Privacy policy

1. Controller and scope

The data controller for this site and the exchange services is Mertin Industries Inc., Republic of Panama, registered office at SL-55 Building, 31st Floor, Samuel Lewis Ave. & 55 East St., Obarrio, Panama City, Republic of Panama.

This policy covers account, organization, marketplace, agent, contact and technical data processed through MXTK Data Exchange. For a dataset uploaded by a seller, the seller is responsible for the source and the legal basis; the exchange processes the dataset only to screen, host, deliver and evidence the transaction. De-identified data is not treated as personal data where the de-identification is effective and the data cannot be re-associated with an individual.

This policy does not cover a third-party site, a buyer's systems, or a seller's own processing outside the exchange.

2. Data we collect

We do not ask for special-category data in account profiles and we prohibit identifiable data, including protected health information, in uploads.

3. Purposes and lawful bases

We process personal data to perform our contract with you, take pre-contract steps at your request, comply with legal obligations, protect our legitimate interests in operating a secure marketplace, and with your consent where required.

• Contract: account, listing, deal, delivery, support and agent access.
• Legal obligation: KYC/KYB, sanctions, AML, tax, audit, court orders and regulatory requests.
• Legitimate interests: security, fraud prevention, service improvement, legal claims and protecting users.
• Consent: optional communications or cookies where consent is required; you may withdraw it at any time.

We do not sell personal data. We do not use seller-uploaded datasets to train our own models.

4. De-identified data and seller responsibility

MXTK Data Exchange is for de-identified data only. Sellers attest to their de-identification method before upload, and the platform screens for direct identifiers. Screening is a fail-safe, not a legal opinion or a guarantee. Sellers must have a lawful basis and the right to license the data.

If you believe a dataset contains identifiable data, contact privacy@mxtktoken.com immediately; we will restrict access and investigate.

5. Sharing and subprocessors

We share personal data with service providers that help us operate the exchange: cloud hosting and object storage, email delivery, payment processing, identity/KYC and sanctions screening (including the NeoBank program), security monitoring, support and professional advisers. They are bound by contract and process data on our instructions.

We may disclose data where required by law, to protect rights or safety, to enforce our terms, or in a corporate transaction with appropriate safeguards. A production deployment will publish a subprocessor list with locations and purposes. We do not sell personal data or share it for cross-context behavioral advertising.

6. International transfers

The controller is in Panama. Our service providers may process data in the United States and other jurisdictions. Where required, we use appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and we assess the law of the recipient jurisdiction.

7. Retention

• Account and marketplace records: while the account is active plus seven years for audit, tax, dispute and legal obligations.
• KYC/KYB and sanctions records: as required by the NeoBank program and applicable law, generally the relationship plus seven years.
• Failed uploads: the staging object is deleted after the screening audit is written; the audit record is retained.
• Server logs: ninety days in identifiable form, then truncated or hashed.
• Contact and seller intake: two years after the last substantive contact, unless needed for a claim.

A production retention schedule will define periods by category and jurisdiction.

8. Security

We use access controls, private staging, audit logging, encryption in deployment and vendor controls. No service is perfectly secure. See the security program for the controls and limitations.

9. Your rights

Depending on your jurisdiction, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent. You may also complain to your supervisory authority. Send requests to privacy@mxtktoken.com; we may verify your identity and authority to act for an organization. We respond within 30 days where required, with an extension where the law permits.

California residents have the rights described in the CCPA/CPRA, including know, delete, correct, limit sensitive data and non-discrimination. We do not sell or share personal data within the meaning of the CCPA.

10. Cookies

The portal uses a server-side session cookie to keep you signed in. It is HttpOnly, SameSite=Lax and expires after seven days. We do not currently set advertising, retargeting or third-party analytics cookies. If we add analytics, we will update this policy and, where required, ask for consent.

11. Children

The exchange is for organizations and authorized personnel. It is not directed at anyone under 18, and we do not knowingly collect data from children.

12. Changes and contact

We may update this policy as the service or law changes. Material changes will be posted with a new date. Privacy questions and rights requests: privacy@mxtktoken.com. Postal: Mertin Industries Inc., SL-55 Building, 31st Floor, Samuel Lewis Ave. & 55 East St., Obarrio, Panama City, Republic of Panama.

Operator details

Mertin Industries Inc. · SL-55 Building, 31st Floor, Samuel Lewis Ave. & 55 East St., Obarrio, Panama City, Republic of Panama.
Legal: legal@mxtktoken.com · Privacy: privacy@mxtktoken.com · Security: security@mxtktoken.com