Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

2.1 Data You Provide to Us

When you use our website, submit a case, or engage our services, we collect:

• Identity data: full name, country of residence
• Contact data: email address, phone number
• Case data: wallet addresses, transaction hashes, incident descriptions, communications with counterparties, and any supporting documentation you provide
• Financial data: invoicing and payment information (we do not store full payment card numbers)
• Account credentials: username and hashed password for the client portal
• Communications: messages, emails, and other correspondence with our team

2.2 Data We Collect Automatically

When you visit our website, we automatically collect:

• Technical data: IP address, browser type and version, operating system, device type
• Usage data: pages visited, time spent, referring URLs, click events
• Cookie data: as described in our separate Cookies Policy

2.3 Data from Third Parties

In the course of a forensic investigation, we may obtain information about you or third parties from:

• Publicly available blockchain data
• Open-source intelligence (OSINT) sources
• Exchanges and financial institutions (only in connection with lawful requests related to your case)
• Law enforcement and regulatory authorities

3. How We Use Your Data

We process your personal data for the following purposes and on the following legal bases:

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects without human review.

4. Data Sharing

We do not sell your personal data. We may share it only in the following circumstances:

• Service providers: IT infrastructure providers, encrypted cloud storage providers, and payment processors engaged under strict data processing agreements
• Affiliated legal professionals: attorneys and law enforcement liaisons engaged to support your case, subject to equivalent confidentiality and data protection obligations
• Exchanges and financial institutions: only in connection with lawful asset preservation or information requests directly related to your case
• Law enforcement and regulatory authorities: where required by a court order, lawful request, or where we are legally obligated to disclose
• Professional advisors: our own legal, tax, and compliance advisors, subject to professional secrecy obligations
• Business transfers: in the event of a merger, acquisition, or sale of substantially all assets, with prior notice to you

5. International Data Transfers

Our primary data processing operations are based in Switzerland. Where we transfer personal data to recipients outside Switzerland or the EEA, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions recognising an equivalent level of data protection
• Your explicit consent, where required

Switzerland is recognised by the European Commission as providing an adequate level of data protection.

6. Data Security

We implement technical and organisational security measures appropriate to the sensitivity of your data, including:

• End-to-end encryption for data in transit (TLS 1.3)
• AES-256 encryption for data at rest
• Role-based access controls and multi-factor authentication on all internal systems
• Regular penetration testing and security audits
• Full audit trails of all access to case data
• ISO 27001-aligned information security management practices

In the event of a personal data breach that presents a material risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, within the timeframes required by applicable data protection law.

7. Your Rights

Subject to applicable data protection law, you have the following rights:

• Right of access: to obtain a copy of the personal data we hold about you
• Right to rectification: to have inaccurate personal data corrected
• Right to erasure ('right to be forgotten'): to request deletion of your data, subject to legal retention obligations
• Right to restriction of processing: to request that we limit how we use your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint: with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or the supervisory authority in your EU member state if you are an EEA resident

To exercise any of these rights, contact us at privacy@trustchainrec.com. We will respond within 30 days. We may request proof of identity before fulfilling a request.

8. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will publish the updated Policy on our website and, for material changes, notify registered users by email. The 'Last Updated' date at the top of this Policy indicates when it was last revised.

10. Contact & Data Protection Enquiries

For all privacy-related questions or to exercise your rights: