Privacy Notice (Costa Rica)

Last updated: 28 October 2026

Introduction

This Privacy Notice, read together with the elibraX Terms and Conditions (and any other document those Terms refer to), explains how we gather, handle, use and share your information. This includes any personal data that we collect from you or that you give us through our website (referred to in this notice as the Website). Whenever you get in touch with us through the Website, fill in a form or send us any details using the Website, we will collect, use and share your personal information in the ways set out in this Privacy Notice.

Details of the Data Controller and the Data Protection Officer

The Data Controller is the company that decides why and how personal data is processed. For elibraX, this is Stratum Limitada, registration number 3-200-165880, registered address: Costa Rica, San José, Mata Redonda, Sabana Oeste, twelfth avenue, ninetieth street.

If you have any question about privacy, please send it to us through our support chat on the Website.

What is personal data?

Personal information means data about an "identifiable individual". In other words, it is information that can single you out as a person, either by itself or when it is combined with other data.

The General Data Protection Regulation (GDPR) (EU Regulation 2016/679) describes personal data as any information that relates to a natural person (the data subject) who is identified or can be identified, whether directly or indirectly, by means of an identifier such as a name, an identification number, location data or an online identifier. Put simply, personal information is any information about you that makes it possible to identify you.

This Privacy Notice describes the personal data that we collect and use.

Personal data we collect and process

We receive some personal data directly from you:

1. Information you give us when you sign up:

  • First name and surname;
  • Email address and password (we store only a hashed version of your password, never the password itself).

2. Information you add to your account and when you verify it:

  • Mobile phone number;
  • Date of birth, citizenship and residential address;
  • If we ask you to verify your identity: identity document data, such as the type of document, the country that issued it, its number and expiry date, the MRZ, information stored in the barcodes of the document (this may differ from one document to another) and its security features;
  • If we ask you to verify your identity: facial image data, such as pictures of your face (selfies included), a photo or scan of the face shown on your identity document, screenshots from a video and audio recordings;
  • If we ask you to verify your identity: biometric data, such as the features of your face.

3. When we ask you about your transactions to prevent fraud and misuse of your account:

  • Information needed to show where your funds come from, such as documents, bank statements, spoken explanations and screenshots;
  • Information needed to explain the purpose and economic reason for a transaction;
  • Answers you give in a questionnaire that shows you have the capacity to act and that you understand the consequences of your actions.

4. When you get in touch with us:

  • Your email address for contact;
  • What you write to us, your messages and any files you attach to them;
  • A unique identifier of your conversation or request in our support system;
  • Technical data about your messages (such as the date, time zone, environment and similar details).

5. Transaction information:

  • Details of your wallets (for USD, EUR, USDT, USDC, UUSD and supported cryptocurrencies), your wallet numbers and your unique identifier in the elibraX system;
  • Operations carried out in your account, including spot exchange orders, exchanges between your own wallets, money sent to and received from other elibraX users by wallet number, and crypto payins and payouts, together with the date, time, amount, currencies, the parties involved, any comments sent or received with the operation, blockchain addresses and transaction hashes, the payment method used and technical usage data;
  • If you use our payment tools for businesses: information about your business, the payment tools you have turned on, your API settings and keys (stored in a protected form), Hosted Checkout payments and the mass payout files and records you submit.

6. Information from your device and your logins:

  • IP address, the country and city linked to that IP address, browser type and settings, operating system, device type, time zone, screen size, the environment you use, and the date, time and length of your visit;
  • Login history, including the date and time of each login and the IP address, country and browser used for it;
  • Security settings, such as whether you use 2-step verification with an authenticator app or with codes sent by email (we do not store the codes themselves after they are used);
  • Cookies and similar technologies, as described in the Cookies section below.

We may also receive your personal data from the following third parties:

  • Information we receive from one of our affiliates;
  • Information from payment providers and banking partners;
  • Information from fraud prevention agencies, blockchain analytics providers, credit reference agencies, and government and law enforcement bodies;
  • Information from public sources, such as company registers and websites, when we carry out enhanced due diligence checks.

Legal basis and use of your personal data

We process your personal data only when there is a lawful basis for doing so. Each processing activity relies on one of these legal bases:

  • Performance of a contract that we have with you;
  • Compliance with our legal obligations;
  • Our legitimate interests, with due regard to your rights, interests and reasonable expectations;
  • Your consent.

1. Performance of a contract we enter with you

We process your personal data so that we can provide you with our Services under the Terms and Conditions that you accept when you sign up for elibraX.

We collect your data to open and manage your elibraX account.

We also process your data to keep access to your elibraX account secure, for example when we send you a one-time code by email or check a code from your authenticator app during 2-step verification.

We use your data to carry out the operations you make with your elibraX account, such as exchanging currencies and crypto, moving funds between your own wallets, sending money to other elibraX users, paying in funds to a wallet, or paying out funds.

