VNX – Privacy Notice

1. GENERAL

This Privacy Notice (the “Notice”) is relevant to all users of services provided by VNX Global Ltd. or its affiliates, as applicable (collectively “VNX Global”, “we”, “us” and their derivatives). This Notice is provided for information purposes only and is not a binding contract. It is of general application and may apply to both customers and non-customers. For customers of VNX Global, the relevant VNX Global Terms and Conditions (as amended from time to time) (the “Terms”) which have been accepted by you in connection with your use of VNX Global’s services govern any access to, or use of, any services provided by us; and in the event of any conflict between the Terms and this Notice, the Terms shall prevail. VNX Global may, at its sole discretion and without notice, amend or modify this Notice from time to time by publishing an updated Notice on the Platform and its website (www.vnx.io) (the “Site”). Unless expressly set out herein, capitalized terms used in this Notice have the meanings ascribed to them in the Terms.

2. INTRODUCTION

VNX Global respects your privacy and is committed to protecting your “Personal Information” (as defined below). This Notice explains how your Personal Information is collected, used, and disclosed by VNX Global and sets out the basis on which we will use your Personal Information when you:

a) visit and use the Site and/or the Platform (regardless of where you visit or use them from);
b) apply for and open User Account on the Platform; and
c) apply for, receive, or use any of the Services offered on the Platform.

This includes any information that you may provide for and in relation to our newsletters, updates, events and other marketing and promotional communications. This Notice also informs you about: (i) how we will handle and look after your Personal Information, (ii) our obligations with regards to processing your Personal Information responsibly and securely, (iii) your information protection rights as an individual, and how the law protects you. It should be read in conjunction with our Cookie Notice.

3. IMPORTANT INFORMATION AND WHO WE ARE

3.1 Purpose

This Notice complies with the maximum Personal Information protection standards in Bermuda. We process your Personal Information in an appropriate and lawful manner, in accordance with the provisions of the Personal Information Protection Act 2016 of Bermuda ("PIPA"), as well as subsidiary legislation and regulations promulgated thereunder. This Notice aims to give information on how we collect and process your Personal Information in the scenarios outlined above in the ‘Introduction’ (namely, through your use of the Site, the Platform, and the Services, including any information that you may provide to us or which we may receive). The Site and the Platform are not intended for minors (i.e. persons under eighteen (18) years of age) and we do not knowingly collect Personal Information relating to minors. It is important that you read this Notice together with any other privacy notice or Notice which we may provide on specific occasions when we are collecting or processing Personal Information about you so that you are fully aware of how and why we are using your Personal Information. This Notice supplements the other notices and is not intended to override them.

3.2 Privacy Officer

VNX Global is the organization responsible for your Personal Information. We have appointed a privacy officer (“PO”) who is responsible for overseeing questions in relation to this Notice and our processing activities in general. If you have any questions or requests, including any requests to exercise your legal rights as an Individual, please contact the PO using the details set out below.

3.3 Contact Details

Full name of legal entity:: VNX Global Ltd.
Email address:: PO@vnx.io
Postal address:: Park Place, 55 Par La Ville Road, Hamilton HM 11, Bermuda

3.4 Your Duty to Inform Us of Changes

It is imperative that the Personal Information we hold about you is accurate and current at all times. Otherwise, this will impair our ability to provide you with the availability of our Platform (amongst other potential and salient issues). Please keep us informed if your Personal Information changes during your relationship with us. For your right to rectify your Personal Information, please refer to Section 12 of this Notice.

3.5 Third-Party Links

Our Site and the Platform may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share information about you. We do not control these third-party websites and are not responsible for their privacy notices, statements, or policies. We encourage you to read the privacy notice of every website you visit.

4. KEY DEFINITIONS

Set out below are key definitions of certain information protection terms which appear in this Notice.

“Consent Form” refers to separate documents which we might from time to time provide you where we ask for your explicit consent for any processing of Personal Information which is not for purposes set out in this Notice.

"Individual" means a natural person.

"Organization" means any entity or public authority that uses Personal Information.

"Personal Information" means any information about an identified or identifiable Individual.

