Privacy Policy

Version dated 23 October 2026

This Privacy Policy explains how personal data is handled in connection with BloxFi’s website, enquiries, business relationships, onboarding, dashboard, APIs, supported white-label interfaces, introductions and approved payment and liquidity services. It covers individuals whose data we receive directly and people whose data is supplied by a business client or service provider, including directors, beneficial owners, authorised users, underlying customers, payers and beneficiaries.

“BloxFi” is a brand used by different legal entities. The entity responsible for particular processing depends on the activity and its actual role, as explained below. This Policy is a privacy notice, not a request for blanket consent, an account-opening agreement or permission to use a financial service. Reading it, accepting commercial terms or receiving a payment does not waive your data-protection rights.

1 Who is responsible for your data

BloxFi Limited, Hong Kong company number 79037373, is responsible for personal data whose purposes and means it determines in operating the BloxFi website, its technology services, business enquiries and its own client, security and compliance records. Its address is Room 602, 6/F, Kai Yue Commercial Building, No. 2C, Argyle Street, Mongkok, Kowloon, Hong Kong.

Victus Ventures GmbH, Swiss company number CHE-264.484.653, is responsible for personal data whose purposes and means it determines when providing its agreed Swiss services, including its own onboarding, financial-crime controls, transaction processing and client relationships. Its address is Dammstrasse 16, 6300 Zug, Switzerland.

BloxFi Payments Inc, of 5307 Victoria Drive #1325, Vancouver, BC V5P 3V6, Canada, is the Canadian entity. If it determines the purposes and means of processing personal data for its own corporate administration, registration process or properly identified business enquiries, it is responsible for that processing. This Policy does not activate Canadian financial services; any future operational processing requires the applicable permissions, arrangements and service-specific privacy information before it begins.

BloxFi USA LLC is the United States entity. If it processes personal data for its own corporate administration, registration process or properly identified business enquiries, its role and complete contact details must be identified in the relevant collection notice. This Policy does not activate United States financial services. Future financial-service processing remains subject to the necessary federal and state requirements and the appropriate privacy information and arrangements.

BloxFi Holding Ltd, British Virgin Islands company number 2210802, is a non-operational holding company and does not provide payment, conversion or custody services. Where it processes personal data for its own ownership, corporate governance or investment-related administration, that processing must have a defined lawful purpose and the appropriate privacy information. Ownership of another company does not give it unrestricted access to that company's customer or transaction records. Naming Victus Ventures GmbH in this Policy does not represent that it is a subsidiary of BloxFi Holding Ltd.

An entity is a controller or equivalent data user only to the extent it actually determines the purposes and means of the relevant processing. BloxFi Limited may also process specified platform data on Victus Ventures GmbH’s instructions under the applicable processing arrangement. Where an entity processes data solely for a business client or another controller, that controller’s notice and instructions govern that processing, subject to applicable law and the relevant processing agreement. Common branding does not by itself create joint controllership; where the actual activities create joint responsibility, the required arrangements and information apply.

Your onboarding documents, service confirmation or collection notice identify the entity involved in your service. Banks, payment institutions, liquidity providers, verification suppliers and other partners may be independent controllers for their own purposes, processors, or both for different activities. Their own notices apply to their independent processing. A shared brand, integration or introduction does not make every listed entity responsible for every activity. An entity beginning a new processing activity must provide the required specific information, including its identity and complete contact details, before that activity begins. This Policy does not transfer a client relationship or create unrestricted permission to share personal data between entities.

For privacy enquiries concerning any listed entity, contact info@bloxfi.com, or write to the responsible entity at its address given above or in the relevant collection notice. If you are unsure which entity is responsible, we will help direct your request. Identifying a service provider or controller in this Policy does not represent that it is authorised to provide every service in every country.

