Privacy Policy

Last updated: January 1, 2025

Bitnxs (“we”, “us”, “our”) respects your right to privacy. This Privacy Policy explains how we collect, use, share, and store information when you access or use the Bitnxs platform, and the rights you have. This Policy should be read together with the Terms of Service.

1. Information We Collect

We design the Bitnxs platform to operate with minimal personal data collection. Many of the items listed below are optional or apply only in specific circumstances.

Wallet and on-chain information: when you connect a self-custodied wallet, we receive your public wallet address, signed messages used for authentication, and the public transaction history associated with that address on the relevant blockchains. We do not have access to your private keys or seed phrase.

Device and connection information: your IP address, approximate geolocation derived from your IP, device type, operating system, browser type and version, screen resolution, language settings, time zone, and referring URL. We may also collect technical fingerprints used to detect fraud, sanctions-list matches, and abuse.

Activity information: pages you view, features you use, orders you place, search queries, and timestamps. We log API requests and errors generated by your client.

Communications: if you contact our support, send feedback, or otherwise communicate with us, we receive the content of those communications and any email address or contact handle you provide.

At the current stage, we do not collect identity-verification information (“KYC information”) such as legal name, government identification, or proof of address from general users. If we introduce KYC in the future for some or all users, we will update this Privacy Policy and provide notice before such collection begins.

We do not knowingly collect any “special category” personal data (e.g., health, biometric, religious, or political-opinion data) and ask that you not submit such data through the Services.

2. How We Use Information

Provision of the Services: to authenticate your wallet, route and execute your orders, calculate your margin, and display your account state.

Security and integrity: to detect and prevent fraud, market abuse, sanctions evasion, unauthorised access, and abuse of the platform; to investigate incidents; to enforce the Terms of Service.

Compliance: to comply with applicable laws, regulations, court orders, and lawful requests from competent authorities.

Service improvement: to understand how users interact with the platform; to debug and improve performance, reliability, and feature design; to develop new features and markets.

Communications: to respond to your inquiries; to send service announcements, security alerts, and critical operational notices; to send marketing or product updates where you have opted in.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on one or more of the following legal bases under Article 6 of the General Data Protection Regulation:

(a) Contract: processing necessary for the performance of the contract between you and us (the Terms of Service) or to take steps at your request before entering into that contract.

(b) Legal obligation: processing necessary for compliance with a legal obligation to which we are subject (for example, sanctions screening, anti-money-laundering laws where applicable, and responses to lawful orders).

(c) Legitimate interests: processing necessary for our legitimate interests in operating, securing, improving, and marketing the Services, except where such interests are overridden by your interests or fundamental rights and freedoms. These legitimate interests include preventing fraud, ensuring platform stability, conducting analytics, and growing our user base.

(d) Consent: where applicable, processing based on your explicit consent (for example, optional cookies and certain marketing communications). You may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not sell, rent, or trade your personal data for monetary or other valuable consideration. We share information only as described below.

Service providers: cloud-infrastructure providers, security and monitoring vendors, analytics tools, customer-support platforms, and other vendors who process information on our behalf under written contracts that require them to protect the data and use it only for the purposes we specify.

Compliance partners: where required, sanctions-screening, fraud-detection, and on-chain analytics providers, who may receive your wallet address and related on-chain activity.

Legal and regulatory: government authorities, law-enforcement agencies, courts, or other parties where we believe in good faith that disclosure is necessary to comply with applicable law, protect our rights, enforce the Terms of Service, or protect the safety of any person.

Corporate transactions: in the event of a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of our assets, your data may be transferred to the counterparty subject to confidentiality undertakings.

Aggregated or de-identified data: we may share aggregated statistics or de-identified information that cannot reasonably be used to identify you.

5. International Data Transfers

We are a globally distributed operation and your information may be transferred to, stored on, and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your jurisdiction.

Where we transfer personal data of EEA, UK, or Swiss residents to a third country that has not received an adequacy decision from the relevant authority, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms.

By using the Services, you understand that your data may be processed in jurisdictions other than your own and consent to such transfers to the extent permitted by applicable law.

