Privacy Policy

1. Controller and scope

The data controller is Madras Company Limited, registration number 0105568009006. This policy covers the A‑EXCHANGE website, Telegram bot, Mini App, support and related transactions.

Privacy contact: A-Exchange-Thai@proton.me; telephone +66 88 021 3888.

2. Data categories

• Telegram id, name, username, language, available profile data and verified phone number.
• Account, KYC status, orders, payments, refunds, balances, ledger records, support messages and audit events.
• Minimal KYC result: name, document type and country, expiry, hash of a masked number and verification scores. A‑EXCHANGE does not store the full number, date of birth or document/selfie images.
• Security data: server logs, timestamps and limited HMAC-derived device/IP markers.
• First-touch UTM data only if the separate internal attribution module is explicitly enabled; it is currently disabled.

3. Purposes and grounds

• Performing the service contract and maintaining the unified account.
• KYC, fraud prevention, AML/CFT review and protection of customers.
• Payments, credits, payouts, refunds and support.
• Applicable legal obligations and establishment or defence of claims.
• Separate consent where required for KYC data transfer and processing; withdrawal does not invalidate prior lawful processing or mandatory retention.

4. Recipients and transfers

Data may be shared, as necessary, with Love&Pay and other actually connected payment/KYC providers, Telegram, banks and payment participants, infrastructure vendors, professional advisers and competent authorities.

Documents and selfies are uploaded directly to the KYC provider. A‑EXCHANGE receives a minimal result and does not claim to store images. Required safeguards apply to cross-border processing.

5. Retention and security

Data is kept only as long as needed for the contract, security, settlement, disputes and mandatory records. KYC validity is not the same as legal retention. The specific period depends on the data category and applicable obligation; support will provide the period or criteria on request.

Controls include least privilege, secret encryption, hashed markers, immutable money records and data minimisation. Absolute security cannot be guaranteed.

6. Rights

Subject to Thailand’s PDPA, a person may request access, copies, correction, portability, erasure or restriction, object, withdraw consent and complain to the Personal Data Protection Committee. Rights may be limited by mandatory retention, AML/CFT and legal claims.

Send requests to A-Exchange-Thai@proton.me. Identity verification may be required to protect the account.