2 The data we collect

We collect data relevant to the relationship or activity, rather than all of the following information about every individual:

• Identity and contact information: name, business role, employer, address, email address, telephone number, date of birth, nationality or residence, and identification documents where required.
• Business, ownership and authority information: company and registration records, directorships, ownership and control interests, beneficial-owner details, signatory information, powers of attorney and evidence of authority to act for a client or underlying customer.
• Onboarding and compliance information: identity-verification results, source of funds or wealth information, business activity, anticipated payment flows, tax information where relevant, sanctions and politically exposed person screening, relevant adverse media, and evidence or explanations needed to assess an application or transaction.
• Account and transaction information: account holder and beneficiary details, bank identifiers, wallet addresses, supported network details, payment references, instructions, quotes, amounts, currencies, fees, transaction history, invoices, payment purposes, confirmations, status and reconciliation records.
• Platform and security information: user and organisation identifiers, permissions, authentication and access records, IP address, device and browser information, API and webhook logs, timestamps, error reports and records of suspected misuse. Do not include passwords, private keys or other secrets in support requests.
• Communications and preferences: enquiries, correspondence, support and complaint records, meeting information, marketing preferences and evidence of notices or consents. Where a call or meeting is recorded, we provide notice and meet applicable legal requirements before recording.
• Regulatory communications and eligibility records: information necessary to assess and evidence a permitted audience, communication, approval, exemption or required customer safeguard, where relevant to the actual activity, as described in Section 16.
• Website information: pages visited, referral information, browser interactions and information collected through permitted cookies or similar technologies, subject to Section 9.

Some information can receive additional legal protection, including biometric identification data, information about criminal allegations or convictions, and other sensitive or special-category data. We process such information only where necessary for a defined purpose and where an applicable additional legal condition and safeguards are satisfied. If a verification process uses biometric identification, its specific purpose, responsible parties and required choices must be explained before use. An identity document containing a photograph does not by itself mean that biometric identification is being performed.

3 Where data comes from

We receive data from you, the business you represent, a client acting under a valid mandate, an authorised introducer or partner, a payer or beneficiary, and providers involved in an approved application or transaction. We may also obtain relevant information from company and beneficial-ownership registers, public websites, sanctions and screening databases, fraud-prevention and identity-verification services, public blockchain records, and competent authorities where lawful.

We use available source information to assess relevance and accuracy. A screening match or publicly reported allegation is not automatically proof of wrongdoing. You may contact us to correct inaccurate information or explain a disputed match, subject to restrictions required by law.

If a business supplies data about another person, it must have authority and a lawful basis to do so and provide the required privacy information. A corporate signature is not consent on behalf of every director, employee or customer. Each responsible BloxFi entity retains its own duties to give notice, assess its processing and respect individual rights. Where we obtain data indirectly, we provide the information required by law within the applicable timeframe, unless a lawful exception applies.

4 Why we use data and the basis for doing so

We use personal data for the purposes below only to the extent relevant and lawful. Where the EU GDPR, UK GDPR or another law requires a specified legal basis, that basis depends on the purpose and circumstances. Swiss and Hong Kong processing must also satisfy their applicable requirements; these regimes do not use identical legal-basis frameworks.

Enquiries and business relationships. We use contact, business and communication information to answer enquiries, arrange demonstrations, assess requested services, administer relationships and keep necessary records. Where applicable, we rely on steps requested before a contract with the individual, performance of that contract, or our legitimate interests in communicating with business representatives and managing business relationships. A contract with a company is not automatically a contract with its employees.

Onboarding, identity, authority and financial-crime controls. We use relevant identification, ownership, mandate, screening and financial information to verify participants, assess eligibility and risk, investigate concerns, meet reporting duties and prevent misuse. We rely on applicable legal obligations where they provide a valid basis, and otherwise on an available lawful basis such as legitimate interests in preventing fraud, protecting customers and maintaining lawful services. A foreign legal obligation is not automatically a qualifying legal-obligation basis under every data-protection regime. Additional conditions are required for protected sensitive or criminal-record data.

