Privacy Policy

1. Who We Are

XBIT Global Ltd ("XBIT", "we", "our", "us") is a digital asset exchange platform. We are the data controller responsible for the personal information you provide to us. Contact our Data Protection Officer at: privacy@xbit.exchange

2. Information We Collect

We collect the following categories of personal data:

• Account Information: Full name, email address, phone number, date of birth, country of residence
• Identity Documents: Government-issued ID, passport, driver's licence, proof of address — collected for KYC compliance
• Financial Data: Transaction history, deposit/withdrawal records, wallet addresses
• Technical Data: IP address, browser type, device identifiers, login timestamps
• Behavioural Data: Pages visited, features used, time on platform — to improve services
• Communications: Support tickets, chat messages, email correspondence

3. How We Use Your Data

We process your personal data for the following purposes:

• Service Delivery: Operating your account, processing trades and transactions
• Legal Compliance: KYC/AML verification, reporting to regulatory authorities as required
• Security: Fraud detection, account protection, suspicious activity monitoring
• Communication: Transaction notifications, security alerts, service updates
• Product Improvement: Analytics to enhance Platform performance and features
• Marketing: Promotional emails (only with your explicit consent, can be unsubscribed at any time)

4. Legal Basis for Processing

We process your data under the following legal bases:

• Contract Performance: To provide the services you signed up for
• Legal Obligation: To comply with AML, KYC, and financial regulations
• Legitimate Interests: For security, fraud prevention, and service improvement
• Consent: For marketing communications (you may withdraw consent at any time)

5. How We Share Your Data

We do not sell your personal data. We may share your data with:

• KYC Providers: Identity verification partners (e.g., Onfido, Jumio) to process document checks
• Payment Processors: For fiat deposit/withdrawal processing
• Cloud Infrastructure: Secure cloud providers hosting our platform data
• Regulatory Authorities: Law enforcement, tax authorities, and regulators as required by law
• Fraud Prevention Services: To detect and prevent financial crime

All third-party data processors are bound by data processing agreements and are prohibited from using your data for their own purposes.

6. Data Retention

We retain your personal data for the following periods:

• Account data: For the duration of your account plus 7 years after closure (regulatory requirement)
• Transaction records: 7 years minimum (AML regulations)
• KYC documents: 5 years after the end of the business relationship
• Technical logs: Up to 12 months
• Marketing data: Until you withdraw consent or unsubscribe

7. Cookies & Tracking

We use the following types of cookies:

• Essential cookies: Required for the Platform to function (authentication sessions, preferences). Cannot be disabled.
• Analytics cookies: Help us understand how users interact with the Platform (e.g., Google Analytics). Can be declined.
• Marketing cookies: Used to show relevant advertisements. Only enabled with your explicit consent.

You can manage cookie preferences through the cookie consent banner displayed on your first visit, or in your browser settings at any time.

8. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Withdraw Consent: Revoke consent for marketing at any time

To exercise any of these rights, contact us at privacy@xbit.exchange. We will respond within 30 days.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. Where we transfer data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by relevant data protection authorities.

10. Data Security

We implement industry-standard security measures to protect your data, including:

• AES-256 encryption for data at rest
• TLS/HTTPS encryption for all data in transit
• Multi-factor authentication for system access
• Regular security audits by independent third parties
• Cold storage for the majority of digital asset holdings
• 24/7 monitoring and intrusion detection systems

Despite these measures, no system is completely secure. Please notify us immediately if you suspect any unauthorised access to your account.

11. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or prominent notice on the Platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact & Complaints

For privacy-related queries or to exercise your rights:

• Data Protection Officer: privacy@xbit.exchange
• General Support: support@xbit.exchange
• Response time: Within 30 days for data requests; 5 business days for general queries

If you are unhappy with how we handle your data, you have the right to lodge a complaint with your local data protection authority.