Privacy Notice | Black Sea Exchange

This Privacy Notice explains how BLACK SEA EXCHANGE S.R.L. processes the personal data of visitors to the website blacksea.exchange, of the persons who contact us and of the participants in BSX events, in accordance with Regulation (EU) 2016/679 (GDPR). Account creation, company onboarding and trading take place on the BSX Platform (blackseaexchange.app) and are described in the Platform Privacy Notice.

1. Who is the controller

Table: swipe or scroll horizontally to view all columns.

Item	Details
Controller	BLACK SEA EXCHANGE S.R.L. (BSX), Strada Luminii nr. 43, Sat Zănești, Comuna Zănești, Județ Neamț, Romania; Trade Register no. J2026054382006; CUI 55586455
General contact	info@blacksea.exchange
Privacy contact	privacy@blacksea.exchange

2. What data we process, why and on what legal basis

Table: swipe or scroll horizontally to view all columns.

Situation	Data	Purpose and legal basis	Retention
Visiting the Website	IP address, browser and device data, pages requested, date and time (technical logs)	Delivering the Website, security and protection against attacks – legitimate interest, Art. 6(1)(f) GDPR	Up to 30 days, unless needed for investigating an incident
Contact by e-mail (info@ or the addresses of the BSX team)	Name, e-mail address, company, position, telephone, content of the message and attachments	Answering your request and, where applicable, taking steps before a contract – Art. 6(1)(b) and (f) GDPR	2 years from the last exchange, unless a contractual relationship follows
Contact via WhatsApp	Telephone number, WhatsApp name and profile picture, content of the messages	Answering your request – legitimate interest, Art. 6(1)(f) GDPR	2 years from the last exchange
Viewing the event video	Data collected by YouTube after you press play	Displaying the video at your request; YouTube (Google) acts as an independent controller	According to the Google policy
Participating in BSX events (e.g. BBS Grain 2026)	Photos and video recordings	Promoting BSX activities: individual images (portraits, close-ups) – your consent, Art. 6(1)(a) GDPR; general images of the event – legitimate interest, Art. 6(1)(f) GDPR, with the right to object	While published on the Website and BSX channels, up to 3 years from the event, or until consent is withdrawn
Newsletter / commercial communications (only if introduced)	E-mail address, name, company	Sending news about BSX – your consent, Art. 6(1)(a) GDPR, with double opt-in and an unsubscribe link in every message	Until unsubscription

Please do not send confidential documents (identity documents, company or bank documents) by e-mail or WhatsApp. These are submitted only through the BSX Platform. The Website has no contact forms and does not use analytics or advertising cookies.

2.1 Event photos and videos

At events, BSX informs participants about photography and filming before the event and on site. Individual images are published only with the consent of the person concerned. If you appear in a photo or video published by BSX and want it removed, write to privacy@blacksea.exchange and we will remove the image without undue delay. You have the right to your own image under Article 73 of the Romanian Civil Code.

2.2 BSX team members presented on the Website

The names, positions and business contact details of the BSX management are published on the Website on the basis of BSX's legitimate interest in enabling business contact, with the knowledge of the persons concerned.

3. Who receives the data

Table: swipe or scroll horizontally to view all columns.

Recipient	Role	Location and safeguard
OpenAI Sites	Website publishing and hosting infrastructure (processor)	EU / USA – applicable contractual safeguards, including standard contractual clauses where required
Cloudflare	Network delivery and security (processor)	USA / EU – EU-US Data Privacy Framework, standard contractual clauses
Hostinger	E-mail hosting (processor)	EU and other locations under the applicable data-processing agreement and contractual safeguards
WhatsApp (Meta)	Messaging service; WhatsApp Ireland Ltd. acts as an independent controller	EU / USA – according to the WhatsApp policy
YouTube (Google)	Video hosting; Google Ireland Ltd. acts as an independent controller, only after you press play	EU / USA – according to the Google policy
Public authorities	Only where required by law	Romania

BSX does not sell personal data and does not use it for advertising.

4. Transfers outside the EEA

Some providers may process data in the United States. In such cases, the transfer is based on the EU-US Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the European Commission. You may request information about these safeguards at privacy@blacksea.exchange.

5. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object at any time to processing based on legitimate interest and to withdraw your consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal. BSX does not take automated decisions about the visitors of the Website.

Requests are sent to privacy@blacksea.exchange; we respond within one month, which may be extended by two months for complex requests. You may lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro.

6. Security

The Website is served exclusively over an encrypted connection (HTTPS), is protected against attacks by Cloudflare and does not collect data through forms. Access to the BSX mailboxes is restricted to authorised staff.

7. Cookies

Information about cookies is available in the Website Cookie Policy.

8. Changes and language

This Notice may be updated; the current version is published on the Website with its version number and effective date. It may also be made available in other languages; in the event of any discrepancy, the English version prevails.