Privacy policy

This Privacy Policy (“Policy”) describes how Arx Finance LLC (“Arx Finance LLC”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information in connection with:

your use of the website arxfinance.io (the “Site”);

your communications with us through messaging applications (such as WhatsApp) and email; and

your use of our principal over-the-counter (“OTC”) digital asset and fiat exchange services and related products (collectively, the “Services”).

This Policy also covers personal information relating to:

visitors to the Site;

prospective Counterparties who contact us or are contacted by us;

onboarded Counterparties, whether individuals or legal entities; and

individuals connected to our corporate Counterparties (for example, beneficial owners, directors, officers, and authorized signatories).

By using the Site or Services, or by providing us with personal information, you acknowledge that you have read and understood this Policy.

1. Who We Are (Data Controller)

The entity responsible for the processing of your personal information under this Policy is:

Arx Finance LLC

14651 Biscayne Blvd, Unit 363

Miami, FL 33181

United States

For privacy and data protection matters, you can contact our Compliance Department at:

Email: compliance@arxfinance.io

Our Compliance Department oversees our privacy and data protection practices, in addition to broader compliance responsibilities (including BSA/AML).

2. Scope of this Policy

This Policy applies to personal information we collect, use, and share when you:

visit or use the Site;

communicate with us through WhatsApp, email, or other official communication channels listed on the Site;

apply to become, or act as, a Counterparty of Arx Finance LLC (either as an individual client or as a representative of a legal entity); or

are an associated person of a Counterparty (for example, a beneficial owner, director, officer, or authorized representative whose information is provided to us).

This Policy does not apply to websites, platforms, or services that we do not control. Please review the privacy policies of those third parties.

3. Personal Information We Collect

We collect and process different types of personal information depending on your relationship with us and the Services you use. This may include:

3.1 Identification and KYC/AML information

Full name, date and place of birth, nationality;

Government-issued identification details (e.g., ID or passport number, issue/expiry dates);

Copies/images of identity documents and selfies for identity verification;

Residential or business address, proof of address;

Tax identification numbers, company registration numbers;

Information about your occupation, employer, business activity, and source of funds/wealth;

Ownership and control structure of legal entities (beneficial owners, directors, officers).

3.2 Contact information

Email address;

Mobile/phone number (including WhatsApp number);

Postal address;

Other contact details you provide.

3.3 Financial and transactional information

Bank account details (e.g., account numbers, IBAN, routing numbers) and related bank records;

Digital asset wallet addresses and related blockchain identifiers;

Transaction details, including dates, amounts, currency/asset pairs, direction (buy/sell), counterparties (you and Arx Finance LLC), and instructions;

Information generated from blockchain analytics regarding the risk profile or history of your wallets and transactions.

3.4 Technical and usage information

IP address, browser type, device identifiers, operating system;

Pages visited, time and date of visits, time spent on pages, and referral URLs;

Cookies and similar technologies (see Section 7);

Logs relating to access, security events, and performance of the Site.

3.5 Communications and documentation

Content of communications with us, including WhatsApp/Telegram messages, emails, and forms;

Notes of interactions with you (for example, onboarding or compliance notes);

Copies of signed agreements, consent forms, and other contractual documents.

We do not intentionally collect special categories of personal data (such as health information, religious or political beliefs, or biometric data beyond what is contained in ID documents and verification images) and we do not seek to collect information about criminal convictions other than as may be inferred from publicly available or compliance-related sources (e.g., sanctions/adverse media checks).

If you provide us with personal information about another person (e.g., a beneficial owner or director), you are responsible for ensuring that you have a lawful basis to do so and, where required, that the individual has been informed about this Policy.

4. How We Collect Personal Information

We collect personal information from a variety of sources, including:

Directly from you, when you:

visit the Site;

complete onboarding or KYC/AML forms;

provide documents and information (e.g., ID, proof of address, bank details);

communicate with us via WhatsApp, email, or other official channels; or

sign or respond to agreements and other contracts.

From your use of the Site and Services, through:

logs, cookies, and other technical means;

monitoring of transaction patterns and wallet activity.

From third parties, including:

KYC/AML and identity verification providers;

sanctions screening, PEP, and adverse media databases;

blockchain analytics providers;

banks and payment partners (e.g., to confirm incoming/outgoing transfers or resolve operational issues);

publicly available sources such as company registries, court records, professional profiles, and corporate websites.