"Publicly Available Information" means Personal Information about an Individual which the Individual knowingly makes public or permits to be made available to the public, or which is legally obtained or accessed from (a) government records that are available to the public; or (b) information required by law to be made available to the public.

"Sensitive Personal Information" means any Personal Information relating to an Individual's place of origin, race, color, national or ethnic origin, sex, sexual orientation, sexual life, marital status, physical or mental disability, physical or mental health, family status, religious beliefs, political opinion, trade union membership, biometric information or genetic information.

"use" or "using", in relation to Personal Information, means carrying out any operation on Personal Information, including collecting, obtaining, recording, holding, storing, organizing, adapting, altering, retrieving, transferring, consulting, disclosing, disseminating, or otherwise making available, combining, blocking, erasing or destroying it.

Personal Information does not include information relating to a legal person (for example, a company or other legal entity). In that regard, information such as a company name, its company number, and registered address does not amount to Personal Information for the purposes of PIPA. Therefore, the collection and use of information strictly pertaining to a legal person does not give rise to obligations at law. Naturally, we will still treat all such information in a confidential and secure manner.

5. THE PERSONAL INFORMATION WE COLLECT ABOUT YOU

5.1. Categories of information

Personal Information means any information about an Individual from which that person can be identified (as stated above). It does not include information where the identity has been removed and is not relatable to an identified or identifiable person (“anonymous information”). During your relationship with us (including during the User Account opening stage), we may collect, use, store and transfer different kinds of Personal Information about you which we have grouped together. We collect information you provide directly to us. For example, we collect information when you create User Account, participate in any interactive feature of the Services, fill out a form, participate in a community or forum discussion, complete an exchange transaction, apply for a job at VNX Global, request customer support or otherwise communicate with us. The types of information we may collect include your name, date of birth, email address, postal address, phone number, certain digital asset information, and any further information you choose to provide. Only Personal Information necessary for carrying out and performing our tasks and Services, or made available by you on a voluntary basis, is collected. For avoidance of doubt, the following categories are applicable to customers (i.e. Individuals who hold a registered customer User Account with us). We request this information in order to be able to register you on our Platform.

Identity Information: includes your first name, maiden name (where applicable), last name, address, username or similar identifier, title, nationality, date of birth, gender, selfie photograph and video recording, identity card, driving license and/or passport number. This will form part of your User Account information on the Platform.
Contact Information: includes your billing address, email address and contact number (telephone and/or mobile).
Financial Information: includes information relating to your financial affairs, e.g. income, salary, assets and investments, payments, creditworthiness, loans, benefits, pension information, bank account or card details, virtual asset wallet address, virtual asset transactions history etc., including your bank account and payment details.
AML / KYC Information: includes the following due diligence / KYC information and documentation about you: (i) copy of valid I.D. card, driving license or passport, (ii) proof of residence (e.g.

confirmation of identity), (iii) KYC database checks, (iv) fraud database checks and (v) any documentation or information which we may, from time to time:

be required to collect to ensure compliance with any applicable legislation (including applicable foreign laws) and global AML/KYC practices; and/or
otherwise be mandated to collect by the Financial Intelligence Agency Bermuda ("FIA"), the Bermuda Monetary Authority ("BMA") and/or any other competent authority or law enforcement agency (national or international).

Marketing and Communications Information: includes your preferences in receiving marketing from us and our third parties and your communication preferences.

The following categories of Personal Information are applicable to customers holding a registered User Account with us who start using the Services, thus coming in addition to the information categories above. For the duration of this information being stored, please see Section 11. In accordance with the relevant legal obligations, AML/KYC Information will be stored until ten (10) years after the termination of the customer relationship. The purpose of storage is based on ensuring the operability of the system, the performance of the transactions on the Platform and compliance with the legal duties concerning KYC/AML/due diligence.

Transaction Information: includes details about:

the type of digital assets involved, the order volume, price, value and, where applicable, the proceeds derived;
your transactional history on the Platform, including withdrawals and order activity; and
the payments which we receive, or otherwise, charge you (e.g. our fees for your use of the Platform).

Portfolio Information: includes details about the digital assets and amounts credited to your User Account and your User Account balances.
Enhanced KYC Information: applies in accordance with our AML/ATF Policy whenever the compliance considers this necessary. .

