Consent to the Processing of Personal Data

Last updated: 19 June 2026 · Version 1.0

Operator. VND Exchange ("the Operator", "we") is a private exchange service. It is not a registered legal entity and is not a licensed institution. The only contact channel for the Operator is the Telegram bot and mini-app @VNDExchangeRobot; all questions, requests, and withdrawals of this consent are handled there.

Not a bank, not regulated, not advice. The Operator is not a bank, credit, payment, or e-money institution, broker, licensed FX agent, or licensed crypto exchange, and is not supervised by the State Bank of Vietnam or any other authority. Nothing here is investment, legal, or tax advice.

Scope. This consent applies to the website, the Telegram bot, and the mini-app @VNDExchangeRobot (together, "the Service").

This is a standalone consent. You give it by ticking the consent box in the bot or mini-app. The box is not pre-ticked; if you do not tick it, do not submit your data. Ticking it means you have read this document and agree to what it says.

1. What this consent covers

By giving this consent you, the data subject, agree that the Operator may process your personal data on the terms below. This consent sits alongside the Privacy Policy, which describes our handling in more detail, and the AML / KYC Policy, which explains why identity and source-of-funds data are collected. Where this consent and the Privacy Policy overlap, read them together.

2. Data we collect

The categories depend on what you do with the Service. We may process:

• Telegram account data — your Telegram user ID, username, display name, and language setting, and any phone number you share through Telegram.
• Contact and identity data for verification — full name, date of birth, nationality, and the document images and selfie you submit for identity checks (passport or other government ID).
• Source-of-funds information — explanations or documents you provide for larger operations.
• Transaction data — order details, the assets and amounts exchanged, wallet addresses you send from or to, and your bank or card requisites for fiat settlement.
• Screening results — the cleanliness score and risk flags returned by a third-party blockchain-analytics provider for the crypto you send in.
• Technical data from the website — IP address (which we store only as a salted hash, sha256(IP + secret)), device and browser information, and cookies, as set out in the Cookie Policy.
• Your messages — what you send us in the bot chat.

3. Why we process it (purpose by purpose)

We process each category only for the purposes below:

1. To carry out your exchange. Order data, wallet addresses, bank/card requisites, and Telegram contact data are used to quote, confirm, settle, and where needed return an operation, including arranging courier hand-over of VND cash.
2. To verify your identity and check funds. Identity documents, the selfie, and source-of-funds information are used for the Operator's own fraud-prevention checks, including the USD 5,000-per-operation internal verification limit and checks triggered at any amount on risk grounds.
3. To screen incoming crypto. Wallet addresses and transaction details are screened through a blockchain-analytics provider; an operation that scores below 80% cleanliness, or that links to sanctions, scam, darknet, or mixers, is treated as failed.
4. To keep records and handle disputes. We retain order and verification records to evidence what was agreed and to deal with any later claim.
5. To run and secure the website. The hashed IP, device data, and cookies are used to operate the site and prevent abuse. Non-essential analytics cookies load only if you also accept them in the cookie banner.

We do not use your data for automated decisions that produce legal effects on you without human involvement. A person reviews verification and screening outcomes before any return or refusal.

4. What we do with the data (processing actions)

You consent to the following actions on the data above: collection, recording, organisation, storage, use, checking, updating, blocking, anonymisation, and deletion. You also consent specifically to:

• Transfer to third-party processors who act on the Operator's instructions, namely the messaging platform Telegram, the blockchain-analytics provider, our hosting/VPS provider, and the website analytics that runs on the site.
• Cross-border transfer and processing. Your data is processed in Vietnam, where the Operator runs the Service, and is handled through Telegram and through the Operator's infrastructure located outside your country. You understand that the level of data protection in those locations may differ from the one where you are, and you agree to this transfer.

We do not sell your personal data.

5. How long we keep it

We keep identity-verification and transaction records for up to 3 years after your last operation with the Service. Other data is kept only for as long as it is needed for the purpose it was collected for, after which it is deleted or anonymised.

6. Withdrawing this consent

You may withdraw this consent at any time by writing to the Operator through @VNDExchangeRobot. Withdrawal stops further processing that relies on your consent, but it does not undo processing already carried out, and it does not affect data we must keep to complete an operation already in progress, to meet the retention period in Section 5, or to deal with a claim. Withdrawing consent before or during an operation may mean the Operator cannot verify you or proceed, in which case the operation will not go ahead.

7. Voluntary nature

Giving this data is voluntary, but it is necessary to use the Service. If you do not provide the data needed to identify you, screen the funds, and settle the operation, the Operator cannot perform the exchange.

8. Confirmation

By ticking the consent box, you confirm that you are at least 18, that the data you provide is yours and accurate, and that you have read and agree to this Consent together with the Privacy Policy.