CROSSx Technologies LTD Privacy Policy

BVI Data Protection Notice
As at 10 January 2023

FOR CUSTOMERS AND COUNTERPARTIES OF AND SUPPLIERS TO CROSSX TECNOLOGIES LTD

Introduction

CROSSx Tecnologies Ltd (the “Company“) is a company incorporated in the British Virgin Islands (the “BVI“) whose registered office is at Trinity Chambers, PO Box 4301, Road Town, Tortola, British Virgin Islands. Its principal business is to provide its corporate customers with access to a platform and related technology thereby permitting its customers to trade certain digital assets.

The purpose of this document (the “Data Protection Notice“) explains the purposes for which the Company may collect, use, transfer, share and otherwise undertake any other operation in relation to “personal data”.

It also assists individuals, whose “personal data” the Company obtains and processes, understand their data protection rights under BVI law.

Terms used in this document

In this document, the Company is referred to “we” and “us” as well as “the Company” and the individual(s) whose personal data the Company might process as “you”.

In this Data Protection Notice, the term “personal data” means data that may enable us or any third party (whether fiscal, commercial or governmental) to identify an individual (whether from the data itself on its own, or in connection with other data). It includes but is not limited to a person’s name, IP address, wallet ID, browsing habits, geolocation, tax ID, credit card number, passport number and driving licence number.

If you are a corporate, please ensure that you have the right to provide the personal data of individuals to us for the purposes set out in this Data Protection Notice, and please bring this Data Protection Notice to the attention of such individuals so they understand the purposes for which their personal data might be used by us.

Kinds of personal data that we may collect and process

In order that our customers may use the Company’s platform, the principal information that we collect will pertain to the corporate customer. However, we may also require the personal data of individuals such as the names of directors, shareholders, authorised persons, signatories and their passport numbers, email addresses and other data, as described in more detail in this notice. This is to satisfy anti-money laundering and know your customer compliance requirements, and for the other purposes as set out in more detail below.

Such personal data will be processed in accordance with this Data Protection Notice. Processing is used to mean any action in relation to that personal data including (but not limited to) storing, transferring, mining, disclosing, modifying, deleting and aggregating with other data.

We also process other personal data for example if you are a service provider such as an auditor or law firm, we will process the personal data of your employees and other representatives who interact with us. Personal data will be processed as set out in this Data Protection Notice.

The data controller

The Company is the data controller in respect of your personal data as it makes decisions about how, why and where the personal data you provide to us is processed. As we are a BVI company, we are required to process personal data in accordance with BVI law and any other applicable law that governs the processing of personal data (the “Data Protection Legislation“).

This Data Protection Notice applies to the processing of personal data processed both by us and on our behalf by any processors we have appointed.

Our Data Protection Notice only applies to personal data collected and processed by or on our behalf. It does not apply to any personal data that may be collected and processed by or for third parties. This includes third parties who might collect personal data through cookies and other software. The data protection notices of those third parties govern their collection and use of any such personal data and you should familiarise yourself with their data protection policies and the privacy settings of the websites of those third parties.

The personal data that we collect

The categories of personal data we may collect, share, disclose, delete and otherwise process will depend on how you interact with us, and the requirements of applicable law. We may collect, process and transfer personal data that you provide to us (or an agent acting on our behalf), as well as personal data that is obtained automatically when you use our platform or interface, as well as personal data from other sources such as third-party services and organisations, as described below.

We may collect the following personal data that you provide to us.

We may collect personal data when an account is created such as your name, address, email address, wallet ID, and username.
We may collect personal data and details associated with transactions that are conducted on our platform, including payment data. We may contract with a third-party payment processor and collect or store any payment data you provide and we and the processor may receive data associated with your payment (e.g. if you are an authorised to make payments, your name and other relevant details).
We may collect personal data such as email address, phone number, and/or address if you contact us or otherwise communicate with us.
We may collect personal data that you submit or make available through messaging and chat features (for example by WhatsApp).

We may collect personal data automatically when you use our platform (including the platforms of our affiliates), as follows:

We may collect certain personal data automatically when you use our platform to trade. This may include your Internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, mobile advertising and other unique identifiers, browser or device information, location information (including approximate location derived from IP address), date and time stamps, mobile device ID, and Internet service provider.

We, as well as third parties that provide content or other functionality, may use cookies, pixel tags, local storage, and other such software to automatically collect personal data, including your personal data.

We do so for necessary operational reasons, such to enhance your experience of using the platform. We also want to ensure that we prevent fraud and other unlawful use of the platform.

Use of your personal data

We use your personal data for a variety of purposes, as follows.

Administrative and compliance purposes, such as (but not limited to):

Account opening, know your customer and anti-money laundering checks (both at the start of a customer relationship and ongoing throughout that relationship);
Network and information security, and fraud prevention;
Surveillance and detecting security incidents, protecting against actual or attempted unlawful, deceptive, fraudulent or illegal activity, and pursuing those responsible for that activity (and assisting law enforcement wherever law enforcement is based with such pursuit);
Improving, upgrading or enhancing the platform and user interface;
Developing new products and associated services;
Ensuring internal quality control and safety;
Complying with legal, tax or regulatory enquiries or investigations including assisting law enforcement and other governmental departments or agencies by filing suspicious activity and transaction reports and sharing personal data to support any lawful tax, fiscal, regulatory, legal, administrative law or criminal investigation;
Authenticating and verifying individual identities, including requests to exercise rights under this Data Protection Notice and applicable law;
Debugging to identify and repair errors;
Audit of interactions, transactions and other compliance activities;
Managing our risk and operations;
Enforcing our agreements and policies;
Complying with our legal obligations;
Answering requests for customer or technical support;
Communicating with representatives of our customers and prospective customers about their account or proposed account; and
Processing financial information for the purposes of making and receiving payments.

