Bitzaro OTC Privacy Policy

Last Updated 23 October 2026

1. Scope

1.1 This Policy explains how Bitzaro Limited collects, uses, shares, stores and protects personal data for its OTC service operated through Vazex at https://v2-waaslite-otc.vazex.io/, including onboarding, quotes, orders, settlement, support and related communications (OTC).

1.2 It covers customers, prospective customers, business representatives, directors, beneficial owners and other individuals whose data is supplied for OTC, including access through partners. Separate WaaS Lite merchant payment services, Bitzaro wallet and card products and partners’ independent services have their own notices. Any reuse of OTC data remains subject to this Policy and applicable law.

1.3 At or before collection, we explain relevant purposes, whether information is obligatory or voluntary, consequences of not providing required information, recipient classes and access and correction rights and contact details. Additional notices and separate consent are provided or obtained where required. This Policy is not blanket consent to processing.

2. Responsible Entity

2.1 Bitzaro Limited, incorporated in Hong Kong with Business Registration Number 76340539, is the data user under Hong Kong’s Personal Data (Privacy) Ordinance for processing described here. Where applicable law uses the term controller, we act in that capacity to the extent we determine processing purposes and means.

2.2 Privacy and data rights requests may be addressed to the person responsible for data protection at [email protected] or Room 1406, 14/F, Solo Building, 41–43 Carnarvon Road, Tsim Sha Tsui, Kowloon, Hong Kong.

2.3 We comply with applicable data protection laws, including Hong Kong’s Ordinance, and provide supplementary notices where additional legal requirements apply. Mandatory rights are preserved.

3. Data Collected and Sources

3.1 Identity and contact data include names, contact details, date of birth, nationality, identification documents, address evidence and verification photographs, selfies, video, facial comparison or liveness information where relevant to the checks used.

3.2 Business and compliance data include incorporation, ownership, directors, beneficial owners, representatives and authority records; occupation, source of funds or wealth, transaction purpose and account or wallet ownership evidence; screening results, risk assessments and review records.

3.3 Transaction data include bank and wallet details, assets and networks, quotes, orders, rates, fees, amounts, payment evidence and references, blockchain records, settlement and refund instructions and related records.

3.4 Account, technical and usage data include account and referral identifiers, authentication and session events, IP addresses, browser and device information, access and interaction records, cookies and security logs, to the extent collected by the tools used. Collection may occur before registration.

3.5 Communications and administration data include enquiries, attachments, complaints, account status, restrictions, investigation notes and audit records.

3.6 Sources include you and your authorised representatives; introducing partners; banks, payment, verification, screening and other service providers; public blockchains, registries and other lawful public sources; and records generated through our operations and your use of OTC.

3.7 Partners may supply account identifiers, contact information, referral data, verification status or prefilled order information where the arrangement lawfully permits this. Where you supply another person’s data, you must have appropriate authority and provide relevant privacy information where required. This does not remove our own duties.

3.8 Information needed for verification, security or transaction processing is identified at collection. Without it, we may be unable to onboard you, execute an order or continue service. Optional preferences are not automatically compulsory.

4. Purposes and Processing Conditions

4.1 We process personal data to administer accounts; authenticate customers and representatives; verify identity, authority and ownership; assess eligibility and risk; prevent financial crime and fraud; secure OTC; and meet applicable legal, sanctions and recordkeeping obligations.

4.2 We also use data to provide quotes, process and settle orders, investigate payments, handle refunds and exceptions, communicate operational and security information, resolve enquiries and complaints, administer referrals and commissions, maintain and improve service functionality, obtain professional advice and establish or defend legal claims.

4.3 Data is used for the purposes explained at collection or directly related purposes permitted by applicable law. An incompatible new purpose requires the notice, prescribed consent or other legal authority applicable to that use.

4.4 Where applicable law requires a lawful basis, we identify an appropriate basis for the activity, such as contractual necessity, a legal obligation actually applicable to us, consent or legitimate interests where recognised and properly assessed. Additional conditions for biometric or other sensitive data are addressed where required. Receipt of this Policy alone is not consent.