For the duration of this information being stored, please see Section 11. The purpose of storage is based on ensuring the operability of the system, the performance of the transactions on the Platform, the compliance with the legal duties concerning KYC/AML/due diligence, and to maintain the integrity of the system. In all cases, we collect the following information upon access to our Platform/Site:

Technical/LOG Information: includes the IP address, your login data to the Platform (username and password), information on your internet service provider, device type, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and other technology on the devices you use to access the Site and Platform. This also includes information about your use of the Services, including the type of browser time and date of access, pages viewed, and the page you visited before navigating to our Services.
Device Information: includes information about the computer or mobile device you use to access our Services, including the hardware model, operating system and version, unique device identifiers, and mobile network information.
Usage Information: includes information about how you use the Platform.

For the duration of this information being stored, please see Section 11. The purpose of storage is based on the security of processing in order to ensure the stability and operational security of the system as well as for statistical purposes in order to derive aggregated information from usage information.

We also collect, use and share aggregated information such as statistical or demographic information for any purpose. Aggregated information will be derived from your Personal Information but is not considered Personal Information in law as this information does not directly or indirectly reveal your identity. For example, we may aggregate your usage information to calculate the percentage of users accessing a specific feature of the Site and/or the Platform. However, if we combine or connect aggregated information with your Personal Information so that it can directly or indirectly identify you, we treat the combined information as Personal Information which will be used in accordance with this Notice.

5.2. If you fail to provide Personal Information

Where we need to collect Personal Information about you:

a) by law; or
b) under the Terms of, or in connection with, the contract that we have with you (as discussed in Section 3 above); or
c) as part of our legitimate business interests to verify the identity of our applicants and customers, mitigate against risks (such as potential or suspected fraud) and in particular, to assess and take a decision on whether we will or should enter into a relationship with you (as subject to our customer acceptance criteria and policies);

and you either fail to provide that information when requested, or else provide incomplete or insufficient information, we may not be able to perform or conclude the contract which we have or are otherwise trying to enter into with you (namely regarding your User Account opening on the Platform and provision of our related Services). In certain instances, particularly where this relates to AML/KYC Information, we may even need to exercise our prerogative to terminate our contract with you, and thus withdraw the availability of our Services to you, or else, if still at application stage, we may have to decline to enter into a relationship with you. We will, however, notify you if this is the case at that point in time.

5.3 Sensitive Personal Information

We do not knowingly collect any information qualifying as Sensitive Personal Information about you. Should we receive Sensitive Personal Information about you, we will only process that information where there is a legitimate reason and purpose in accordance with PIPA where applicable, and, in all circumstances, in accordance with our obligations at law and under the appropriate safeguards.

As set out below in Section 7, we collect and process AML/KYC Information in order to be able to (i) comply with legal and regulatory obligations, as applicable (ii) conduct our AML and KYC checks, and other due diligence checks, on you, (iii) verify your identity or claimed identity and identify and/or verify your source of funds and source of wealth, as appropriate, (iv) perform a risk assessment on the potential customer relationship, (v) take an informed decision on whether we want to enter into a customer relationship with you, and, if positive, to conduct initial and ongoing screening and monitoring and (vi) to comply with any legal or regulatory obligation that we may have and/or any court, regulatory or enforcement order that may be issued upon us.

6. HOW WE COLLECT YOUR PERSONAL INFORMATION

6.1 User Account Registration and Opening

We will ask you to provide us with your Identity, Contact, Financial and AML/KYC Information when you apply to register and open User Account with us on the Platform. You provide these personal details and information to us, which we collect and use, when you fill in and submit our application form (together with other related forms) and complete our required application steps. Your User Account Information will be generated on the basis of your application and is also used and stored by us. For the duration of this information being stored, please see Section 11.

6.2 Service Use

This encompasses all of the information categories listed in Section 5 (namely, Identity, Contact, Financial, AML and KYC Information, Marketing and Communication Information, Enhanced KYC Information, Portfolio Information, and Transaction Information).

