Consent to the Collection and Use of Personal Information

1. Items, Purposes and Retention Periods

1.1 Account registration and sign-in

• Items: email address; password (stored only as a salted one-way hash); confirmation that you are 19 or older; referral code entered at sign-up (if any); record of each consent (document, version, time, IP address and browser).
• Purposes: identifying you as a member, verifying your email address, signing you in, preventing duplicate or unauthorized accounts and proving the consents you gave.
• Retention: while your account is open and for five (5) years after it is closed.

1.2 Trading and asset management

• Items: orders, fills, fees, positions, leverage and margin settings, funding payments and liquidations; balances and ledger entries; deposit addresses assigned to you; deposit and withdrawal details (asset, network, amount, fee, destination address, memo or tag, blockchain transaction ID, status); withdrawal address book (label, network and address); referral relationships and rewards.
• Purposes: executing and settling trades, keeping your balances, processing deposits and withdrawals, paying referral rewards, providing histories and CSV exports, keeping accounting records and handling errors and disputes.
• Retention: while your account is open and for five (5) years after it is closed; ledger entries are then kept as accounting records without information that identifies you. The address book is deleted when you close the account.

1.3 Account security

• Items: sign-in history (time, result, IP address, browser); signed-in devices and their last activity; 2FA secret (encrypted) and recovery codes (hashed); anti-phishing code; email verification, password reset and withdrawal confirmation codes (hashed).
• Purposes: protecting your account, detecting unauthorized access and fraud, sending security alerts and investigating incidents.
• Retention: sign-in history while your account is open and for five (5) years after it is closed; device sessions until 30 days after they end; confirmation codes until one day after they expire or are used; 2FA and anti-phishing settings until you change them or close the account.

1.4 Customer support

• Items: category, subject and content of your inquiries, our replies and the transaction you refer to.
• Purposes: answering inquiries, resolving complaints and disputes and keeping a record of what was agreed.
• Retention: while your account is open and for five (5) years after it is closed.

Where another law requires a longer period, or a dispute or investigation is pending, we keep the information concerned until that obligation or matter ends.

2. Identity Verification Information

Withdrawals require identity verification. When you apply, we collect your full name, date of birth, nationality, residential address, the type and number of your identity document, images of the document and a photo of your face, to carry out customer due diligence and age verification and to meet our anti-money-laundering obligations. The identification number and the face photo are processed only with the separate consents in the identity verification consents, which you give when you apply.

• Retention: for an approved application, while your account is open and for five (5) years after it is closed; for a rejected application, the document images and face photo are erased 30 days after the decision and the other details are kept for the same period as an approved application.

3. Information Collected Automatically

While you use the Service, the IP address and browser or device description of each request, and the times and results of your requests, are recorded in sign-in history and in the technical logs of our servers. Server logs are rotated automatically and overwritten when their storage limit is reached. The Service does not use cookies; see section 8 of the Privacy Policy for the values the web application keeps in your browser.

4. Processing by Service Providers and Overseas Transfer

Xenobex entrusts server and database hosting, including encrypted backups, to [HOSTING PROVIDER] and email delivery to [EMAIL SERVICE PROVIDER]. The servers are located in [HOSTING LOCATION] and the email provider processes data in [EMAIL PROVIDER LOCATION]; if you live elsewhere, your information is transferred there over encrypted connections when it is stored or when an email is sent. To confirm deposits and withdrawals, our systems also query public blockchain nodes and explorers run by independent operators with blockchain addresses and transaction IDs only. Details are in sections 4 and 5 of the Privacy Policy.

5. Provision to Third Parties

Xenobex does not provide your personal information to third parties, except: when a law requires it or a competent authority or court lawfully demands it; when the law requires sender and recipient information to accompany a virtual asset transfer; and, if you signed up with a referral code, the masked email address, date of joining and earned commission shown to the member who referred you. Any other provision needs your separate consent.

6. Right to Refuse and Its Consequences

You have the right to refuse this consent. Because the items above are the minimum needed to provide the Service, you cannot create an account or use the Service without it. If you refuse the identity verification consents, you can still deposit and trade, but you cannot withdraw. The marketing consent is separate and optional.

7. Withdrawing This Consent

This consent is a condition of membership, so it is withdrawn by closing your account (Account & Security > Close Account). The information collected under it is then kept and destroyed as described in section 1 and in section 6 of the Privacy Policy.