Privacy policy

Definitions and scope

Personal data is information relating to an identified or identifiable person. Processing includes collecting, using, storing, sharing and deleting that information. A controller decides the purposes and means of processing; a processor acts on a controller’s instructions. These roles depend on the actual activity, rather than the name placed on a website.

This notice covers browsing and contact requests on https://avenclaro.org. It is not the privacy notice for an exchange, broker, custodian or identity-verification service you may later choose. Before sending sensitive material to another organisation, read its own notice and confirm the contracting entity.

Who to contact

Privacy enquiries about this website should be addressed to Avenclaro at [email protected]. Ask for the responsible legal controller’s identity if it has not been provided before you submit information. The brand name alone is not a statement of financial authorisation or a substitute for identifying the legal operator.

The website should provide the controller’s legal details before personal information is collected in production. Contact requests must not be used as a route to unidentified businesses. If you are uncertain about a recipient, pause your submission and request clarification.

Contact information and enquiry content

A registration or contact request can include your first name, surname, email address, telephone number and the content of your enquiry. Correspondence may include a case reference, your preferred callback time and information needed to resolve a problem. Provide accurate details and avoid including another person’s private information without a lawful reason.

This website does not ask for a wallet recovery phrase, authentication code or API secret. Identity documents and complete payment-card information should not be sent through ordinary email. If an account provider needs verification, it must explain the purpose and offer its own suitable submission channel.

Usage information

Servers and security systems may process an IP address, request time, requested page, browser details and technical error information. The supplied backend also uses network location information for regional presentation, such as currency. An IP-derived location is approximate and should not be treated as proof of residence or nationality.

Technical records support security, diagnosis and operation of the website. They should not be repurposed into an undisclosed advertising profile. The exact production logging configuration must be reviewed by the operator so this notice accurately reflects the deployed service.

Cookies and local storage

Necessary storage can support form operation, security or user interface choices. The actual cookies and browser storage used by the separately installed backend depend on its configuration. Optional analytics or advertising storage must not be activated merely because a user opens the page; any required consent should be obtained before those technologies run.

No optional analytics identifier is configured in the delivered website. Browser settings can remove stored information or restrict cookies, although some functions may be affected. If the operator later adds optional tools, it must publish the relevant details and provide appropriate controls before enabling them.

Purposes of processing

Contact information is used to respond to your request, discuss onboarding, investigate a reported problem and maintain a record of the response. Technical data can be used to keep the service available and detect abuse. Information may also be needed to comply with a lawful requirement or establish, exercise or defend a legal claim.

A request for account information is not an instruction to trade. It does not justify unrelated marketing or transferring your details to a provider you have not been told about. If the purpose changes materially, the responsible organisation must assess the legal basis and provide the necessary information before further processing.

Legal bases under the GDPR

Responding to a request made before a contract can rely on the steps you ask to take towards that contract, where applicable. Legitimate interests may support proportionate security and enquiry administration, subject to your rights and reasonable expectations. A legal obligation applies only where a specific requirement actually binds the responsible controller.

Optional direct marketing may require consent or another legally permitted basis under applicable electronic-communications rules. Consent must be distinguishable from a mandatory condition of a simple enquiry and can be withdrawn. The operator should document which basis applies to each purpose rather than treating all possible bases as interchangeable.

Retention and deletion

Routine enquiries should be kept only while the request remains active and for a justified follow-up period. Security logs should have a shorter, purpose-based retention period unless an incident requires preservation. A complaint or legal claim can justify retaining relevant evidence for longer. There is no verified universal retention schedule for the separately installed backend in the supplied package.

Before production collection, the controller must set and disclose the actual periods or clear criteria for contact records, technical logs and complaint files. Financial providers may have statutory retention duties for identity and transaction records; those duties do not automatically apply to every marketing enquiry. You can ask how long your particular record will be retained and why.

Recipients and disclosure

Access should be limited to personnel and suppliers who need it for the stated purpose, such as hosting, communications, security and enquiry handling. A lawful authority may receive information where disclosure is required and valid. Sharing with a financial provider must be explained before it happens, including the provider’s identity and whether it acts as a separate controller.

No named commercial partner has been verified for this website. Do not infer a data-sharing relationship from a market logo or educational reference. The operator must check recipient arrangements and appropriate processor contracts rather than allowing unrestricted onward distribution of contact details.

International processing

Where a supplier processes data outside the European Economic Area, the responsible controller must assess whether an adequacy decision or another permitted safeguard applies. This can include contractual safeguards and an assessment of the circumstances of the transfer. The existence of an overseas server is not, by itself, an explanation of the legal mechanism.

Ask for information about the locations and safeguards relevant to your data. The delivered package does not identify the final hosting or communications suppliers, so it does not assert that all processing takes place in Ireland. Those operational details must be confirmed before collection begins.

Security

Appropriate access controls, secure transport, software maintenance and incident procedures should protect information against unauthorised use or disclosure. No online system can promise absolute security. The actual protection depends on the production hosting, backend and supplier configuration, not just the appearance of the form.

Use the HTTPS address and avoid sharing sensitive information in a general message. If you believe information has been exposed, contact [email protected] with a safe description and relevant timestamps. Do not send another unnecessary copy of the exposed material.

Your rights

Subject to the conditions in data-protection law, you can request access, correction, erasure, restriction and portability, and object to certain processing. You can withdraw consent where processing relies on it without affecting earlier lawful processing. Some requests may be limited by a legal obligation or the need to protect another person’s rights.

Send a request to the contact address above and identify the record or interaction concerned. Proportionate identity confirmation may be necessary. The GDPR generally requires a response within one month, with a permitted extension for complex or multiple requests when the required explanation is provided. You may complain to Ireland’s Data Protection Commission.

Suppliers, analytics and advertising

Hosting and enquiry-handling suppliers may process data necessary to provide their services. They should receive documented instructions and appropriate access limits. The supplied site includes an inactive Google Analytics configuration slot; it makes no analytics request while its identifier is empty. Activating it requires a separate review of consent, configuration and notice content.

No advertising or retargeting integration is included in the site’s own code. The operator must inspect the separately installed backend and any later additions for tracking behaviour. Adding a script later does not automatically bring that processing within the purposes described here.

External links and children

External sites apply their own privacy practices. A map, if enabled after the office address is verified, can send technical information to its external provider when loaded. Review the relevant provider notice before interacting. This website’s policy does not control a third party’s handling of information.

The service is intended for adults and does not invite children to submit account requests. If you believe a child has supplied personal information, contact support with enough detail to locate the record. Avoid sending additional sensitive information about the child unless it is needed through an agreed secure process.

Changes and further questions

Updates should reflect changes in processing, suppliers or legal requirements. The publication date identifies this version, and material changes should be communicated appropriately. A revised notice cannot retrospectively justify an undisclosed use of information.

Contact [email protected] for clarification, a rights request or a concern about a referral. Keep a copy of the notice and any consent wording relevant to your interaction. The Complaints page explains how to request a formal review of an unresolved service issue.