1. Introduction

Galaxia Rescue ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in compliance with GDPR, CCPA, and other applicable data protection laws.

2. Information We Collect

2.1 Personal Information

• Identity information (name, date of birth, nationality)
• Contact information (email, address, phone)
• Identity documents (passport, driver's license, national ID)
• Proof of address documents
• Financial information (source of funds, occupation)
• Wallet addresses and transaction history

2.2 Technical Information

• IP address and geolocation data
• Device information and browser type
• Usage data and analytics
• Cookies and similar tracking technologies

3. How We Use Your Information

We use your information to:

• Provide and improve our services
• Comply with KYC/AML regulatory requirements
• Monitor transactions for suspicious activity
• Screen against sanctions lists
• Process complaints and support requests
• Send important service updates
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Legal Obligation: Compliance with AML, KYC, and other regulatory requirements
• Contract Performance: To provide our services
• Legitimate Interests: Fraud prevention, security, and service improvement
• Consent: Where required by law

5. Data Retention

We retain your personal data for as long as necessary to:

• Transaction Records: Minimum 5 years (AML requirement)
• KYC Records: 5 years after account closure
• Complaint Records: 6 years
• Audit Logs: 5-7 years (compliance requirement)

After retention periods, we securely delete or anonymize your data, except where legal holds apply.

6. Your Rights (GDPR)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion (subject to legal retention requirements)
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Restrict: Request restriction of processing
• Withdraw Consent: Where processing is based on consent

To exercise these rights, contact us at privacy@galaxia.org. We will respond within 30 days.

7. Data Sharing and Disclosure

We may share your data with:

• Regulatory Authorities: As required by law (AML reporting, SARs)
• Service Providers: KYC providers, sanctions screening services, cloud providers
• Legal Requirements: Court orders, subpoenas, legal processes
• Business Transfers: In case of merger, acquisition, or sale

We do not sell your personal data to third parties.

8. Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside the EEA. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions
• Other approved transfer mechanisms

9. Security Measures

We implement technical and organizational measures to protect your data:

• Encryption at rest and in transit (AES-256, TLS 1.3+)
• Access controls and authentication
• Regular security audits
• Incident response procedures
• Employee training on data protection

10. Data Breach Notification

In the event of a data breach that poses a risk to your rights, we will:

• Notify the relevant supervisory authority within 72 hours (GDPR)
• Notify affected users without undue delay
• Provide details of the breach and mitigation measures

11. Cookies and Tracking

We use cookies and similar technologies. See our Cookie Policy for details. You can manage cookie preferences in your browser settings.

12. Children's Privacy

Our services are not intended for individuals under 18. We do not knowingly collect data from children.

13. Contact Information

For privacy inquiries or to exercise your rights:

Data Protection Officer
Email: privacy@galaxia.org
Address: [Your Registered Address]