Bcash™ Privacy and Personal Data Protection Policy

BCASH S.A. - Privacy and Personal Data Protection Policy

[last update: October 2026]

 

1. Scope

This Policy explains how BCASH S.A. collects, uses and protects personal data when you visit and use the websites bcash.eu, cash.bcash.eu and id.bcash.eu, and how cookies and similar technologies are used.

It covers browsing, account creation and management, signing in to our services, communication with us, website features, statistical analysis and advertising technologies.

The specific procedures for providing services and ensuring regulatory compliance are described in the corresponding terms and policies available on the BCASH Legal Terms and Policies page. Where required, additional information on the processing of personal data is provided at the relevant stage.

Visiting the websites, creating an account or accepting the Terms of Use does not, in itself, constitute consent to optional cookies, statistical analysis or advertising tracking.

 

2. Data controller and contact details

The data controller for the activities described in this Policy is:

BCASH S.A.
Dimitrakopoulou 84, Postal Code 11741, Athens, Greece
Telephone: +30 6998 499 499
General enquiries: [email protected]
Contact for personal data matters and the exercise of rights: [email protected]

Processing is governed by the General Data Protection Regulation — Regulation (EU) 2016/679 (GDPR), Law 4624/2019 and applicable legislation. The storage of and access to information on your device are also governed by Law 3471/2006, as amended.

 

3. What personal data we process

The categories of data depend on the services you use and your privacy choices.

Account and contact information. Information you submit to create, use or manage an account, such as your name, email address, telephone number, account identifier and information used to verify your contact details.

Sign-in and session information. Sign-in status, session identifiers, access times and information necessary to securely recognise your account across BCASH services.

Browsing data. IP address, date and time of access, pages requested, browser type and version, operating system, language, referring website, response statuses and technical errors.

Feature and preference data. Language choice, cookie preferences and information you enter into website features, such as the crypto-asset selected, the amount and the choice to buy or sell in the conversion calculator.

Request and communication information. The content of messages, support requests or other correspondence you send us, together with the information necessary to handle them.

Customer relationship and transaction information. Where you use the corresponding services, information necessary to provide them and maintain the relevant records, such as transaction identifiers, dates, amounts, crypto-assets and related payment or wallet references.

Technical security data. Information supporting the protection of accounts and systems, such as security identifiers or keys, browser and device characteristics, screen and graphics rendering characteristics, language, time zone, indicators of automated access and interaction event measurements. A combination of certain characteristics may form a technical fingerprint of the browser or device.

Statistical analysis and advertising data. With your consent, cookie or device identifiers, page views, interactions, visit sources, advertising campaign information and events measuring advertising effectiveness.

The data comes from you, your browser and device, our systems and, depending on your choices, the third-party services described below.

 

4. Purposes and legal bases for processing

Purpose	Legal basis
Account creation and management, provision of services and execution of transactions you request	Article 6(1)(b) GDPR — performance of a contract or steps taken at your request prior to entering into a contract
Maintaining the required customer and transaction records, assessing customers for regulatory compliance purposes	Article 6(1)(c) GDPR — compliance with applicable legal obligations
Secure operation of the websites, protection of accounts, prevention of unauthorised access, automated abuse and fraud	Article 6(1)(f) GDPR — legitimate interests in protecting our users, services and systems
Handling communication requests	Article 6(1)(b), where the request concerns a contract or a pre-contractual request; otherwise, Article 6(1)(f) for the effective handling of communications
Enabling optional features and third-party services	Article 6(1)(a) GDPR — consent, where required
Statistical analysis using optional technologies	Article 6(1)(a) GDPR — consent
Advertising measurement and, where applicable, ad personalisation	Article 6(1)(a) GDPR — consent
Optional informational or promotional messages to which you subscribe	Separate consent, where required by applicable legislation
Handling requests to exercise rights and complying with data protection obligations	Article 6(1)(c) GDPR — legal obligation

Customer assessment for regulatory purposes is distinct from statistical analysis of website traffic and advertising profiling.

When we rely on a legitimate interest, we assess the necessity and proportionality of the processing and balance it against your rights. Legitimate interest does not replace consent where consent is required for storing or accessing information on your device.

If you do not provide data necessary for a particular service or required by law, it may not be possible to provide that service. Rejecting optional cookies does not prevent basic access to the websites.

 

5. Cookies and similar technologies

Cookies are small files stored in your browser or on your device. Similar technologies are also used, such as local storage (localStorage), session storage (sessionStorage), IndexedDB, tracking pixels and technical identifiers.

