Pre-launch build Not ready to accept real clients: legal documents are unreviewed drafts; the operator is not identified; no contracted licensed provider; no live market rate configured.
Skip to main content
P2P BrokerMontenegro
Menu

Draft — not in force

This document is a working draft. It has not been reviewed by Montenegrin counsel and does not yet bind either party. It is published here so that the structure and the substantive restrictions can be reviewed, not so that it can be relied upon.

Privacy notice

Version 0.1-draft · P2P Broker

1. Who is responsible for your data

Paxa Media j.d.o.o., an IT company, of [Street and number], [Postcode] [City], Montenegro, registration number [CRPS number], operates this website and is the controller of the personal data described here. You can contact us about data protection — access, correction, erasure or a complaint — at [privacy@p2pbroker.me].

Luka Rukavina and Lazar Barjaktarović carry out the identity checks described below and decide whether to make an introduction. They receive your details from the platform for that purpose.

2. What we collect, and when

When you create an accountwe collect your email address, a password (which we store only as a slow one-way hash and cannot read), your declared country of residence, and your confirmation that you are not resident in the EU or EEA. We record the date and time, your IP address, your browser’s user agent string, and the country our systems observed for your connection.

When you make an exchange request we collect your full name, a telephone number if you give one, the direction, asset, settlement method and indicative amount, your stated purpose in your own words, how you heard about us, and any referrer.

Neither form collects identity documents, and you should not send them to us by email or messaging application. Identity verification happens separately, through our verification provider, over a secure link.

3. Why we collect it, and on what basis

We use this information to assess whether we are able to work with you, to carry out the customer due diligence and screening described in our AML statement, to make an introduction to the registered provider if we proceed, and to keep the records we are required to keep.

Our bases for processing are: taking steps at your request before entering into a contract; compliance with legal obligations relating to the prevention of money laundering and terrorist financing; and our legitimate interest in operating the business and protecting it and our clients from fraud and financial crime.

4. Who we share it with

  • the registered crypto-asset service provider, the registered crypto-asset service provider, where we make an introduction. It receives your file over a secure channel and becomes a controller of it in its own right.
  • Our identity verification provider, which processes your identity documents and liveness check on our behalf.
  • Screening and blockchain analytics providers, for sanctions, politically exposed person, adverse media and wallet checks.
  • Supervisory authorities, the financial intelligence unit and law enforcement, where we are required to report or to respond to a lawful request.
  • Our banks and professional advisers, where necessary.

We do not sell your data and we do not use it for advertising.

5. How long we keep it

Five years from the end of our relationship with you, or from your enquiry where no relationship follows. This period is set by anti-money-laundering law and we are not able to shorten it on request. Records are encrypted, access is limited to named individuals, and every access is logged.

6. Your rights

You have rights to access your data, to have inaccurate data corrected, to object to or restrict certain processing, and to complain to the supervisory authority for data protection in Montenegro.

There are two limits on these rights that we would rather tell you about now than at the moment you exercise them. First, we cannot delete records we are legally required to retain, even if you ask us to and even if we never worked together. Second, where the law prohibits us from disclosing that a report concerning you has been made or is contemplated, we are not permitted to confirm or deny it in response to a request for access, and we may be obliged to withhold information without explaining that we have done so.

7. Where your data is held

Outstanding. To state the hosting location and any transfer outside Montenegro, once hosting is confirmed. See compliance/hosting-and-data-residency.md — this must name a real region and a real provider before launch.

8. Cookies

This site sets no advertising or analytics cookies and includes no third-party trackers. The cookies we do set are all necessary for the service to work, and none of them requires consent:

  • your chosen language;
  • a record that you have answered the residency question, so that you are not asked again on every page;
  • the direction, asset and amount you entered on the calculator, so they carry over when you continue;
  • your sign-in session, if you have an account — this one identifies you and is deleted when you sign out;
  • briefly, the reference number of a request you have just made, so it can be shown to you once.

9. Changes

We record which version of this notice was in force when you sent your enquiry, so that we can tell you what you were told at the time.