When you use our payment tools for businesses (such as the API, Hosted Checkout or mass payouts), we process the related data to provide those tools to you. Where this requires working with third parties, you can find more details in the "Disclosure of personal data to third parties" section.

We may send you important messages about our Services, such as login confirmations, alerts about suspicious login attempts and notices about completed operations, and we may provide you with technical support.

We process personal data to help you solve problems you have while using elibraX when you contact our support team through the support chat or by email.

2. Our legal obligation

We process your personal data to meet our legal obligations, in particular those under laws against money laundering and terrorist financing, which require us to check and confirm your identity as part of our KYC (know your customer) procedure.

When you start crypto payins or payouts, we also review the related data to meet AML requirements and apply KYC rules.

We may use your data to support an investigation by a law enforcement authority, or share data when a court order requires it, as the law may oblige us to do.

3. Our legitimate interests

We may use anonymized and aggregated data to understand how Customers use our Services and to assess the quality and ease of use of our product, as well as how well the Website works.

In the same way, we may use your data to tell you about updates to our policies or about new elibraX features.

We use a risk-based approach to evaluate both user profiles and the operations users carry out, and to spot and stop fraud and other illegal activity. For these purposes, we collect, use and keep personal data, including your login history and device data.

When you contact our support team, we keep a record of the conversation. This helps us improve our Services and products, protect our interests if a dispute arises, assess the quality of our staff's work and train them.

4. Your consent

You may choose to receive emails about our Services and allow us to measure how our marketing emails perform and to analyze how our product is used. You can withdraw this consent at any time.

If we ask you to verify your identity, we may ask you to complete a liveness check to confirm that you are a real person and that the documents you provided truly belong to you. For this, you will need to switch on your camera and turn your head so that automated software can analyze the individual features of your face. This analysis is processing of a special category of personal data, and we may carry it out only with your consent. The collection and processing of this data may be performed by a third party that acts as a data processor on our behalf. You can find more about this in the "Disclosure of personal data to third parties" section.

Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, protect your account and understand how the Website is used. When you first visit the Website, a cookie banner lets you accept or refuse cookies that are not strictly necessary, and you can change your choice later through the same cookie banner settings.

How we keep your data secure

We are dedicated to keeping your personal data protected. We use a range of security measures to keep your personal data safe when you enter it on the Website or give it to us in any other way.

We also use encryption and authentication procedures to stop unauthorized access to our systems and to your data. Passwords are stored only in hashed form, and you can protect your account further with 2-step verification by authenticator app or email codes. Your login history, with the IP address, country and browser of each login, is available in your account so that you can spot any access you do not recognize. Only authorized staff may physically enter the places where data is processed and stored, and those places are monitored.

All sensitive information you provide is sent over encrypted connections (TLS, the successor of SSL).

We give access to your personal data only to staff who need it for their work (for example, members of our support team). Every staff member with access to personal data is bound by a confidentiality agreement. We train our staff on a regular basis on how to keep personal data secure and confidential.

Personal data of users who are subject to the GDPR is processed with the safeguards that the GDPR requires.

We keep improving our security procedures so that they follow the best industry standards, which helps us maintain a high level of protection for your personal data.

We also suggest that you follow a few simple rules to stay safe. Do not reuse the same password for accounts on different websites, and always choose a strong password that mixes upper and lower case letters, numbers and symbols. Never share your elibraX password or your 2-step verification codes with anyone. Please keep in mind that our staff will never ask you for your password or codes. If someone claiming to work for elibraX asks for your password or any other login details, do not give them out, and let us know right away through our support chat.

How long we keep your data

We keep your personal data only for as long as we need it for the specific purpose for which it was collected, unless the law requires us to keep it longer. Information collected to meet the requirements of AML laws is kept for 5 years after your account is closed. Once your personal data is no longer needed, or the period set by law has ended, we delete it securely.

Disclosure of personal data to third parties

To provide our Services, we may need to share your data with third parties, such as the following. For each group we explain who they are, why we share data with them and how they are identified.