6.3 Direct Interactions

You may also give us your Identity, Contact, Financial, AML/KYC Information, Marketing and Communications Information, and Transaction Information by filling in our other forms (i.e. separate to our User Account opening and registration form), or by corresponding with us by post, phone, e-mail or otherwise. This includes Personal Information that you provide when you, as applicable:

apply to open User Account;
update or edit your User Account details;
subscribe to our Platform;
request withdrawals from your User Account;
contact us with complaints or queries;
report issues;
submit the (additional or supplementary) AML/KYC Information that we may request from you;
request marketing to be sent to you;
participate in a survey; or
provide us with feedback.

6.4 Automated Technologies or Interactions.

As you interact with the Platform and the Site, we may automatically collect Technical Information about your equipment, browsing actions and patterns (please see the bullet point “Technical/LOG Information” for the relevant information that is collected and used). We collect this Personal Information by using cookies, server logs and other similar technologies.

Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience, see which areas and features of our Services are popular and count visits, manage the registration process for User Accounts, remember your site preferences, retain certain information to process orders for exchange transactions, and retain information to provide you with support. Web beacons are electronic images that may be used on the Platform or emails and help deliver cookies, count visits, and understand usage and campaign effectiveness. Cookies remain stored until you delete them. Thus, we can recognize your browser when you visit the Platform/Site again.

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that choosing to remove or reject cookies could affect the availability and functionality of the Services.

Cookies retain their validity for the minimum period necessary for their functionality Please see our Cookie Notice further details.

6.5 Third Parties or Publicly Available Information.

We also obtain information from other sources and combine that with information we collect through the Services. For example, we collect information about you from third parties, including but not limited to social media platforms and publicly available information.

We also receive Personal Information about you from various third parties and public sources, as set out below:

Google Analytics

We use the web analytics service Google Analytics from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; 'Google') on our Site.
The data processing serves the purpose of analyzing this Site and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the information obtained on our behalf as the operator of the Site to evaluate your use of the Site, to compile reports on website activity and to provide us with other services related to website activity and internet usage. The following information, among others, can be collected: IP address, date and time of the page view, click path, information about the browser you are using and the device you are using (device), pages visited, referrer URL (website from which you accessed our Site), location data, purchase activities. The IP address of your browser transmitted by Google Analytics is not linked to any other Google data.
Google Analytics uses technologies such as cookies, web storage in the browser and tracking pixels, which enable an analysis of your use of the Site. The information about your use of our Site generated by the Google Analytics cookies is normally transmitted to a Google server in the USA and stored there.

There is no adequacy decision by the EU Commission for the USA. The data transmission takes place inter alia on the basis of standard contractual clauses as appropriate guarantees for the protection of personal data and is available at https://policies.google.com/privacy/frameworks and https://business.safety.google/adsprocessorterms/. Both Google and US government agencies have access to your data. Your data may be linked by Google with other data, such as your search history, your personal user accounts, your usage data from other devices and any other data that Google has about you.

In the case of users that fall within the remit of the GDPR, cookies or comparable technologies are used on the basis of Art. 6 (1). Whenever your personal data is processed with your consent on the basis of Art. 6 (1)(a) GDPR, you can revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent up to the revocation.
You can find more information on terms of use and data protection at https://marketingplatform.google.com/about/analytics/terms/us/ or at https://policies.google.com/?hl=en&gl=de and at https://policies.google.com/technologies/cookies?hl=en. Our Platform/Site also uses Google Analytics reports for performance, based on demographic characteristics and interests as well as reports to impressions in the Google Display Network. You may deactivate Google Analytics for display advertising and set the displays in the Google Display Network by accessing the display settings under this link: https://myadcenter.google.com/home?hl=ene&sasb=true&ref=ad-settings.

Google Tag Manager

The Platform and the Site use Google Tag Manager. Google is a group of companies and consists of the companies Google Ireland Ltd. (provider of the service), Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA and other affiliated companies of Google LLC.
This service allows you to administer so-called website tags centrally via an interface. Google Tag Manager implements only tags. No cookies are used and no personal data are collected.
Google has a privacy Notice for such data collection by third-party providers:

https://marketingplatform.google.com/intl/de/about/analytics/tag-manager/use- Notice/

However, Google Tag Manager does not access these data. If certain domains/websites or cookies were deactivated, it remains in place for all tracking tags provided that they are implemented using Google Tag Manager.