We may combine information we receive from different sources for the purposes described in this Policy.

5. How We Use Personal Information (Purposes)

We process personal information for the following purposes:

Providing and operating the Services

To evaluate and process your application to use the Services;

To execute and settle OTC fiat/digital asset transactions;

To maintain your relationship with us and provide Counterparty support.

KYC/AML, sanctions, and risk management

To verify your identity and eligibility;

To perform Counterparty due diligence (CDD) and enhanced due diligence (EDD);

To screen against sanctions, PEP, and watchlists;

To monitor and analyze transaction activity and wallet behaviour;

To detect, prevent, and investigate fraud, money laundering, terrorist financing, and other illicit activity.

Legal and regulatory compliance

To comply with obligations under the Bank Secrecy Act (BSA), FinCEN regulations, money services business (MSB) rules, tax laws, and other applicable U.S. federal and state laws;

To maintain required records and reports;

To respond to lawful requests from regulators, law enforcement agencies, courts, and other competent authorities.

Security and integrity of systems and communications

To secure our systems, wallets, and infrastructure;

To detect and prevent cyberattacks, fraud, abuse, and unauthorized access;

To monitor and log activity for audit and incident response.

Business operations and governance

To maintain accounting and financial records;

To conduct internal audits, risk assessments, and compliance reviews;

To manage disputes, legal claims, and defense of our rights;

To support corporate governance, strategy, and decision-making using appropriately aggregated or anonymized data.

Site performance and improvement

To understand how the Site is used;

To maintain and enhance the performance, content, and security of the Site;

To generate aggregated statistics and analytics to inform our operations.

We do not use your personal information for general marketing or advertising campaigns. We may, however, contact you with service-related communications (e.g., policy updates, changes to the Services, or legal notices).

6. Legal Bases (Where Required)

Our primary regulatory focus is on U.S. and non-U.S. Counterparties who maintain U.S. bank accounts. However, to the extent that data protection laws such as the EU/EEA General Data Protection Regulation (“GDPR”) or similar regimes apply, our processing of personal information is generally based on one or more of the following legal bases:

Performance of a contract: where processing is necessary to enter into and perform our agreements with you (e.g., a Master Service Agreement and specific OTC transactions).

Compliance with legal obligations: where processing is required by applicable laws and regulations (e.g., BSA/AML, sanctions, tax, recordkeeping, and MSB obligations).

Legitimate interests: where processing is necessary for our legitimate interests and those interests are not overridden by your rights and freedoms (e.g., maintaining security, preventing misuse, improving the Site and Services, and managing business operations).

Consent: where we obtain your explicit consent for specific processing (for example, certain electronic communications where required by law).

Where we rely on consent, you may withdraw it at any time, although we may continue to process data where permitted or required by law (for example, for AML recordkeeping).

7. Cookies and Similar Technologies

We use cookies and similar technologies on the Site to:

enable core functionality (e.g., page navigation, session management, security); and

gather limited analytics information about Site usage (for example, page visits, time on site, and error diagnostics), potentially through third-party analytics tools.

We currently do not use cookies for targeted advertising or behavioural marketing.

You can typically manage cookies through your browser settings, including by blocking or deleting them. However, disabling certain cookies may affect the performance and functionality of the Site.

8. How We Share Personal Information

We may share personal information with the following categories of recipients, strictly for the purposes described in this Policy and subject to appropriate safeguards and confidentiality obligations:

KYC/AML and identity verification providers

to verify your identity, check sanctions/PEP lists, and perform risk assessments.

Blockchain analytics providers

to analyze wallet addresses and transaction flows for AML, sanctions, and risk management purposes.

Banks and payment partners

to send and receive fiat payments;

to verify transactions, resolve payment issues, and comply with financial obligations.

Cloud hosting, IT, and operational service providers

including email providers, productivity suites, storage, and other infrastructure providers.

Document and e-signature platforms

to facilitate the execution and management of agreements and forms.

Professional advisers and auditors

including lawyers, accountants, auditors, and consultants who provide services to us.

Regulators, law enforcement, and other competent authorities

where we are required or permitted by law to do so, or where we believe in good faith that such disclosure is necessary to protect our rights or the rights of others.

Corporate transactions

in connection with a merger, acquisition, restructuring, or sale of all or part of our business, in which case personal information may be transferred to the relevant third party as part of the transaction, subject to appropriate safeguards.