6. On-Chain Data Transparency

Blockchains are inherently public, immutable, and global. Any transaction signed by your wallet, including deposits, withdrawals, and on-chain trade settlements, becomes part of the public blockchain record. This record can be searched and analysed by anyone, including authorities, researchers, journalists, and adversaries.

Even when you do not provide personal information to us, on-chain activity associated with your wallet address may be linked to you by third parties through chain-analysis techniques, exchange records, or other off-chain data. This is not something we can remove or limit.

We recommend that you (a) understand the privacy properties of each blockchain you interact with, (b) consider using separate addresses for separate activities, and (c) be aware that withdrawing to or depositing from a centralised exchange typically links your wallet to your verified identity at that exchange.

7. Cookies & Tracking Technologies

We use cookies and similar technologies (local storage, session storage, pixels) for the following purposes:

Strictly necessary: maintaining your authenticated session, remembering security settings, load-balancing, and preventing fraud. These cannot be disabled without breaking core functionality.

Functional: remembering your preferences such as language, chart layout, and interface theme.

Analytics: understanding how the platform is used in aggregate, identifying performance issues, and measuring feature adoption. We use privacy-preserving analytics where reasonably possible.

We do not use third-party advertising cookies or cross-site tracking pixels for behavioural advertising. You can manage cookies through your browser settings; however, disabling strictly necessary cookies may prevent the Services from functioning.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements.

Indicative retention periods (subject to extension where required by law or legitimate business need):

Wallet activity and trading logs: at least five (5) years from the date of the activity, to comply with potential record-keeping obligations and to enable dispute resolution.

Technical logs (server access logs, error logs): typically ninety (90) days, with longer retention for security-relevant events.

Support communications: up to three (3) years from resolution of the underlying matter.

Cookies and analytics data: as set out in our cookie banner; typically up to thirteen (13) months.

We may anonymise data and retain it indefinitely for statistical and research purposes.

9. Data Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit using TLS 1.3 or higher, encryption at rest for sensitive data stores, role-based access controls, network segmentation, security monitoring, periodic penetration testing, and security awareness training for personnel with access to personal data.

No method of transmission over the internet or method of electronic storage is one hundred percent secure. We cannot guarantee the absolute security of your personal data. In the event of a personal-data breach likely to result in a high risk to your rights and freedoms, we will notify affected users and the competent authorities in accordance with applicable law (within seventy-two (72) hours where required by GDPR).

10. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

Access: obtain confirmation that we process your data and request a copy of that data.

Rectification: correct inaccurate or incomplete data.

Erasure (“right to be forgotten”): request deletion of your data, subject to our legal and operational retention obligations.

Restriction: restrict our processing in certain circumstances.

Portability: receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

Objection: object to processing based on legitimate interests, including profiling.

Withdrawal of consent: where processing is based on consent, withdraw that consent at any time.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (“CCPA”), as amended by the CPRA, including the right to know what categories of personal information we collect and disclose, the right to delete, the right to correct, and the right to opt out of any “sale” or “sharing” of personal information. We do not sell personal information for monetary consideration.

To exercise any of these rights, please email support@bitnxs.com with a clear description of your request and proof reasonably sufficient to verify your identity (for example, a signed message from the wallet address concerned). We will respond within thirty (30) days, or such longer period as permitted by law if your request is complex.

If you believe we have not adequately responded to your request, you have the right to lodge a complaint with the data-protection supervisory authority in your jurisdiction.

11. Children & Policy Changes

Children: the Services are not directed at, and we do not knowingly collect personal data from, individuals under the age of eighteen (18). If we become aware that we have collected personal data from a child without verifiable parental consent, we will delete such data promptly.

Policy changes: we may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. The “Last Updated” date at the top of this document indicates when the latest revision took effect. Material changes will be communicated through the platform or by email at least thirty (30) days before they take effect, except where a shorter period is required to comply with legal obligations.

12. Contact Us

For any question, request, or complaint regarding this Privacy Policy or our processing of your personal data, please contact us at support@bitnxs.com.

If you are located in the European Economic Area, the United Kingdom, or Switzerland and have inquiries that cannot be resolved with us directly, you may contact the data-protection supervisory authority in your country of residence.