How we handle your data.

Balboa Exchange is a Panama-based digital-asset desk, operating since 2020. This policy covers balboaexchange.com, the client portal, and the desk correspondence that surrounds them.

Balboa Exchange is the trading name of [LEGAL ENTITY], a company incorporated in the Republic of Panama under registration number [RUC], with its registered office at [REGISTERED OFFICE], Panama City, Republic of Panama. That entity is the data controller responsible for the personal data described here.

Questions about this policy, or any request concerning your data, go to desk@balboaexchange.com.

We collect what we need to open your account, to satisfy the identity and anti-money-laundering obligations that apply to us, and to execute what you ask the desk to execute. Categories:

• Identity and verification: legal name, date of birth, nationality, government-issued identity document, a selfie or liveness capture, tax identification number, and proof of address.
• Contact: email address, telephone number, and postal address including country, province, city and street lines.
• Suitability and financial profile: account type, occupation, annual income band, stated source of funds, the purpose you give for the account, and your expected monthly transaction volume.
• Transactional: quotes requested, orders, trades, transfers, deposit and withdrawal instructions, wallet addresses, and bank account details.
• Technical and security: IP address, device and browser characteristics, sign-in and session events, and two-factor authentication enrolment.
• Communications: email, WhatsApp and other correspondence with the desk, including the qualification questionnaire.

To perform our agreement with you. Without identity and settlement data we cannot open an account, quote, execute, or move funds.

To comply with legal obligations. Panamanian anti-money-laundering and counter-terrorist-financing law, principally Law 23 of 2015 and its implementing regulation, requires us to identify our clients, understand their source of funds, screen against sanctions and politically-exposed-person lists, monitor transactions, retain records, and report where reporting is required.

For our legitimate interests. Securing the platform, preventing fraud and abuse, defending legal claims, and improving the service.

With your consent, where we rely on it. Optional communications are consent-based and you can withdraw that consent at any time without affecting the service you already hold.

Verification data is not optional. If you decline to provide it, or if we cannot verify it, we cannot open or maintain the relationship.

We do not sell personal data, and we do not disclose it for third-party advertising. We share it only with the following recipients, and only to the extent each needs it:

• Identity-verification providers, who perform document authentication, liveness checks, and sanctions and PEP screening on our behalf.
• Our execution and custody partners, who need client identity and instruction data to settle and to meet their own regulatory obligations.
• Banking and payment partners involved in fiat settlement.
• Infrastructure providers (application hosting, database and authentication, and transactional email), acting on our instructions under contract.
• Professional advisers, including counsel, auditors and compliance consultants, under a duty of confidentiality.
• Competent authorities, including the Financial Analysis Unit, the National Authority for Transparency and Access to Information, tax authorities, courts and law enforcement, where we are legally compelled to disclose. Where the law prohibits us from telling you about such a disclosure, we will not tell you.
• An acquirer or successor, if the business or the relevant part of it is transferred, subject to the same protections.

Some of the providers above operate outside the Republic of Panama, including in the United States and the European Union. Where personal data is transferred abroad we require the recipient by contract to apply protections equivalent to those in this policy and to process the data only on our instructions.

We hold your data for the life of the relationship, and afterwards for the period Panamanian anti-money-laundering law requires records to be retained: at least five years from the end of the relationship or from the date of the last transaction, whichever is later.

Where a dispute, investigation or legal claim is live, we retain the relevant records until it is resolved. Data we no longer have a basis to keep is deleted or irreversibly anonymised.

Data is encrypted in transit and at rest. Access is restricted to personnel who need it, on a least-privilege basis, and authentication events are logged. Two-factor authentication is available on every client account and we recommend enabling it.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the competent authority as the law requires.

Under Law 81 of 2019 on the Protection of Personal Data and its implementing decree, you may request access to the personal data we hold about you, rectification of data that is inaccurate or incomplete, deletion, portability, and you may object to or ask us to restrict certain processing.

Write to desk@balboaexchange.com to exercise any of these. We may need to verify your identity before we act, and we will respond within the period the law allows.

These rights have limits. We cannot delete records we are legally required to retain, and we cannot continue a relationship where deletion would leave us unable to meet our verification obligations.

If you believe we have handled your data improperly, you may complain to the National Authority for Transparency and Access to Information (ANTAI) in Panama.

We use only what the site needs to function: a session cookie that keeps you signed in, and preference cookies that remember your language and display theme. These are strictly necessary or set at your direction, and there is no advertising or cross-site tracking cookie on this site.

Blocking the session cookie in your browser will prevent you from signing in to the portal.

Sanctions, PEP and transaction-monitoring tools screen accounts and flag matches automatically. A flag is a prompt for human review, not a decision; no account is refused, suspended or closed on the output of an automated tool alone.

The service is for adults. We do not knowingly collect data from anyone under 18, and we will delete such data if we discover it, subject to any retention obligation that has already attached.

We update this policy as the service and the law change. The current version is always the one published here, with the date shown at the top of this page. Where a change materially affects your rights, we will tell you directly before it takes effect.

Balboa Exchange, desk@balboaexchange.com. For data-protection matters, mark your message for the attention of the data-protection contact.