My review of xace.io

[JohnnyDoe]

I have never opened an account with them. There is no AML law to apply.

 

[ilke]

I have never opened an account with them. There is no AML law to apply.

Not actually how it works, you don't need an activated account for the law to begin applying. It starts with you providing any KYC/AML related information and requesting to initiate a business relationship; I touched on that in my main comment as well.

 

[JohnnyDoe]

Not actually how it works, you don't need an activated account for the law to begin applying. It starts with you providing any KYC/AML related information and requesting to initiate a business relationship; I touched on that in my main comment as well.

Let them explain this to me in their reply.

 

[JohnnyDoe]

They answered with this:

Thank you for submitting your Data Subject Access Request (DSAR) & invoking your right to be forgotten. We have received your request and are currently processing it in accordance with the General Data Protection Regulation (GDPR).

Verification of Identity

To ensure the security and confidentiality of your data, we may need to verify your identity further as we process your request. If required, we will contact you with details on the specific information or documentation needed to confirm your identity.

Processing Your Request

We aim to provide a response within 30 days under GDPR. If additional time is required due to the complexity of your request or the need for further verification, we will notify you and explain the reason for the extension.

What Happens Next?

• If further information is required, we will contact you promptly.
• Once verification is complete, we will provide you with the requested data or notify you if your request cannot be fulfilled for any legal or technical reasons.

If you have any additional information or clarifications about your request, please feel free to contact us via email [email protected].

We appreciate your patience and understanding as we ensure the secure and compliant handling of your request.

 

[avalanche]

They answered with this:

Thank you for submitting your Data Subject Access Request (DSAR) & invoking your right to be forgotten. We have received your request and are currently processing it in accordance with the General Data Protection Regulation (GDPR).

Verification of Identity

To ensure the security and confidentiality of your data, we may need to verify your identity further as we process your request. If required, we will contact you with details on the specific information or documentation needed to confirm your identity.

Processing Your Request

We aim to provide a response within 30 days under GDPR. If additional time is required due to the complexity of your request or the need for further verification, we will notify you and explain the reason for the extension.

What Happens Next?

• If further information is required, we will contact you promptly.
• Once verification is complete, we will provide you with the requested data or notify you if your request cannot be fulfilled for any legal or technical reasons.

If you have any additional information or clarifications about your request, please feel free to contact us via email [email protected].

We appreciate your patience and understanding as we ensure the secure and compliant handling of your request.

Sounds like bureaucracy wall

 

[diro]

They answered with this:

Thank you for submitting your Data Subject Access Request (DSAR) & invoking your right to be forgotten. We have received your request and are currently processing it in accordance with the General Data Protection Regulation (GDPR).

Verification of Identity

To ensure the security and confidentiality of your data, we may need to verify your identity further as we process your request. If required, we will contact you with details on the specific information or documentation needed to confirm your identity.

Processing Your Request

We aim to provide a response within 30 days under GDPR. If additional time is required due to the complexity of your request or the need for further verification, we will notify you and explain the reason for the extension.

What Happens Next?

• If further information is required, we will contact you promptly.
• Once verification is complete, we will provide you with the requested data or notify you if your request cannot be fulfilled for any legal or technical reasons.

If you have any additional information or clarifications about your request, please feel free to contact us via email [email protected].

We appreciate your patience and understanding as we ensure the secure and compliant handling of your request.

So they refuse to delete your data ?

 

[JohnnyDoe]

So they refuse to delete your data ?

No, these scumbags just asked for more:

Thank you for your Data Subject Access Request (DSAR) received on 18th November 2024.

We are committed to processing your request in accordance with General Data Protection Regulation (GDPR 2018) and ensuring the appropriate measures are in place to protect your personal data.

As part of this process, we require verification of your identity to prevent unauthorized access to sensitive information. We request additional documentation to confirm your identity and to help us locate any information related to your request.

Please note that the time required to fulfil your DSAR may be extended by an additional 3 weeks, depending on the time it takes for you to provide the requested information. The timeline for completing your request will commence once we have successfully verified your identity and located the relevant data.

We kindly remind you to provide the following documentation as soon as possible:

1. A copy of a government-issued identification document (e.g., passport, national ID, driver’s license).

1. Proof of address, such as a utility bill or bank statement dated within the last three months.

1. Any additional information specific to your business entity, its legal status and other information relevant to any application you may have made.

1. Any additional information that would help us locate the data you are requesting (e.g., relevant account numbers, e-residency information, email addresses or correspondence identifiers).

Should we not receive the required information within a reasonable timeframe, we may be unable to proceed with your request.

Please be assured that the information you provide for verification will only be used for this verification purpose and will be securely processed in line with applicable law.

If we require further clarification about your request, we will inform you promptly. If you have any questions or need further assistance in the meantime, please do not hesitate to contact us via email at [email protected].

We look forward to your response.

 

[hofo]

So I understand what is it you try to do while they ask you for all the information ?

 

[JohnnyDoe]

So I understand what is it you try to do while they ask you for all the information ?

Waste their time by feeding them with PGP garbage and potentially discover what they do with my data (as if I didn’t know already).

Plus, show the public how they work and warn potential clients to stay away from them.

 

[JohnnyDoe]

After I provided them with the requested documents, here is their reply:

Thank you for your recent data subject access request (DSAR).

We have reviewed the documentation you provided (image of a passport and digitally generated utility bill).

Unfortunately, we are unable to verify your identity based on these documents. As identity verification is a critical part of processing a DSAR, we regret to inform you that your request cannot proceed at this time.

To submit a new DSAR, please provide alternative identity documentation. This must include:

• A government-issued form of identification (such as a driver's license, national ID card, military service card or equivalent).
• A utility bill (e.g., electricity, gas, or water) that is not digitally generated (not one provided to you in a digital format). This document should clearly display your name, address and date of issue (within the last 3 months).

We are committed to protecting personal data and must adhere to strict verification protocols to ensure information is disclosed securely.

Please contact us at [email protected] should you have further questions or wish to provide additional documentation for a separate request.

Thank you for your understanding.

 

[JohnnyDoe]

And my reply:

in response to your email rejecting my Data Subject Access Request (DSAR) on the grounds that the provided documentation (passport and utility bill) was deemed insufficient for identity verification, first and foremost, I would like to point out that my name is xxx, not “yyy” as you incorrectly addressed me. My passport, which you reviewed, clearly states this. Such a careless error calls into question the thoroughness of your review process and undermines your justification for rejecting my request.

Further, let me categorically state that the documents I provided—a government-issued passport and a utility bill—are universally recognized as valid forms of identification. Your claim that these are inadequate is baseless and unreasonable. A digitally generated utility bill is no less valid than a printed copy, and to suggest otherwise lacks legal foundation.

Your refusal to process my DSAR based on these invalid grounds constitutes a clear failure to comply with your obligations under applicable data protection laws. Should you fail to proceed with my request, I will have no choice but to escalate this matter, including lodging a formal complaint with the relevant data protection authority and pursuing legal action against your organization.

I am giving you until January 3, 2025 to confirm in writing that my DSAR is being processed without further obstruction. Failure to comply will result in immediate escalation of this matter.

This situation is entirely avoidable, and I strongly urge you to reconsider your position. Please confirm your compliance with my request by the stated deadline.