Privacy Policy
‍

TBW 21 Inc. (The Bitcoin Way)

Effective date: October 28, 2026

1. Who we are

This Privacy Policy explains how TBW 21 Inc., trading as The Bitcoin Way ("The Bitcoin Way", "we", "us"), collects, uses, shares and protects personal data when you visit our website, contact us, or use our services. TBW 21 Inc. is a company incorporated in the Republic of Panama. We are the controller of the personal data described in this policy.

We process personal data in accordance with applicable data protection laws, including the laws of the Republic of Panama, where we are based.

2. Our approach

- You do not need to give us your real identity. You may use an alias and an email address created only for us. We do not verify the name or email you provide, except where the law requires it for a specific service (see section 4).
‍

- We never collect the keys to your Bitcoin. We never ask for, receive or store your seed phrase, passphrase, private keys, extended public keys, wallet addresses, wallet balances or backups. Anyone asking you for these on our behalf is not us.
‍

- We do not sell your personal data, and we do not use it for advertising.

3. Information we collect

Information you give us

- Contact details: a name or alias and an email address. A phone number only if you choose to give one. Our newsletter also accepts an email address that does not identify you.
‍

- Form answers: our forms may ask about your current setup and what you are looking for. Every answer is optional, and you decide what to share.
‍

- Booking details: the time of your appointment and anything you write in the booking form.
‍

- Communications: messages you send us by email or encrypted messaging, transcripts of calls where they are made (see section 6), and notes our team makes to support you. Notes are written to be useful without recording anything that could help someone attack you.
‍

- Service records: which services you purchased and when, and your anti-phishing words.
‍

- Payment details: we accept Bitcoin only. We keep a record of the payment needed for our accounts. We do not analyse where the coins came from.
‍

- Events, webinars and surveys: the details you give when you register for a webinar, workshop or event, or answer a survey.

- Feedback and testimonials: only if you choose to give them.
‍

- Social media: if you interact with our social media accounts, we may see information that the platform makes available under your privacy settings, such as your username, profile picture and public activity.

Information collected automatically

- Website analytics: we use privacy-friendly analytics, including an open source analytics tool hosted in the EU and the analytics built into our website platform. They record aggregated information such as page views, referral sources, device type, browser type and country. They do not use cookies or persistent identifiers, do not collect IP addresses, do not build a profile of you, and do not track you across sites or devices. The data is never shared with advertisers or sold.
‍

- Site activity linked to your contact record: if you are already a contact or client, or have submitted your details through our website, we may link your activity on our website to your contact record in our customer relationship management system. This can include pages visited, the time and frequency of visits, interactions with specific content, and how you arrived at our site. We use this to understand how our website is used, improve our content and services, and make our communication more relevant and timely. This uses a first-party identifier stored in your browser, is never used for advertising, and never tracks you on other websites. You can object at any time by emailing us, and you can remove the identifier by clearing your browser cookies.
‍

- Cookies: apart from the identifier described above, our website only uses cookies that are strictly necessary for it to work, such as keeping it secure and remembering your preferences. We do not use advertising cookies, tracking pixels or web beacons.
‍

- Technical data: like any website, our hosting may briefly process technical data such as your IP address to deliver pages and protect the site from abuse. We do not use it to identify you.

4. Second residency services

If you use our second residency services, the law requires certain identity and supporting documents to process your application. In that case only, we collect the documents required and share them with the legal counsel and government authorities handling your application. We use them for no other purpose, and keep them only as long as the law and your application require.

5. How we use your information, and why

We use personal data only where we have a lawful reason to do so:

- To provide our services (performance of our agreement with you): responding to enquiries, scheduling and holding sessions, running webinars and events, delivering education and support, and arranging hardware delivery.
‍

- To communicate with you (performance of our agreement, or our legitimate interests): service updates, security notices and answers to your questions.
‍

- To send newsletters and marketing (your consent): we only send these if you have opted in. You can unsubscribe at any time using the link in every email, or by emailing us.
‍

- To improve our website, content and services (our legitimate interests): using aggregated analytics and, for existing contacts, site activity linked to your contact record, as described in section 3.
‍

- To meet legal obligations (legal obligation): accounting and tax records, responding to lawful requests, and the requirements of residency applications.
‍

- To protect our clients and our business (our legitimate interests): preventing fraud, phishing and abuse, enforcing our terms, and defending legal claims.
‍

- To share testimonials (your consent): only with your permission, and in the form you agree to.

