Privacy Policy

Definitions

In this policy, "personal data" means information relating to an identified or identifiable person; "processing" means anything we do with it (collecting, storing, reading, sharing, deleting); "controller" means the party deciding why and how data is processed; "processor" means a party processing data on the controller's instructions. Murravyn (trading name, 26 Fitzwilliam Square, Dublin 2, D02 XY45, Ireland) is the controller for the data described here, unless a specific section says otherwise.

Personal data we collect

We collect the data needed to open and run an account and to answer you: name and surname, email address, phone number, and, when you proceed to verification, date of birth, residential address, identity document details and the document images themselves, plus a selfie or liveness capture where the check requires one. When you send us a query, we keep the content of your request and our replies. If you visit the site without registering, the technical data described two sections below is collected in anonymised or short-lived form, and no profile of you is built.

Usage data

When you use the site, our servers record technical usage data: the pages visited, the approximate location derived from your IP address, browser type and device category, the referring page and timestamps. This data keeps the service secure (spotting attack patterns), lets us fix defects (which pages fail) and gives us aggregate statistics (which guides are read). Usage data is stored in identifiable form for a short period and then aggregated or deleted; it is not combined with your account data for marketing decisions.

Cookies

The site uses strictly necessary cookies to keep your session working and your login secure, and analytics cookies that measure aggregate traffic once a measurement ID is configured. Marketing cookies are used only if you consent, and consent can be withdrawn at any time from the cookie settings linked in the footer banner. You can also block or delete cookies in your browser, though blocking the necessary ones will break sign-in. This paragraph is a summary: the cookie table in the banner lists every individual cookie with its purpose and lifetime.

Controller and processors

Murravyn is the controller of your personal data. To deliver the service we use processors acting on our instructions under written data-processing agreements: identity verification providers, IT hosting and email delivery providers, analytics tooling and support desk software. Processors may not use your data for their own purposes, are bound by security obligations, and are audited or certified as appropriate to what they do for us. Where execution of trading services involves licensed counterparties, those entities act as controllers of the data they must collect under their own regulatory duties.

How your information is used

Your data is used to: create and administer your account; verify your identity under the AML/KYC policy; provide, maintain and secure the platform; process deposits and withdrawals; respond to your questions and complaints; meet legal obligations that apply to us, including tax and anti-money-laundering duties; improve the service using aggregate statistics; and, only with your consent, send you marketing. Each use maps to a purpose in the lawful-basis section below; there is no hidden purpose, and we do not sell personal data.

Legal bases (GDPR)

Processing rests on four bases, used as follows. Contract (Article 6(1)(b)): account creation, onboarding, executing your instructions, payments and support, because these are necessary to provide the service you asked for. Legal obligation (Article 6(1)(c)): identity checks, record-keeping and reporting required by applicable Irish and European law. Legitimate interests (Article 6(1)(f)): keeping the platform secure, preventing fraud, diagnosing defects and aggregate analytics, each assessed against your rights and documented. Consent (Article 6(1)(a)): marketing emails, optional analytics cookies and any liveness biometric check, each with a separate, withdrawable consent. Where special-category data such as biometrics is processed for verification, the additional condition in Article 9(2)(a) (explicit consent) applies.

How long data is kept

Retention follows purpose, not convenience. Account and verification records are kept for the period required by applicable Irish anti-money-laundering law after the account closes, generally five years or such longer period as required. Transaction and payment records follow tax and accounting retention rules. Support correspondence is kept for up to three years after the last message, and complaint files for the period needed to document the outcome. Usage data in identifiable form is kept for months, not years, then aggregated. Marketing consent records are kept while the consent is active plus a proof period. When a period expires, the data is deleted or irreversibly anonymised.

Transfers of data

Your data is primarily processed in Ireland and the European Economic Area. Some processors operate global infrastructure; where data may be accessed from outside the EEA, transfers rely on adequacy decisions or the European Commission's standard contractual clauses, supplemented by additional technical measures where needed. A current list of processor categories and transfer mechanisms is available on request through the contact details at the end of this page, and material changes to where data is processed are reflected here before they take effect.

