Privacy Policy

1. Introduction

This Privacy Policy (the "Policy") applies to the services offered by TheDEX (the "Platform", "we", "us", or "our"). We are deeply committed to protecting the privacy, confidentiality, and security of your personal data. This comprehensive policy details how we collect, process, share, protect, and retain your data when you access our websites, mobile applications, APIs, trading platforms, and related decentralized infrastructure (collectively, the "Services").

For the purposes of the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable global data protection laws, TheDEX acts as the Data Controller. By accessing, registering an account, or utilizing our Services, you explicitly acknowledge that you have read, understood, and consent to the data practices described in this document.

2. Information We Collect

To provide secure financial services and comply with stringent global anti-money laundering frameworks, we collect various categories of personal data, including but not limited to:

• Identity & Biometric Data: Full legal name, date of birth, gender, nationality, national identification numbers (e.g., SSN, Passport Number), government-issued ID copies, facial recognition biometric data (liveness checks), and proof of residential address.
• Financial & Transactional Data: Bank account details, credit/debit card metadata, digital asset wallet addresses, transaction hashes, smart contract interactions, source of funds (PoSOF) declarations, and comprehensive historical trading logs across spot, margin, futures, and copy-trading services.
• Technical & Device Data: IP addresses, MAC addresses, browser fingerprinting, operating system details, device identifiers (IMEI/UUID), internet service provider (ISP), geo-location data, and network latency metrics.
• Usage & Interaction Data: Clickstreams, page navigations, session durations, heatmaps, search queries, and interactions with our AI chatbots, liquid engine, and user interfaces.
• Communications Data: Records of support tickets, email correspondence, chat logs, and telephone recordings with our customer service representatives.

3. How We Use Your Information (Legal Basis)

We process your personal data under the following lawful bases and for the specified purposes:

• Contractual Necessity: To onboard you as a client, execute trades, process fiat gateways, manage your portfolio, provide customer support, and deliver the core functionalities of the Platform.
• Legal Obligation: To comply with Anti-Money Laundering (AML), Counter-Terrorism Financing (CTF), and sanctions screening regulations. We also process data to comply with mandatory tax reporting requirements to global tax authorities.
• Legitimate Interests: To detect, prevent, and mitigate fraudulent activities, market manipulation, cyberattacks, and unauthorized account access. Furthermore, we utilize aggregated, deeply anonymized trading metadata to train and optimize our algorithmic "Liquid Engine". Your personal identity is permanently decoupled from this algorithmic training data.
• Consent: For sending direct marketing communications, newsletters, and promotional offers. You may withdraw this consent at any time via your account settings.

5. Automated Decision Making & Profiling

We employ automated risk-scoring engines and machine learning algorithms to fulfill our legal AML/CTF obligations. These systems automatically analyze your transaction patterns, login locations, and identity documentation to assign a risk profile. If the automated system detects highly anomalous behavior, it may trigger an automatic, temporary suspension of withdrawal capabilities pending manual review by our compliance team. You have the right to contest automated decisions by contacting our support team.

6. Information Sharing and Disclosure

We do not sell, rent, or lease your personal data to data brokers. However, your data may be shared with strictly vetted third parties under binding confidentiality agreements:

• Affiliates & Subsidiaries: Within the TheDEX corporate group to provide unified services and centralized compliance.
• Service Providers: Payment gateways, liquidity providers, cloud hosting services (e.g., AWS, GCP), email delivery services, and KYC/AML identity verification vendors.
• Legal & Regulatory Authorities: We will disclose your data to law enforcement agencies, tax authorities, or financial regulators when compelled by a valid subpoena, court order, or binding legal request, or when necessary to prevent imminent physical harm, financial crime, or fraud.
• Corporate Transactions: In the event of a merger, acquisition, bankruptcy, or sale of all or a portion of our assets, your data may be transferred to the acquiring entity.

7. Cross-Border Data Transfers

As a global digital asset platform, your personal data may be transferred to, processed, and stored in jurisdictions outside of your home country, including countries that may not have data protection laws equivalent to those in your jurisdiction. We ensure that such international transfers are protected by appropriate legal safeguards, such as the European Commission's Standard Contractual Clauses (SCCs), Binding Corporate Rules, or equivalent mechanisms.

8. Data Security Measures

We implement military-grade cryptographic safeguards to protect your data. This includes AES-256 encryption for data at rest, TLS 1.3 for data in transit, strict role-based access controls (RBAC), multi-signature wallet architectures, and continuous vulnerability penetration testing. Despite these extensive measures, no transmission of data over the internet or decentralized networks can be guaranteed to be 100% secure. You acknowledge that you provide your personal data at your own risk.

9. Data Retention Period

We retain your personal data only for as long as is strictly necessary to fulfill the purposes outlined in this Policy. However, due to stringent global financial regulations, we are legally mandated to retain your KYC records, identity documentation, and complete transaction histories for a minimum period of five (5) to seven (7) years after your account is closed, depending on your jurisdiction's specific AML statutes.

10. Your Privacy Rights (GDPR/CCPA)

Depending on your residency, you possess powerful statutory rights regarding your personal data:

• Right to Access & Portability: Request a complete copy of the data we hold about you in a structured, machine-readable format.
• Right to Erasure ("Right to be Forgotten"): Request the deletion of your data. CRITICAL NOTE: This right is heavily superseded by our legal AML data retention obligations. We cannot and will not delete your trading history, wallet addresses, or KYC files until the statutory retention period expires.
• Right to Rectification: Request the correction of inaccurate or incomplete data.
• Right to Object & Restrict: Object to our processing of your data for direct marketing purposes or request the restriction of processing under certain circumstances.

11. Cookies and Tracking Technologies

We use cookies, web beacons, local storage, and similar tracking technologies to enhance user experience, analyze platform traffic, and personalize content. You can control cookie preferences through your browser settings; however, disabling strictly necessary cookies may impede your ability to log in or execute trades securely on the Platform.

12. Third-Party Links & Services

The Platform may contain links to third-party websites, decentralized applications (dApps), or partner services. We are not responsible for the privacy practices, smart contract vulnerabilities, or content of these third-party entities. We strongly encourage you to review the privacy policies of any third-party site you interact with.

13. Children's Privacy

Our Services are strictly not directed at, nor intended for, individuals under the age of 18 (or the legal age of majority). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will immediately freeze the account and take steps to delete the information, subject to AML retention laws regarding the attempted fraudulent opening of an account.

14. Changes to this Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Material changes will be communicated via email or through a prominent notice on the Platform. Your continued use of the Services after the "Last Updated" date indicates your acceptance of the revised Policy.

15. Contacting the Data Protection Officer (DPO)

If you have any questions, concerns, or requests to exercise your data rights, please contact our legal and compliance team:

• Data Protection Officer: Support@codeitworkstation.top
• Registered Headquarters: Default Address
• Compliance Hotline: 1234567890