Finquest Exchange — https://exchange.finquestexchange.com · Version 1.0 · Effective Date: 1 April 2026
1. Introduction
PowrAI Digital Exchange sp. z o.o. ("PowrAI", "we"), operator of Finquest Exchange, is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our services at https://finquestexchange.com and the trading platform at https://exchange.finquestexchange.com.
PowrAI acts as Data Controller under GDPR (Regulation EU 2016/679) and applicable Polish data protection law. PowrAI is a co-owned entity of Finquest Capital Group Ltd (Ireland), operating independently as the licensed exchange entity within the Finquest ecosystem.
2. Data controller
| Data Controller | PowrAI Digital Exchange sp. z o.o. |
|---|---|
| NIP / KRS | NIP: 5214096566 / KRS: 0001141746 |
| VASP Licence | RDWW-1725 |
| Jurisdiction | Republic of Poland |
| Data Protection Email | privacy@finquestexchange.com |
| Ecosystem Parent | Finquest Capital Group Ltd (CRO 726903) |
3. Data we collect
3.1 Identity and KYC data
- Full legal name, date of birth, and nationality;
- Government-issued ID (passport, national ID card, driver's licence);
- Proof of address dated within 3 months;
- Selfie and liveness verification images (via Sumsub);
- Source of funds documentation for applicable thresholds;
- PEP and sanctions screening data.
3.2 Account and profile data
- Email address, username, encrypted password, and phone number;
- Account tier, trading preferences, and language settings;
- Support and compliance communication history.
3.3 Financial and transaction data
- Deposit, withdrawal, and trading records;
- Wallet addresses (internal and external);
- Fiat payment data processed via Banxa (not stored by PowrAI directly).
3.4 Technical, usage, and cookie data
- IP address, device type, browser, operating system;
- Login timestamps, session data, and access logs;
- Cookies and similar technologies — for categories, legal bases, third parties, and how to manage preferences, see our Cookie Policy.
4. Legal bases for processing
| Legal basis | GDPR Article | Examples |
|---|---|---|
| Contractual necessity | Art. 6(1)(b) | Account operation, trade execution, withdrawals |
| Legal obligation | Art. 6(1)(c) | KYC/AML verification, VASP regulatory reporting |
| Legitimate interests | Art. 6(1)(f) | Platform security, fraud prevention |
| Consent | Art. 6(1)(a) | Marketing communications, non-essential cookies |
5. How we use your data
- Operating the Platform and managing your account;
- Performing KYC verification and ongoing AML/CTF monitoring;
- Processing fiat transactions via Banxa;
- Complying with VASP licence obligations and applicable law;
- Preventing fraud, money laundering, and market manipulation;
- Communicating about your account and service updates;
- Marketing communications (only with explicit consent);
- Improving Platform features and user experience.
6. Data sharing
| Recipient | Purpose | Legal basis |
|---|---|---|
| Sumsub | KYC identity verification | Contractual necessity / Legal obligation |
| Banxa | Fiat on/off ramp processing | Contractual necessity |
| Fireblocks | Digital asset custody | Contractual necessity |
| Polish FIU / KNF | AML reporting, VASP obligations | Legal obligation |
| Law enforcement | Lawful requests and court orders | Legal obligation |
| Boldergroep | Compliance consultancy | Legitimate interests |
| FCG (ecosystem) | Group reporting and governance | Legitimate interests |
We do not sell your personal data to third parties for advertising.
7. International data transfers
Where data is transferred outside the EEA, we apply Standard Contractual Clauses (SCCs) or other approved safeguards under GDPR Chapter V. Contact privacy@finquestexchange.com for details of specific transfer mechanisms.
8. Data retention
| Data category | Retention period |
|---|---|
| KYC / AML records | Minimum 5 years after end of business relationship (Polish AML Act) |
| Transaction records | Minimum 5 years from transaction date |
| Account data | Duration of account plus 5 years after closure |
| Technical / usage logs | 12 months (rolling) |
| Marketing data | Until consent withdrawn or 3 years from last interaction |
9. Your rights under GDPR
| Right | What it means |
|---|---|
| Access (Art. 15) | Request a copy of personal data we hold about you. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete data. |
| Erasure (Art. 17) | Request deletion, subject to legal retention obligations. |
| Restriction (Art. 18) | Request restriction of processing in certain circumstances. |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format. |
| Objection (Art. 21) | Object to processing based on legitimate interests. |
| Withdraw consent | Withdraw consent at any time for consent-based processing. |
To exercise rights: privacy@finquestexchange.com. Response within 30 days. You may lodge a complaint with the Polish data protection authority (UODO — www.uodo.gov.pl) or your local supervisory authority.
10. Security
- TLS 1.2+ encryption for data in transit;
- Encryption of data at rest;
- Multi-factor authentication for Platform access;
- Institutional-grade custody via Fireblocks;
- Access controls on a need-to-know basis;
- Incident response and GDPR breach notification procedures.
11. Contact
| Data Controller | PowrAI Digital Exchange sp. z o.o. |
|---|---|
| Privacy contact | privacy@finquestexchange.com |
| Supervisory Auth. (PL) | UODO — www.uodo.gov.pl |
| Supervisory Auth. (IE) | DPC — www.dataprotection.ie (for FCG group matters) |