Pending final legal review. Items shown in square brackets, such as [JURISDICTION], will be completed by Xenobex before the public launch of the Service.
Identity Verification (KYC) Notice and Consent
This notice explains why Xenobex verifies the identity of its members, what information and documents we collect for that purpose, how we use and protect them and how long we keep them. It also contains the two separate consents you give when you apply for verification: the Consent to the Processing of Unique Identification Information and the Consent to the Processing of Facial Images (Biometric Information).
1. About This Notice
1.1 Xenobex, a company registered in [JURISDICTION] with its registered address at [REGISTERED ADDRESS] ("Xenobex", "we", "us"), is responsible for the personal information described in this notice.
1.2 This notice supplements the Privacy Policy, which describes our processing of personal information in general and your rights. If this notice and the Privacy Policy differ on identity verification, this notice applies.
2. Why We Verify Your Identity
2.1 As a virtual asset service provider, Xenobex must know who its customers are. We verify identity in order to:
- comply with anti-money laundering, counter-terrorist financing and sanctions laws, including customer due diligence and record-keeping obligations under the law of [JURISDICTION];
- confirm that you are the person who opened the account and that you meet our eligibility requirements, including the minimum age of 19;
- screen members against sanctions and other lists that we are required to check;
- prevent and investigate fraud, account takeover, identity theft and other misuse of the Service; and
- protect your assets, for example before a withdrawal leaves the Service.
3. When Verification Is Required
3.1 You must complete identity verification before you can request a withdrawal, and Xenobex may require it before you use other features. We tell you in the Service when verification is required.
3.2 After your verification has been approved, we may ask you to update your information or provide further information or documents (for example about the source of your funds) where the law requires it, when your documents expire, or when activity in your account calls for enhanced checks. Features may be restricted until you provide what we ask for.
4. What We Collect
4.1 When you apply for verification, we collect:
- your full legal name, date of birth, nationality and residential address;
- the type of your identity document (national identity card, passport or driving licence) and its document number;
- images of the front of your identity document and, except for a passport, of its back;
- a photograph of your face, taken for comparison with the photograph on your identity document; and
- the time of your application, the IP address and device information of the request, the consents you gave and their versions, and the outcome of the review with the reason for any rejection.
4.2 Images must be in PNG, JPEG or WEBP format and no larger than 1 MB each. You can submit up to three applications in any 24 hours.
4.3 Please make sure that everything you submit is true, current and your own. Submitting false or another person's information or documents is prohibited, will lead to rejection and may lead to the closure of your account and a report to the authorities.
5. Consent to the Processing of Unique Identification Information
5.1 What is processed: the number of your identity document (resident registration number, passport number or driving licence number) and the images of the document on which it appears.
5.2 Purpose: identity verification and customer due diligence, sanctions screening, prevention of fraud and identity theft, and record-keeping required by law.
5.3 Retention: as described in section 10 below.
5.4 Right to refuse: you may refuse this consent. If you do, you cannot complete identity verification and the features that require it, including withdrawals, are not available to you (see section 13).
5.5 Where the law of [JURISDICTION] permits Xenobex to process your identification number without consent in order to meet a legal obligation, we rely on that legal basis and this consent is in addition to it.
6. Consent to the Processing of Facial Images (Biometric Information)
6.1 What is processed: the photograph of your face that you submit, and the photograph on your identity document.
6.2 Purpose: only to confirm that the person applying is the holder of the identity document. At present the comparison is made by Xenobex's authorised review staff. We do not create a facial recognition template from your photograph, and we do not use it for marketing, profiling or any purpose other than identity verification. If we introduce automated verification or an external verification provider, we will update this notice and ask for your consent again where the law requires it.
6.3 Retention: as described in section 10 below.
6.4 Right to refuse: you may refuse this consent. If you do, you cannot complete identity verification and the features that require it, including withdrawals, are not available to you (see section 13).
7. How We Use the Information
7.1 We use the information collected for verification only for the purposes in section 2 and for: responding to lawful requests from courts, regulators and law enforcement; establishing, exercising or defending legal claims; and handling your enquiries and complaints about the verification.
7.2 Lists used by our staff show your name in masked form. The full information and images are opened only when needed to review an application or to meet a legal obligation.
8. How We Protect It
8.1 Your verification data and images are transmitted over encrypted connections and stored encrypted (AES-256-GCM) with a key used only for identity verification data.
8.2 Access is limited to authorised staff who need it for their role and who must use two-factor authentication. Every time a member of staff opens an application or a member's personal details, the access is recorded in a personal-data access log that is reviewed [ACCESS LOG REVIEW FREQUENCY].
8.3 No system is completely secure. If a personal data breach occurs, we will notify you and the competent authority as required by law.
10. Retention and Destruction
10.1 Approved applications: we keep the information and images as the record of customer due diligence for as long as you hold an account and for [RETENTION PERIOD, e.g. five (5) years] after your account is closed or the business relationship ends, or for any longer period required by law or needed for an ongoing investigation or legal proceeding.
10.2 Rejected applications: the document images and the facial photograph are deleted 30 days after the decision. The rest of the application record (including the review outcome and reason) is kept for the period in section 10.1.
10.3 When the retention period ends, the information is destroyed so that it cannot be restored. You cannot close your account while an application is still under review.
11. The Review and Its Outcome
11.1 Your application is reviewed by Xenobex's staff. We notify you of the outcome by e-mail and in the Service. If your application is rejected, we tell you the reason where we are allowed to, and you may correct your information and apply again.
11.2 We may refuse or withdraw verification, or ask for more information, at our discretion and where required by law. In some cases the law prohibits us from explaining the reason.
12. Your Rights
12.1 Subject to the law, you may ask to access, correct or delete your verification data, to restrict its processing, or to withdraw your consent. Because we must keep due diligence records for the period required by law, we may be unable to delete them before that period ends; withdrawing consent does not affect processing already carried out or processing we are required by law to continue.
12.2 To exercise your rights, contact our privacy officer at [PRIVACY OFFICER EMAIL]. You also have the right to complain to [DATA PROTECTION AUTHORITY].
13. Your Right to Refuse Consent
13.1 You may refuse either or both of the consents in sections 5 and 6. Without both, you cannot complete identity verification, and withdrawals and any other features that require verification are not available to you. You can still log in, view your account and contact customer support, and other features remain available as described in the Terms of Use.
14. Contact Us
Xenobex · Registered address: [REGISTERED ADDRESS] · Registration number: [REGISTRATION NUMBER]
Privacy officer: [PRIVACY OFFICER NAME], [PRIVACY OFFICER EMAIL]. Customer support: the support page in the Service, or [SUPPORT EMAIL].