Privacy Notice

1. Introduction

This Privacy Notice explains how TheXBanky s.r.o. ("TheXBanky", "txbfi", "Company", "we", "us", or "our") collects, uses, stores, shares, and protects your personal data when you access or use our website, mobile applications, APIs, products, services, or otherwise interact with us.

TheXBanky s.r.o. is committed to protecting your privacy and processing personal data in accordance with applicable data protection laws, including:

• Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR");
• applicable Czech data protection legislation;
• applicable Anti-Money Laundering ("AML") and Counter-Terrorist Financing ("CTF") legislation;
• sanctions regulations;
• financial crime prevention requirements; and
• other applicable legal and regulatory obligations.

Please read this Privacy Notice carefully before using our Services.

2. Data Controller

For the purposes of the GDPR and other applicable data protection legislation, the data controller is:

If you have any questions regarding this Privacy Notice or the processing of your personal data, you may contact us using the details above.

3. Scope of this Privacy Notice

This Privacy Notice applies whenever personal data is processed through:

• our website;
• mobile applications;
• APIs;
• customer onboarding;
• account registration;
• verification processes;
• Digital Asset Services;
• Dedicated IBAN Services;
• Card Services;
• customer support;
• marketing communications;
• business relationships;
• corporate onboarding;
• merchant onboarding;
• partner onboarding; and
• any other products or services made available by TheXBanky s.r.o.

This Privacy Notice applies to:

• individual customers;
• business customers;
• corporate representatives;
• beneficial owners;
• authorised users;
• merchants;
• prospective customers;
• website visitors; and
• any individual whose personal data we process in connection with our Services.

4. Personal Data We Collect

Depending on the Services you use, we may collect and process the following categories of personal data.

4.1 Identity Information

This may include:

• full name;
• date of birth;
• nationality;
• residential address;
• government-issued identification documents;
• passport details;
• national identity card information;
• driving licence information;
• photographs;
• biometric verification data;
• liveness verification results; and
• other identity verification information.

4.2 Contact Information

Including:

• email address;
• telephone number;
• residential address;
• mailing address; and
• preferred communication preferences.

4.3 Account Information

Including:

• username;
• customer identification number;
• account identifiers;
• verification status;
• authentication credentials;
• two-factor authentication settings; and
• account preferences.

4.4 Financial Information

Where applicable, we may collect:

• bank account information;
• payment details;
• transaction history;
• deposit history;
• withdrawal history;
• payment references;
• card-related information;
• Dedicated IBAN details;
• source of funds information;
• source of wealth information; and
• other financial information necessary to provide the Services or comply with legal obligations.

4.5 Digital Asset Information

Depending on the Services used, we may collect:

• wallet addresses;
• blockchain transaction identifiers;
• supported blockchain network information;
• transaction hashes;
• wallet ownership information;
• blockchain analytics results;
• wallet risk assessments;
• transaction monitoring information; and
• Digital Asset transaction history.

4.6 Compliance Information

To comply with applicable legal and regulatory obligations, we may process:

• Know Your Customer ("KYC") information;
• Know Your Business ("KYB") information;
• Enhanced Due Diligence ("EDD") information;
• sanctions screening results;
• politically exposed person ("PEP") screening results;
• adverse media screening results;
• fraud prevention information;
• AML monitoring information;
• regulatory reporting information; and
• any additional documentation reasonably required under applicable law.

4.7 Technical Information

When you access our Platform, we may automatically collect:

• IP address;
• browser type;
• operating system;
• device identifiers;
• device type;
• language settings;
• access times;
• login history;
• session information;
• crash reports;
• application usage information;
• security logs; and
• other technical information required for the operation and security of the Platform.

4.8 Communications

We may retain records of communications with you, including:

• emails;
• live chat conversations;
• customer support requests;
• telephone recordings (where permitted by law);
• complaints;
• feedback;
• correspondence; and
• other communications relating to your use of the Services.

5. How We Collect Personal Data

We collect personal data from several sources.

5.1 Information You Provide

We collect information that you voluntarily provide when you:

• register an Account;
• complete identity verification;
• submit compliance documentation;
• contact customer support;
• use our Services;
• complete forms;
• participate in surveys;
• communicate with us; or
• otherwise interact with the Platform.

5.2 Information Collected Automatically

We automatically collect certain technical information when you use our website, applications, or APIs through cookies, server logs, security monitoring systems, and similar technologies.