Identity, Contact, AML/KYC Data from publicly available sources such as public court documents, the Commercial Register and the company houses and registers of other jurisdictions, and from electronic data searches, online KYC search tools (which may be subscription or license based), anti-fraud databases and other third party databases, sanctions lists, outsourced third-party KYC providers and from general searches carried out via online search engines.

7. HOW WE USE YOUR PERSONAL INFORMATION

7.1. Purposes for which we will use your Personal Information

We will only use your Personal Information when applicable law allows us to. Most commonly, we will use your Personal Information in the following circumstances:

a) Where we need to perform the contract we are about to enter into or have entered into with you in respect of your customer relationship with us.
b) Where, except in relation to Sensitive Personal Information, a reasonable person giving due weight to the sensitivity of the Personal Information would consider that the Individual would not reasonably be expected to object that use of Personal Information and that the use does not prejudice the rights of the Individual (referred to below as the reasonable and non-prejudicial condition).
c) Where we need to comply with a legal or regulatory obligation.

We have set out below, in a table format, a description of all the ways we plan to use your Personal Information, and which of the legal basis we rely on to do so. We have also identified what our legitimate interests are where appropriate. We may process your Personal Information for more than one lawful ground depending on the specific purpose for which we are using your Personal Information.

Purpose/Activity	Type of Data	Lawful Basis for Use of Personal Information
To conduct due diligence checks on you (following your application to open and register User Account). To determine if we will enter into a customer relationship with you and, if positive, to register your User Account and on-board you as a new customer.	Identity Contact Financial AML/KYC Information	Performance of a contract with you. Necessary for compliance with our legal obligations. Reasonable and non-prejudicial on the basis that you have been informed of the use and our requirement to obtain this information for reasons including to establish and verify: your identity and suitability for the Platform, the existence of any risks that you may present as a prospective customer, your ability to meet financial commitments, and ultimately, to enable us to take an informed decision on whether we should enter into a customer relationship with you.
To Issue/redeem VNX Stablecoins, proprietary trading with VNX Stablecoins, exchange of digital assets (other than VNX Stablecoins), POBO/COBO payment services, etc.; Manage payments, fees, charges, etc.; collect and recover money owed to us, repay money owed to you, as applicable; and investigate any suspected fraudulent transactions.	Transaction Portfolio	You have been informed of the use and our requirement to obtain this information for reasons including to collect and recover money owed to us, repay money owed to you, and prevent fraudulent transactions.
For legal, tax and accounting purposes (e.g. reporting to tax authorities, accounting and record-keeping requirements).	Financial Transaction	Necessary to comply with a legal obligation.
To detect, prevent and report fraudulent or suspicious orders/transactions.	Identity Contact AML / KYC Information Enhanced KYC Information Financial Portfolio Transaction	Necessary to comply with legal obligations, where applicable. Reasonable and non-prejudicial on the basis that you have been informed of the use and our requirement to obtain this information for reasons including: protect the reputation of our business; avoid any complicity or association with fraud; report fraudulent or otherwise suspicious transfers that we receive (or which later comes to our knowledge) to relevant public authorities.
To manage our relationship with you, including, in particular, to: notify you about changes to the Terms or Privacy Notice; inform you about changes to the Platform (including the addition of new digital assets supported by the Platform); deal with your enquiries, requests, complaints or reported issues; provide you with customer support and assistance; contact you in relation to your User Account, portfolio and other related matters; ask you to participate in a survey; request feedback from you; advise you of industry and legislative updates; inform you about our events; provide you with information about the Platform; administer your User Account; provide you with any other information or materials that you have requested to receive from us; manage disputes with you or other users/customers; identify and correct issues with the Platform and/or the Site.	Identity Contact Financial User Account Portfolio Transaction Usage Profile Marketing and Communications	Performance of a contract with you. Reasonable and non-prejudicial on the basis that you have been informed of the use and our requirement to obtain this information for reasons including ‘customer care’ and service matters, to study how customers use the Platform, to assess our operations, to develop the Platform and our services, and grow our business.
To administer and protect our business, including the Platform and the Site, (including troubleshooting, data analysis, testing, system maintenance, support, safety and security testing, reporting and hosting of data).	Identity Contact Technical User Account	Reasonable and non-prejudicial on the basis that you have been informed of the use and our requirement to obtain this information for reasons including running and administering our business, network security, preventing fraud, and in the context of a business reorganization or group restructuring exercise. Necessary to comply with a legal obligation. Performance of a contract with you.
To deliver relevant website content and, where applicable, marketing communications to you and measure or understand the effectiveness of the marketing or advertising which we serve to you. To ensure that our content is presented in the most effective way for you and your computer and devices, and in a user-friendly manner.	Identity Contact User Account Usage Marketing and Communications Technical.	Reasonable and non-prejudicial on the basis you have been informed of the use and our requirement to obtain this information for reasons including to study how customers use the Platform, to develop the Platform and our services, to grow our business and to inform our marketing strategy.
To use data analytics, including those collected by third parties such as Google Analytics and Google Tag Manager, to improve the Site and the Platform, marketing, customer relationships and experiences.	Technical Usage	Reasonable and non-prejudicial on the basis that you have been informed of the use and our requirement to obtain this information for reasons including to define types of customers and investors that have registered an User Account on our Platform, to keep the Site and the Platform updated and relevant, to develop our business and to inform our marketing strategy.

