Privacy Policy

1. General

This Privacy Policy (the "Policy") explains what personal data LEDGEUM EOOD (the "Company", "we") processes when you use the website https://www.ledgeum.com (the "Website") and related services, for what purposes, on what legal basis, and how you can exercise your rights.

Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act. The data controller is:

2. What data we process

• Enquiry data: the name, e-mail address, subject and message you enter in the form on the Contacts page.
• Waitlist data: the e-mail address you leave to be told when a product launches.
• Technical data: IP address, browser and device type, pages visited and cookies — see the Cookie Policy for details.
• Data needed to prepare a report: information required to check an individual, a company or a wallet address, including identity documents and verification data. Such data is processed only when you order the service.

We do not collect data that is not needed for these purposes, and we do not take decisions with legal effects on you based solely on automated processing.

3. Purposes and legal bases

• Replying to an enquiry and preparing a proposal — steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Providing the services you order, including preparing a report — performance of a contract (Art. 6(1)(b) GDPR).
• Complying with anti-money-laundering legislation — a legal obligation of the Company (Art. 6(1)(c) GDPR).
• Notifying you from the waitlist that a product has launched — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Keeping the Website running and secure — the Company's legitimate interest (Art. 6(1)(f) GDPR). Analytics cookies are used only with your consent.

4. Who receives the data

We do not sell personal data or share it with third parties for advertising. Access is limited to those involved in providing the services, under contracts that bind them to confidentiality and the GDPR:

• the identity verification and screening provider in whose infrastructure documents and check results are processed;
• hosting and e-mail providers that keep the Website and correspondence running;
• public authorities — only in the cases and to the extent expressly required by law.

5. Transfers outside the EEA

Where a provider processes data outside the European Economic Area, the transfer takes place only with appropriate safeguards: a European Commission adequacy decision or the standard contractual clauses approved by the Commission.

6. Retention periods

• Enquiry data — for the duration of the correspondence and a reasonable period after it ends, if the enquiry did not lead to a contract.
• Waitlist data — until the product launches or you withdraw your consent.
• Data relating to services that must be kept under anti-money-laundering legislation — for the period set by law (as a rule, five years).
• Technical data and cookies — for the periods stated in the Cookie Policy.

When the period expires, the data is deleted or anonymised.

7. Your rights

Under the GDPR you have the right to:

• find out whether your data is processed and obtain a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased where there is no longer a basis for processing it;
• have processing restricted;
• receive your data in a structured, machine-readable format and transmit it to another controller;
• object to processing based on legitimate interest;
• withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, write to office@ledgeum.com. We reply within one month; this period may be extended in the cases provided for by the GDPR, and we will tell you in advance. To protect your data, we may ask you to confirm your identity.

8. How we protect data

We apply organisational and technical measures appropriate to the risks of processing: encryption in transit, access restricted to staff who need it, and processing of verification documents in the infrastructure of a specialised provider rather than on our own servers. The Company does not hold client funds and has no access to private keys.

9. Responsible person

The Company has not appointed a Data Protection Officer (DPO), as the nature and scale of processing do not meet the mandatory criteria of Article 37 GDPR. The Company's director is responsible for personal data matters; please write to office@ledgeum.com.

10. Right to complain

If you believe that the processing of your data breaches the law, you may lodge a complaint with the supervisory authority:

11. Changes to this Policy

We may update this Policy, in particular when new products launch. A new version takes effect when it is published on this page; we will give separate notice of material changes.