The category of each technology is determined by its actual purpose and operation. Whether it is provided by BCASH or a third party does not, in itself, determine whether it is necessary.

Necessary cookies and similar technologies — Always active

These are necessary for the secure operation of BCASH websites, signing in to your account, maintaining your session and actions while browsing, and storing your privacy choices.

They also include technologies that are strictly necessary to protect accounts and systems against unauthorised access, automated abuse and fraud.

They are used without consent only to the extent that they meet the conditions of the legal exemption. They cannot be disabled through the cookie preferences interface.

Functional cookies and similar technologies

These support optional features, embedded third-party services and optional storage of preferences beyond what is necessary for the functionality you request. They are enabled after you give the relevant consent.

Google Maps has a separate activation option, as described in Section 7.

Statistical analysis cookies

These are used, with your consent, to understand how the websites are used, which pages you visit and how you interact with them, so that we can improve our services. This category includes Google Analytics.

Advertising cookies

These are used, with your consent, to measure the effectiveness of advertising campaigns and, when the corresponding features are used, to create advertising audiences and personalise ads through services such as Google Ads and Meta Pixel.

Optional technologies are not enabled before you make the relevant choice. The exemption for necessary technologies does not generally cover advertising or website traffic analysis.

 

6. Shared privacy choices across the three websites

Cookie choices are shared across bcash.eu, cash.bcash.eu and id.bcash.eu.

When you save your choice on one of the three websites, it also applies to the others for the services and purposes described in this Policy, in the same browser and on the same device. Each service is enabled only on the pages where it is used.

In the cookie preferences interface, you can select:

• “Accept all”, to enable all optional choices.
• “Reject optional”, to use only strictly necessary technologies.
• “Cookie settings”, to choose by category or available service.
• “Save preferences”, to apply the choices you have selected.

Simply browsing, scrolling the page or closing the window without an affirmative choice does not constitute consent. Closing the settings without saving does not change a previous valid choice.

Once your choice has been saved, we do not request a new choice merely because you move to another of the three websites.

You can change or withdraw your consent at any time through the “Cookie settings” link, which remains available on each website. Acceptance, rejection and subsequent changes apply across all three websites.

Your choice is retained for up to 400 days, for the same period regardless of whether you accept or reject optional technologies. Your browser may remove the cookie earlier.

The interface may appear again when:

• The saved choice expires.
• You delete the relevant browser data.
• You use a different browser, device or private browsing environment without a saved choice.
• The purposes or services change materially and new consent is required.

Withdrawal stops the future use of the corresponding optional technologies. It does not affect the lawfulness of processing carried out before withdrawal. Data that does not need to be retained for another lawful reason is deleted in accordance with our applicable obligations.

You can also delete cookies and other stored data through your browser settings. Deleting necessary information may result in you being signed out or losing saved preferences.

 

7. Google and Meta services and a unified account

Google Maps

We use Google Maps on our websites to display BCASH service locations and make them easier to find.

Embedded maps remain disabled until you consent to their activation through “Cookie settings”, the “Enable Google Maps” button or the “Accept all” option. Enabling Google Maps alone does not enable statistical analysis or advertising cookies.

Enabling the service establishes a connection with Google and transmits technical information, such as your IP address and information about your browser and device. The service may also use cookies or similar technologies.

The use of Google Maps features and content is subject to the Google Maps Additional Terms of Service, while Google's processing of data is described in Google's Privacy Policy.

You can withdraw your consent at any time through “Cookie settings”. The addresses of service locations remain available without enabling the maps.

Google Analytics

We use Google Analytics to understand how our websites are used, identify problems and improve their content and operation.

The service is enabled only after you consent to statistical analysis cookies. Depending on its settings, it processes information such as the pages you visit, your interactions with the website, the source of your visit, technical information about your browser and device, and cookie identifiers. Using identifiers instead of your name does not, in itself, mean that the data is anonymous.

Further information is provided on the page How Google uses information from sites or apps that use its services.

Rejecting or withdrawing consent to statistical analysis does not prevent you from using the basic features of our websites.

Google Ads and Meta advertising tools

We use Google and Meta advertising services to promote BCASH and measure the effectiveness of our advertising campaigns.

The relevant non-essential technologies on our websites, such as advertising cookies, pixels and conversion measurement tools, are enabled only after you consent to the “Advertising cookies” category.

Depending on the features used, information about visits, interactions with ads and actions on the website may be transmitted, together with cookie identifiers and technical device information. Where personalisation features are used, this information may be used to create advertising audiences and display more relevant ads.

