Introduction
In this notice, “TracePointVault”, “we”, “us” and “our” refer to the operator of the website and services. The legal identity and registered address of the operator should be inserted here before this policy is published. “You” means a visitor, prospective client or client whose information we process.
This policy describes the types of information we may receive when you browse the website, contact us, submit a case assessment request, create an account or communicate with our team. The information actually processed depends on the features you use and the services the operator genuinely provides.
Important: Case assessment, open-source research and transaction tracing may help organise information about a suspected fraud, but do not guarantee that funds can be located, frozen or recovered. Do not send passwords, private keys, wallet seed phrases or additional money to anyone promising guaranteed recovery.
Where UK data-protection law applies, processing must have an appropriate lawful basis and meet the relevant transparency, purpose-limitation, data-minimisation, retention and security requirements. See the UK Information Commissioner's guidance and the Data Protection Act 2018. ICO guidance · Data Protection Act 2018.
Definitions
Data We May Collect
Depending on the website features you use and the details you choose to provide, we may process the following categories. Remove any category that the live website does not collect, and add any actual collection methods not listed here.
| Category | Examples | Possible purpose |
|---|---|---|
| Contact details | Name, email address, telephone number, country or preferred contact method | Responding to enquiries and communicating about a request |
| Case details | Description of events, dates, alleged platform or company names, communications and supporting documents | Initial review, case organisation and explaining possible next steps |
| Transaction information | Payment receipts, bank-transfer references, transaction IDs, public wallet addresses and amounts you report | Organising information for possible tracing or referral |
| Identity information | Identity documents or verification details, only if the service actually requests them | Identity checks where necessary and lawful |
| Technical information | IP address, browser and device information, access logs and security events | Website operation, troubleshooting and abuse prevention |
| Communications | Emails, support messages, contact-form submissions and chat history | Responding, maintaining records and resolving disputes |
Please submit only information relevant to your enquiry. Where possible, redact unrelated account numbers, full card numbers and third-party personal information. Never submit passwords, authentication codes, private keys or seed phrases.
How We May Use Data
Subject to the actual services offered and an applicable lawful basis, personal information may be used to:
- Review enquiriesRead the information you provide and determine whether it is suitable for an initial case assessment.
- Organise case materialRecord reported events and organise relevant documents or public transaction data for review.
- Communicate with youAnswer questions, request relevant information and provide service-related updates.
- Protect the websiteMonitor for misuse, investigate security incidents and maintain technical reliability.
- Handle legal mattersEstablish, exercise or defend legal claims, or respond to valid legal obligations where applicable.
- Improve the serviceUnderstand website performance and improve content, where lawful and proportionate.
Lawful Basis for Processing
If UK GDPR applies, each processing purpose must have a lawful basis that fits the actual circumstances. Potential bases include the following; this list is not a statement that every basis applies to every activity.
| Possible basis | Example where applicable |
|---|---|
| Contract or pre-contract steps | Taking steps at your request before entering into an agreement, or performing an agreement with you. |
| Legitimate interests | Proportionate website security, record management or handling and responding to enquiries, after considering individuals' rights. |
| Legal obligation | Processing required by a law that actually applies to the operator. |
| Consent | Optional processing where consent is the appropriate basis, such as certain non-essential cookies or marketing activities. |
| Vital interests or public task | Only where the specific legal conditions for that basis are met; these are not routine default bases for a private business. |
For each purpose, the operator should document the selected basis and, where legitimate interests are relied on, identify those interests. Consent should not be described as the basis for all processing by default.
Data Sharing and Disclosure
Personal information may be shared only where necessary, appropriate and lawful. Depending on the case and the services actually provided, recipients may include:
- Technology providersHosting, security, email, support or case-management providers that help operate the website, under suitable contractual and security arrangements.
- Financial institutions or platformsA bank, payment provider or digital-asset platform only where there is a genuine and lawful reason to contact it; do not imply that it will act on a request or return funds.
- Professional advisersLegal or other professional advisers where reasonably necessary and appropriately protected.
- AuthoritiesPublic authorities, regulators or law-enforcement bodies where disclosure is legally required or otherwise lawful.
Insert the actual names or meaningful categories of providers and recipients required for transparency. Do not claim that all recipients are under confidentiality agreements unless you have verified the relevant contracts.