We may also use personal data to provide our customers with tailored content, such as through email campaigns for marketing purposes. We shall provide you with these materials only as permitted by applicable law. You will be able to unsubscribe at any time.

We also use your personal data for other purposes as permitted by applicable law. For example:

We may use personal data for other lawful purposes that are clearly disclosed to you at the time you provide personal data or with your consent.
We may use personal data and other data about you to create de-identified and/or aggregated information, such as de-identified demographic information, de-identified location information, information about the device from which you access our website, or other analyses we create.
We may create anonymised data records from your personal data. We may use this data to analyse requests and usage patterns so that we improve the services we offer to our users. We reserve the right to use this data for any purpose and to disclose this to third parties without any restriction or prior notice to you.

Disclosure and sharing of personal data

We disclose your personal data to third parties for a variety of purposes, including to service providers such as lawyers, auditors, website designers and developers, and also to ensure that we comply with AML/KYC and other applicable BVI legislation, to protect us or others from attempted fraud, to support law enforcement or government authorities (wherever situated), or in the event of a merger, sale, or asset transfer. The privacy policy of those third parties will apply to the processing of your personal data in these cases. Where a tax authority, regulator, government, or law enforcement agency requests that we voluntarily provide your personal data to them, whether or not they are incorporated, formed or registered in the BVI, we shall reserve the right to do so without first seeking your express permission to such disclosure provided we consider in our absolute discretion that that request is not frivolous. If you are not comfortable with this potential disclosure of your personal data, you must not provide it to us. We may also share your personal data with our affiliates for the purposes noted above. We will not sell your personal data.

The rights you have in respect of your personal data

The rights you may have about your personal data are determined by applicable Data Protection Legislation including under BVI law. Under BVI law, they include the following rights:

If you receive an unwanted marketing email from us, you can use the unsubscribe link found at the bottom of the email to opt out of receiving future emails. Note that you will continue to receive emails as are necessary to enable us to provide products and any related services. We may also send you certain non-promotional communications. You will not be able to opt out of those communications.
You may stop or restrict the placement of cookies and other comparable software on your device or remove them by adjusting your preferences as your browser or device permits. Please note that cookie-based opt-outs may not be effective on mobile applications, and you must separately opt out in each browser and on each device.
You may access your personal data held by us: if we hold such personal data, you are entitled to know (i) whether we are processing your personal data; and (ii) to receive an electronic copy of the personal data that we are processing (subject to limited exceptions);
You are entitled to require that we correct or that we enable you to correct any of your personal data where it is inaccurate or incomplete;
You are entitled to require that we delete your personal data (subject to limited exceptions);
You are entitled to object to certain kinds of processing of your personal data (such as for marketing purposes);
You are entitled to know the purposes for which we process your personal data; and
You are entitled to withdraw your consent to our processing of your personal data where you have previously consented to our processing (subject to limited exceptions).

If you would like to exercise any of these rights, please contact us using the email address provided in the “Contact Us” section below. We will process such requests in accordance with applicable laws. We may require satisfactory proof of identity in order to proceed.

Our duty to keep your personal data secure

We take steps to ensure that your personal data are kept secure. We have taken appropriate safeguards to require that your personal data will remain protected and require our third-party service providers and partners to have appropriate safeguards as well.

By providing personal data to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues.

International data transfers

All personal data processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, other countries, legal areas, or territories which may have data protection laws that may be different from the laws of the BVI and not offer comparable protections.

If we receive personal data and transfer that personal data to countries outside the BVI (unless such transfer is to the UK or the European Economic Area), we will put in place appropriate safeguards to ensure that this transfer complies with applicable laws and regulations (unless an exception or exemption applies). For more information about these safeguards, please contact us.

Retention and deletion of your personal data

We will retain and process the personal data we collect as described in this Data Protection Notice for as long as necessary to fulfil the purpose(s) for which it was collected, including to set up and maintain an account, provide the interface, resolve disputes, establish legal defences, conduct audits, comply with applicable AML, KYC and other applicable law and regulations, enforce our agreements, and comply with all other applicable laws that require us to keep the personal data. We are required to, and will, delete any personal data once it is no longer necessary to hold, store or otherwise process it.

Notwithstanding the above, and any other information in this Data Protection Notice, we cannot edit or delete any information that is stored on a blockchain as we do not have custody or control over any blockchain. This may include purchases, sales, and transfers related to your blockchain address. When you use the interface, you are interacting with a public blockchain which provides transparency of your transactions. We are not responsible for any personal data and any information that is made public on a blockchain.

Other important points to note

Our user interface and platform may link to the websites/applications of third parties and third party websites/applications may reference or link to us. These third-party websites and their services are not controlled by us. We encourage you to read the privacy policies of each website and application with which they interact. We do not endorse, screen or approve, and are not responsible for, the privacy practices or content of such other websites or applications. Providing personal data to third-party websites or applications is at your own risk.

Certain territories may give you different or additional rights under Data Protection Legislation (for example, if you are a California resident or a user in the European Economic Area or the United Kingdom); this may include a right to file a complaint with your local data protection supervisory authority for example if you believe your personal data has been unfairly processed. This right may be in addition to any rights you may have under BVI law. If you are unsure of your data protection rights whether these are rights under BVI law or otherwise, you should seek appropriate advice from a suitably qualified person.

We may revise our data processing practices and this Data Protection Notice from time to time in our sole discretion. If there are any material changes we will notify you as required by applicable law. You will be deemed to have accepted the updated Data Protection Notice if you continue to use our platform or user interface.

Getting in touch

If you have any questions about this Data Protection Notice, or you wish to exercise your rights as detailed herein, please contact the Company at its registered office address or by email to compliance@crossovermarkets.com.