We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we use your Personal Information for our legitimate interests. We do not use your Personal Information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about which grounds we are relying on and how we assess (which lawful condition applies) by contacting us at the following email address: PO@vnx.io

7.2 Marketing

We strive to provide you with choices regarding certain Personal Information uses in relation to your User Account. Through your User Account, Identity, Contact, Technical, Usage and Marketing and Communications Information, we can form a view on what we think you may want or need. We will send details as to how you may enhance your trading activity in relation to the User Account. You may receive marketing communications from us (which may consist of newsletters, industry updates, mailshots, publications, promotional materials and/or information about our events) where:

a) you provide your consent to receiving such marketing material; or
b) you have an ongoing commercial or contractual relationship with us (e.g. where we consider you to be an active customer and user of the Platform); and
c) provided you have not opted out of receiving marketing from us (see Your right to object in Section 12 below).

7.3 Third-Party Marketing

We will get your express opt-in consent before we share your Personal Information with any third parties (including our associated or related corporate entities) for marketing purposes. If consent is not provided, your Personal Information shall not be shared.

7.4 Opting Out

You can ask us to stop sending such advertising and marketing communications at any time by:

a) following the opt-out links on any marketing message sent to you;
b) contacting us at any time at PO@vnx.io Where you opt out of receiving such communications, this will not apply to Personal Information used or provided to us as a result of your entry into a customer relationship with us and our Platform for the other respective purposes.

7.5 Change of Purpose / Processing under a Different Purpose

We will only use your Personal Information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose, or we are obliged to process your information by applicable laws or court or other enforceable orders.

If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at PO@vnx.io.

If we need to use your Personal Information for an unrelated purpose based on a legal provision requiring such using, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Information without the need to obtain your consent, in compliance with the above rules, where this is required or permitted by law.

8. DISCLOSURES OF YOUR PERSONAL INFORMATION

We may have to share your Personal Information with the parties set out below for the purposes set out in the table in Section 7 above.

External third parties.
Suppliers and external agencies that we engage to process information on our and/or your behalf, including to provide you with the information and/or materials that you have requested.
Our subsidiaries, associates and agents where necessary to facilitate your relationship with us.
The Office of the Bermuda Privacy Commissioner, other applicable regulators, law enforcement agencies and other authorities who require reporting of processing activities, or may request information from us, in terms of applicable law and in certain circumstances.
Professional advisers such as consultants, bankers, professional indemnity insurers, brokers and auditors.
Other organizations where exchange of information is for the purpose of fraud protection or credit risk reduction.
Debt recovery agencies who assist us with the recovery of debts owed to us.
Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets (successors in title). Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Information in the same way and for the same purposes as set out in this Notice.

