This is a draft pending legal review. Values in [square brackets] are placeholders that Xenobex will complete before the document takes effect.
Privacy Policy
This Privacy Policy explains how Xenobex handles personal information when you visit our website, create an account, trade spot markets or USDT-margined perpetual futures, deposit or withdraw virtual assets, verify your identity, contact customer support or otherwise use our services (together, the "Service"). Please read it together with the Terms of Use and the Consent to the Collection and Use of Personal Information.
1. Who We Are
Xenobex, registered in [JURISDICTION] under registration number [Xenobex REGISTRATION NUMBER] with its registered office at [REGISTERED ADDRESS], decides why and how personal information is processed in connection with the Service and is responsible for it as the data controller.
This Policy applies to everyone who uses the Service, including visitors who do not have an account. It does not apply to websites or services operated by others, even when the Service links to them.
2. Information We Collect and Where It Comes From
2.1 Information you provide
- Account details: email address and password. The password is stored only as a salted one-way hash, so nobody at Xenobex can read it.
- Sign-up declarations: your confirmation that you are at least 19 years old, your decision on each consent (document, version, time, IP address and browser) and the referral code you entered, if any.
- Security settings: the secret of your two-factor authentication (2FA), one-time recovery codes (stored as hashes), your anti-phishing code, withdrawal address book entries (label, network and address) and the address whitelist setting.
- Identity verification (KYC): full name, date of birth, nationality, type and number of your identity document, residential address, images of the front and back of the document and a photo of your face. We collect these only when you apply for verification, and only with the separate consents described in the identity verification consents.
- Instructions you give: orders and cancellations, leverage and margin mode choices, transfers between your spot and futures wallets, and deposit and withdrawal requests (asset, network, amount, destination address and memo or tag).
- Customer support: the category, subject and content of your inquiries, our replies and any transaction you refer to.
- Account closure: the reason you give for closing your account (optional) and your decision on forfeiting small balances.
2.2 Information generated when you use the Service
- Trading records: orders, fills, fees, positions, funding payments, liquidations and realized profit and loss.
- Asset records: balances and every ledger entry, the deposit addresses assigned to you, and your deposit and withdrawal history, including blockchain transaction IDs, confirmations and review status.
- Referral records: the member who referred you, the members you referred and the commissions or rebates paid.
- Account status: email and identity verification status, restrictions on the account and their reasons, notes our staff record while handling your account, and your display language setting.
2.3 Information collected automatically
- The IP address and the browser or device description (user agent) sent with your requests.
- Sign-in history: time, result (success, or the reason for a failure), IP address and browser.
- Active sessions: each signed-in device, when it was last active and when it was signed out.
- Technical request logs of our servers (time, IP address, request method and path, response status) and security events such as failed sign-ins, lockouts and refused requests over the rate limits.
2.4 Information from other sources
- Public blockchain data about transfers to the deposit addresses assigned to you and about the withdrawals we send for you, read from public blockchain nodes and explorers.
- Information that public authorities, courts or other financial institutions lawfully provide to us, for example in an anti-money-laundering inquiry.
- If another member referred you, the fact that you signed up with their referral code.
2.5 What we do not collect
We do not use cookies, advertising identifiers, third-party analytics or tracking pixels, and we do not collect your precise location, contacts or other content of your device. Apart from the facial image used for identity verification, we do not ask for sensitive information such as health, political opinions or religious beliefs; please do not send it to us through customer support.
3. How We Use Your Information and Our Legal Bases
We use personal information only for the purposes below. Each purpose rests on one or more legal bases: performing our contract with you (the Terms of Use), complying with a legal obligation, our legitimate interests (weighed against your rights and interests), or your consent.
- Opening and running your account — creating the account, verifying your email address, signing you in and keeping your settings, including your display language. Legal basis: contract.
- Providing trading services — accepting, matching and settling spot and futures orders, keeping balances and the ledger, calculating fees, margin, funding and liquidation, and producing histories and CSV exports. Legal basis: contract.
- Deposits and withdrawals — assigning deposit addresses, detecting and crediting deposits, reviewing and sending withdrawals (processed manually by Xenobex staff, with a second approver where our controls require one) and correcting errors. Legal bases: contract; legal obligation.
- Identity verification and financial crime prevention — customer due diligence, age verification, sanctions and anti-money-laundering checks, monitoring and reporting suspicious transactions, and keeping the records the law requires. Legal bases: legal obligation; your separate consent for identification numbers and facial images where the law requires it.
- Protecting accounts and the Service — detecting unauthorized access, locking sign-in after repeated failures, holding withdrawals for a period after security changes, sending security alerts, investigating incidents and preventing abuse such as market manipulation. Legal bases: legitimate interests; contract; legal obligation.
- Customer support and service messages — answering inquiries and sending messages you need in order to use the Service, such as verification codes, deposit and withdrawal notices, verification results, changes to our terms, maintenance and market delisting notices. Legal bases: contract; legal obligation.
- Referral program — linking referrals and calculating and paying commissions and rebates. Legal basis: contract.
- Operating and improving the Service — ledger integrity checks, backups, troubleshooting, capacity planning and statistics that do not identify you. Legal basis: legitimate interests.
- Legal claims and requests from authorities — establishing, exercising or defending legal claims, enforcing our terms and answering lawful requests. Legal bases: legal obligation; legitimate interests.
- Marketing — news about events, promotions and new products, sent only if you opted in to the Consent to Receive Marketing Information. Legal basis: consent.
Before using personal information for a new purpose that is not compatible with those above, we will tell you and, where the law requires, ask for your consent.
5. International Transfers
Xenobex is established in [JURISDICTION]. Our servers are located in [HOSTING LOCATION] and our email service provider processes data in [EMAIL PROVIDER LOCATION]. If you live in another country, your personal information is transferred there over encrypted network connections whenever it is stored on our servers or an email is sent to you.
- Recipients, countries and purposes: the providers and locations in sections 4.1 and 5.
- Items: the information described in section 2; for the email provider, only your email address and the content of the message.
- Retention by the recipient: the periods in section 6, and in any case no longer than the contract with Xenobex.
- Safeguards: contractual protections recognized under applicable law, encryption and the access controls described in section 9.
Public blockchain nodes and explorers may be located in any country. Where the law gives you the right to refuse an overseas transfer, you can exercise it by contacting us; because the Service cannot run without these transfers, refusing may mean that we cannot provide the Service to you.
6. Retention and Destruction
We keep personal information only as long as the purposes in section 3 or the law require, and then destroy it. The main periods are:
- Account, identity verification, trading, deposit and withdrawal, sign-in, consent and support records: while your account is open and for five (5) years after it is closed, the record-keeping period of anti-money-laundering law; longer only where another law requires it or a dispute or investigation is pending.
- Documents of a rejected verification application: the document images and the face photo are erased 30 days after the decision.
- Email verification, password reset and withdrawal confirmation codes: stored only as hashes and deleted one day after they expire or are used.
- Session records (device list): deleted 30 days after the session expires or is signed out.
- Content of outgoing emails: stored encrypted until delivery and erased once the email is sent; the delivery record is deleted after 30 days.
- Server request logs: rotated automatically and overwritten when their storage limit is reached.
- Backups: encrypted copies of the database kept on a rolling basis for at most about twelve (12) months; information erased from our live systems leaves the backups when the last backup holding it expires.
- Withdrawal address book: deleted when you close your account.
- Marketing consent: used until you withdraw it or close your account; the record of your decisions is kept as proof for the period in the first item.
When you close your account, we sign out every device at once, remove your 2FA settings, anti-phishing code and address book, and replace the email address on the account so that you can sign up again. Your original email address is kept only in encrypted form, separated from active accounts and with restricted access, for the retention period above. When that period ends, a daily housekeeping job erases your identity verification data and images, the IP addresses and browser details in your sign-in history, your sessions, recovery codes and password hash, and the encrypted email address. Ledger, trade, deposit and withdrawal entries remain as accounting records, linked only to an internal account number and without your email address, identity data, IP addresses or device details.
How we destroy information. Electronic records are deleted or overwritten so that they cannot be restored by ordinary means, and encrypted data is erased together with its ciphertext. Paper documents, if any, are shredded or incinerated. Any destruction outside the automatic jobs is approved and recorded by the privacy officer.
7. Your Rights and How to Exercise Them
Subject to the conditions of applicable law, you have the right to:
- Access — learn whether we process your personal information and obtain a copy of it.
- Correction — have inaccurate or incomplete information corrected.
- Deletion — have information deleted when it is no longer needed or was processed unlawfully.
- Restriction and objection — ask us to suspend processing, or object to processing based on our legitimate interests.
- Portability — receive the information you gave us in a structured, machine-readable format.
- Withdrawal of consent — withdraw a consent at any time, without affecting processing that took place before. Optional consents such as marketing can be withdrawn on their own; the consents required to provide the Service end when you close your account.
- Automated decisions — ask for an explanation of a decision made solely by automated means, ask a person to review it, or contest it (section 11).
