Privacy Policy

AssetTrace helps victims of online investment fraud and crypto-related crime through blockchain analysis, evidence reporting, and coordination with counsel and law enforcement toward asset recovery. Asset tracing and recovery support is a non-regulated service: it is not licensed, it is not a guarantee, and no recovery outcome can be promised. We never take custody of client funds or crypto-assets. This policy covers personal data processed when you visit our website, submit a case for review, or engage our services through ForFarmers Nederland BV (Netherlands).

• Identity — your name and the jurisdiction you contact us from.
• Contact details — email address and telephone number.
• Case context — your free-text description, transaction hashes, wallet addresses, exchange names, and loss figures.
• Documents — screenshots, correspondence, or reports you choose to upload.
• Technical metadata — hashed IP address, browser/device type, and language preference.

By default we use privacy-respecting, cookieless analytics (Plausible, self-hosted) that record aggregate visit metrics without storing your IP address or any personally identifiable information. See our Cookie & Tracker Notice for detail.

Assessing your enquiry

Article 6(1)(f) GDPR — our legitimate interest in evaluating prospective engagements (Recital 47; fraud prevention).

Delivering an engagement

Article 6(1)(b) GDPR — performance of a contract once you sign an engagement letter with ForFarmers Nederland BV.

Processing payments

Article 6(1)(b)/(c) GDPR — performance of a contract and compliance with legal obligations, where payments are handled by Real Transfer Limited (United Kingdom).

Advertising measurement

Article 6(1)(a) GDPR — your consent, for the Meta pixel and Conversions API, given via our cookie banner and withdrawable at any time.

Legal & regulatory compliance

Article 6(1)(c) GDPR — compliance with a legal obligation to which we are subject.

Sanctions & integrity screening

Article 6(1)(f) GDPR, and Article 9(2)(f)/(g) where special-category data is strictly necessary to establish or defend legal claims or for reasons of substantial public interest.

We do not sell or rent personal data, and we do not use it for unrelated marketing without your explicit consent.

• Authorised personnel within ForFarmers Nederland BV operating the AssetTrace brand, bound by confidentiality.
• Real Transfer Limited (United Kingdom) as payments processor, for handling any payments you make.
• Vetted sub-processors (cloud hosting, secure storage, communications) under Article 28 GDPR data-processing agreements.
• Meta Platforms Ireland Limited, only where you have accepted marketing/analytics cookies, for advertising measurement.
• Counsel or law-enforcement agencies, on your instruction or where legally compelled.
• Regulatory or judicial authorities in response to lawful requests.

We never disclose client case data for advertising or resale. In the event of a merger or acquisition, personal data transfers only under continued confidentiality and equivalent protection.

Where a sub-processor or recipient — including Real Transfer Limited (United Kingdom) and Meta Platforms Ireland Limited — operates outside the EEA, transfers rely on European Commission adequacy decisions (the United Kingdom benefits from a UK adequacy decision) or on Standard Contractual Clauses with supplementary technical and organisational measures.

Lead PII

36 months from last activity

Engagement files

Per the engagement letter & any legal hold

Audit-log records

7 years

We delete or anonymise data once its purpose is fulfilled, unless a legal obligation requires longer storage.

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion where permitted by law.
• Restriction — limit how we process your data.
• Objection — object to processing based on legitimate interests.
• Portability — receive your data in a portable format.
• Withdraw consent — at any time, without affecting prior processing.
• Complain — to the Dutch Autoriteit Persoonsgegevens or your local supervisory authority (see below).

To exercise any right, email [email protected]. We may verify your identity first and will respond within one month (Article 12(3) GDPR).

• Encryption in transit (TLS) and at rest.
• Role-based access control with multi-factor authentication.
• EU-resident, KMS-managed encryption keys.
• Least-privilege access and continuous monitoring for unauthorised access.

ISO 27001 certification is targeted for Q4 2026. While no system is entirely risk-free, we continuously review and strengthen our safeguards.

Our services are not directed to individuals under the age of 18. If we learn that we have collected a minor’s personal data without parental consent, we will delete it promptly.

For individuals in the United Kingdom, we process personal data under the UK GDPR and the Data Protection Act 2018; the relevant supervisory authority is the Information Commissioner’s Office (ICO). Payments to UK-based users are processed by Real Transfer Limited (Belfast, United Kingdom), a DNB-registered payment institution (relation R124476). Our EU and UK representative details are published in our compliance disclosure.