We require all third parties to respect the security of your Personal Information and to treat it in accordance with the law (including applicable information protection and privacy law). We do not allow our third-party business partners or service providers to use your Personal Information for their own purposes and only permit them to use your Personal Information for specified purposes and in accordance with our documented instructions. Furthermore, these third-parties access and process your information on the basis of strict confidentiality and subject to the appropriate security measures and safeguards. We may also disclose your information:

a) if we are under a duty to disclose or share your Personal Information to comply with any legal obligation, judgment or order from a court, tribunal or authority; or
b) if we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property or safety of VNX Global or others; or
c) in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company; or
d) if we have your consent or at your direction.

We may also share aggregated or anonymized information, which cannot reasonably be used to identify you.

9. INTERNATIONAL TRANSFERS

We do not generally transfer your Personal Information to entities outside Bermuda (other than to other VNX Global entities) except as may be necessary to: (i) enable your use of the Platform and the Services, (ii) fulfil our contractual obligations to you or exercise our contractual obligations against you, (iii) comply with our legal or regulatory obligations or (iv) assert, file or exercise a legal claim. Where we do need to transfer such personal data outside Bermuda (whether for these stated purposes or any other purpose listed in Section 7 above), we will seek to ensure a similar degree of protection is afforded to that Personal Information by ensuring at least one of the following safeguards applies or is otherwise implemented:

a) We will only transfer your Personal Information to countries that have been deemed to provide an adequate level of protection for Personal Information by the Bermuda Privacy Commissioner in a corresponding adequacy decision.
b) In the absence of an adequacy decision, we will verify that the recipient provides a level of protection comparable to that required under PIPA, or we have implemented appropriate contractual or other safeguards, or whether another transfer basis or exception under PIPA applies.
Such transfers of your Personal Information shall only take place subject to the appropriate safeguards. In particular, wherever possible and practicable, we make use of standard contractual clauses recognized or approved by the Bermuda Privacy Commissioner to transfer your Personal Information to our service providers indicated above.

Please contact us at PO@vnx.io if you want further information on the specific mechanism used by us when transferring your personal data out of Bermuda.

10. INFORMATION SECURITY

While no online or electronic system is guaranteed to be secure, we take reasonable measures to help protect information about you from loss, theft, misuse, and unauthorized access, disclosure, alteration and destruction.

In relation to you visiting our Site and/or the Platform, we use the industry standard encryption for the connection between our servers and the user's browser. Whether an individual page of our internet presence is transmitted through encryption can be seen by e.g. the shut padlock symbol in your browser’s address bar.

We have put in place appropriate technical and organizational security measures to prevent your Personal Information from being partially or entirely lost, accidentally or intentionally manipulated, used or accessed in an unauthorized way by third parties, altered, disclosed, or destroyed. In addition, we limit access to your Personal Information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Information on our instructions, and they are subject to a duty of confidentiality. Our security measures are improved in accordance with technological progress.

We have put in place procedures to deal with any suspected Personal Information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

11. INFORMATION RETENTION

11.1 How long will you use my Personal Information for?

Please note that we consider our relationship with you to be an ongoing and continuous customer relationship, until terminated.

We will only retain your Personal Information for as long as necessary to fulfil the purposes we collected it for (i.e. the ongoing service provision) and, thereafter, for the purpose of satisfying any legal, accounting, tax, KYC and AML, and reporting requirements or obligations to which we may be subject and/or to the extent that we may also need to retain your Personal Information to be able to assert, exercise or defend possible future legal claims against or otherwise involving you.

By and large, our retention of your Personal Information shall be aligned with the duration of data retention required by our AML/ATF Policy and the applicable laws. This period is set to be a minimum of five (5) years from the date of the termination of your relationship with us (which would typically arise from the closure/de- registration of your User Account on the Platform). This period of retention enables us to use the information in question for the possible filing, exercise or defense of legal claims (taking into account the timeframe of applicable statutes of limitation and prescriptive periods). In certain cases, though, we may need to retain your Personal Information for a period of up to ten (10) years in order to comply with applicable accounting and tax laws (this will primarily consist of your Transaction Information).

In the event that VNX Global’s activities are held by competent legislators and regulators to amount to a ‘relevant activity’ under due diligence law, we will retain your AML and KYC Information for the duration of your business relationship with us and for a further period of ten (10) years following its termination. We may need to revise this AML retention period in the event of applicable legal or regulatory developments, but we will notify you if this is the case at the time.

In some circumstances, you can ask us to delete your information. See below for further information.

Please contact our PO for further details about the retention periods that we apply.

11.2 Information Anonymization

Whenever and to the extent possible, we anonymize the information which we hold about you when it is no longer necessary to identify you from the data which we hold about you (anonymous information).

12. YOUR LEGAL RIGHTS

12.1 Your rights

You have rights under information protection laws in relation to your Personal Information.

a) Request access to your Personal Information.
b) Request rectification of your Personal Information.
c) Request erasure of your Personal Information.
d) Object to use of your Personal Information.
e) Request restriction of using your Personal Information.
f) Request transfer of your Personal Information.
g) Right to withdraw consent.

If you wish to exercise any of the rights set out above, please contact us at PO@vnx.io. These rights are explained below.

12.2 No fee usually required

You will not normally have to pay a fee to exercise your rights as an Individual under PIPA. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in the above circumstances.

12.3 What we need from you

We will need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights of Individuals). This includes your name, address, date of birth, and (in case of a passport/identity card being requested) its validity period.

12.4 Time limit to respond

We try to respond to all legitimate requests within the period of one (1) month from receipt of the request. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you within four weeks and keep you updated. Your legal rights explained further You have the right to:

a) Request access to your Personal Information. This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully using it. In particular, you are entitled to receive information on the use purposes, the categories of Personal Information, the categories of recipients to whom your Personal Information has been or is disclosed, the intended duration of storage, the existence of a right to correction or rectification, erasure, restriction of or objection to processing, transfer (data portability), the information’s origin (as far as it has not been collected on our part), as well as on the existence of automated Individual decision-making including profiling. You may send an email to PO@vnx.io requesting information as to the Personal Information which we use. You shall receive one copy free of charge via email of the Personal Information which is undergoing processing. Any further copies of the information processed may incur a charge of US$10.00 (or other currency equivalent).

If the confirmation as stated above cannot be delivered to you within one (1) month after receiving the request due to the complexity of the request, we will inform you of the extension of the deadline (of two (2) months maximum) within one (1) month after receiving your request, while providing reasons for the delay. The requested information will be delivered no later than within three (3) months after receiving the request (Sections 20(4) and (6) of PIPA), about the third party or publicly accessible source from which we have collected your Personal Information.

b) Request of rectification of the Personal Information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected and/or updated, though we may need to verify the accuracy of the new information you provide to us. As mentioned, it is in your interest to keep us informed of any changes or updates to your Personal Information which occur during your relationship with us.
c) Request erasure of your Personal Information. This enables you to ask us to delete or remove Personal Information where:

there is no need or legitimate reason for us continuing to process it;
you have withdrawn your consent to the processing (where applicable);
you have successfully exercised your right to object to processing (see below);
we have processed your information unlawfully; or
we are required to erase your Personal Information to comply with local law.

Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. These may include instances where continued processing or storage is necessary in order to be able to:

comply with a legal or regulatory obligation to which we are subject; or
establish, exercise or defend our legal claims.

d) Withdraw consent at any time where we are relying on consent to process your Personal Information (which will not generally be the case). This will not however affect the lawfulness of any processing which we carried out before you withdrew your consent. Any processing activities that are not based on your consent will remain unaffected by the withdrawal of consent.
e) Right to file a complaint with the supervisory authority: If you are of the opinion that your Personal Information has been processed unlawfully or that your rights have been breached, you have the right to lodge a complaint at any time with the Privacy Commissioner, (Office of the Privacy Commissioner for Bermuda), Maxwell Roberts Building, 4th Floor, 1 Church Street, Hamilton HM11, Bermuda (https://www.privacy.bm/). We would, however, appreciate the opportunity to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.

Kindly note that none of these rights of Individuals are absolute and must generally be weighed against our own legal obligations. If a decision is taken to override your request for your Personal Information, you will be informed of this by our compliance team along with the reasons for our decision.

12.5 Your choices regarding your User Account information

You may update, correct, or delete information about you at any time by logging into your online User Account. If you wish to delete or deactivate your User Account, please contact PO@vnx.io but note that we may retain certain information as required by law or where a lawful condition applies, as further highlighted above.

13. CONTACT US

If you need additional information, please contact us at PO@vnx.io.