- Complaint — lodge a complaint with a data protection authority (section 12).
Self-service tools. When signed in, you can view your sign-in history and signed-in devices and sign them out, change your password and 2FA settings, download your order, trade, deposit and withdrawal history as CSV files, and close your account.
Requests. For anything else, write to the privacy officer at [PRIVACY EMAIL] from the email address registered on your account, or contact customer support. We verify your identity before acting and reply without undue delay, within the period set by applicable law. A legal representative or a person you have authorized in writing may make a request for you with proof of authority. Requests are free of charge unless they are clearly unfounded or excessive.
Limits. We may refuse or limit a request where the law requires us to keep the information (for example the anti-money-laundering records in section 6), where it would harm the rights of others, or where disclosure is prohibited, as with a suspicious transaction report. We will tell you why.
9. How We Protect Your Information
- Encrypted connections (TLS) between your device and the Service.
- Passwords stored only as salted one-way hashes; verification and recovery codes stored only as hashes.
- Identity verification data and images, 2FA secrets, outgoing email content and the original email address of closed accounts encrypted at rest with AES-256, using a separate key for each purpose.
- Account protection: optional 2FA, your anti-phishing code in our emails, automatic sign-out after inactivity, a list of signed-in devices you can revoke, lockouts after repeated failures and withdrawal holds after security changes.
- Staff access on a need-to-know basis: 2FA for every administrator, a second administrator's approval for actions on funds and privileges, a log of every staff view of member data kept for at least two (2) years, and a record of every staff change that cannot be edited.
- The core application runs in an isolated network without direct internet access, and backups are encrypted to a key kept offline.
- Regular integrity checks of the ledger, system monitoring, internal privacy rules and training for staff who handle personal information.
No system is completely secure. Keep your password and 2FA device to yourself, and check the anti-phishing code in any email that claims to come from us. If a breach affects your personal information, we will notify you and the competent authorities as the law requires, explain what happened and tell you what we are doing and what you can do.
10. Children
The Service is only for people aged 19 or older. Every member confirms this at sign-up, and identity verification is refused when the date of birth shows an age under 19. We do not knowingly collect personal information from younger people. If we learn that we have, we will close the account and delete the information, except what the law requires us to keep. If you believe a minor has opened an account, please tell us at [PRIVACY EMAIL].
11. Automated Decision-Making
Some decisions in the Service are made automatically, because they must take effect immediately or are rules applied equally to every member:
- Sign-in and 2FA: after five consecutive failures, sign-in or 2FA is locked for 15 minutes, and requests above the rate limits are refused.
- Age check: a verification application whose date of birth shows an age under 19 is refused.
- Deposits: a deposit is credited automatically only after enough blockchain confirmations, when independent data sources agree and within set value limits; otherwise it waits for review by our staff.
- Withdrawals: after a password or 2FA reset, withdrawals are held for a set period, and withdrawals above set thresholds need a second staff approval.
- Orders: price protection bands, self-trade prevention, open-order limits and market status rules may reject or cancel orders.
- Futures: a position is liquidated automatically when its margin falls below the maintenance margin, as described in the Terms of Use and the Futures Trading Risk Disclosure.
Identity verification decisions and account restrictions are made by Xenobex staff, not solely by automated means. Apart from the rules listed, we do not make decisions with legal or similarly significant effects by automated means, and we do not profile you for advertising. To ask for an explanation of an automated decision, have a person review it or contest it, contact the privacy officer.
12. Privacy Officer and Contact
- Privacy officer: [PRIVACY OFFICER NAME], [PRIVACY OFFICER TITLE]
- Email: [PRIVACY EMAIL]
- Customer support: [SUPPORT EMAIL]
- Postal address: Xenobex, [REGISTERED ADDRESS]
The current contact details are also shown at the bottom of the Service's screens. If you are not satisfied with our answer, you may contact [DATA PROTECTION AUTHORITY] or another authority competent where you live.
13. Links to Other Websites
The Service may link to websites run by others, such as blockchain explorers or the provider of our chart library. What you do there is governed by their own privacy policies, not by this Policy.
14. Changes to This Policy
We may revise this Policy when the law, the Service or the way we process personal information changes. We announce a revision in the Service at least seven (7) days before it takes effect, or at least thirty (30) days before if it reduces your rights or adds new collection, sharing or transfers; until then the upcoming version and its effective date are shown next to the current one. Earlier versions are available on request, and the version and dates at the top of this page tell you which one you are reading.
This Policy is written in English. A Korean version is provided to members for whom Korean is enabled; if the two differ, the [GOVERNING LANGUAGE] version prevails.