We do not sell or rent your personal information to third parties for their own marketing purposes, nor do we share data for third-party targeted advertising.

9. International Transfers of Personal Information

We are based in the United States, and many of our service providers are located in the U.S. or other countries. As a result, your personal information may be transferred to, stored in, and processed in countries that may have data protection laws that are different from those in your country of residence.

For example:

we may store information in U.S.-based systems (e.g., Google Workspace); and

we may use third-party vendors located outside the U.S. (such as identity verification providers and analytics tools) to support the Services.

Where data protection law requires it (for example, for individuals located in the European Economic Area), we will take steps to ensure that adequate safeguards are in place for such transfers, such as contractual safeguards and other appropriate measures.

10. Retention of Personal Information

We retain personal information for as long as necessary to fulfil the purposes described in this Policy and to comply with our legal, regulatory, and business obligations.

In particular:

KYC/AML and transaction records: We generally retain Counterparty due diligence information, transaction data, and related documents for at least five (5) years after the end of the Counterparty relationship or the relevant transaction, or longer where required by law or where reasonably necessary for legal, regulatory, or risk management purposes.

Website logs and technical data: We retain technical and log data for as long as reasonably necessary to operate, secure, and improve the Site, and to maintain audit trails and incident response capabilities.

Communications and contracts: We retain communications and contractual records for as long as necessary to manage our relationship with you and to protect our legal interests.

When personal information is no longer required for the purposes described above, we will either delete it or anonymize it, unless we are required or permitted by law to retain it for a longer period.

11. Security of Personal Information

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These include, as appropriate:

access controls and role-based permissions;

encryption in transit and, where appropriate, at rest;

secure configuration and monitoring of systems and networks;

incident detection, response, and logging;

staff training and confidentiality obligations;

vendor due diligence and security commitments.

While we use reasonable measures to protect personal information, no system or transmission can be guaranteed to be completely secure. You are responsible for maintaining the security of your own devices, credentials, and communication channels when interacting with Arx Finance LLC.

12. Your Rights and Choices

Your rights regarding personal information may depend on your country or state of residence and the applicable laws. Subject to legal and regulatory constraints (particularly in relation to AML/BSA obligations), you may have some or all of the following rights:

Access: to request confirmation of whether we process your personal information and, where applicable, to receive a copy.

Correction: to request that we correct inaccurate or incomplete personal information.

Deletion: to request the deletion of your personal information, subject to our need to retain certain data to comply with law (e.g., AML recordkeeping) or for legitimate business purposes.

Restriction: to request that we restrict the processing of your personal information in certain circumstances.

Objection: to object to processing based on our legitimate interests, where your particular situation justifies such objection, subject to our need to continue processing as required by law or for compelling legitimate reasons.

Portability (where applicable): to receive personal information you have provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller, where technically feasible.

We will honour such requests to the extent required by applicable law and consistent with our legal and regulatory obligations, including those relating to anti-money laundering, sanctions, and financial recordkeeping. In many cases, we will be legally required to retain certain KYC/AML and transactional data and will not be able to delete it upon request.

13. Children’s Privacy

Our Site and Services are not directed to children, and we do not knowingly collect personal information from individuals under the age of 18.

If we become aware that we have collected personal information from a child under 18, we will take appropriate steps to delete such information as soon as reasonably practicable, unless we are legally required to retain it. If you believe we may have collected personal information from a child, please contact us at compliance@arxfinance.io.

14. Third-Party Websites and Services

The Site may contain links to third-party websites or services that are not operated or controlled by Arx Finance LLC. This Policy does not apply to those third parties, and we are not responsible for their privacy practices.

Your use of third-party websites or services is subject to their own terms and privacy policies. We encourage you to review those policies before providing any personal information.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law.

When we do so, we will:

update the “Last updated” date at the top of this Policy; and

where appropriate, provide additional notice (for example, on the Site or via email).

Your continued use of the Site or Services after any changes take effect will signify your acknowledgment and acceptance of the revised Policy. If you do not agree with the updated Policy, you must stop using the Site and Services.

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of personal information, please contact:

Arx Finance LLC – Compliance Department

Arx Finance LLC

14651 Biscayne Blvd, Unit 363

Miami, FL 33181

United States

Email: compliance@arxfinance.io

We take privacy and regulatory obligations seriously and will do our best to respond promptly and transparently to your inquiries.