Privacy Policy

1. Introduction

Galaxia Culture ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

This policy complies with:

• General Data Protection Regulation (GDPR) - EU
• California Consumer Privacy Act (CCPA) - US
• UK GDPR - United Kingdom
• Other applicable data protection laws

2. Data Controller

Data Controller: Galaxia Culture
Email: privacy@galaxia.earth
Address: [Registered Business Address]

For EU users, our Data Protection Officer can be contacted at: dpo@galaxia.earth

3. Information We Collect

3.1 Personal Information

We collect:

• Identity Information: Name, date of birth, government ID, photos
• Contact Information: Email, phone, address
• Financial Information: Wallet addresses, transaction history, payment methods
• KYC/AML Data: Verification documents, source of funds, PEP status
• Technical Information: IP address, device information, browser type
• Usage Data: Platform interactions, preferences, cookies

3.2 Blockchain Data

Transactions on blockchain are public. We collect and process on-chain transaction data for compliance and service provision.

3.3 Cookies & Tracking

We use cookies and similar technologies. See our Cookie Policy for details. You can manage cookie preferences in your browser settings.

4. How We Use Your Information

We use your information for:

• Service Provision: Operating the platform, processing transactions
• Compliance: KYC/AML verification, sanctions screening, regulatory reporting
• Security: Fraud prevention, risk management, account security
• Legal Obligations: Tax reporting, SAR/STR filing, record keeping
• Communication: Service updates, support, marketing (with consent)
• Analytics: Platform improvement, usage analysis

Legal Basis (GDPR): We process data based on contract performance, legal obligations, legitimate interests, and your consent.

5. Data Sharing & Disclosure

We may share your information with:

• Service Providers: KYC providers, payment processors, cloud services
• Regulatory Authorities: When required by law or for SAR/STR filing
• Law Enforcement: In response to valid legal requests
• Business Transfers: In connection with mergers, acquisitions
• With Your Consent: As you explicitly authorize

We do not sell your personal information. We require all third parties to maintain appropriate security measures.

6. International Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) for EU transfers
• Adequacy decisions where applicable
• Other approved transfer mechanisms

7. Data Retention

We retain your data for:

• Transaction Records: Minimum 5 years (AML requirement)
• KYC Data: Duration of relationship + 5 years
• Account Data: While account is active + retention period
• Marketing Data: Until consent withdrawn

After retention periods, data is securely deleted unless legal hold applies.

8. Your Privacy Rights

You have the right to:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion (subject to legal obligations)
• Restriction: Limit processing in certain circumstances
• Portability: Receive your data in a structured format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for consent-based processing
• Complain: Lodge a complaint with supervisory authority

To exercise these rights, contact: privacy@galaxia.earth. We will respond within 30 days (or as required by applicable law).

9. Security Measures

We implement:

• Encryption at rest and in transit (TLS 1.3+)
• Access controls and authentication
• Regular security audits
• Incident response procedures
• Employee training on data protection

10. Data Breach Notification

In the event of a data breach that poses a risk to your rights, we will:

• Notify relevant supervisory authority within 72 hours (GDPR)
• Notify affected users without undue delay
• Provide details of the breach and mitigation measures

11. Children's Privacy

Our platform is not intended for users under 18. We do not knowingly collect data from children. If we become aware of such collection, we will delete it immediately.

12. Changes to Privacy Policy

We may update this Privacy Policy. Material changes will be notified via email or platform notification. Continued use after changes constitutes acceptance.

13. Contact

For privacy inquiries:

• Email: privacy@galaxia.earth
• DPO (EU): dpo@galaxia.earth
• Address: [Registered Business Address]