Privacy Policy

XBO – Privacy Policy INTRODUCTION

This privacy policy ('Privacy Policy') outlines Procryptic SP. Z.O.O a company incorporated under the laws of Poland and Clickjoint B.V., a company incorporated under the laws of Curacao ('Company', 'we', 'our' or 'us') practices with respect to information collected from users who access our website at https://www.xbo.com/ including any of its subdomains or similar domains with another extensions ('Website'), our non-downloadable or downloadable applications including without limitation any mobile applications ('Apps'), or use our other services (together with the Website and Apps: 'Services') or communicate with us in any other way (collectively, 'Users', 'you' or 'your').

The Company is constantly concerned about your Personal Information and privacy and has drafted this Privacy Policy to help you determine whether to use the Services. By accessing and using the Services, or providing information to us directly or publicly, you agree and accept the terms of this Privacy Policy as amended from time to time and consent to the collection and use of information in the manner set out in this Privacy Policy.

We encourage Users to carefully read the Privacy Policy and use it to make informed decisions.

This Policy is integrated into and forms part of our Terms of Use.

In this Privacy Policy, you can learn about:

• WHAT INFORMATION WE COLLECT?
• HOW WE USE THE COLLECTED INFORMATION?
• MINORS
• MARKETING
• WITH WHOM WE SHARE INFORMATION?
• INTERNATIONAL TRANSFER OF INFORMATION
• THIRD PARTY TRACKING TECHNOLOGIES
• THIRD PARTY SERVICES
• RETENTION OF PERSONAL INFORMATION
• YOUR RIGHTS
• HOW WE KEEP YOUR INFORMATION SECURED
• CHANGES TO THE PRIVACY POLICY
• HOW TO CONTACT US

We encourage you to read the Privacy Policy carefully and use it to make informed decisions. By visiting the Company’s websites, mobile apps or other online properties, by creating an account through our Services, or by otherwise using our Services, you hereby indicate that you have read and understood this Privacy Policy.

What information we collect?

We collect two types of information from our Users:

Personal Information

The first type of information which we collect is information that identifies or may reasonably identify an individual with a reasonable effort ('Personal Information'). Personal Information which is being gathered consists of the following:

• Account details and identification documentation: When you open an account and register to use the Services, you will be asked to provide us certain details about yourself, such as: first and last name, email address, password, gender, birth date, personal numeric code, age, physical address, governmental issued ID including date of issue and expiry as well as the number, fiscal code, signature, phone number and occupation. In addition, we may collect certain information as required under various anti-money laundering ('AML') and countering the financing of terrorism regulations ('CFT'), sanctions, crypto-assets, payments, electronic money, transfer of funds, financial services, digital operational resilience and other applicable laws or regulations, including Know Your Client ('KYC'), Know Your Business ('KYB') or Customer Due Diligence ('CDD') regulatory requirements, such as your source of funds, source of wealth, tax declarations, your photos, banks statements, salary slip, confirmation of employment, utility bills, bank statements and other proofs of address, or confirmation of a clean criminal record. We collect and store uploaded documents such as: copies, images or scan of your government-issued national ID card, or international passport or other government-issued proof of identification or any authentication information in order to identify or to assess risk of users, to process your requests and/or to comply with the applicable laws and regulations. We may use third parties to carry out identity verification on our behalf.
• Biometric Information – as part of the KYC, KYB, CDD and AML/CFT processes and in order to provide you with our services, we will require you to provide us with certain biometric information, such as your photo ('Biometric Information').
• Transaction and activity information: In order for us to provide the Services, we automatically or by request record different information related to your account and use of our Services, including with respect to your transactions, deposits (including without limitation their origin), balances, trades (as applicable), withdrawals (including without limitation their beneficiary), your users (where applicable) and any rewards or bonuses.
• Financial information: In order to provide you with our services, you will be required to provide certain financial information, including payment details information and digital asset wallet address. Such information will be collected and processed by us and by the relevant service providers ('Financial Information').
• Voluntary information: We also collect information which you provide us voluntarily in order to personalize his account or for a specific function, which you voluntarily provide to us at your discretion for a specific function. In addition, we collect your communication when you respond to communications from us, provide us with feedback, communicate with us via email or share additional information about you through your use of the Services.
• Device information: We collect specific types of connection details and information with regard to your device, software or hardware that may identify you, such as: device’s unique identifiers (e.g., UDID, IMEI and MAC address), browser fingerprinting, type of the operating system used by your device, language preference, access time, the domain name from which you linked to the Services, IP address and geo-location data.
• Information we collect from third parties: We collect Personal Information from third party service providers, such as information which is gathered in order to verify your identity and prevent fraudulent or illegal activity.