  1. Financial and banking institutions and payment providers. Why we share: to carry out payins, payouts and payments that you start using our Services, including payments received through our payment tools for businesses. Depending on the payment method chosen by the Customer, payer or buyer, we share the information with the financial institutions that check and process each payment method for approval, validation and settlement. Who: this may differ depending on the payment method, region and requested service.
  2. Blockchain networks and crypto service providers. Why we share: to process your crypto payins and payouts. Please note that blockchain transactions, including addresses and amounts, are recorded on public networks and cannot be changed or deleted by us. Who: this may differ depending on the network and asset.
  3. Third-party analytics providers. Why we share: to collect metrics and information about how you use the Website, including how Customers use our Services ("Usage Data"), so that we can build new features, improve existing ones or plan our sales and marketing, based on our legitimate interest in improving our Services. When we process Usage Data, any personal information is anonymized. The Website may use cookies and other tracking technologies to measure performance and collect metrics, but only in line with the choices you make in the cookie banner. Who: determined case by case; we will list the providers we use in this notice when they are confirmed.
  4. Customer support tool providers. Why we share: to run our support service and keep related requests together, we may use a support or ticket system. Any such provider is bound by contract to keep the processed data secure and intact. Who: determined case by case.
  5. AML analytics and KYC service providers. Why we share: to meet our legal obligations under AML laws and to monitor for fraud, including verifying your identity (if we ask you to) and analyzing and monitoring cryptocurrency transactions. Who: determined case by case and may differ by region.
  6. Email delivery and online survey providers. Why we share: to send you service messages, security codes and, if you agree, offers and news that may interest you. We may also invite you to tell us about your experience with our Services so that we can improve them. Some email providers use technology that shows when you receive and open our emails. You can stop receiving marketing emails by clicking the unsubscribe link in any such email. Who: determined case by case.
  7. Other business partners, suppliers (including, among others, IT and hosting suppliers) and affiliates. Why we share: to perform the contract we have with you, keep our Services running and meet our obligations. Who: determined case by case and may differ depending on your region.
  8. Prospective buyers of our business. Why we share: if we buy, sell or otherwise transfer any business or assets, or in the event of an actual or possible merger or similar business combination, we may pass your data to the new data controller. This processing is based on legitimate interest, because sharing personal data is needed to complete such a transaction. Who: determined case by case.
  9. Courts, law enforcement or government authorities, or other authorized third parties, as the law requires and permits, where the disclosure is reasonably necessary. Why we share: we may disclose your information to meet our legal obligations, to respond to requests related to criminal investigations, alleged or suspected illegal activity, or any other activity that could expose us or other users to legal liability, and to enforce our Website policies and protect our rights, property or safety, or those of others. Who: determined case by case.

Some of our partners and service providers may change over time. We will update this section promptly whenever such an update is possible and reasonable.

Links to other websites

The Website may include links to websites run by third parties. Those websites have their own separate terms of use and privacy policies. Please read their policies before you give any personal data to those websites. We are not responsible or liable for the content or activities of those websites.

Data subject rights

You have the right to control how your personal data is processed:

  • Right to be informed. You have the right to know how and why we process personal data. That is why we publish this Privacy Notice, and we are always happy to answer your questions.
  • Right of access. You can ask us to confirm whether we process your personal data. You can also ask for detailed information about how we collect, process, use, store and share it.
  • Right to rectification. We work to keep the data we hold accurate and up to date. You can always ask us to clarify or correct information that is out of date or wrong. You can also update some of your details yourself on the Personal data page of your account.
  • Right to erasure. You can ask us to delete your personal data by sending a request through our support chat. Please keep in mind that the law requires us to keep some of your personal data, so we cannot remove all of your information from our system. The right to erasure does not apply to that processing. However, we will delete any information we no longer need.
  • Right to restrict and object to processing. You have the right to ask us to limit, or to object to, the processing of your personal data.
  • Right to data portability. You can ask us to send your data to another company that offers similar services, where this is technically possible and not restricted by law. We will send the data in a structured, commonly used and machine-readable format.
  • Right to withdraw consent. Where we have specifically asked for your consent to process your personal data, you can withdraw it at any time by changing your account settings, by changing your choices in the cookie banner, or by telling us through our support chat which consent you are withdrawing. You can stop receiving marketing messages from us by clicking the "unsubscribe" link in any email we send you.
  • Right to complain. You may file a complaint if you believe your rights have been breached. Please see the "Filing a complaint" section below for more details.

We will answer your request within 30 days of receiving it. If we expect it to take longer, we will tell you.

You can use any of the rights described above by contacting us through our support chat. Before we give you any confidential information, we need to make sure that you really are the person you say you are. For example, we may ask you to send the request while signed in to your elibraX account or from the email address linked to it, or, in rare cases, to complete an identity verification.

We will give you the requested data free of charge. However, if a request is clearly unfounded or excessive, in particular because it is repeated, we may charge a reasonable fee that reflects the administrative cost of providing the information or communication or of taking the requested action.

Please note that there may be legal reasons why we are unable to carry out your request.

Filing a complaint

If you are in the EU and believe that your rights have been breached, you can file a complaint with a supervisory authority in the country where you live or work, or where the alleged breach took place. You can find the right supervisory authority on the website of the European Data Protection Board.

Changes to our Privacy Notice

We will publish any future changes to this Privacy Notice on this page and, where appropriate, we will also let you know by email.

Contact

We welcome your questions, comments and requests about this Privacy Notice. Please send them to our data protection team through our support chat on the Website.