Privacy and data protection

This page is the Coinimas privacy portal. It explains what Coinimas collects, why, and how you ask for a copy, a correction, or deletion. It is written for Coinimas. It is not a notice from any other exchange.

What counts as personal data

Personal data is anything that identifies you or can be tied to you. On Coinimas that includes your name, email, phone, date of birth, country, a photo of an identity document, a selfie used for verification, your account id, your balances, your trades, your withdrawal addresses, the IP address and device used at login, and the codes sent to prove it is you.

Principles

You can see what we do

This page is the current notice. If the list of data or the reasons change, the date at the top changes too. Coinimas does not sell your personal data.

Only what the job needs

Coinimas asks for data to open the account, to keep the login safe, to credit and debit the ledger, to meet anti-money-laundering law, and to answer a support ticket. A feature that is still an application (the card, an eSIM, a gift card) stores only the fields on that form.

A named owner

The data-protection contact is dpo@coinimas.com. Security of the account is described on the user protection page. Coinimas does not claim an ISO 27001, ISO 27701, SOC 2, or PCI certificate. If that changes, this page will name the auditor and the year.

Data we hold

• Account: email, display name, password hash, and the time the account was created.
• Security: authenticator secret (stored so the code can be checked), passkey public key, fund-password hash, phone number, and one-time codes. Coinimas never stores the fund password or the login password as plain text.
• Identity: the document type, the document number, country, images you upload, and the review result (unverified, pending, verified, or rejected).
• Ledger: every deposit, trade, fee, and withdrawal, including the coin, the amount, the address, and the status. This record is how your balance is proved.
• Pay requests: bank details you typed for a transfer, card application country and phone, gift-card codes, and shop orders.
• Technical: IP address, a device label, and the time of a login, so a new device can be challenged.

Why we use it

• To perform the contract: show balances, match trades, send withdrawals, and take the published fee.
• To meet the law: identity checks, sanctions checks, and record keeping. See the AML page.
• To protect the account: new-device email codes, withdrawal holds, and freeze reviews.
• With consent: optional marketing. You can refuse and still use the exchange.

Who else sees it

• The email provider that sends your codes, and the phone provider that sends SMS codes, see the address or number and the code. They do not see your balance.
• A blockchain sees the hot-wallet transaction. That record is public. It does not include your name.
• A bank you choose for a Pay transfer sees the payment reference you were given.
• A regulator, a court, or law enforcement can receive data when a valid request arrives at compliance@coinimas.com.
• Coinimas staff who do not need a record cannot open it. The house desk is a separate login. It does not trade and it does not hold a user wallet.

How long it stays

Login codes expire in minutes. Session data is kept while the session is valid. Identity files and the ledger are kept for at least five years after the account closes. Marketing preferences are kept until you change them. Backups roll forward and then age out. Coinimas does not promise that a chain transaction can be deleted. It cannot.

Security of the data

The site is served over HTTPS. Passwords are stored as hashes. The hot-wallet seed is sealed and is not shown in the app. Customer long-term storage is a cold address that you, the operator, hold offline. The server stores the address, not the cold private key. KYC images are access-limited to the review role. None of this is a claim that a breach is impossible.

Children

Coinimas does not open accounts for anyone under 18. If you believe a child has an account, email privacy@coinimas.com.

Exercising your privacy rights

Contact the data-protection contact

privacy@coinimas.com for a copy, a correction, deletion, or a marketing opt-out. dpo@coinimas.com if you want the data-protection contact directly. legal@coinimas.com for a legal notice. If you live in a place with a privacy regulator, you may also complain there. Coinimas would like the chance to fix the problem first.