xmoney.hk Privacy Policy (V2.0)

Welcome to xmoney.hk! Your privacy is critically important to us. This Privacy Policy (hereinafter referred to as "this Policy") aims to clearly explain how we collect, use, store, share, and protect your personal data when you use our services (as defined in the Terms of Service), and the rights you have regarding your data.

This Policy is an integral part of the xmoney.hk Terms of Service. By using our Service, you signify that you have read, understood, and agreed to the entire contents of this Policy.

To provide you with secure and compliant services, and to fulfill our legal obligations (such as Anti-Money Laundering (AML) and Know Your Customer (KYC) / Know Your Business (KYB)), we collect the following categories of personal data:

1.1. Identity and Contact Information:

• Personal Identifiers: Your name, date of birth, nationality.
• Identity Verification Documents: Images and information from government-issued identification documents (e.g., ID card, passport, driver's license).
• Contact Details: Your residential address, email address, telephone number.
• (If applicable) Institutional Identifiers (KYB): For institutional users such as [XM Merchant Partners], we may need to collect entity qualification information like registration documents, beneficial ownership information, business address, etc.

1.2. Transaction Information:

• Information regarding the [Currency Commodities] you list on the Platform, including counterparty details, transaction amounts, and payment method specifics.
• Your [X-Wallet] balance, transaction history (including records of acquisition and use of [X-Dollar]).
• Communication records within the Platform and supporting materials you provide for dispute resolution.

1.3. Technical and Usage Information:

• Technical Data: IP address, login data, browser type and version, time zone setting, device information.
• Usage Data: Information about how you interact with our website and Service, including browsing history, search queries, etc.

1.4. Communication Information:

• Information you provide when contacting our customer support team.

We use your data only for specified, explicit, and legitimate purposes:

2.1. Providing and Maintaining the Service:

• To create and manage your account.
• To process your C2C transactions and provide support for inter-user dispute arbitration.
• To send you important notices related to the Service.

2.2. Fulfilling Legal and Compliance Obligations:

• To conduct identity verification (KYC/KYB) to prevent fraud and illicit activities.
• To monitor transactions to comply with Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) regulatory requirements.
• To respond to lawful requests from law enforcement, regulatory bodies, and courts.

2.3. Enhancing and Securing the Service:

• To protect our Platform, systems, and Users from fraud, abuse, and other security risks.
• To improve and optimize the performance and user experience of our Service.

We are committed to maintaining the confidentiality of your data but may share it with third parties under the following necessary circumstances:

3.1. Service Providers:

• With technical service providers who assist us in operating our business (e.g., cloud storage, data analytics providers). We have strict data processing and confidentiality agreements in place with these providers.

3.2. Legal and Law Enforcement Agencies:

• We may disclose your data upon receipt of a legally valid subpoena, court order, or lawful request from government authorities.

3.3. Business Transfers:

• In the event of a merger, acquisition, or asset sale, your data may be transferred as part of the transaction. We will ensure the receiving party continues to comply with this Policy or provides equivalent protection.

3.4. Risk Control:

• We may share necessary information with financial institutions, identity verification services, or third-party risk assessment databases for AML and fraud risk assessment purposes.

3.5. Dispute Resolution:

• When handling transaction disputes between Users, as stipulated in Section 10.5 of the Terms of Service, we may need to share necessary transaction or communication records with the other party to the dispute or third parties required for arbitration (e.g., payment channel verification).

Our operations may be global, and therefore your personal data may be transferred to and stored on servers located outside your country or region of residence (e.g., Hong Kong). Regardless of where your data is processed, we will take all necessary legal, organizational, and technical measures (such as implementing Standard Contractual Clauses) to ensure your data receives an adequate level of protection comparable to that described in this Policy.

We employ administrative, technical, and physical security measures that comply with industry standards to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These include data encryption, firewalls, and access controls. However, please understand that no internet-based transmission or electronic storage method is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security. You assume the inherent risks associated with transmitting and storing information online.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with applicable legal, regulatory (especially AML), tax, or reporting requirements. Typically, even after you close your account, we are required by regulations such as AML laws to retain your identity and transaction data for a minimum statutory period (e.g., 5 to 7 years, depending on Hong Kong regulations). After the retention period expires, we will securely delete or anonymize your data.

Depending on the applicable laws in your jurisdiction (e.g., GDPR, CCPA), you may have several rights concerning your personal data. We are committed to enabling you to exercise these rights:

• Right of Access: You have the right to request access to copies of your personal data held by us.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure (Right to be Forgotten): In certain circumstances (e.g., the data is no longer necessary for the purposes collected, or you withdraw consent), you have the right to request the deletion of your personal data, unless we have an overriding legal or compliance obligation to retain it (such as AML records).
• Right to Restrict Processing: In certain circumstances (e.g., while you contest the accuracy of the data), you have the right to request the restriction of processing of your personal data.
• Right to Object to Processing: In certain circumstances (e.g., processing based on legitimate interests), you have the right to object to our processing of your personal data.
• Right to Data Portability: You have the right to request that we provide certain data that you provided to us in a structured, commonly used, machine-readable format, or (where technically feasible) transmit it directly to a third party you designate.
• Right to Withdraw Consent: If our processing of your data is based on your consent, you have the right to withdraw that consent at any time, although this will not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact our Data Protection Officer using the contact details provided at the end of this Policy. We may require proof of your identity to process your request.

We use Cookies and similar technologies (such as web beacons) to enhance your website experience, analyze site traffic, ensure security, and provide personalized services. For detailed information about the types of Cookies we use, their purposes, and how you can manage them (e.g., opting out via browser settings), please refer to our separate Cookie Policy.

The Service is explicitly not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will take immediate steps to delete that information.

We may update this Privacy Policy from time to time based on business developments or changes in legal or regulatory requirements. We will notify you of any material changes before they take effect, either through website announcements, in-app notifications, or email. The "Last Updated" date at the top of this Policy will always reflect the date the latest version was published. We encourage you to review this Policy periodically.

This Policy is written in English. We may provide translations into Chinese or other languages. All translated versions are provided solely for user convenience. In the event of any conflict, ambiguity, or inconsistency between the English version and any translated version, the English version shall prevail. The English version possesses final and exclusive legal binding force.

If you have any questions, comments, or complaints about this Privacy Policy or our processing of your personal data, or if you wish to exercise your data rights, please contact our Data Protection Officer:

Email: privacy@xmoney.hk