites or services we do not control.

By using the Website or providing personal data to us, you acknowledge the practices described in this Policy. Where we rely on your consent, we explain that below.

2. Who We Are

Cambeon is the controller responsible for the personal data described in this Policy. Our full corporate identity and registered office are set out in Section 1.

3. Information We Collect

We collect personal data that you provide to us directly, data generated through your use of the Website, and data we receive from third parties. The categories below describe the types of information we may collect; not all of it applies to every individual.

Information you provide. Name, contact details (such as email address, telephone number, and country), your organization and role, and the content of any message, form submission, or request you send us.

Institutional and relationship information. Where you interact with us on behalf of an organization, we may collect details about that organization and your relationship to it, including your position and authority to act.

Commercial inquiries. Information about the products or services you are interested in, the nature of your inquiry, and any preferences you share with us.

4. Identity Verification and Compliance Information

Where you or your organization proceed toward a client relationship, we are subject to legal and regulatory obligations that require us to verify identity and assess risk. For those purposes we may collect additional information, including identification documents, date of birth, nationality, government-issued identifiers, proof of address, beneficial-ownership and corporate-structure information, and the results of identity, sanctions, politically-exposed-person, and adverse-media screening.

We engage specialized third-party providers to perform identity verification, KYC/KYB and customer due diligence (CDD), and sanctions- and watchlist-screening on our behalf, and we may share your information with them for that purpose. Engaging these providers does not relieve us of our responsibilities. These providers may be located in countries other than your own, and the specific providers may change from time to time.

5. Financial and Transaction Information

In connection with a client relationship, we may process financial and transaction-related information, such as bank or settlement details, wallet or account identifiers, transaction records, and information necessary to process and reconcile activity. For the over-the-counter (“OTC”) service we intermediate, this includes fiat payment and settlement details and the details of each transaction; for our DeFi service it includes the USDT you allocate, your wallet and transaction details, and the allocations, any returns, reinvestments, and withdrawals recorded for your account.

6. Blockchain and Digital-Asset Information

Where our services involve digital assets, we may process public blockchain data associated with transactions, including wallet addresses and on-chain transaction details. Information recorded on a public blockchain is, by the nature of the technology, public, distributed, and generally not capable of being altered or deleted. We do not control public blockchain networks. Using this Website or submitting an inquiry does not involve any on-chain processing of your personal data; such processing arises only if and when you engage us for services that involve digital assets.

7. Information Collected Automatically

When you use the Website, we and our hosting and analytics providers automatically process limited technical information, such as your IP address, device and browser type, operating system, referring pages, the pages you view, and the dates and times of your visits.

We measure website usage with Umami, a privacy-focused analytics tool that operates without cookies and does not track visitors across other websites or build advertising profiles. It records only aggregate, non-identifying usage data: page views, referring site, browser, operating system, device type, and approximate country. We do not use third-party advertising or cross-site tracking tools.

8. Information From Third Parties

We may receive personal data about you from third parties, including identity-verification and screening providers, sanctions and watchlist data sources, publicly available sources, business partners, and referrals. We may combine this information with data we already hold about you. In practice these are the identity-verification, KYC/CDD, and sanctions- and watchlist-screening providers we engage (from which we receive verification and screening results), sanctions and watchlist data sources, and any introducing broker that refers you (from which we receive the referral and the information you gave them).

9. How and Why We Use Personal Data

We use personal data to:

  • respond to your inquiries and provide information you request;
  • establish, operate, and administer client relationships and provide our services;
  • verify identity and meet our compliance, anti-money-laundering, sanctions, and other legal and regulatory obligations;
  • operate, maintain, secure, and improve the Website and our services;
  • detect, prevent, and investigate fraud, security incidents, and prohibited or unlawful activity;
  • communicate with you about our services and, where permitted, send marketing communications;
  • carry out research and analysis to develop and improve our products and services; and
  • comply with applicable law and enforce our terms and agreements.

Where a data-protection law requires a legal basis for processing, we rely on the basis appropriate to each activity, which may include performance of a contract, compliance with a legal obligation, our legitimate interests, or your consent. In general, we rely on your consent or our legitimate interests to operate and improve the Website and to respond to inquiries, on the performance of a contract where we provide services to you, and on compliance with a legal obligation for record-keeping and regulatory purposes.

11. Anti-Money-Laundering, Sanctions, and Regulatory Compliance

As a business operating in the digital-asset and financial sector, we are subject to legal and regulatory obligations that require us to process personal data, including for identity verification, sanctions and watchlist screening, transaction monitoring, record-keeping, and the reporting of suspicious activity to competent authorities. Identity verification, KYC/KYB, customer due diligence, and sanctions and watchlist screening are performed on our behalf by specialized third-party providers. We may be required to process this data, and to retain and disclose it, to meet those obligations, and in some cases we may be prohibited from informing you of a disclosure. As a company incorporated in Panama, these are the anti-money-laundering, counter-terrorist-financing, and sanctions obligations that apply to us, and we report to the competent authorities where required.