Approved services and transactions. We use relevant account, instruction, participant and transaction information to support account applications, collection, conversion, routing, settlement, payout, reconciliation and service communications. We rely on performance of a contract with the individual where applicable, legal obligations, or legitimate interests in carrying out authorised business transactions and providing contracted services to corporate clients. We disclose only the information necessary for the relevant service or payment leg.

Security, support and improvement. We use relevant technical, transaction and communication information to authenticate access, investigate errors, maintain resilience, prevent abuse and improve service reliability. Where applicable, the basis is our legitimate interests in operating secure, reliable services, legal obligations, or performance of a contract with the individual. We use aggregated or anonymised information where it meets the purpose without identifying people. Pseudonymised information remains personal data where re-identification remains possible.

Legal, accounting and governance purposes. We retain and use necessary records to meet legal obligations, handle complaints, conduct audits, establish or defend legal claims, manage corporate transactions and evidence instructions and accepted terms. The applicable basis is a qualifying legal obligation or a legitimate interest in proper administration and protecting legal rights.

Financial-promotion and geographic eligibility controls. Where relevant, we process necessary information to assess and evidence permitted communications, geographic access and required customer safeguards. Section 16 explains the relevant purposes, data and legal-basis assessment for UK financial promotions.

Marketing and optional features. We use business contact information and preferences for relevant updates or optional features only on a lawful basis, obtaining consent or a valid indication of no objection where required. We identify the relevant consent request separately. Marketing is not a condition of receiving core services. Section 10 explains how to opt out.

Where we rely on legitimate interests, we assess necessity and the effect on individuals and do not proceed where their interests or rights require otherwise. You can ask for information about the relevant assessment. Where consent is the basis, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Withdrawal does not prevent processing that remains necessary on another valid basis, such as statutory recordkeeping.

5 Required and optional information

We identify information that is required for an application, transaction or legal obligation when requesting it. If necessary identity, authority, source-of-funds, account or beneficiary information is missing or cannot be verified, we or the relevant provider may be unable to onboard a relationship, activate a service or process a payment. Additional checks may be needed while a request is pending. Optional information and marketing choices are identified separately.

Please provide accurate information, tell us when material details change and use the approved secure upload or communication channel. Do not send unrelated sensitive information or other people’s information without a lawful reason. Test and sandbox environments must not contain live funds or unapproved personal data.

6 Who receives personal data

We share information only where necessary for a disclosed purpose and with a lawful basis. Relevant recipient categories include:

• The entity responsible for the activity and authorised personnel who need access for that purpose; common ownership or branding alone does not justify access.
• Banks, payment institutions, account providers, liquidity providers, exchanges, custodians and settlement or payout partners involved in an approved service, application or transaction.
• Identity-verification, sanctions-screening, fraud-prevention, blockchain-analysis and compliance service suppliers, where relevant to an approved process.
• A legally competent financial-promotion approver or other compliance provider involved in the particular lawful arrangement, where applicable and identified in the relevant notice, as explained in Section 16.
• Technology and operational suppliers providing hosting, authentication, communications, secure storage, support, monitoring and other defined functions under appropriate terms.
• A business client and its authorised users for activity within their lawful role, and the relevant payer, beneficiary or their financial institution for a payment.
• Professional advisers, auditors, insurers, the relevant Swiss self-regulatory organisation and competent courts, regulators, law-enforcement or other public authorities where lawfully required or permitted.
• A potential or actual successor, investor or purchaser in a genuine corporate transaction, subject to necessity, confidentiality, appropriate safeguards and any required further notice.

A provider may need to make its own eligibility, legal or compliance decision; an introduction or integration does not remove that responsibility. We do not provide raw identity documents or biometric material merely because an integration can technically access them. Recipient and processing details specific to a service are supplied in the relevant onboarding, verification or service notice.

