Privacy policy

CR Forensics is the responsible party for the personal information described in this policy. CR Forensics provides cryptocurrency recovery and blockchain investigation services.

• Email: customersupport@cr-forensics.com

Our Information Officer is responsible for CR Forensics's compliance with POPIA and for dealing with requests and complaints about personal information.

You can reach the Information Officer at customersupport@cr-forensics.com. Please mark your message for the attention of the Information Officer.

This policy applies to information we collect through this website, by email and telephone, during the free consultation and while we work on a case under a signed mandate.

We collect only what we need to review and work on your case. This may include:

• Claim form details: your full name, email address, an optional telephone number and the country you live in.
• Details of the loss: the company or platform you lost funds to and its website, the date you lost the funds, the amount and currency, how you paid (credit card, bank transfer or cryptocurrency), any wallet addresses used, and your own account of what happened.
• Case documents and transaction data: payment records, bank or card statements, transaction IDs, exchange history, screenshots, messages and emails you choose to share.
• Wallet-access information: for cases involving lost passwords or damaged hardware, details of the wallet software or device, and any partial passwords or backups you agree under the mandate to provide.
• Mandate information: the details needed to sign and administer the mandate and to settle fees.
• Communications: emails, call notes and other correspondence between you and us.
• Technical data: the information your browser sends to any website, such as IP address, browser type and the pages requested, which our hosting provider records in server logs for security and reliability.

Investigating a loss usually means processing information about other people, such as the operators of a fraudulent platform, people who contacted you, or, in concealed-asset matters, a person believed to be hiding cryptocurrency. This may include names, contact details, wallet addresses, account identifiers and public blockchain records. Please share information about others only where it is relevant to your case. We use it only for the investigation and protect it in the same way as your own.

Information about alleged criminal behaviour, such as fraud, theft, hacking or blackmail, is special personal information under POPIA (sections 26 to 33). Your account of events may also reveal other sensitive matters.

We process special personal information only where POPIA allows it, in particular with your consent, or where the processing is necessary to establish, exercise or defend a right or obligation in law. Access is limited to the people working on your case, and we do not use it for any unrelated purpose.

• To review your claim and hold the free consultation.
• To contact you about your case.
• To prepare, sign and carry out the mandate, including tracing transactions on the blockchain, wallet-access work and drafting reports.
• To work with exchanges, law enforcement agencies and other parties on recovery, and to provide expert witness evidence where needed.
• To give you regular updates about your case.
• To calculate and collect fees under the mandate.
• To meet our legal, regulatory and accounting obligations, and to keep this website and our systems secure.

Under section 11 of POPIA we process personal information on one or more of these grounds:

• your consent, which you give when you submit the claim form and which you may withdraw at any time;
• the processing is necessary to take steps you have asked for before signing a mandate, or to perform the mandate;
• the processing is required by law;
• the processing protects your legitimate interests, for example in recovering lost funds; or
• the processing is necessary for CR Forensics's legitimate interests or those of a third party to whom information is supplied, such as preventing and investigating fraud.

Withdrawing consent does not affect processing that took place before you withdrew it, or processing we are entitled to carry out on another ground.

We do not sell personal information. We share it only with your consent or where the law requires or permits it, and only to the extent needed:

• your own lawyers or advisers, and counsel or experts engaged on your case;
• law enforcement agencies, regulators and courts, where you ask us to or where we are legally required to;
• cryptocurrency exchanges, banks and payment providers, through the appropriate legal process or on your instruction;
• third parties whose services are needed in difficult cases, as provided for in the mandate;
• service providers who support our business, such as hosting, email, secure storage and blockchain analysis tools. They act as operators under written agreements that require them to keep the information confidential and secure, as section 21 of POPIA requires; and
• a professional adviser or successor business, if CR Forensics is restructured or sold, subject to the same protections.

Cryptocurrency cases often cross borders. Some of our service providers, and some of the exchanges, authorities and advisers involved in a case, are located outside South Africa. We transfer personal information across borders only where section 72 of POPIA allows it: where the recipient is subject to law, binding corporate rules or a binding agreement that gives an adequate level of protection, where you consent, or where the transfer is necessary to perform the mandate or take steps you have asked for.

We keep personal information only for as long as we need it for the purpose it was collected for. Claims that do not lead to a mandate are deleted once they are no longer needed. Case records are kept for the period the law requires (for financial and tax records, generally five years) and for as long as they may be needed to establish or defend a legal claim. After that, we delete or de-identify them.

We take appropriate technical and organisational measures to protect personal information against loss, damage and unauthorised access, as section 19 of POPIA requires. These include access controls limited to the people working on a case, encrypted connections, secure storage and confidentiality obligations on staff and operators.

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible.

Under POPIA you have the right to:

• ask whether we hold personal information about you and request a copy of it;
• ask us to correct information that is inaccurate, out of date, incomplete or misleading;
• ask us to delete information we are no longer authorised to keep;
• object to processing on reasonable grounds, including processing based on legitimate interests;
• withdraw your consent; and
• lodge a complaint with the Information Regulator.

To make a request, contact the Information Officer. We may ask you to verify your identity first. Some requests may be limited where the law requires us to keep information, or where releasing it would expose another person's information or prejudice an investigation. Formal access requests are handled under the Promotion of Access to Information Act, and our PAIA manual is available on request.

CR Forensics does not send marketing messages unless you have asked to receive them. If you do opt in, every message will tell you how to stop receiving them, and we will act on that request promptly.

Our services are intended for adults. If a case involves a person under 18, it should be raised by a parent, guardian or legal representative.

If you are unhappy with how we have handled your personal information, please contact the Information Officer first so that we can try to put it right. You may also complain to the Information Regulator:

• Website: inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

We may update this policy when our services or the law change. The date at the top shows when it was last revised. Where a change materially affects how we use information you have already given us, we will tell you directly.

Questions about this policy can be sent to customersupport@cr-forensics.com, for the attention of the Information Officer.