Privacy notice

xchange.coffee operates a marketplace for verified green coffee. For the personal data described here, we act as the data controller. If you have any question about your data or wish to exercise a right below, contact us at privacy@xchange.coffee.

• Account details you provide to register or sign in: email address, a securely hashed password, display name, role, and your legal entity name, country and contact details.
• Verification data where you complete business verification: trade licence details, beneficial-owner information (name, date of birth, nationality, identity-document reference) and uploaded certificates. This can include data of a sensitive nature and is held with additional safeguards.
• Payout details for settlement: account holder, bank and account number. Account numbers are encrypted at rest.
• Activity you generate on the platform: lots, trades, samples, messages, reviews, watchlists and similar records.
• Access requests: if you ask for early access, the name, company, role, country and email you submit.
• Technical data: a session cookie to keep you signed in, a language-preference cookie, and privacy-friendly, aggregate usage analytics that do not profile you.

We process personal data only where we have a lawful basis to do so:

• To provide the marketplace and settle trades - necessary to perform our contract with you.
• To verify identity and meet trade, custody and anti-money-laundering obligations - to comply with a legal obligation.
• To secure the platform, prevent abuse and keep records - our legitimate interest, balanced against your rights.
• To send you optional updates - only with your consent, which you can withdraw at any time in your notification settings.

Under the UAE Personal Data Protection Law you have the right to access, correct, erase, restrict and object to the processing of your personal data, to withdraw consent, and to receive a copy of your data in a portable format. You can exercise the main rights yourself:

• Access and portability: download a complete, machine-readable copy of your data from your profile ("Download my data").
• Correction: edit your profile, business and payout details at any time.
• Erasure: erase your account from your profile. We remove your personal identifiers; records of completed transactions are retained where the law requires, but no longer identify you.
• Consent: manage optional email and notification preferences, and cookie choices, at any time.

To exercise any right that is not self-service, or to complain, email privacy@xchange.coffee. You also have the right to lodge a complaint with the UAE Data Office.

We apply technical and organisational safeguards: encrypted transport, encryption at rest for account numbers, hashed passwords, optional two-step sign-in, strict access controls, rate limiting, and regular backups. Sensitive verification documents are held in access- controlled storage and served only to you or authorised compliance staff.

We do not sell personal data. We share it only with service providers that help us run the platform, under contract and only as needed: hosting and compute (Vercel), database and backups (Neon, hosted in the EU), transactional email (Resend), payments for memberships (Stripe), and map tiles and indicative market prices from public sources. Where data is transferred outside the UAE, we rely on an appropriate transfer safeguard as permitted by the PDPL.

We keep account and activity data for as long as your account is active. After erasure or closure we remove personal identifiers and retain only the transaction and compliance records we are legally required to keep, for the period the law requires, after which they are deleted. Access-request details are kept only as long as needed to respond to your enquiry.

We will update this notice as the platform grows and will show the date of the latest change here. This is our own notice and not legal advice; a full data-protection review is completed before public launch.