As a User, you are responsible for providing true and accurate information and for keeping the Company informed of any changes in your Personal Information or circumstances by emailing Company’s support at [email protected].

Non-personal Information

The second type of information is un-identified and non-identifiable information pertaining to you, which may be made available or gathered via your use of the Services ('Non-Personal Information'). Non-Personal Information which is being collected consists of technical information and aggregated usage information, and may contain, among other things, your operating system, type of browser, screen resolution, browser and keyboard language, your ‘click-stream’ and activities on the Services, the period of time you visited the Services and related time stamps, etc.

For avoidance of doubt, any Non-personal Information connected or linked to any Personal Information shall be deemed as Personal Information as long as such connection or linkage exists.

Types of Non-personal Information we collect from or about you:

• Log-in history and technical information: In order to enhance the functionality of the Services and to provide you with a better user experience, we collect technical information transmitted by your device, including certain software and hardware information (e.g., the type of browser and operating system your device uses, language preference, access time and the domain name of the website from which you linked to the Services, etc.).
• Device and connection information: We collect information from the particular device you are using, for security and fraud detection and prevention purposes. For example, we may gather information with regard to other software which is running simultaneously with the software for detecting if you are using software which is associated with fraudulent activity (e.g., robots, malware, etc.) or checking if the connection you are using is via a VPN or proxy.
• Analytics information: We collect information about your use of the Services, such as applications' usage, log files, user activity (e.g., pages viewed, the amount of time spent on particular pages, online browsing, clicks, actions, etc.), time stamps, alerts, etc. This information is collected for amongst other things troubleshooting errors and bugs as well as for research and analytics purposes about your use of the Services.
• Anonymous information: We may anonymize or de-identify the information collected by the Services or via other means so that the information cannot, on its own, personally identify you. Our use and disclosure of such aggregated or de-identified information is not subject to any restrictions under this Privacy Policy, and we may disclose it to others without limitation and for any purpose, such as for advertising or marketing purposes.

How we use your personal information

We will process your Personal Information for a variety of reasons, each of which is prescribed by the applicable data protection and other laws and regulations.

Where we rely on your consent to process your Personal Information, you have the right to withdraw or decline consent at any time. Where we rely on our legitimate interests to process your Personal Information, you have the right to object.

If you have any questions about or need further information concerning the legal basis on which we collect and use your Personal Information, please contact us through the contact details available below.

Where you have not consented (or have withdrawn your consent) to the processing of your Personal Information by us, we may continue to process your Personal Information (a) where processing is required for the performance of the contract (i.e. the Terms of Use between you and us); and/or (b) where processing is necessary for compliance with a legal obligation to which we are subject; (c) where processing is necessary for the purposes of a legitimate interest of the Company (including for security reasons or for marketing purposes).

Minors

The Services are not designed or directed to persons under the age of 18 or persons under the age of legal consent with respect to the use of the Services of any jurisdiction, whichever is higher ('Legally of Age'). If you are not Legally of Age, you should not download or use the Services nor provide any Personal Information to us.

We reserve the right to access and verify any Personal Information collected from you. In the event that we become aware that a user who is not Legally of Age has shared any information, we may discard such information unless it is needed to comply with any legal or statutory obligation binding upon us. If you have any reason to believe that a minor has shared any information with us, please contact us (our contact details are available under the 'HOW TO CONTACT US?' section).

Marketing

The Company may use Personal Information, such as your IP or transaction history collected by Company or through its trusted third party subcontractors for the purpose of providing Users with promotional materials via different marketing techniques such as direct email, telephone marketing, SMS concerning the Services as well as products, services, websites and applications which relate to: (i) other companies within the Company's group or any other affiliated entities with the Company ('Group'), as applicable; or (ii) the Company's business partners and affiliates (collectively: 'Marketing Affiliates'), which we believe could interest you.

Company may also share and disclose Personal Information with Marketing Affiliates for the purpose of providing Users different marketing offers, which Company, or Marketing Affiliates, believe are relevant for User.

Company might use your Personal Information for the purpose of providing Users with promotional materials solely where Company has a legitimate interest in doing so, or where it has obtained User's affirmative consent.

You have the possibility at any time to decline receiving further marketing offers from Company or from Marketing Affiliates by contacting Company's customer support. Please note that even if you unsubscribe from Company's marketing mailing list, the Company shall continue to send you service-related updates and notifications.

In addition, if you download any of our mobile applications to your device from the Apple AppStore or Google Play, the only way to prevent receipt of notifications is by changing the settings on the device itself.