Providers may associate this information with data they already hold, in accordance with their own policies and your account settings. For Google, the privacy information referenced above applies. For Meta, you can consult Meta's Privacy Policy.

Consent to advertising cookies does not constitute consent to receive newsletters or other promotional messages.

Google reCAPTCHA and protection against automated abuse

We use Google reCAPTCHA on sign-in and registration forms to protect our accounts and systems against automated actions, malicious access attempts and abuse.

The service involves processing technical information about the device, browser and interaction with the relevant page, which is transmitted to Google for risk assessment.

Processing for security purposes is based on our legitimate interest in protecting our users and services. The exemption from consent for storing or accessing information on a device applies only to technologies that are strictly necessary for the secure provision of the service you request. It does not cover any additional uses for statistical analysis or advertising.

Shared sign-in and cookie choices across BCASH websites

The websites bcash.eu, cash.bcash.eu and id.bcash.eu use, where necessary, authentication and session maintenance mechanisms for secure access to your account and navigation between our services.

These necessary mechanisms operate independently of your consent to optional cookies. Creating an account or signing in does not, in itself, enable Google Maps, statistical analysis or advertising technologies.

The cookie choices you save apply across all three websites when you use the same browser and device, in accordance with Section 6. You can change them or withdraw your consent through “Cookie settings” on any of these websites.

 

8. Data recipients and third-party services

The following may have access to personal data, to the extent necessary:

• Authorised persons at BCASH.
• Hosting, infrastructure, technical support and security providers.
• Communications providers supporting functions such as sending messages and sign-in codes.
• Providers of statistical analysis, advertising and optional features, in accordance with your choices.
• Professional advisers and competent authorities, where disclosure is required or permitted by law.

When a provider processes data on our behalf, the relationship is governed by appropriate contractual data protection obligations. When a third party determines independent purposes of processing, its own privacy notice also applies.

Our websites may contain links to third-party websites or embedded services from third-party providers. We recommend that you read their respective privacy policies.

BCASH does not control the content or independent processing practices of third-party websites. This does not limit BCASH's obligations for processing operations in which it acts as a controller or joint controller, including, where applicable, the collection and transmission of data through embedded services.

 

9. Transfers outside the European Economic Area

Personal data may be transferred to or made accessible in countries outside the European Economic Area, such as the United Kingdom and the United States of America.

Transfers to the United Kingdom are based on the European Commission's applicable adequacy decision, in accordance with Article 45 GDPR.

Transfers to organisations in the USA that hold an active certification under the EU–US Data Privacy Framework are based on the corresponding adequacy decision, provided that the certification covers the specific transfer.

For transfers not covered by an adequacy decision, the European Commission's Standard Contractual Clauses apply, with supplementary safeguards where required.

For information about and access to the relevant safeguards for transfers of data outside the EEA, contact [email protected].

 

10. Retention periods

We retain data for the time required by the specific purpose and the applicable obligations. A single retention period does not apply to all categories.

Category of records or purpose	Retention period
Archiving customer relationship information to fulfil legal obligations	5 years after the termination of the customer relationship, subject to specific applicable obligations
Customer assessment for legal and regulatory compliance purposes	5 years after the termination of the customer relationship, subject to specific applicable obligations
Customer records retained for legal and regulatory compliance	5 years after the termination of the customer relationship, subject to specific applicable obligations
Transaction records subject to the corresponding retention obligation	5 years after the termination of the customer relationship or from the date of the occasional transaction, as applicable
Active account information	For as long as the account remains active. Once its closure is completed, information serving exclusively the operation of the account is deleted or anonymised. For information forming part of transaction records, regulatory compliance records or another category in this table, the corresponding retention period applies.
Routine technical access and security logs	No fixed deletion date is currently applied to routine access and security logs. They may be retained beyond five years until manually deleted. Records related to a security incident or a specific legal obligation follow the applicable retention requirement.
General communication and support requests	Until the request has been finally resolved. If the relevant communication forms part of a customer relationship, transaction or complaint record subject to a retention obligation, the corresponding retention period for that record applies.
Statistical analysis data	For bcash.eu, the Bcash - GA4 property retains event and user-level data for 14 months. User retention resets with each new activity, so active user identifiers can remain longer. Standard aggregated reports are unaffected.
Advertising measurement and personalisation data	Meta Pixel and Conversions API event data are retained by Meta for up to two years. Contact information used for matching is deleted after the matching process. Audiences created from event data, where used, may be retained by Meta until we delete them through our account tools.