5.3 Information from Third Parties

Where permitted by law, we may obtain information from:

• identity verification providers;
• banking partners;
• Licensed Service Providers;
• payment institutions;
• card issuers;
• fraud prevention providers;
• blockchain analytics providers;
• sanctions screening providers;
• public registers;
• regulatory authorities;
• law enforcement authorities;
• business partners; and
• other lawful third-party sources.

Such information may be combined with information already held by TheXBanky s.r.o. where necessary to provide the Services or comply with legal obligations.

6. How We Use Your Personal Data

TheXBanky s.r.o. processes personal data only where there is a lawful basis to do so and only for purposes that are compatible with this Privacy Notice.

We may process your personal data for the following purposes:

• creating and administering your Account;
• verifying your identity;
• providing our Services;
• processing deposits, withdrawals, exchanges, and transfers;
• facilitating Digital Asset Services;
• facilitating Dedicated IBAN Services;
• facilitating Card Services;
• communicating with you regarding your Account or the Services;
• responding to customer support enquiries;
• complying with applicable legal and regulatory obligations;
• preventing fraud, money laundering, terrorist financing, sanctions evasion, and other financial crime;
• improving the security, functionality, and performance of the Platform;
• monitoring and protecting our systems;
• enforcing our legal rights;
• resolving disputes;
• conducting internal audits;
• complying with court orders, regulatory requests, and lawful instructions from competent authorities; and
• any other purpose permitted or required by applicable law.

We will not process your personal data for purposes that are incompatible with those described in this Privacy Notice unless required or permitted by law.

7. Legal Bases for Processing

Where the GDPR applies, we process personal data on one or more of the following legal bases.

7.1 Performance of a Contract

We process personal data where necessary to:

• create and maintain your Account;
• provide the Services you request;
• process transactions;
• provide customer support;
• administer your relationship with TheXBanky s.r.o.; and
• perform our contractual obligations.

7.2 Compliance with Legal Obligations

We process personal data where necessary to comply with legal obligations, including obligations relating to:

• Anti-Money Laundering (AML);
• Counter-Terrorist Financing (CTF);
• sanctions compliance;
• fraud prevention;
• tax reporting;
• financial crime prevention;
• regulatory reporting;
• court orders;
• law enforcement requests; and
• other applicable legal requirements.

7.3 Legitimate Interests

Where appropriate, we process personal data based on our legitimate interests, including:

• improving our Services;
• protecting the security of the Platform;
• preventing fraud;
• managing operational risk;
• ensuring network and information security;
• responding to complaints;
• defending legal claims;
• improving customer experience;
• conducting internal reporting and analytics; and
• developing new products and services.

Where processing is based on legitimate interests, we ensure that our interests are not overridden by your fundamental rights and freedoms.

7.4 Consent

Where required by law, we rely on your consent before processing personal data.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

8. Anti-Money Laundering, Fraud Prevention and Financial Crime

As a regulated Virtual Asset Service Provider, TheXBanky s.r.o. is legally required to implement measures designed to prevent financial crime.

Accordingly, we may process personal data for the purposes of:

• customer identification;
• identity verification;
• Know Your Customer (KYC);
• Know Your Business (KYB);
• Enhanced Due Diligence (EDD);
• sanctions screening;
• politically exposed person (PEP) screening;
• adverse media screening;
• source of funds verification;
• source of wealth verification;
• transaction monitoring;
• wallet screening;
• fraud detection;
• suspicious activity detection;
• regulatory reporting;
• financial crime investigations; and
• compliance with applicable laws and regulatory requirements.

Failure to provide requested information may prevent us from providing certain Services or may result in delays, restrictions, suspension, or termination of your Account where permitted by law.

9. Digital Asset and Blockchain Data

Where you use Digital Asset Services, certain information relating to blockchain transactions may be processed.

This may include:

• wallet addresses;
• blockchain network information;
• transaction hashes;
• blockchain timestamps;
• supported Digital Asset identifiers;
• transaction metadata;
• wallet ownership information where available;
• blockchain analytics results;
• wallet risk indicators; and
• transaction monitoring information.

Blockchain networks are generally public and decentralized.

Accordingly, certain blockchain information may remain permanently visible on public distributed ledgers and cannot be altered or deleted by TheXBanky s.r.o.

We do not control public blockchain networks and cannot modify, erase, or remove blockchain records.

