Privacy and data protection

Identity data (full name, date of birth, nationality, identity document); contact data (address, email, phone); verification data (document images, liveness and biometric check results, beneficial ownership information); financial data (bank account details, transaction history, balances, source of funds information); blockchain data (wallet addresses and transaction hashes linked to you); and technical data (login and security logs).

To meet our legal and regulatory obligations (AML/CTF, sanctions, Travel Rule, record keeping, reporting to AFSA and competent authorities); to perform our contract with you (onboarding, execution, custody, withdrawals, support and complaints); and, where required, with your consent. We collect only what is necessary for these purposes and do not use it for anything else.

Only where necessary and under written data processing agreements: identity verification (KYC/KYB) providers; blockchain analytics (KYT) providers, which receive wallet addresses and risk scores but not your identity; Travel Rule counterparties when you transfer to another service provider; regulated partner banks holding client money; cloud hosting providers; and AFSA, the Financial Monitoring Agency and other authorities where the law requires. OTC liquidity providers receive trade instructions only, never your personal data.

We do not sell, rent or otherwise commercialise personal data.

Personal data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher), stored separately from operational data, and accessible only to authorised staff on a need-to-know basis with multi-factor authentication. All access is logged and reviewed.

Due diligence and transaction records are kept for at least six years after the end of the relationship or the transaction, as required by AIFC rules; longer where a legal hold applies. After that, data is securely deleted or anonymised.

You can ask to access your data, correct inaccurate data, restrict or object to certain processing, and request erasure where we are not required by law to keep it. Send requests to info@credence.kz. We acknowledge requests within 3 business days and respond within 30 calendar days; if a legal obligation prevents us from acting, we will tell you why.

Material personal data breaches are notified to AFSA within 24 hours of confirmation, and to affected clients where a breach poses a high risk to their rights.

This website does not use analytics or advertising cookies. It stores only your language choice in your browser.