Privacy Policy

Last updated: June 2025

1. Who We Are

TraceX NL ("we", "us", "our") is a specialist forensic investigation company based in the Netherlands. We provide blockchain transaction tracing, fraud intelligence, and evidence reporting services to individuals who have been victims of online financial crime.

As the entity that determines the purpose and means of processing your personal data, TraceX NL is the data controller within the meaning of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

Contact:
TraceX NL
YOUR STREET ADDRESS, City, Postal Code, Netherlands
Email: info@tracexnl.com

2. Data We Collect

We only collect data that is necessary for the services you request. When you submit a case via our contact form, we collect:

• Identity data - first name and last name
• Contact data - email address and telephone number
• Case data - the type of fraud experienced, the approximate amount lost, and your description of events

We do not collect payment information, government identification numbers, or any special category data (such as health or biometric data) through this website.

We do not use advertising trackers, third-party analytics scripts, or social media pixels on this website.

3. How We Use Your Data

The data you provide is used exclusively for the following purposes:

• Assessing whether your case falls within the scope of our investigation services
• Contacting you to discuss your case and provide a service proposal
• Conducting the blockchain forensic investigation you have requested
• Producing a written investigation report for your use
• Complying with applicable legal obligations (e.g. record-keeping requirements)

We will never use your data for marketing purposes without your explicit consent, and we will never sell your data to any third party under any circumstances.

4. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)) - processing your case submission data is necessary to take pre-contractual steps at your request and, where a service agreement is concluded, to perform that contract.
• Legitimate interests (Art. 6(1)(f)) - we have a legitimate interest in retaining case records for quality assurance and in improving our investigation methodologies, provided this does not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)) - we may be required to retain certain records under Dutch law or in response to a lawful request from law enforcement authorities.

5. Third-Party Data Processors

We share your data only with service providers who process data on our behalf and are bound by data processing agreements. Our current processors are:

• Formspree, Inc. (United States) - receives your contact form submissions and forwards them to our email inbox. Formspree is GDPR-compliant and processes data under Standard Contractual Clauses. See their privacy policy at formspree.io/legal/privacy-policy.
• Web hosting provider - hosts the static files of this website. No personal data is stored by the hosting provider beyond standard server access logs (IP address, timestamp, page requested), which are deleted within 30 days.

We do not share your personal data with any other third parties unless required by law or compelled by a court order.

6. Cookies & Local Storage

This website does not use tracking cookies or advertising cookies.

We use browser localStorage solely to remember your preferred display language (English, German, or Dutch) between page visits. This preference is stored only on your own device and is never transmitted to our servers. It does not identify you personally and does not constitute a cookie within the meaning of the ePrivacy Directive.

You can clear this preference at any time by clearing your browser's local storage for this site, or by switching languages using the dropdown in the navigation bar.

7. Data Retention

We retain personal data for as long as is necessary for the purpose for which it was collected:

• Initial enquiries that do not proceed to an investigation - deleted within 90 days of our last contact with you.
• Active investigation case files - retained for the duration of the engagement and for 3 years thereafter, to allow for follow-up legal proceedings or regulatory requests.
• Completed case records - retained in anonymised or pseudonymised form for internal statistical and quality purposes after the 3-year period.

Where we are required by Dutch law to retain records for a longer period, we will do so and will inform you accordingly.

8. Your Rights (GDPR)

As a data subject under the GDPR, you have the following rights, which you may exercise free of charge at any time:

• Right of access (Art. 15) - you may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) - you may ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17) - you may request deletion of your data where it is no longer necessary or where you withdraw consent (subject to our legal retention obligations).
• Right to restriction (Art. 18) - you may ask us to restrict processing in certain circumstances.
• Right to data portability (Art. 20) - you may request your data in a structured, machine-readable format.
• Right to object (Art. 21) - you may object to processing based on legitimate interests at any time.

To exercise any of these rights, contact us at info@tracexnl.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

9. International Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA) - specifically by Formspree, which operates in the United States. Such transfers take place under Standard Contractual Clauses approved by the European Commission, providing an adequate level of protection for your data.

We do not transfer your data to any country without an adequate protection mechanism in place.

10. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include access controls, encrypted communications (HTTPS), and restricted internal access to case data on a need-to-know basis.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and will inform you directly where required by law.

11. Contact & Complaints

For any privacy-related questions or to exercise your rights, contact us at:

TraceX NL
Email: info@tracexnl.com
Address: YOUR STREET ADDRESS, City, Postal Code, Netherlands

If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens
Website: autoriteitpersoonsgegevens.nl
Telephone: +31 70 888 85 00