Privacy Policy

The privacy of our users is a top priority at Umbraswap (hereinafter “Umbraswap”, “we”, “our”, or “us”) — a Digital Asset Exchange & Payment Solutions provider, accessible at www.umbraswap.com.

Umbraswap is a limited liability company incorporated under the jurisdiction of Costa Rica (registration number 3-102-944661), with its registered address at Province 01 San José, Canton 15 Montes de Oca, Costa Rica. We process personal data in accordance with the Law on Protection of Persons Regarding the Processing of their Personal Data, Law No. 8968 (“Costa Rica Data Protection Law”) and its implementing regulations, under the supervision of the Agency for the Protection of Inhabitants’ Data (Agencia de Protección de Datos de los Habitantes, “PRODHAB”).

This Privacy Policy describes the categories of personal information that Umbraswap collects and processes, the purposes for which it is used, how it is protected, and your rights as a data subject. It applies to visitors to and users of our website and platform with regard to information shared with or collected by Umbraswap in connection with our online services. It does not apply to information gathered offline or through sources other than our website and platform.

Please read this Privacy Policy carefully. We recommend that you save or print a copy for your records.

Umbraswap’s management is fully committed to ensuring the effective implementation of this Privacy Policy and expects all employees, contractors, and third-party partners to share in this commitment.

The following terms used in this Privacy Policy have the meanings set out below:

• “Personal Data”
• or
• “Personal Information”
• means any information that identifies or can be used to identify an individual, directly or indirectly, including but not limited to name, date of birth, email address, identification numbers, location data, or online identifiers.
• “Processing”
• means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, or erasure.
• “Controller”
• means a person or organisation which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. For the purposes of this Privacy Policy, Umbraswap is the Controller.
• “Executing Partner”
• means Collect & Exchange Ltd., a company incorporated in Kazakhstan and authorised by the Astana Financial Services Authority (AFSA), which executes payment and exchange transactions on behalf of Umbraswap.
• “User”
• or
• “Customer”
• means any natural or legal person who accesses our website and/or platform or uses our Services.
• “Website”
• or
• “Platform”
• means the Umbraswap website and digital platform accessible at www.umbraswap.com.
• “PRODHAB”
• means the Agencia de Protección de Datos de los Habitantes, the Costa Rican supervisory authority responsible for oversight of personal data protection.

By using our website and/or platform, you consent to the collection and processing of your Personal Data as described in this Privacy Policy. Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time by contacting us at info@umbraswap.com or by closing your account.

Our processing of Personal Data is based on one or more of the following legal grounds: (i) performance of a contract with you; (ii) compliance with a legal obligation; (iii) your explicit consent; or (iv) our legitimate interests, where these are not overridden by your rights and interests.

Our dealings with you are based on: (i) the contractual relationship formed under our Terms and Conditions; and (ii) your explicit consent to Personal Data processing, provided as part of account registration or use of our Services.

We may collect the following categories of Personal Data from you (this list is not exhaustive):

• Identity data:
• full name, date of birth, nationality, and government-issued identification documents (e.g. passport, national identity card, driving licence).
• Contact data:
• email address, telephone number, and postal address.
• Account data:
• username, password (stored in encrypted form), account settings and preferences.
• Financial and transaction data:
• payment card details, bank account information, transaction history, wallet addresses, and details of digital assets held or exchanged.
• KYC/AML data:
• source of funds documentation, proof of address, and any enhanced due diligence information required under applicable anti-money laundering legislation.
• Technical data:
• IP address, browser type and version, operating system, device identifiers, time zone settings, and browser plug-in information.
• Usage data:
• pages visited, clickstream data, referring/exit URLs, session duration, and features used on our platform.
• Location data:
• where permitted by your device settings, approximate location data derived from your IP address or mobile device.
• Communications data:
• records of correspondence between you and our customer support team, including the content of messages and any attachments.
• Marketing preferences:
• your preferences regarding receipt of marketing communications from us.

You should be aware that transactions executed on a public blockchain network are recorded on a distributed public ledger. Wallet addresses and transaction amounts associated with blockchain transactions are publicly visible to any participant on the relevant network. This is an inherent characteristic of blockchain technology and is not within Umbraswap’s control. Umbraswap is not responsible for the public availability of on-chain transaction data.

We collect and process blockchain transaction data, including wallet addresses and transaction identifiers, as necessary for the execution of your orders and for compliance with applicable AML/KYC obligations.

We use your Personal Data only in accordance with the Costa Rica Data Protection Law (Law No. 8968), our Terms and Conditions, and this Privacy Policy. The purposes for which we process your Personal Data include:

• Account registration and administration.
• Identity verification and KYC/AML compliance.
• Execution of payment and exchange transactions, including sharing necessary data with our Executing Partner (Collect & Exchange Ltd.) as described in section 10.
• Responding to your enquiries and providing customer support.
• Personalisation of your experience on our platform.
• Sending you transactional communications (e.g. order confirmations, security alerts, account notifications).
• Sending you marketing and promotional communications, where you have provided consent or where otherwise permitted by law.
• Fraud detection and prevention, and protection of our platform and users.
• Compliance with legal and regulatory obligations, including reporting to PRODHAB or other competent authorities where required.
• Internal research, analytics, and improvement of our Services.
• Enforcement of our Terms and Conditions and other legal rights.