The five-year periods concern the corresponding customer and transaction records. They do not automatically apply to cookies, statistical analysis or all technical browsing data.

For records subject to a specific regulatory regime, the corresponding duration and starting point for its calculation apply. An extension is made only where there is a specific legal basis or a relevant request from a competent authority.

Data necessary for investigating an incident or for the establishment, exercise or defence of legal claims may be retained for as long as required by that specific reason, with restricted access.

The following information applies to technologies on your device:

Category of cookies and similar technologies	Purpose	Storage period
Required — active sessions	Keep the account and requested website features working safely during a visit.	Until the browser session or server-side session ends; browser session restoration may extend the local session.
Required — privacy choices	Remember acceptance, rejection and individual choices across the three BCASH websites.	Up to 400 days from the last saved or changed choice; the browser may delete it earlier.
Required — selected language	Show the language version selected or requested by the visitor.	Up to 400 days after the preference is set; the browser may delete it earlier.
Required — temporary sign-in state	Complete shared sign-in and account actions already started by the visitor.	Short-lived authorisation lasts up to 10 minutes; tab data ends when the action is completed or the tab session ends.
Functional — optional interface settings	Remember optional display and tool settings, including calculator choices, when Functional storage is allowed.	Local browser storage has no automatic expiry. Without Functional consent, the calculator stops using it and removes it when its page next loads; website data can also be cleared in the browser.
Required — remembered sign-in and trusted devices	Maintain remembered access, transaction continuation or a trusted-device choice requested by the visitor.	Remembered access lasts 30–180 days depending on the service. Trusted-device approval lasts up to 2 years server-side; the browser identifier is subject to browser limits (up to 400 days in Chrome).
Required — form and access protection	Assess abuse risk on protected forms, including through Google reCAPTCHA.	A Google browser identifier was observed for approximately 180 days on the tested ID contact form; expiry may vary by browser and form.
Optional maps	Display Google Maps after the corresponding optional choice.	No dedicated persistent map cookie was observed on tested bcash.eu and ID pages; provider-set storage may vary by browser.
Performance — website analytics	Understand website use after consent, including through Google Analytics.	On tested bcash.eu pages, persistent analytics identifiers lasted up to 400 days; shorter identifiers, when set, about 24 hours or 1 minute. None were observed on tested ID or Cash pages.
Advertising — campaign measurement	Measure advertising after consent, including Meta technologies where used.	A Meta browser identifier lasted approximately 90 days in the tested browser. No Google Ads tag or cookie was observed on the tested pages.

The duration of storage of a cookie or identifier on the device does not necessarily coincide with the retention period for the corresponding data in the systems of BCASH or the provider.

After the applicable period expires, the data is deleted or anonymised appropriately, provided there is no specific lawful reason for further retention.

 

11. Data security

We take appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure.

The measures include access control, protection of communications and accounts, logging of relevant events and incident management procedures, depending on the nature and risk of the processing.

Access is restricted to persons who need it to perform their duties. We also limit the data collected to what is necessary for the corresponding purpose.

 

12. Your rights

Subject to the conditions of the GDPR, you have the right:

• To request access to your personal data and information about its processing.
• To request rectification of inaccurate data or completion of incomplete data.
• To request erasure or restriction of processing.
• To object, on grounds relating to your particular situation, to processing based on a legitimate interest.
• To object at any time to direct marketing, including related profiling.
• To receive the data you have provided to us in a structured, commonly used and machine-readable format, where the processing is based on consent or a contract and is carried out by automated means.
• To withdraw your consent at any time.
• To exercise the rights under Article 22 GDPR, where it applies to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise a right, contact [email protected]. For optional technologies, you can use “Cookie settings” directly.

If there are reasonable doubts about the identity of the requester, we may request only the additional information necessary to confirm it.

We respond without undue delay and, as a rule, within one month. Where an extension is permitted due to the complexity or number of requests, up to two additional months may be required. In that case, we inform you within the first month of the extension and the reasons for it.

The rights are subject to the legal conditions and exceptions. For example, information that must be retained due to a specific legal obligation is not deleted.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority or the competent supervisory authority in the place of your habitual residence, place of work or the alleged infringement.

 

13. Updating the Policy

This Policy is updated when our services, processing methods or applicable obligations change.

The current version is published on the BCASH websites with the date of the last update. Appropriate information is provided about material changes. Where new consent is required, we request it before activating the corresponding processing.