10. Dedicated IBAN Services

Where available, Clients may access Dedicated IBAN Services provided by an applicable Licensed Service Provider.

In connection with these Services, we may process personal data necessary to:

• facilitate onboarding;
• verify identity;
• satisfy regulatory obligations;
• process payment instructions;
• communicate with the applicable Licensed Service Provider;
• manage customer support requests; and
• administer the relevant Service.

All fiat funds associated with Dedicated IBAN Services are held and safeguarded by the applicable Licensed Service Provider in accordance with applicable regulatory requirements.

Personal data may be shared with the relevant Licensed Service Provider where necessary to provide the requested Service or comply with applicable law.

11. Card Services

Where Clients obtain payment cards through the Platform, personal data may be processed to:

• issue payment cards;
• administer Card Services;
• process card transactions;
• authenticate payments;
• prevent fraud;
• comply with regulatory requirements;
• investigate disputes;
• process chargebacks;
• respond to customer support enquiries; and
• manage card security.

Card Services are provided by an applicable Licensed Service Provider.

Personal data may therefore be shared with the relevant Licensed Service Provider where necessary for the provision of Card Services or compliance with applicable legal obligations.

12. Automated Decision-Making and Profiling

To comply with applicable legal obligations and to protect our Platform, customers, and Licensed Service Providers, certain processing activities may involve automated analysis.

This may include automated systems used for:

• identity verification;
• fraud prevention;
• sanctions screening;
• transaction monitoring;
• wallet risk assessment;
• financial crime detection;
• cybersecurity monitoring;
• suspicious activity detection; and
• operational risk management.

Where legally required, Clients may request additional information regarding automated processing or exercise any rights available under applicable data protection legislation.

Automated processing does not replace human oversight where review is required under applicable law or regulatory requirements.

13. Sharing Your Personal Data

We may share your personal data only where necessary to provide the Services, comply with applicable legal or regulatory obligations, protect legitimate interests, or where otherwise permitted by law.

Depending on the Services you use, your personal data may be shared with the following categories of recipients:

• Licensed Service Providers;
• banking partners;
• payment institutions;
• electronic money institutions;
• card issuers;
• identity verification providers;
• fraud prevention providers;
• blockchain analytics providers;
• AML and sanctions screening providers;
• cloud infrastructure providers;
• IT service providers;
• customer support providers;
• professional advisers, including legal, accounting, audit, and compliance advisers;
• regulators;
• supervisory authorities;
• financial intelligence units;
• tax authorities;
• law enforcement agencies;
• courts;
• governmental authorities; and
• any other recipient where disclosure is required or permitted by applicable law.

We do not sell your personal data to third parties.

13.1 Licensed Service Providers

Certain Services available through the Platform are provided by independent Licensed Service Providers.

Where necessary, we may share personal data with such providers to:

• perform identity verification;
• comply with regulatory obligations;
• facilitate Dedicated IBAN Services;
• facilitate Card Services;
• process payment instructions;
• process transactions;
• investigate fraud;
• comply with AML and sanctions requirements;
• resolve operational issues; and
• provide customer support.

Each Licensed Service Provider processes personal data in accordance with its own legal and regulatory obligations.

13.2 Legal and Regulatory Disclosures

We may disclose personal data where necessary to:

• comply with applicable law;
• respond to lawful requests from competent authorities;
• comply with regulatory reporting obligations;
• investigate suspected financial crime;
• enforce our contractual rights;
• protect our customers;
• protect Licensed Service Providers;
• defend legal claims; or
• protect the security and integrity of the Platform.

14. International Transfers of Personal Data

Your personal data may be transferred to countries outside the European Economic Area ("EEA") or the United Kingdom where necessary to provide the Services or comply with legal obligations.

Where personal data is transferred internationally, we implement appropriate safeguards in accordance with applicable data protection laws.

These safeguards may include:

• European Commission Adequacy Decisions;
• UK Adequacy Regulations;
• Standard Contractual Clauses ("SCCs");
• International Data Transfer Agreements ("IDTAs");
• Binding Corporate Rules where applicable; or
• any other lawful transfer mechanism recognised under applicable data protection legislation.

Where required, we also perform transfer risk assessments to ensure an appropriate level of protection for personal data.

15. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice, comply with applicable legal and regulatory obligations, resolve disputes, enforce our agreements, and protect our legitimate interests.