We may also disclose your Personal Data to third parties in the following circumstances:

• In response to lawful requests by public authorities, including for national security or law enforcement purposes.
• To protect, establish, or exercise our legal rights or to defend against legal claims.
• To comply with a court order, subpoena, or other legal process.
• Where we reasonably believe disclosure is necessary to prevent imminent harm, financial loss, or to investigate suspected fraud or criminal activity.

The above lists are not exhaustive. We record all purposes for which we process your Personal Data.

Umbraswap uses standard server log files as part of its hosting infrastructure. Information collected in log files includes IP addresses, browser type, Internet Service Provider (ISP), date and time stamps, referring and exit pages, and the number of clicks. This information is not linked to any personally identifiable information and is used for the purposes of analysing trends, administering the site, tracking user movements, and gathering aggregate demographic information.

Umbraswap may use automated decision-making processes, including profiling, to improve the quality of our Services and to personalise your experience on our platform. For example, automated algorithms may analyse your browsing behaviour and interactions with our platform to tailor content and communications to your interests.

We may also use automated processes as part of our fraud detection and AML compliance obligations. Decisions made by automated means that produce legal or similarly significant effects on you will only be taken where permitted by law, and in such cases you will have the right to request human review of the decision.

Umbraswap is a company registered and operating under the laws of Costa Rica. Your Personal Data is stored and processed primarily within Costa Rica, in accordance with Law No. 8968 and the applicable standards established by PRODHAB.

To facilitate the provision of our Services, we may transfer and access Personal Data from other countries in connection with the involvement of our Executing Partner (Collect & Exchange Ltd., registered in Kazakhstan) and other third-party service providers. Where such transfers occur, we take appropriate steps to ensure that your Personal Data is protected to a standard consistent with Costa Rica Data Protection Law, including by entering into appropriate data transfer agreements where required.

We implement the following safeguards to protect your Personal Data:

• Physical safeguards:
• Personal Data records are maintained in secure environments with restricted physical access.
• Electronic safeguards:
• Data is stored on systems with strict access controls and authentication requirements.
• Administrative safeguards:
• Access to Personal Data is limited to authorised personnel who are bound by confidentiality obligations.
• Technical safeguards:
• Data in transit is protected using industry-standard encryption methods, including Secure Socket Layer (SSL/TLS) protocols.

As described in our Terms and Conditions, Umbraswap provides its Services in partnership with Collect & Exchange Ltd. (the “Executing Partner”), which executes payment and exchange transactions on our behalf. In order to fulfil your orders, it is necessary for us to share certain categories of your Personal Data with the Executing Partner, including:

• Identity and contact data required for KYC/AML verification.
• Transaction data, including amounts, wallet addresses, and payment details.
• Any additional information required by the Executing Partner to comply with its regulatory obligations under the laws of the Astana International Financial Centre (AIFC).

The Executing Partner is required to process your Personal Data only for the purposes of executing your transactions and fulfilling its compliance obligations, and is bound by appropriate data processing and confidentiality obligations. We do not authorise the Executing Partner to use your Personal Data for any other purpose.

The Executing Partner operates under the regulatory supervision of the Astana Financial Services Authority (AFSA) in Kazakhstan. Data transfers to the Executing Partner are governed by appropriate safeguards as described in section 9 above.

Our website uses cookies — small text files stored on your device that allow our website to recognise you when you return. We use cookies to remember your preferences, improve the functionality of our platform, and support our security and analytics capabilities.

We use the following categories of cookies:

• Session cookies:
• temporary cookies that expire when you close your browser, used to maintain your session and process your transactions.
• Persistent cookies:
• cookies that remain on your device for a set period, used to remember your preferences and provide a more convenient experience on return visits.
• Security cookies:
• used to recognise your browser or device for security purposes and to detect and prevent fraudulent activity.
• Analytics cookies:
• used to collect aggregate information about how users interact with our platform, to help us improve our Services.
• Advertising and attribution cookies:
• used to track the effectiveness of advertising campaigns and to identify the source through which you reached our platform.

We may also permit trusted third parties (including search engines, analytics providers, social media networks, and advertising companies) to place their own cookies or tracking technologies on our platform. Such third parties are governed by their own privacy policies.

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our platform.

We treat all Personal Data as confidential and do not disclose it to third parties except as described in this Privacy Policy or where required for the provision of our Services.

In addition to sharing with our Executing Partner as described in section 10, we may disclose Personal Data:

• To the extent required by applicable law or regulation.
• In connection with actual or prospective legal proceedings.
• To establish, exercise, or defend our legal rights, including sharing information with third parties for fraud prevention and credit risk reduction purposes.
• To trusted service providers who assist us in operating our platform or delivering our Services (such as data processors, payment processors, and customer support providers), provided that such providers are bound by appropriate data processing agreements and are prohibited from using your data for any other purpose.