12. How We Share Personal Data

We do not sell your personal data. We may share personal data with:

  • Affiliates within our corporate group, for the purposes described in this Policy;
  • Service providers and processors that perform functions on our behalf, such as hosting, identity verification, screening, communications, analytics, and professional services, under obligations of confidentiality and data protection;
  • Financial institutions and counterparties where necessary to provide our services;
  • Legal, regulatory, and governmental authorities where required by law, regulation, legal process, or a lawful request, or to protect our rights, safety, or property or those of others;
  • Professional advisers, such as auditors, lawyers, and accountants; and
  • Parties to a corporate transaction, such as a merger, acquisition, financing, or sale of assets, in which case personal data may be transferred as part of that transaction.

We may also share information that has been aggregated or de-identified so that it does not identify you.

The service providers we currently rely on to operate the Website and process inquiries are Cloudflare, Inc. (website hosting, content delivery, and serverless functions), Resend (the transactional-email service used to deliver and respond to the inquiries you submit), and Umami (cookieless website analytics). Each processes personal data only on our behalf and under confidentiality and data-protection obligations. The other categories listed above, such as identity-verification, screening, and financial counterparties, apply only where and when we provide the corresponding services to you.

13. International Data Transfers

Cambeon and its service providers may process personal data in countries other than the one in which you are located. Those countries may have data-protection laws that differ from those of your own country. Where we transfer personal data internationally, we take steps to ensure it is protected in a manner consistent with applicable law. Our hosting, email, and analytics providers operate globally distributed infrastructure, and personal data may be processed in various countries, which may include the United States and the European Union. Where personal data is transferred to a country that does not provide an equivalent level of protection, we rely on the transfer safeguards available, which may include standard contractual clauses or equivalent measures.

14. Cookies and Similar Technologies

The Website does not use cookies for advertising, profiling, or cross-site tracking, and sets no non-essential cookies. For analytics we use Umami, which is cookieless (see Section 7). The only data we store on your device is a small amount of local session storage used to remember basic interface preferences during your visit (for example, that you dismissed a notice); it is removed when you close the browser tab. Because we set no non-essential cookies, no cookie-consent banner is presented; you can clear local storage at any time through your browser settings.

15. Marketing Communications

Where permitted by applicable law, we may send you communications about our services. You can opt out of marketing communications at any time using the unsubscribe mechanism in the relevant message or by contacting us. Opting out of marketing does not affect communications we send you for operational, contractual, or legal reasons.

16. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, including to provide our services, and to meet our legal, regulatory, accounting, and record-keeping obligations, after which we delete or anonymize it. We do not apply a single fixed retention period: identity, onboarding, and transaction records collected for anti-money-laundering and other legal purposes are kept for at least the minimum period required by the laws that apply to us, after which they are deleted or anonymized, while other data is kept only for as long as needed for the purpose for which it was collected.

17. Security

We maintain technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, and alteration. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping any credentials you use confidential. In practice, these measures include encryption of traffic in transit (HTTPS/TLS), a strict Content-Security-Policy and related security headers, hosting on reputable infrastructure with network and denial-of-service protection, data minimization, and limiting access to personal data to those who need it. We do not currently claim any specific security certification.

18. Your Privacy Rights

Depending on your location and the applicable law, you may have rights in relation to your personal data, which can include the right to access, correct, delete, or receive a copy of your data, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority. To exercise any right available to you, please contact us using the details in Section 24. We may need to verify your identity before responding, and some rights are subject to conditions and exceptions under applicable law, including where we are required to retain data for legal or regulatory reasons.

19. Jurisdiction-Specific Rights

Some data-protection laws grant individuals in particular jurisdictions additional or specific rights, and may require specific disclosures, beyond those described in Section 18. Where such a regime applies to our processing of your personal data, the additional rights and protections it provides are available to you, and you may exercise them by contacting us using the details in Section 24; we will give effect to them as that regime requires. Because our clients and website visitors are international and the regime that applies depends on your location and circumstances, we handle jurisdiction-specific requests on that basis rather than listing a fixed set of regimes here.

The Website may link to or integrate third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy notices of any third party before providing your personal data to them.

21. Children’s Privacy

The Website is intended for individuals who are 18 years of age or older. We do not knowingly collect personal data from anyone under that age. If we become aware that we have collected personal data from a person under the applicable age, we will take steps to delete it.

22. Changes to This Policy

We may update this Privacy Policy from time to time. Any updated version becomes effective when published on the Website. Where required by law, we will provide additional notice of material changes. Your continued use of the Website after an update means you acknowledge the revised Policy.

23. Client Acknowledgement

By using the Website or providing personal data to us, you acknowledge that you have read and understood this Privacy Policy. When you register as a client, you are required to confirm that you have read and agree to this Policy and our other policies; you cannot complete registration without doing so, and by completing registration you represent that you have read, understood, and accepted them.

24. Contact and Data-Protection Requests

If you have questions about this Policy or wish to exercise a privacy right, you may contact us at legal@cambeon.com or at Calle 50, Plaza 2000, Floor 17, Panama City, Republic of Panama. We have not appointed a dedicated data protection officer; privacy matters are handled through the contact above.

Contact