With whom we share information?

We do not rent, sell, or share your Personal Information with third parties ('Recipients') except as described in this Privacy Policy. The Personal Information will be disclosed to Recipients only to the extent required for the specific purpose, as stipulated in this Privacy Policy.

We share Personal Information with any of the following recipients:

• Any replacement service provider that we engage with to operate the Services;
• Companies within the Group as applicable and other affiliated companies;
• Subcontractors and third party service providers, as well as their subcontractors, which by way of example include (but is not limited to) cloud computing companies, security companies, marketing affiliates, KYC / KYB / CDD providers and identity verification services providers, sanctions and trade restrictions screening services providers, fraud prevention services providers, and other data verifiers;
• Payment service providers, payment processors and banks;
• Any third parties who provide services in relation to the operation or promotion of the Services;
• Auditors, contractors or legal/financial/other advisers of any of the Group’s business processes;
• Any third parties who investigate, detect or prevent fraudulent or illegal activity or enable us to enforce our policies, including in order to ascertain your source of income or funds (e.g., governmental authorities, law enforcement bodies, banks and other investigatory bodies);
• Governmental, judicial, quasi-judicial and regulatory bodies, in accordance with applicable laws and regulations;
• Research, technical diagnostics and analytics vendors;
• Marketing and advertising partners (see above, under 'Marketing Purposes');
• Potential purchasers, successors or investors in the Company or in any of the companies within the Group, or in a corporate transaction (e.g., sale of a substantial part of our business, merger, reorganization, bankruptcy, consolidation or asset sale of any asset or transfer in the operation thereof) in relation to the Company (in such event, the acquiring company or transferee will assume the rights and obligations as described in this Privacy Policy);

In addition to the purposes listed in this Privacy Policy, we share Personal Information with the relevant Recipients whenever we believe in good faith that disclosure is necessary to protect our rights or legal claims, enforce our policies (including our Terms of Use and Privacy Policy), protect your safety or the safety of others, as well as to investigate or prevent any fraud or illegal or non compliant use, for security reasons or to help us with any other related technical issue.

International transfer of information

Since we operate globally, it may be necessary for the provision of Services and to the extent required for the specific purpose, as stipulated in this Privacy Policy to transfer your Personal Information to countries outside the European Union and European Economic Area, including the United States. The data protection and other laws of these countries may not be as comprehensive as those in the European Union and the European Economic Area. In such case, in the absence of an adequacy decision by the European Commission (list of approved jurisdiction available here), we will only transfer your Personal Information on the basis of the Standard Contractual Clauses adopted by the European Commission (available here).

For more information about the transfer of your Personal Information outside of the EEA, please contact us (our contact details are available under the 'HOW TO CONTACT US?' Section).

Tracking technologies

When you visit or access our Services (for example when you visit our websites), we use (and authorize third parties to use) web beacons, cookies, pixels, scripts, tags and other technologies ('Tracking Technologies').

The Tracking Technologies allow us to automatically collect information about you and your online behavior, as well as your device (for example your computer or mobile device), for different purposes, such as in order to enhance your navigation on our Services, improve our Services’ performance and customize your experience on our Services. We also use this information to collect statistics about the usage of our Services, perform analytics, deliver content and advertisements which are tailored to your interests and administer services to our Users, advertisers, publishers, customers and partners.

We also allow third parties to collect information about you through Tracking Technologies.

Cookies are small data files that are placed on users’ devices to monitor how users interact with websites and other online services. Cookies can be used to identify your IP address, browser type, domain name, and specific web pages through which you click.

Please note: You can control the delivery of certain advertising or social campaigns through the settings offered by the respective third party platforms.

Third party services

While using the Services you may encounter links to third party websites, services or applications. Please keep in mind that this Privacy Policy does not apply to any third party websites, services or applications, even if they are accessible, downloadable, or otherwise distributed through the Services.

Please be advised that such third party websites, services or applications are independent from the Company. We assume no responsibility or liability whatsoever with regard to privacy matters or any other legal matter with respect to such third party websites or services. We encourage you to carefully read the privacy policies and the terms of use of such third party websites or services, as their terms, not ours, will apply to any of your interactions with such third parties.

You should always review their privacy practices carefully before providing Personal Information to such third parties.

You are knowingly and voluntarily assuming all risks of using any third-party websites, services or applications. You agree that we shall have no liability whatsoever with respect to such third party websites and your usage of them.

Compliance with the travel rule and data sharing

To comply with applicable regulations, including the Financial Action Task Force's (FATF) Travel Rule, our Company may be required to collect, process, and share specific personal information with third parties such as financial institutions, payment providers, and regulatory authorities. This information may include your name, contact details, identification information, and transaction details.

