Privacy Policy

(a) Account Registration and Identity Verification

‍When you create an account, apply for our Services, or undergo our Know Your Customer (KYC) and Know Your Business (KYB) verification processes, we may collect:

• Full legal name, date of birth, nationality, and place of birth;
• Residential address and proof of address documentation (e.g., utility bill, bank statement dated within 3 months);
• Government-issued identification documents (passport, national identity card, driver’s licence);
• Biometric data for identity verification purposes (facial image, liveness detection video), collected only with your explicit consent;
• Contact information: email address, telephone number;
• Tax identification number(s) and tax residency information;
• Source of funds and source of wealth documentation.

‍(b) Corporate Client Data

‍For corporate or business accounts, we additionally collect:

• Legal entity name, registration number, registered office address, and articles of association or equivalent formation documents;
• Identity documentation for all directors, authorised signatories, shareholders holding 25% or more of voting rights or capital, and ultimate beneficial owners (UBOs);
• Proof of business activity, nature of business, and purpose of the account relationship;
• Corporate structure chart and group ownership information;
• Financial statements and proof of source of corporate funds where required.

‍(c) Financial and Transactional Data‍

• Bank account details (IBAN, BIC/SWIFT, account holder name);
• Cryptocurrency wallet addresses;
• Payment card details (where applicable, processed in PCI DSS-compliant environments);
• Transaction history: amounts, dates, currencies, counterparty details, and transaction references.

When you interact with our Platform, we automatically collect:

• IP address (IPv4 and IPv6), approximate geolocation derived from IP;
• Device identifiers, device type, operating system, and browser type and version;
• Pages visited, navigation paths, referral URLs, session duration, and clickstream data;
• Cookie identifiers and similar tracking technologies (see Section 10);
• Log files, error reports, and performance data.

We may receive personal data from the following categories of third-party sources:

• Identity verification and electronic Know Your Customer (eKYC) service providers;
• Credit reference agencies and fraud prevention databases;
• Sanctions and Politically Exposed Persons (PEP) screening databases;
• Publicly available sources, including commercial registers and public records;
• Financial institutions and payment service providers involved in your transactions;
• Regulatory authorities and law enforcement agencies, where permitted by law.

We do not generally process special categories of personal data (also known as sensitive data) as defined under Article 9 GDPR or equivalent provisions. Where biometric data is processed for identity verification, this is done only with your explicit consent and in compliance with applicable law. We do not process data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning health or sexual orientation.

We engage carefully selected third-party service providers who process personal data on our behalf under written data processing agreements. These include:

• Cloud infrastructure and hosting providers;
• Identity verification and eKYC service providers (e.g., Sumsub);
• Payment processors, card issuers, and banking partners;
• Sanctions screening and risk intelligence providers;
• Customer communication platforms;
• IT security, monitoring, and audit service providers.

All processors are contractually bound to process data only in accordance with our documented instructions, to implement appropriate technical and organisational security measures, and to delete or return personal data upon termination of the engagement.

We may disclose personal data to regulatory authorities, law enforcement agencies, tax authorities, or courts where required to do so by applicable law or regulation, or in response to a valid legal process. This includes, without limitation:

• The Swiss Money Laundering Reporting Office (MROS) under AMLA reporting obligations;
• The Swiss Financial Market Supervisory Authority (FINMA) or the VQF SRO;
• Tax authorities under CRS, FATCA, or equivalent automatic exchange of information frameworks;
• The Financial Conduct Authority (FCA), the Information Commissioner’s Office (ICO), or other UK authorities;
• ADGM Financial Services Regulatory Authority (FSRA) or the UAE Central Bank;
• Law enforcement agencies in response to lawful requests (subpoenas, court orders, warrants);
• Any other competent authority where we are legally obligated to do so.

We may share personal data with affiliated entities within our corporate group (including, where applicable, entities operating under the Oxen or Escrowfy brand in other jurisdictions), solely for the purposes described in this Policy and subject to equivalent data protection safeguards.

In the event of a merger, acquisition, corporate restructuring, or sale of all or a substantial part of our assets, your personal data may be disclosed to the prospective acquirer or successor entity, subject to appropriate confidentiality obligations and the protections described in this Policy. We will notify you of any such transfer where required by applicable law.

We may share personal data with our legal counsel, auditors, accountants, and other professional advisors to the extent necessary for the provision of their professional services to us, subject to professional privilege and confidentiality obligations.

Where personal data is transferred from Switzerland to a country that does not provide an adequate level of data protection as recognised by the Swiss Federal Council (Annex 1 to the Data Protection Ordinance, DPO/DSV), we implement the following safeguards:

• EU/Swiss-approved Standard Contractual Clauses (SCCs) with the Swiss-specific amendments as required by the FDPIC;
• Binding Corporate Rules (BCRs), where applicable;
• Explicit consent, in limited circumstances where no other safeguard is feasible and you have been informed of the risks.