Data Retention
Personal information should be kept only for as long as needed for the documented purpose, taking account of legal requirements, disputes, security needs and limitation periods that genuinely apply. The operator should establish and follow a retention schedule rather than publish arbitrary periods.
| Data type | Retention approach |
|---|---|
| Enquiries and case records | Keep while the enquiry or case is active, then review for deletion or restricted retention based on documented legal and operational needs. |
| Identity documents | Collect only where necessary; limit access and define a specific retention period based on the actual purpose and applicable law. |
| Payment and accounting records | Retain for the period required by the accounting, tax or other laws that apply to the operator. |
| Security and access logs | Retain for a documented period proportionate to security and investigation needs. |
| Support messages | Retain while needed to respond, manage a case or resolve a dispute, then review for deletion. |
Before publication, replace these criteria with your real retention periods or a clear explanation of how you determine them. When data is no longer needed, it should be securely deleted or irreversibly anonymised where appropriate.
Your Rights
Where applicable data-protection law grants you rights, you may be able to:
- AccessAsk whether personal data about you is being processed and request access to it.
- RectificationAsk for inaccurate personal data to be corrected or incomplete data to be completed.
- ErasureRequest deletion in circumstances where the law provides this right; some records may need to be retained lawfully.
- RestrictionAsk for certain processing to be restricted in specified circumstances.
- PortabilityReceive certain information in a structured, commonly used, machine-readable format where the legal conditions are met.
- ObjectObject to processing based on legitimate interests or direct marketing, subject to the applicable rules.
- ComplainRaise a concern with the relevant data-protection supervisory authority if you believe your information has been handled unlawfully.
Rights depend on the law that applies and are subject to exceptions. If UK data-protection law applies, information about making a complaint is available from the Information Commissioner's Office (ICO). Do not publish a guaranteed response deadline unless your process can meet the applicable legal requirements.
Cookies and Similar Technologies
The website may use essential technologies needed for core functionality, security or session management. If analytics, embedded media, live chat, advertising or other non-essential technologies are enabled, explain what they do and obtain consent where required by applicable law.
| Type | Possible purpose | Action needed |
|---|---|---|
| Essential | Session handling, security and basic site functions | Document the actual cookies and why they are necessary. |
| Preference | Remembering language or theme settings | Confirm what is stored and how long it remains. |
| Analytics | Understanding visits and page performance | List the tool and apply required consent controls. |
| Third-party embeds or chat | Video, maps, support chat or other embedded functions | Identify providers and explain any resulting data transfers. |
You can also manage cookies through your browser settings. Browser controls may not replace consent mechanisms required by law. Audit the live site before leaving any cookie category in this policy.
Security
The operator should use technical and organisational safeguards appropriate to the type and sensitivity of the information it actually handles. These may include access restrictions, software updates, secure configuration, backups, staff guidance, logging and an incident-response process.
No website or transmission method can be guaranteed completely secure. Do not claim specific encryption standards, routine security audits, 2FA availability or a certified security programme unless you have confirmed those controls are implemented. Report personal-data breaches to authorities or affected individuals when and as required by applicable law; the reporting rules and deadlines depend on the circumstances.
International Data Transfers
If personal data is accessed or transferred across borders, the operator should identify the countries and providers involved and apply the safeguards required by the applicable law. Where UK GDPR applies, an international transfer may require an adequacy regulation or another valid transfer mechanism and, where applicable, additional assessment and safeguards.
Confirm your hosting location, email provider, support-chat provider, analytics tools and any other service that can access personal information. Do not state that a specific transfer safeguard is in place until it has been checked.
Changes to This Policy
This policy may be updated when the website, services, providers or legal requirements change. The revised version should show its updated date. Where required by law or where a change materially affects users, the operator should provide an appropriate notice or obtain consent as applicable.
Do not rely on a blanket statement that continued use always constitutes consent to any change. Review the notice periodically and keep a record of material versions where appropriate.
Contact and Privacy Requests
Use the contact details below to ask about this policy or make a privacy request. Replace every placeholder with accurate details for the entity that actually operates the website. Do not identify a person as a Data Protection Officer unless that appointment has been made and is appropriate.