02 Privacy Notice and Personal Data Processing Authorization
1. Controller and Scope
This Notice explains how ATTEX, its affiliates, authorized service providers, compliance advisers and processors collect, use, store, share, transfer, protect and delete personal data during KYC, account onboarding, risk control, regulatory reporting and use of Platform services.
This Notice applies to the processing of personal data relating to Standard Verification, Additional Verification, OCR, liveness detection, face comparison, AML/CFT risk information collection, KYT placeholders and subsequent transaction monitoring.
2. Categories of Personal Data
Identity data: name, nationality, date of birth, document type, document number, issuing jurisdiction and expiry date;
Contact and account data: email address, phone number, account ID, login records, device information and IP address;
Verification materials: document images, selfies, liveness detection results, handheld document photos, authorization letters, proof of address, source-of-funds evidence, source-of-wealth evidence and supplementary files;
Biometric-related data: facial images, selfie videos, liveness detection results, similarity scores, biometric templates or provider responses;
Occupation and risk information: work status, industry, source of funds, source of wealth, trading purpose, expected transaction volume and PEP declaration;
Compliance and transaction data: review decisions, rejection reasons, risk tags, sanctions/PEP/adverse media screening results, KYT or blockchain risk indicators, audit logs, deposits, withdrawals, wallet addresses, blockchain transaction hashes, counterparty addresses and transaction patterns.
3. Purposes and Legal Bases
The Platform processes personal data to complete identity verification and account administration; comply with digital asset service provider obligations; prevent money laundering, terrorist financing, proliferation financing, fraud, sanctions evasion, account abuse and other unlawful activity; perform risk rating, transaction monitoring, KYT analysis, blockchain address risk identification and suspicious transaction handling; perform user agreements; handle disputes, audits, risk controls and regulatory assistance; and improve compliance processes and security controls.
Legal bases may include user consent, contract performance, compliance with legal and regulatory obligations, protection of legitimate interests of the Platform and users, compliance with AML/CFT and sanctions obligations, regulatory requirements and legitimate interests where permitted by applicable law.
4. KYC, KYT and Sensitive Data Processing
Document images, facial images, liveness detection results, biometric templates, identity document information, source-of-funds information and risk tags may constitute sensitive or high-risk personal data. The Platform will apply stricter security measures and access controls in accordance with applicable law.
The user understands and agrees that the Platform may use KYC identity information, AML questionnaire answers, risk tags and Additional Verification results for KYT transaction monitoring, deposit source risk identification, withdrawal destination address risk screening, blockchain address risk assessment, suspicious transaction handling and regulatory reporting.
5. Third-Party Processing, Sharing and Cross-Border Transfers
The Platform may provide necessary personal data to identity verification, OCR, facial verification, liveness detection, cloud storage, data security, sanctions screening, PEP, adverse media, KYT, compliance audit, legal advisory, regulatory reporting, payment/fiat channel or customer support service providers.
The user understands that data may be processed or stored in El Salvador, the Platform’s operating jurisdiction, cloud service locations, third-party provider locations or other jurisdictions permitted by law. The Platform shall take necessary data protection, cross-border transfer and contractual measures under applicable law.
6. Data Security, Retention and User Rights
The Platform shall adopt reasonable technical and organizational measures to protect personal data, including encryption in transit and at rest, access controls, backend preview restrictions, prohibition on downloading identity documents, least-privilege access, logging, abnormal-access audits, employee confidentiality obligations and service provider security requirements.
The Platform will retain personal data in accordance with the laws of El Salvador and other applicable laws, regulatory requirements, AML/CFT recordkeeping obligations, audits, dispute resolution, regulatory assistance and law enforcement assistance needs. After the necessary period, the Platform may delete, anonymize or continue to retain data required for regulatory, dispute, audit or law enforcement assistance purposes.
To the extent permitted by applicable law, users may request access, correction, update, restriction, objection, deletion, portability or withdrawal of consent. Withdrawal or deletion requests do not affect lawful processing before withdrawal and do not prevent the Platform from retaining and processing necessary data for legal, regulatory, AML/CFT, audit, dispute or law enforcement assistance purposes.
7. Governing Law, Jurisdiction and Dispute Resolution
Unless otherwise required by mandatory applicable law, this Notice and any matters arising from personal data processing, privacy requests, identity verification, risk control, regulatory assistance or related disputes shall, in principle, be governed by the laws of the Republic of El Salvador.
Users may submit requests, complaints or disputes through the customer support, privacy, data protection or compliance contact channels published by the Platform. The Platform shall receive and handle user requests within a reasonable period.
If the dispute cannot be resolved through consultation, and unless mandatory applicable law provides otherwise, the user may file a complaint or request with the competent courts, competent authorities or other applicable institutions of the Republic of El Salvador in accordance with law.