Retention periods may vary depending on the nature of the information and the Services provided.

Examples include:

• Customer account information — Duration of the customer relationship and applicable statutory retention period
• Identity verification records — As required under applicable AML legislation
• Transaction records — As required by applicable financial regulations
• Communications with customer support — As reasonably necessary for legal and operational purposes
• Fraud prevention records — As required for legal, regulatory, or security purposes
• Marketing preferences — Until consent is withdrawn or no longer required

Where personal data is no longer required, it will be securely deleted, anonymised, or otherwise disposed of in accordance with applicable law.

16. Security of Personal Data

TheXBanky s.r.o. maintains appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Our security measures may include:

• encryption of data in transit and at rest where appropriate;
• multi-factor authentication;
• access controls based on least privilege;
• secure infrastructure;
• network monitoring;
• logging and audit controls;
• security testing;
• vulnerability management;
• business continuity procedures;
• disaster recovery planning;
• employee confidentiality obligations; and
• regular security reviews.

While we take reasonable steps to protect personal data, no method of electronic transmission or storage can be guaranteed to be completely secure.

17. Your Rights

Subject to applicable law, you may have the following rights regarding your personal data:

• the right to access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent; and
• the right not to be subject to certain automated decision-making where applicable.

Requests may be submitted by contacting us using the contact details provided in this Privacy Notice.

We may request additional information to verify your identity before responding to your request.

We will respond within the timeframes required by applicable law.

18. Marketing Communications

Where permitted by law, we may send information regarding our products, services, promotions, updates, and other marketing communications.

Where consent is required, marketing communications will only be sent after obtaining your consent.

You may unsubscribe from marketing communications at any time by:

• clicking the unsubscribe link contained in marketing emails;
• updating your communication preferences within your Account (where available); or
• contacting us directly.

Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

19. Cookies and Similar Technologies

TheXBanky s.r.o. uses cookies and similar technologies to operate, secure, and improve the Platform.

Cookies may be used to:

• maintain secure user sessions;
• remember user preferences;
• improve website functionality;
• protect the Platform against fraud and abuse;
• analyse website performance; and
• support analytics and, where permitted by applicable law, marketing activities.

For detailed information about the cookies we use, the purposes for which they are used, their retention periods, and how you can manage your cookie preferences, please refer to our separate Cookie Policy, which forms part of our overall privacy framework.

Where required by applicable law, non-essential cookies will only be placed on your device after obtaining your consent.

20. Children's Privacy

The Services are intended solely for individuals who are at least eighteen (18) years of age or the legal age required to use the Services within their jurisdiction.

We do not knowingly collect personal data from children.

If we become aware that personal data relating to a child has been collected without appropriate legal authority, we will take reasonable steps to delete such information as soon as reasonably practicable.

If you believe that a child has provided personal data to us, please contact us immediately.

21. Third-Party Websites

The Platform may contain links to third-party websites, applications, products, or services operated independently of TheXBanky s.r.o.

This Privacy Notice does not apply to those third-party services.

We encourage you to review the privacy notices of any third-party services before providing personal data to them.

TheXBanky s.r.o. is not responsible for the privacy practices, content, or security of third-party websites or services.

22. Changes to this Privacy Notice

We may amend, update, or replace this Privacy Notice from time to time to reflect:

• changes in applicable laws or regulations;
• changes to our Services;
• technological developments;
• operational changes;
• regulatory guidance; or
• changes to our data processing activities.

Where required by applicable law, we will notify users of material changes through appropriate channels, including:

• email;
• notifications within the Platform;
• our website; or
• other reasonable communication methods.

The "Last Updated" date shown at the beginning of this Privacy Notice indicates the date of the latest revision.

23. Complaints

If you have any questions, concerns, or complaints regarding this Privacy Notice or the processing of your personal data, we encourage you to contact us first so that we may attempt to resolve the matter.

Email:

You also have the right to lodge a complaint with the competent data protection supervisory authority in the jurisdiction where you reside, work, or where the alleged infringement occurred.

For TheXBanky s.r.o., the competent supervisory authority is:

Nothing in this Privacy Notice limits your statutory rights under applicable data protection legislation.

24. Contact Information

If you have any questions regarding this Privacy Notice or our privacy practices, please contact us:

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Notice and that your personal data will be processed in accordance with this Privacy Notice and applicable data protection laws.