1. Scope and controller
This Privacy Policy explains how ZEXO collects, uses, shares, retains and protects personal data when you visit a ZEXO website, create an account, use an application, communicate with support or use any related service. The ZEXO entity identified during onboarding or in a product-specific notice is responsible for the relevant processing. The publication timestamp shown with this document is its effective date.
This Policy should be read with the Terms of Service and any just-in-time privacy notice shown when information is requested. It does not govern an independent third party’s processing under its own privacy policy.
2. Information you provide
ZEXO may collect account and contact information; identity and verification documents; photographs or video evidence; tax information; source-of-funds and source-of-wealth information; payment and wallet details; beneficiary information; support communications; survey responses; and any other information you choose or are required to provide.
You must ensure that information about another person is lawfully provided and that the person receives any notice required by law.
3. Information generated through the Services
ZEXO may generate or collect account identifiers, balances, orders, trades, deposits, withdrawals, transfers, subscriptions, rewards, campaign activity, consent records, support history, security events and audit records. ZEXO also processes device, browser, operating system, application version, IP address, approximate location, language, time zone, session, authentication, cookie and diagnostic information.
When you interact with a blockchain, ZEXO may process public wallet addresses, transaction identifiers, network metadata and information obtained from blockchain analytics providers.
4. Information from other sources
ZEXO may receive information from identity-verification providers, fraud-prevention services, sanctions and politically exposed person screening providers, public registers, blockchain analytics providers, payment and custody providers, marketing partners, affiliates and public sources. ZEXO combines this information with information it already holds when permitted by law.
5. Why ZEXO uses personal data
ZEXO uses personal data to create and administer accounts; authenticate users; provide transactions and products; process deposits and withdrawals; calculate fees, rewards and eligibility; communicate about Services; provide support; maintain records; and improve reliability, accessibility and user experience.
ZEXO also uses personal data to prevent fraud and abuse; secure accounts and systems; detect market manipulation; perform identity, sanctions, anti-money-laundering and source-of-funds checks; respond to legal process; enforce agreements; manage disputes; and comply with legal and regulatory obligations.
Where permitted, ZEXO may use contact and activity information to measure engagement and provide product communications. You can manage optional communications through available preference controls. Security, legal and transaction notices are not optional marketing.
6. Legal grounds
Depending on the jurisdiction and context, ZEXO processes personal data to perform a contract with you; comply with legal obligations; protect vital or public interests; pursue legitimate interests such as security, fraud prevention, service improvement and legal claims; or with your consent. Where processing relies on consent, you may withdraw it prospectively, but withdrawal does not affect prior lawful processing.
7. Automated systems and risk decisions
ZEXO may use automated tools to detect fraud, account compromise, sanctions exposure, suspicious transactions, market abuse and other risk. These tools may delay an instruction or flag an account for review. Where applicable law provides a right to request human review or contest a qualifying automated decision, you may contact ZEXO through the official in-product support channel.
8. How information is shared
ZEXO may share personal data with affiliates and vetted service providers that support identity verification, custody, wallet infrastructure, cloud hosting, cybersecurity, communications, analytics, payments, customer support, professional advice and records management. Providers are authorized to process information only for specified purposes and subject to contractual and security requirements.
ZEXO may also share information with courts, regulators, law-enforcement bodies, tax authorities or other competent authorities when required or permitted by law; with counterparties or financial institutions as needed to execute an instruction; or in connection with a merger, financing, reorganization, sale of assets or similar transaction subject to appropriate safeguards.
ZEXO does not sell personal data for money. If a jurisdiction defines “sale” or “sharing” more broadly, ZEXO will provide any controls required by applicable law.
9. International transfers
ZEXO and its providers may process information in countries other than the country where you live. Those countries may have different data-protection laws. Where required, ZEXO uses recognized safeguards for international transfers, such as contractual protections, adequacy mechanisms or another lawful transfer basis.
10. Retention
ZEXO retains personal data for as long as needed to provide the Services, comply with legal and regulatory obligations, maintain financial and consent records, prevent fraud, resolve disputes and enforce agreements. Retention periods depend on the type of information, the sensitivity and risk of processing, account status and applicable law.
When information is no longer required, ZEXO deletes or anonymizes it, unless continued retention is legally required or technically necessary in secure backups. Public blockchain records cannot generally be altered or deleted by ZEXO.
11. Security
ZEXO uses administrative, technical and physical safeguards designed to protect personal data, including access controls, encryption, monitoring, logging, resilience and vendor review where appropriate. No system can be guaranteed completely secure. You are responsible for protecting your devices and credentials and for reporting suspected compromise promptly.
12. Your rights and choices
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing; receive a portable copy; withdraw consent; opt out of certain communications; request review of a qualifying automated decision; or complain to a data-protection authority. Rights may be limited where ZEXO must retain information for legal, security, anti-fraud or claims purposes.
Submit a request through the official in-product support channel. ZEXO may verify your identity before responding and may request information needed to locate the relevant records. An authorized agent must provide evidence of authority where required.
13. Cookies and similar technology
ZEXO may use strictly necessary storage and similar technology for authentication, security, preferences and service operation. Where required, optional analytics or measurement technologies are used only according to the choices presented to you. Browser or device settings may affect functionality.
14. Children
The Services are not directed to persons who do not meet the applicable minimum age. ZEXO does not knowingly offer accounts to children. If you believe a child has provided personal data contrary to this Policy, contact ZEXO through the official support channel.
15. Changes and contact
ZEXO may update this Policy prospectively to reflect changes in Services, law or processing. The current version and publication date will remain available through the legal pages, and additional notice will be provided where required.
Questions, complaints and privacy-rights requests should be submitted through the official in-product support channel. Information about the applicable ZEXO entity or local privacy contact may also be provided during onboarding or in a product-specific notice.