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

6. How we communicate with you

Email. Every email we send includes your anti-phishing words. If a message claims to be from us and the words are missing or wrong, it is not from us.

Encrypted messaging. Client support takes place in end-to-end encrypted messaging, so the content of your messages cannot be read by the messaging provider or anyone intercepting them.

Calls and transcripts. Calls are held over encrypted video. We do not keep audio or video recordings of calls. Some calls may be transcribed so we can write accurate notes and follow up properly. Transcripts are stored securely, used only to support you, never shared for anyone else's purposes. You can ask us not to transcribe your call at any time, before or during the call.

Text messages (SMS). If you give us your phone number, you agree to receive text messages from The Bitcoin Way about your enquiry, appointments, service updates or support. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for assistance. We do not send unsolicited promotional or mass marketing texts. Your phone number and SMS consent are confidential and are not shared with anyone, except our messaging provider solely to deliver messages. We do not sell, rent or otherwise share phone numbers collected for SMS.

7. Scheduling

When you book a session, your booking is handled by a third-party scheduling tool embedded on our website. That tool processes the details you enter and may use its own cookies or similar technologies, which are governed by its own privacy policy. If you prefer, you can contact us directly and we will arrange a time with you instead.

8. Who we share information with

We share personal data only where it is necessary, and only the minimum needed:

- Service providers that help us run our business, such as website hosting, analytics, email delivery, customer relationship management, scheduling, call transcription, encrypted messaging, payment processing and secure data storage. They may use your data only to perform their service for us, under confidentiality and data protection obligations.
‍

- Legal counsel and government authorities, only if you use our second residency services and only as required for your application.
‍

- Professional advisers, such as lawyers, accountants, auditors and insurers, where necessary for the services they provide to us, under a duty of confidentiality.
‍

- Authorities, where we are legally required to, such as in response to a valid court order. We only disclose what the law requires.
‍

- A successor business, if The Bitcoin Way is merged, sold or reorganised. Any successor must protect your data in line with this policy, and we will tell you before your data becomes subject to a different policy.

We do not sell, rent or trade personal data, and we never share it for anyone else's marketing.

9. International transfers

Some of our service providers are located outside Panama, and outside the country where you live. When your data is transferred internationally, we take reasonable steps to make sure it receives a level of protection consistent with this policy and applicable law, including contractual safeguards where required.

10. How we protect your information

We apply the same security standards to our own operations that we teach our clients:

- Encryption of data in transit and, where available, at rest
‍

- Access limited to team members who need it to support you, protected by strong authentication
‍

- Written security standards for every device our team uses
‍

- Client data kept within approved systems, and never stored in personal accounts or exported to spreadsheets
‍

- Confidentiality obligations for everyone on our team and every service provider who handles your data

If a security incident affects your personal data, we will act promptly to contain it, and notify you and the relevant authorities within 72 hours of becoming aware of it, as the law requires.

No system connected to the internet is ever completely secure, so we cannot guarantee absolute security. This is one of the reasons we collect so little in the first place.

11. How long we keep your information

- Client records are kept for as long as you are a client, and afterwards only as long as needed to support you or as required by law.
‍

- Accounting and payment records are kept for the period required by tax and commercial law.
‍

- Residency documents are kept only for as long as your application and the law require.
‍

- Newsletter subscriptions are kept until you unsubscribe.

When data is no longer needed, we delete it securely or anonymise it so it can no longer identify you. If you ask us to delete your record, we will, unless the law requires us to keep something, in which case we will tell you what and why.

12. Your rights

Depending on where you live, you have the right to:

- Access the personal data we hold about you
‍

- Correct data that is inaccurate or incomplete, including changing the name or email on file at any time
‍

- Delete your data
‍

- Object to or restrict how we use your data
‍

- Receive a copy of your data in a portable format
‍

- Withdraw your consent at any time, where we rely on it

To exercise any of these rights, email us at info@thebitcoinway.com. We do not charge for this, and we will respond within the time required by law, and in any case within 30 days. We may need to confirm the request comes from you, using information you have already given us, such as your anti-phishing words. We will never ask you for identity documents to do this.

If you are not satisfied with our response, you can complain to ANTAI in Panama, or to the data protection authority where you live.

13. Children

Our services are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

14. Changes to this policy

We may update this policy to reflect changes in our practices or the law. When we make significant changes, we will tell you by email or with a clear notice on our website before they take effect. The effective date at the top always shows the current version.

15. Contact us

If you have any questions or concerns about this policy or how we handle your data, contact us at: