Privacy Policy

1About this policy

1.1This policy explains how we handle your personal data when you visit NEVIX Exchange, open an account, verify your identity, trade, transfer assets, use P2P or another enabled product, or contact us. It applies to customers, prospective customers and website visitors. We handle personal data with reference to Malaysia's Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024, and other applicable law. We may provide additional product-specific notices when we collect data.

1.2Public blockchain transactions can remain visible and immutable even after you close an account. This policy does not promise deletion of information already recorded on a blockchain.

1.3This policy applies whether you interact with us through the website, mobile experience, customer support, an application programming interface, a promotion or another NEVIX service that refers to it. A product notice may provide additional information for a particular feature, but it does not reduce the protections stated here unless applicable law permits that result and we explain it clearly.

2Controller and contacts

2.1NEVIX Exchange is a brand and platform owned and operated by NeviX, with technology powered by Pips Forex Technology. NeviX determines why and how we process personal data for our services. The technology attribution alone does not establish a separate controller relationship. Send privacy questions and requests to privacy@nevix.com, security incidents to security@nevix.com, and general complaints to complaints@nevix.com.

2.2Please use the contact addresses in this policy for requests about our handling of your data.

2.3If another company independently decides why and how it processes your data, such as your bank, a blockchain analytics provider acting for its own purposes or a P2P counterparty, that company may be a separate controller under applicable law. Its privacy terms apply to its independent processing. We remain responsible for explaining our own use of your data and for selecting service providers with appropriate safeguards.

3Data we collect

3.1Identity and eligibility.Name, date of birth, nationality, address, identity documents, photograph, verification results, tax or residency information, and beneficial-ownership information where relevant.

3.2Account and security.Email, telephone number, login history, device and browser identifiers, IP address, authentication settings, access logs, fraud signals and support communications. We do not need your authenticator recovery codes or password in a support message.

3.3Financial and transactional.Payment-account details, wallet addresses, blockchain transaction identifiers, deposits, withdrawals, transfers, orders, executions, fees, balances, P2P advertisements and dispute evidence. We may process source-of-funds information to meet legal and risk obligations.

3.4Website and communications.Cookies, usage events, preferences, messages, feedback and marketing choices. We seek to collect only what is reasonably needed for the stated purpose.

3.5Compliance and risk information.Sanctions and watchlist results, source-of-funds or source-of-wealth evidence, occupation or business activity, expected account use, risk classifications, investigation notes and information connected to legal requests.

3.6Support and complaint information.Recordings or transcripts of support communications where permitted, documents you submit, complaint history, technical diagnostics and the steps taken to investigate and resolve an issue. Do not send passwords, private keys, seed phrases or authentication codes.

3.7Inferences and derived information.We may derive security, fraud, eligibility or product-use indicators from the data described above. These indicators support account protection and legal compliance; they are not sold as consumer profiles.

4Where data comes from

4.1We receive data from you, your device and use of our services; payment, identity and fraud-prevention providers; blockchain networks and analytics; counterparties in a P2P transaction; and public or official records where lawful. We may compare sources to verify accuracy and investigate suspicious activity.

4.2You provide information when you register, complete identity verification, fund an account, submit an order, communicate with another user, contact support or exercise a privacy right. You are responsible for keeping account and contact information accurate and for having authority to provide information about another person.

4.3We collect technical and transactional records automatically when you use the services. These records can include timestamps, device and network information, page or feature events, authentication results, order lifecycle events and security alerts.

4.4We may receive information from identity-verification services, payment providers, blockchain data sources, sanctions lists, fraud-prevention networks and authorities acting under lawful powers. We assess the reliability and relevance of information before relying on it for a significant decision.

5How and why we use data

5.1We use data to create and secure accounts, verify eligibility and identity, execute and record transactions, deliver support, prevent fraud and market abuse, comply with legal obligations, resolve disputes, and maintain and improve our services.

5.2Where applicable law requires a lawful basis, processing may rely on consent, performance of a contract, compliance with law, or another basis permitted by applicable law. Marketing uses consent or another lawful basis and includes an opt-out where required. Withdrawing consent does not invalidate earlier lawful processing or prevent processing required for security, legal retention or an existing transaction.

5.3We do not sell personal data. We do not use sensitive identity information for unrelated advertising.

5.4Account and contract administration.We use identity, contact, security and transaction data to open and maintain your account; authenticate you; process deposits, withdrawals, transfers and orders; calculate fees; issue receipts; and respond to service requests.

5.5Legal compliance and protection.We use relevant data to conduct KYC and sanctions checks, monitor transactions, respond to valid legal process, keep required records, prevent fraud and protect users, our services and the public. Where law restricts what we can disclose about an investigation, we may be unable to give you full details.

5.6Service improvement.We use aggregated usage, performance and support information to diagnose faults, assess product quality and improve accessibility and security. We use identifiable data only where the improvement cannot reasonably be achieved with anonymous or aggregated information.

5.7Communications.We send transaction, security, legal and account messages because they are necessary to operate the service. We send promotional communications only where we have an appropriate legal basis and provide the controls required by applicable law.

6Automated checks

6.1Automated tools may screen identity, sanctions, fraud indicators, transaction patterns and security events. They can flag an account or transaction for review, delay or restriction. Contact support@nevix.com if you believe a decision is wrong; a human will review where required by law or reasonably available, without disclosing confidential detection rules.

6.2Automated checks may compare submitted information with verification sources, assess whether a device or transaction appears unusual, or identify a potential match to a sanctions or fraud record. A match may lead to additional questions, a temporary hold, rejection or referral to a specialist.

6.3We test and monitor material automated controls for accuracy and unintended outcomes appropriate to their use. No automated system is error-free. We keep information needed to understand and review significant decisions, subject to security and legal restrictions.

6.4Where applicable law provides a right to contest a solely automated decision with significant effects, you may request review at privacy@nevix.com or through support. We may ask for further information to distinguish you from another person or resolve inconsistent evidence.

7Sharing and service providers

7.1We may share the minimum necessary data with identity-verification, cloud-hosting, communications, analytics, payment, banking, custody, blockchain-monitoring and customer-support providers engaged for the Service; with transaction counterparties where necessary for P2P; and with courts, regulators or law-enforcement bodies where legally required or permitted.

7.2Providers are required to protect data and use it only for authorised purposes under applicable contracts and law. We do not represent a particular provider as involved in a transaction unless it actually is.

7.3Where a technology provider processes personal data on our behalf, we limit that processing to the services it provides under appropriate contractual and security controls. We remain the contact point for requests under this policy. The phrase “powered by” does not itself mean that a company holds your assets or independently determines every use of your data.

7.4We may disclose information to a P2P counterparty only to the extent needed to conduct or investigate the order, such as a verified display name, payment instructions, order status or dispute evidence. Users must not use counterparty information for marketing, harassment or activity outside the order.

7.5We may disclose information in response to a valid court order, statutory request or other lawful process; to protect life, security or legal rights; or to investigate fraud. We assess the authority, scope and legal basis of a request and disclose only information we reasonably determine is required or permitted.

7.6If our business or a service is reorganised, financed, acquired or transferred, relevant data may be reviewed or transferred subject to confidentiality, applicable law and appropriate notice. A transaction does not permit a recipient to use your data for unrelated purposes contrary to this policy.

8International processing

8.1Service providers or infrastructure may process information outside your location. We use safeguards required by applicable law and restrict transfers where law prohibits them. Contact privacy@nevix.com for information about a transfer relevant to your data, subject to security and confidentiality limits.

8.2The laws of a destination may differ from those in your location. Depending on applicable law and the transfer, safeguards may include contractual protections, assessments of the destination and provider, access controls, encryption and limits on onward disclosure.

8.3We periodically review material cross-border processing and update safeguards when the service, provider or legal requirements change. We do not treat the public availability of blockchain data as permission to disclose unrelated account or identity information.

9Retention

9.1We keep data only as long as needed for the purposes above, including account operation, transaction reconciliation, tax, AML record-keeping, dispute resolution and legal claims. Legal retention or an active investigation may continue after account closure. We then delete, anonymise or securely archive data as appropriate; immutable blockchain records cannot generally be erased.

9.2Retention depends on the data type, the service used, legal record-keeping duties, limitation periods, security needs and whether a dispute or investigation remains open. Identity and transaction records may therefore be retained longer than optional marketing preferences or routine diagnostic logs.

9.3Closing your account does not immediately erase every record. We first resolve open orders, balances, legal holds, complaints and required retention. Data kept only because of a legal or claims obligation is restricted from ordinary operational use where appropriate.

9.4When the applicable retention period ends, we delete or anonymise information using processes appropriate to the system and risk. Backup copies may remain until overwritten under the backup cycle and are protected from ordinary access in the meantime.

10Security and breaches

10.1We apply access controls, encryption where appropriate, logging, monitoring and incident-response measures. No system is risk-free. Tell security@nevix.com promptly if you suspect account compromise. We assess personal-data breaches and notify the Personal Data Protection Commissioner and affected individuals where required by the PDPA.

10.2Access to personal data is limited according to role and business need. We review privileged access, record relevant administrative activity, manage vulnerabilities and require personnel and providers to protect confidential information.

10.3You contribute to account security by using a unique password, enabling available authentication controls, protecting your email and devices, and checking the domain before entering credentials. We will not ask you to disclose a password, private key, seed phrase or one-time authentication code through an unsolicited message.

10.4If an incident occurs, we work to contain it, preserve evidence, assess affected data and users, restore secure operation and address the cause. Any notice will describe available facts, likely consequences and protective steps where required and safe to disclose.

11Your choices and rights

11.1Subject to applicable law, you may request access, correction, deletion, withdrawal of consent, complaint resolution and other rights available under the PDPA. Send requests to privacy@nevix.com from your registered email, or use an available account tool. We may verify identity before responding and may retain data that law or a legitimate dispute requires us to keep.

11.2You may opt out of marketing without losing essential account, security or transaction communications. You can control browser cookies as described below.

11.3Depending on applicable law, your rights may include confirmation of processing, access to data, correction, erasure, restriction, objection, portability, withdrawal of consent, review of certain automated decisions and complaint to a competent authority. A right may be limited by legal retention, the rights of others, security or an active claim.

11.4We verify the identity and authority of the requester before disclosing or changing account data. We may ask for information already associated with the account and will avoid collecting unnecessary documents. An authorised representative may need to provide proof of authority.

11.5We respond within the period required by applicable law. If a request is complex or unusually broad, we may ask you to clarify it and may extend the response period where law permits, with an explanation. We do not charge for an ordinary request unless applicable law allows a reasonable charge for manifestly unfounded or excessive requests.

11.6If we refuse all or part of a request, we explain the reason and available complaint route unless law or security prevents us from doing so. You may contact privacy@nevix.com if you believe account tools did not complete your request correctly.

12Cookies and analytics

12.1We use essential cookies for login, security and core functionality. If we use optional analytics or marketing cookies, we identify them in our cookie controls and use them according to applicable consent rules. You can block cookies in your browser, although essential features may stop working.

12.2Essential technologies can remember a session, route traffic, prevent abuse and retain security choices. Because they support the service you request, disabling them may prevent sign-in or transaction functions.

12.3Analytics technologies help us understand performance and feature use. Marketing technologies, if enabled, help measure campaigns. We provide category information and available choices in the cookie interface and do not treat silence as consent where affirmative consent is required.

12.4Your browser and device may provide additional controls. Deleting cookies can remove saved choices, so you may need to set them again. Cookie choices do not stop essential service, security, legal or transaction communications.

13Children

13.1We offer NEVIX accounts only to adults aged 18 or older. We do not knowingly offer exchange accounts to children. Contact privacy@nevix.com if you believe a child provided personal data.

13.2If we learn that a child submitted personal data in an attempt to open an account, we may restrict the account, verify age and delete information that we have no lawful reason to retain. Transaction, fraud-prevention or legal records may need to be preserved.

14Changes and complaints

14.1We may update this policy and will publish the current version on the website, with additional notice when law or the significance of a change requires it. Privacy requests go to privacy@nevix.com; complaints about our handling may also go to complaints@nevix.com. You may approach the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) or another competent authority where applicable law allows.

14.2A change applies prospectively unless law requires otherwise. Where a material change needs consent, we request it before using data for the new purpose. Previous versions and acceptance records are retained as needed to demonstrate what applied at a relevant time.

14.3We encourage you to contact us first so we can investigate, but doing so does not remove a right to complain to a competent data-protection, consumer or judicial authority. We cooperate with lawful authority requests while protecting confidentiality and the rights of other users.