4.5 Subject to applicable law and your choices, we may use your name and contact details to send information and offers about OTC and related Bitzaro digital-asset conversion, payment, wallet and card services. Before using personal data for direct marketing, we provide the required information about the data and classes of products or services involved, a means to indicate your choice, and obtain the consent required under applicable law. You may opt out without charge at any time using the unsubscribe facility provided or by contacting [email protected]. Refusing marketing does not affect access to OTC. Necessary transaction, account, security and legal notices may still be sent.

4.6 We do not treat consent to marketing by one product or entity as permission for every other product or group entity. Before providing personal data to another person, including a group company, for its own direct marketing, we provide the required disclosure and obtain the required written consent, including disclosure of any intended provision for gain where applicable. Any such use must remain within the scope of the consent and applicable law.

5. Verification Providers and Reused Checks

5.1 We use Sumsub to support identity and risk checks. Our service agreement identifies SUMSUB TECH LTD of Cyprus as the contracting provider. Checks may involve identification documents, photographs, selfies or video, facial comparison, liveness and screening results, depending on the enabled services.

5.2 Biometric checks are explained before collection and separate consent is obtained where required. Authorised personnel may access relevant documents and results where necessary for their duties, with access restricted by role.

5.3 Where Sumsub acts on our behalf, its processing is governed by our instructions and applicable data processing arrangements. It may also process data for its own purposes, including fraud prevention and service development, where permitted by the applicable arrangements and law. Its Service Privacy Notice is available at https://sumsub.com/privacy-notice-service/. That notice supplements our disclosures and does not replace our responsibilities.

5.4 Earlier verification from another Bitzaro product or an approved partner may be reused only where consistent with applicable law, relevant notices and appropriate sharing arrangements. We may require new or updated checks. Shared infrastructure alone does not authorise sharing or reuse.

5.5 You may contact us about verification processing or challenge inaccurate results. Where processing relies on consent, you may withdraw it. If a necessary verification method cannot lawfully continue, the affected service may be unavailable unless an appropriate alternative exists. Withdrawal does not affect earlier lawful processing or lawful retention.

6. Sharing and Partner Access

6.1 We share relevant data with verification, sanctions screening, blockchain analytics, hosting, communications, security and support providers for the purposes described here. Providers acting on our behalf are subject to contractual or other appropriate safeguards covering security, confidentiality, permitted use, retention and subcontracting. Independent processing is subject to the recipient’s applicable duties and notices.

6.2 Banks, payment channels, exchanges and wallet or settlement providers receive data necessary to process, investigate and comply with requirements concerning payments, transfers and refunds. Some act as independent data users or controllers.

6.3 Introducing partners may receive limited identifiers, referral attribution, relevant order status, transaction volume and commission information needed for their authorised role. Dashboard access is restricted accordingly and reviewed when the relationship changes or ends. A referral alone does not authorise access to identity documents, biometric data, private support messages, internal AML findings or confidential reports. Any additional role requires a justified purpose, appropriate safeguards and required notice or consent.

6.4 Relevant group entities may receive data for defined OTC operational, technical, settlement, security or compliance purposes under appropriate arrangements. Group membership alone does not permit unrestricted access. Relevant entity roles are explained in the collection information applicable to the arrangement.

6.5 Other recipients may include regulators, law enforcement, courts and authorities where legally required or permitted; professional advisers and auditors; and prospective or actual purchasers or successors under appropriate confidentiality and data protection safeguards.

6.6 Blockchain transfers make addresses, amounts, transaction hashes and related on-chain information public. Confirmed blockchain records generally cannot be erased or altered by us. This does not remove our responsibilities for off-chain records we control.

6.7 We do not sell personal data. Provision for another person’s own direct marketing, if proposed, is subject to clause 4.6 and applicable law. A partner’s independent services are governed by its notice, but we remain responsible for our own disclosures.

7. Overseas Processing

7.1 Data may be stored, accessed or processed in Hong Kong and jurisdictions used by authorised providers and group entities for the stated purposes. Processing locations depend on the services and hosting arrangements in use; overseas remote access may also be relevant under applicable transfer laws.

7.2 Sumsub publishes its provider and location information at https://docs.sumsub.com/docs/third-party-processors-and-affiliates. The providers involved depend on the services and contracting arrangements applicable to our account. Contact us for information about arrangements relevant to your data.

