Privacy Policy

1. Controller and scope

The data controller is Madras Company Limited, registration number 0105568009006. This policy covers the A‑EXCHANGE website, Telegram bot, Mini App, support and related transactions.

Privacy contact: A-Exchange-Thai@proton.me; telephone +66 88 021 3888.

2. Data categories

• Telegram id, name, username, language, available profile data and verified phone number.
• Account, KYC status, orders, payments, refunds, balances, ledger records, support messages and audit events.
• Minimal KYC result: name, document type and country, expiry, hash of a masked number and verification scores. In this provider KYC flow, A‑EXCHANGE does not store the full number, date of birth or document/selfie images. Separately, the optional A‑EXCHANGE payer form before DoverkaPay payment records the declared full name, phone number and full Russian passport series and number, encrypted and attached to the invoice, under separate consent. The form does not automatically verify identity. Only administrators may access it; the data may be provided to DoverkaPay on request for payment review and disputes.
• Security data: server logs, timestamps and limited HMAC-derived device/IP markers.
• First-touch UTM data only if the separate internal attribution module is explicitly enabled; it is currently disabled.

3. Purposes and grounds

• Performing the service contract and maintaining the unified account.
• KYC, fraud prevention, AML/CFT review and protection of customers.
• Payments, credits, payouts, refunds and support.
• Applicable legal obligations and establishment or defence of claims.
• Separate consent where required for KYC data transfer and processing; withdrawal does not invalidate prior lawful processing or mandatory retention.

4. Recipients and transfers

Data may be shared, as necessary, with Bistropay and other actually connected payment/KYC providers, Telegram, banks and payment participants, infrastructure vendors, professional advisers and competent authorities.

Documents and selfies are uploaded directly to the KYC provider. A‑EXCHANGE receives invoice data and payment status; the merchant API does not provide documents or a separate KYC status. Required safeguards apply to cross-border processing.

5. Retention and security

Data is kept only as long as needed for the contract, security, settlement, disputes and mandatory records. KYC validity is not the same as legal retention. The specific period depends on the data category and applicable obligation; support will provide the period or criteria on request.

Controls include least privilege, secret encryption, hashed markers, immutable money records and data minimisation. Absolute security cannot be guaranteed.

6. Rights

Subject to Thailand’s PDPA, a person may request access, copies, correction, portability, erasure or restriction, object, withdraw consent and complain to the Personal Data Protection Committee. Rights may be limited by mandatory retention, AML/CFT and legal claims.

Send requests to A-Exchange-Thai@proton.me. Identity verification may be required to protect the account.