Where personal data is transferred outside the EEA, we rely on:

• An adequacy decision by the European Commission (Art. 45 GDPR);
• Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR);
• Binding Corporate Rules (Art. 47 GDPR), where applicable.

Switzerland benefits from an adequacy decision of the European Commission and is therefore treated as providing an adequate level of data protection for transfers from the EEA.

For transfers of personal data outside the UK, we rely on UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU SCCs, as approved by the UK Information Commissioner’s Office (ICO).

Where personal data subject to the ADGM Data Protection Regulations is transferred outside the ADGM, we ensure compliance with the transfer provisions of the ADGM DPR, including reliance on adequacy determinations, standard data protection clauses, or other approved transfer mechanisms as prescribed by the ADGM.
You may request a copy of the appropriate safeguards we have in place by contacting dpo@oxen.finance.

To exercise any of the rights described above, please submit your request to:
Email: dpo@oxen.finance
Subject line: “Data Subject Request – [Your Right]”
Postal address: Escrowfy GmbH, Bahnhofstrasse 7, 6300 Zug, Switzerland

We may require you to verify your identity before processing your request. We will respond to all valid requests within 30 days, or within the timeframe required by applicable law. Where a request is complex or voluminous, we may extend this period by an additional 60 days, subject to notifying you of the extension and the reasons therefor.

Please note that certain rights may be limited by applicable law, including where we are required to retain data to comply with anti-money laundering, tax, or other regulatory obligations. In such cases, we will explain the basis for the limitation.

If you are dissatisfied with how we handle your personal data or your data protection request, you have the right to lodge a complaint with the competent supervisory authority. The relevant authorities include:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC/PFPDT) — www.edoeb.admin.ch
• European Union: The supervisory authority in your EU Member State of habitual residence, place of work, or place of the alleged infringement
• United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk
• Abu Dhabi / ADGM: ADGM Office of Data Protection — www.adgm.com
• Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• California (USA): California Privacy Protection Agency — cppa.ca.gov
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD) — www.gov.br/anpd

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (as required by GDPR Art. 33, ADGM DPR, and recommended under nFADP Art. 24);
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34; nFADP Art. 24(2));
• Document all breaches in our internal breach register, including the facts, effects, and remedial action taken, regardless of whether notification thresholds are met.

This Policy complies with the Swiss Federal Act on Data Protection (nFADP/DSG), effective 1 September 2023, and its implementing ordinance. Under Swiss law, you have the right to request information about your personal data, to request its correction, deletion, or restriction, and to receive your data in a commonly used electronic format. The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

Where we process personal data of data subjects located in the EEA, we do so in compliance with the GDPR. The legal bases for processing are set out in Section 4 above. You may exercise all rights under Articles 15–22 GDPR as described in Section 8.

For data subjects located in the United Kingdom, we process personal data in accordance with the UK GDPR and the Data Protection Act 2018. Your rights are as described in Section 8. The competent supervisory authority is the Information Commissioner’s Office (ICO).

Where we process personal data in connection with our activities within the Abu Dhabi Global Market (ADGM), we do so in compliance with the ADGM Data Protection Regulations 2021. Where we process personal data subject to the UAE Federal Decree-Law No. 45 of 2021, we comply with the provisions thereof, including the requirements relating to purpose limitation, data minimisation, cross-border transfers, and data subject rights. You may exercise your rights as set out in Section 8 or contact the ADGM Office of Data Protection.

For individuals in Canada, we process personal data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). We rely on your implied or express consent for most processing activities. You have the right to access your personal data, to request correction of inaccurate information, and to withdraw consent for certain processing. Complaints may be directed to the Office of the Privacy Commissioner of Canada.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) provides you with specific rights:

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected, the purposes of collection, and the categories of third parties to whom we disclose data.
• Right to delete: You may request deletion of your personal information, subject to legal exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt-out: You may opt out of the “sale” or “sharing” of personal information. We do not sell personal data for monetary consideration. If we engage in targeted advertising that may constitute “sharing” under the CCPA/CPRA, you may opt out by contacting privacy@oxen.finance.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

‍Notice at Collection: We collect personal identifiers, financial data, internet or network activity, geolocation data, and biometric data (with consent). These categories are collected for the purposes described in Section 4. We retain this data as described in Section 7.

For data subjects in Brazil, we process personal data in accordance with the Lei Geral de Proteção de Dados (LGPD). You may exercise all rights under Articles 17–18 LGPD, including confirmation of processing, access, correction, anonymisation, data portability, deletion, information about sharing, and withdrawal of consent. We will provide responses in Portuguese upon request.

For data subjects in Australia, we handle personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). You have the right to request access to and correction of your personal information, and to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).