Disclosure of data

We disclose personal data only to: processors listed in the controller section acting on instruction; licensed counterparties involved in executing your transactions, to the extent they must verify you themselves; professional advisers (legal, audit) under confidentiality; and regulators, An Garda Síochána or other competent authorities where the law requires or permits. We do not disclose data to advertisers, data brokers or social platforms, and there is no sale of personal data, full stop. Court orders are honoured where valid under Irish law, and we notify you when lawfully possible.

Security of processing

Technical and organisational measures protect your data: encryption in transit and at rest, access control by role with logged access, segregation of verification records, network protections and monitoring, and staff trained in handling personal data. No system is perfect, so we also practise the boring half of security: patching schedules, backups with restricted restore rights, and incident procedures that include telling affected users and the competent authority within statutory deadlines where a breach meets the threshold. The security page describes the account-level protections you control yourself.

Your rights as a data subject

You have the right to access your data and receive a copy; to have inaccurate data corrected; to have data deleted where no overriding obligation requires keeping it; to restrict processing while a dispute over accuracy or lawful basis is resolved; to object to processing based on legitimate interests, including profiling within analytics; to withdraw consent at any time where consent is the basis; to data portability for data you provided on a contract basis; and to lodge a complaint with the Data Protection Commission, the Irish supervisory authority. We respond to requests within one month, extendable by two months for complex cases with notice, and identification precedes disclosure, for obvious reasons.

Service providers

The processors we rely on include: identity verification and document-check services; cloud hosting and managed database providers; email delivery services; the support desk and ticketing platform; analytics services active only with consent; and payment processors invoked by the deposit and withdrawal methods described on the payments page. Each operates under a data-processing agreement, processes only what its task needs, and is listed with enough particularity for you to ask us about any of them.

Analytics

Aggregate analytics answer questions like "did the new guide help people finish registration?" Without consent, we use only server-side counts that are not linked to your identity. With consent, measurement cookies provide richer aggregate statistics. Analytics never triggers individual pricing, never feeds trading decisions and is never used to build profiles sold or shared outside the platform. The measurement identifier slot is configured to stay inactive until the site owner sets it, and you can verify in your browser that no analytics cookies load before you agree to them.

Advertising and retargeting

We do not run third-party advertising trackers on the site. If marketing campaigns ever bring you here from an ad platform, the link parameters measure the campaign in aggregate only, and you can strip them without losing site functionality. Retargeting pixels are not used, and there is no sharing of your on-site behaviour with advertising platforms. Should the marketing approach change, this section changes first, and never backwards: new tracking begins only after consent where the law requires it.

Links to third-party websites

Our pages link to third-party sites for reference: regulators' public registers, payment providers' help pages, exchanges' documentation. Once you follow such a link, this policy no longer applies, and the destination's own policy governs. We choose links that are useful and stable, but we do not audit third parties' data practices on your behalf, and you should read their policies where you interact with them.

Children's privacy

The platform is intended for adults. Accounts are available only to people aged eighteen or over, and onboarding verification makes underage registration effectively impossible. We do not knowingly collect data from children; if we learn that data belonging to a child was provided, we delete it promptly. Parents or guardians who believe a child gave us information can write to [email protected] and the matter is treated as a priority.

Changes to this policy

This policy may be updated to reflect changes in the service, our processors or the law. The current version is always the one published on this page, and it applies from the moment of publication; material changes are additionally announced inside the platform before they take effect, and where a change requires new consent, we ask for it rather than assume it. Earlier versions are available on request so you can see exactly what changed and when.

Contact us

Questions, data-subject requests and complaints about privacy go to [email protected], subject line "Privacy", or by post to 26 Fitzwilliam Square, Dublin 2, D02 XY45, Ireland. Our support hours are Monday to Friday, 9:00–17:30 GMT (excluding public holidays), and privacy requests are handled by the Client Support & Compliance department. If you are unhappy with our answer, you can escalate to the Data Protection Commission, and nothing in this policy limits your right to do so.