We share this information only to the extent necessary to meet our legal obligations, prevent financial crimes, and ensure regulatory compliance. We implement strict safeguards to protect your personal data and only engage with trusted partners and entities that adhere to robust data protection and privacy standards.

Retention of personal information

If you have registered with an account through our Services, the Company will retain your Personal Information during the period your account is active. In addition, the Company will retain your Personal Information for additional periods, as strictly necessary to enable the Company to meet its legal obligations under applicable laws or regulations, such as the applicable crypto-asset, payments, electronic money, financial services, digital operational resilience, transfer of funds, AML/CFT and sanctions or trade restrictions-related laws or regulations including any KYC, KYB or CDD requirements, as well as to meet the Company’s contractual obligations.

In addition, the Company may retain your Personal Information for longer periods, provided that retaining such information is strictly necessary for the Company’s legitimate interests, such as fraud prevention and record keeping, resolving or exercising claims regarding potential disputes, and where the Company is guided to do so by the applicable supervisory authority.

Your rights

You have certain rights regarding the collection and processing of Personal Information. To the extent these rights apply to and concern you, you can exercise the following rights:

• Rights of access – You can obtain a copy of the Personal Information held by the Company at any time;
• Right of data portability – You have the right to receive your Personal Information, in a structured, commonly used and machine-readable format and to request that your Personal Information be transmitted to a third party of your choice;
• Right of rectification – In the event that the data held about you by the Company is inaccurate, incomplete or outdated, you have the possibility to request the rectification of said data (except in cases where the information is required to be kept in its original format under any applicable laws and regulations);
• Right of erasure – You have the possibility at any time to request that the Company erases data held about you by sending an email to the Company as outlined in this Privacy Policy. However, you are advised that with the deletion of your Personal Information, you might not be able to use the Services anymore or the account might be totally closed;
• Right to restriction of processing, objection to processing – At any time, you have the right to request that the Company restricts or ceases to conduct certain data processes provided that there exists no other lawful basis on which the Company is authorized to process said data;
• Right to withdraw consent – You have the right to withdraw given consent at any time. The withdrawal of consent will not affect the lawfulness of processing;
• Right to lodge a complaint – All requests, complaints or queries should be addressed to the Company to the following email address: [email protected] with the subject ‘Privacy’. We will consider any requests, complaints or queries and provide you with a reply in a timely manner. You can also file a complaint with the relevant data protection authority, should you not be satisfied with the way in which we handle your Personal Information.

We take our obligations seriously and we ask that any concerns be first brought to our attention, so that we can try to resolve this.

Please note that these rights are not absolute and requests are subject to any applicable legal requirements, including without limitation crypto-asset, payments, transfer of funds, electronic money, financial services, digital operational resilience, AML/CFT and sanctions and trade restrictions-related laws and other legal and reporting or document retention obligations. We may also rectify, replenish or remove incomplete or inaccurate information, at any time and at our own discretion, in accordance with our internal policies.

How we keep your information secured

We take great care in implementing and maintaining the security of the Services and your information. We have put in place appropriate physical and technological safeguards to help prevent unauthorized access, to maintain data security, and to use correctly the information we collect online. These safeguards vary based on the sensitivity of the information that we collect and store.

We employ industry standard procedures and controls to ensure the safety of our users’ information, such as:

1. Secure network topology;
2. Encrypted communication;
3. Authentication and access control;
4. Static security analysis tools;
5. DDOS and WAF protection tools;
6. Next generation anti-virus;
7. External and internal audit tests, etc.

Although we take reasonable steps to safeguard information, we cannot be responsible for the acts of those who gain unauthorized access or abuse the Services, and we make no warranty, express, implied or otherwise, that we will prevent such access.

Changes to the privacy policy

We reserve the right to periodically amend or revise the Privacy Policy; material changes will be effective immediately upon the display of the revised Privacy policy. The last revision will be reflected in the 'Last modified' section. Your continued use of the Site or services, following the notification of such amendments on our Site, constitutes your acknowledgment and consent of such amendments to the Privacy Policy and your agreement to be bound by the terms of such amendments.

How to contact us?

If you have any general questions about the Services or the information that we collect about you and how we use it, please contact us by:

Email at: [email protected]

The Privacy Policy has been drafted in the English language. In the event of any discrepancy between the meanings of any translated versions of the Privacy Policy and the English language version, the meaning of the English language version shall prevail, to the extent permissible by domestic law in the jurisdiction you reside in.

Last updated on the 21st of March 2025