We implement appropriate technical and organisational measures to protect your Personal Data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include password-protected account access, SSL/TLS encryption for data in transit, and strict internal access controls.

You also have a role in maintaining the security of your account. We recommend that you choose a strong, unique password and keep your login credentials confidential. We will never ask for your password by email or telephone.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (PRODHAB) in accordance with applicable law.

We retain your Personal Data only for as long as is necessary for the purposes for which it was collected, as follows:

• Account data:
• retained for the duration of your account and for a period of 5 years following account closure, to comply with applicable AML/KYC record-keeping obligations and to resolve any disputes.
• Transaction data:
• retained for a minimum of 5 years following the date of the transaction, in accordance with Costa Rica’s anti-money laundering legislation and applicable financial regulations.
• KYC/AML documents:
• retained for 5 years following the end of the business relationship, or longer if required by a competent authority.
• Marketing data:
• retained until you withdraw consent or opt out, or for a period of 3 years following your last interaction with us, whichever is earlier.
• Log files and technical data:
• retained for up to 12 months for security and analytical purposes.

Following the expiry of the applicable retention period, we will securely delete or anonymise your Personal Data. Where anonymisation is not possible, we will restrict processing to the minimum required for the permitted purpose.

We may work with third-party advertising partners, including ad networks and analytics providers, whose technologies (such as cookies, JavaScript, or web beacons) may collect information about your device and browsing activity when you visit our platform. These technologies allow our advertising partners to measure the effectiveness of their campaigns and to deliver relevant content.

Umbraswap does not control the cookies or tracking technologies of third-party advertisers. We encourage you to review the privacy policies of any third-party services you interact with through our platform. You may also exercise your right to opt out of interest-based advertising through your browser settings or applicable industry opt-out mechanisms.

Our platform may contain links to or integrations with third-party websites and services. This Privacy Policy applies only to data processed by Umbraswap and does not cover the practices of third parties. We are not responsible for the privacy practices or content of any third-party websites. We encourage you to read the privacy policies of any third-party services you access.

Under the Costa Rica Data Protection Law (Law No. 8968) and its implementing regulations, you have the following rights in relation to your Personal Data:

• Right of access:
• you may request a copy of the Personal Data we hold about you. We may charge a reasonable administrative fee for this service.
• Right to rectification:
• you may request that we correct any inaccurate or incomplete Personal Data.
• Right to erasure:
• you may request the deletion of your Personal Data, subject to applicable legal and regulatory retention obligations.
• Right to restriction of processing:
• you may request that we restrict the processing of your Personal Data in certain circumstances, for example where you dispute its accuracy.
• Right to object:
• you may object to the processing of your Personal Data, including processing based on our legitimate interests or for direct marketing purposes.
• Right to data portability:
• where processing is based on your consent or on a contract, and is carried out by automated means, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format, or that we transfer it directly to another controller.
• Right to withdraw consent:
• where we rely on consent as the legal basis for processing, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint:
• if you believe we have violated your data protection rights, you have the right to lodge a complaint with PRODHAB (
• www.prodhab.go.cr
• ).

To exercise any of these rights, please contact us at info@umbraswap.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

You may close your account and request deletion of your Personal Data at any time by contacting us at the email above. Please note that certain data may be retained following account closure as required by applicable law, as described in section 14.

Our Services are intended solely for individuals who are at least 18 years of age. Umbraswap does not knowingly collect Personal Data from anyone under the age of 18. If you believe that a minor has provided Personal Data to us, please contact us immediately at info@umbraswap.com and we will take prompt steps to delete that information from our records.

We encourage parents and guardians to monitor the online activities of minors in their care.

As a registered user, you will receive certain service-related communications from us as part of our contractual relationship. These include, but are not limited to:

• Email or push notifications regarding account creation and verification.
• Transaction confirmations and status updates.
• Security alerts and notifications relating to your account.
• Important updates to our Terms and Conditions or this Privacy Policy.

Where you have consented, we may also send you marketing and promotional communications about our Services. You may unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email, by adjusting your account notification settings, or by contacting us at info@umbraswap.com.

Opting out of marketing communications will not affect your receipt of service-related communications that are necessary for the provision of our Services.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Services we provide. When we make material changes, we will notify you by posting the revised Privacy Policy on our website and, where appropriate, by sending a notification to the email address registered to your account.

The date of the most recent revision is indicated at the top of this document. We encourage you to review this Privacy Policy periodically. Your continued use of our platform following the posting of an updated Privacy Policy constitutes your acceptance of the revised terms.

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a concern about our handling of your Personal Data, please contact us:

By email

info@umbraswap.com

By post

Umbraswap, Province 01 San José, Canton 15 Montes de Oca, Costa Rica

If you are not satisfied with our response to a data protection enquiry, you have the right to lodge a complaint with PRODHAB, the Costa Rican data protection supervisory authority, at www.prodhab.go.cr.

Umbraswap | Province 01 San José, Canton 15 Montes de Oca, Costa Rica | Registration No. 3-102-944661
Last updated: May 2026