7.3 We use appropriate contractual, organisational and technical measures for overseas processing and comply with applicable transfer requirements, including additional safeguards, notice or consent where required. Overseas processing does not remove our legal responsibilities.

8. Automated Processing and Review

8.1 Automated tools may support identity and liveness checks, screening, risk assessment, deposit detection and order controls. Results may affect verification, access or order processing and may be inaccurate or incomplete. A risk indicator is not proof of wrongdoing.

8.2 Settlement involves our operations team, but not every preceding automated outcome necessarily receives human review. You may contact us to challenge inaccurate information or request review of an outcome. Where review is required or offered, it is carried out by a person with appropriate authority, subject to legal confidentiality and security restrictions.

9. Retention and Deletion

9.1 We retain data only for as long as necessary for the stated purposes and applicable legal requirements. Retention depends on the record, including identification and relationship records, transactions, accounting, unsuccessful applications, complaints, security investigations and legal claims, and the relevant completion, closure or other legally prescribed event.

9.2 Lawful holds, investigations or disputes may justify longer retention of relevant records. Account closure or withdrawal of consent does not require deletion of data we must or are lawfully entitled to retain. We securely delete or effectively anonymise data when retention is no longer justified.

9.3 Providers processing on our behalf are subject to appropriate retention and deletion requirements. Independent providers may have separate lawful retention purposes. Biometric and verification records are subject to the purposes and requirements applicable to that processing, rather than being retained indefinitely merely because they were collected for verification.

9.4 Restricted backup records are deleted or overwritten under the applicable cycle; relevant deletion requirements are reapplied if restored. Public blockchain records are addressed in clause 6.6.

10. Security and Incidents

10.1 We use technical and organisational safeguards appropriate to the data and processing risks, including access restrictions, confidentiality requirements and controls for relevant systems and providers. Safeguards are reviewed as appropriate, but no system eliminates every risk.

10.2 We assess suspected incidents, take appropriate containment and response measures and notify authorities and affected individuals where required by applicable law. Suspected account compromise or data incidents may be reported to [email protected].

11. Cookies and Similar Technologies

11.1 OTC and embedded tools may use cookies, local storage and similar technologies for authentication, security and service functionality, including preferences where supported. These may involve personal data such as online identifiers and device or usage information.

11.2 Information on the technologies deployed, relevant providers, purposes, duration and available controls is provided through the relevant portal or tool notices. Optional analytics or advertising technologies are subject to the applicable notice and consent requirements before activation.

11.3 You may manage browser storage through browser settings and any consent controls provided. Blocking necessary technologies may affect functionality. Removing browser data does not delete records lawfully held on our systems or by providers. A partner’s independent site has its own notice; we remain responsible for the tools we deploy.

12. Rights and Choices

12.1 Subject to applicable law and exemptions, you may request access to or a copy of your personal data and correction of inaccuracies. Other rights, such as deletion, restriction, objection, portability, withdrawal of consent or review of automated decisions, apply where the relevant law provides them.

12.2 Send requests to the data protection contact in clause 2.2. We may reasonably verify identity and representative authority and respond within applicable statutory periods. If a request cannot be fulfilled in whole or part, we explain the reason and relevant complaint options where lawful. Any permitted extension is communicated as required.

12.3 Withdrawal of consent concerns processing based on that consent and does not invalidate prior lawful processing or separate legal duties. Marketing opt-outs are free and do not stop necessary service notices.

12.4 You may complain directly to the competent data protection authority. For Hong Kong matters, contact the Office of the Privacy Commissioner for Personal Data at https://www.pcpd.org.hk/. Contacting us first is optional.

13. Children

13.1 OTC is not intended for anyone under 18 or a higher applicable age of majority. If we identify information from an ineligible child, we restrict use and delete or limit processing as appropriate, subject to lawful retention requirements.

14. Policy Changes

14.1 We publish updated versions with an effective date and give notice of material changes through OTC or email as appropriate. New purposes or activities are subject to any additional notice or consent required before they begin. Continued use alone is not consent where a specific affirmative choice is required.

15. Contact

15.1 For OTC privacy, data rights or security matters, contact the person responsible for data protection at Bitzaro Limited, [email protected], or Room 1406, 14/F, Solo Building, 41–43 Carnarvon Road, Tsim Sha Tsui, Kowloon, Hong Kong.