A payment can disclose the sender’s or beneficiary’s name, account information, payment reference and related details through banking messages, statements or legally required transfer information. For digital-asset transfers, wallet addresses and transaction information recorded on a public blockchain may be visible globally and may remain accessible indefinitely. We minimise personal information in public transaction fields. We cannot erase data from an independently operated public blockchain, but remain responsible for our own processing and for considering available rights and protective measures.

The service agreements do not grant a general right to sell identifiable customer data, use it for unrelated advertising or train general-purpose AI models on identifiable data or confidential information. A different purpose requires its own lawful assessment, notice and any required consent or agreement.

7 International processing and transfers

The entities identified in Section 1 are established in Hong Kong, Switzerland, Canada, the United States and the British Virgin Islands. Their establishment in a country does not mean that every person's data is transferred there. For Swiss services, approved platform processing may involve BloxFi Limited in Hong Kong. Any processing by another listed entity must meet the purpose, necessity, notice and transfer requirements described in this Policy. An international payment or an authorised provider connection may also require necessary data to be handled in the country of the relevant provider, account, payer or beneficiary. Remote access from another country can itself constitute a transfer.

Before such processing begins, we identify the actual recipients, countries, roles and purposes and implement the safeguards required by the applicable law. The specific destination countries and relevant transfer arrangements are disclosed in the applicable collection, onboarding or service-specific information; further details are available from our privacy contact. We do not rely on a general reference to international services as permission to send data anywhere.

Depending on the law and destination, a transfer may rely on a recognised adequacy decision, approved standard contractual clauses with required adaptations and supplementary measures, another legally recognised safeguard, or a permitted exception whose conditions are met. For Swiss transfers this includes the requirements of the Swiss Federal Act on Data Protection; for transfers subject to EU or UK law the corresponding transfer requirements also apply. We assess onward transfers and relevant government-access risks where required.

Accepting an MSA, granting a payment mandate or agreeing to a provider connection is not by itself a lawful international-transfer mechanism. You can request information about the safeguard applying to your data and a copy or explanation of it, with lawful redactions to protect confidential or security-sensitive information.

8 Screening profiling and automated decisions

The services may use automated tools to verify information, identify possible sanctions or fraud concerns, detect unusual activity, apply security controls and assess available transaction routes. Such tools can produce matches, scores or alerts based on information such as identity details, transaction patterns, location, wallet activity and published screening data. An alert may lead to further questions, review, a temporary restriction or referral to the responsible provider; it does not necessarily establish that a person has acted unlawfully.

A route comparison or technical payment control is not automatically a decision about an individual with legal or similarly significant effects. Before introducing solely automated decisions that have such effects, the responsible entity must establish the applicable legal conditions, provide the required specific information about the logic and likely consequences, and implement the required safeguards. This Policy does not give blanket consent to such decisions.

You may contact us to question an outcome, supply relevant information and request human review where applicable. A provider is responsible for its own independent decisions and associated rights process. We may be unable to disclose particular screening details where doing so would breach law, prejudice a protected investigation or reveal measures that would enable fraud, but will explain restrictions to the extent lawful.

9 Cookies and similar technologies

Cookies, local storage, pixels and similar technologies can support website functionality, security, preference storage, analytics and other features. The categories actually used, their providers, purposes and lifetimes must be described in the cookie information shown for the relevant website or interface.

Technologies that require consent under applicable law are not deployed until the required choice has been made. Where a lawful exception permits use without consent, its conditions must be satisfied and any required information or opt-out provided. Merely browsing the website, accepting service terms or leaving a preselected option unchanged is not consent to optional tracking.

You may change choices through the relevant consent controls where offered, or contact us for help. Browser settings can also restrict cookies, although disabling necessary technologies may affect functionality. A third-party site or separately operated white-label interface may have its own cookie controls and privacy notice. Those operators remain responsible for their own tracking and disclosures.

10 Marketing choices

You can ask us to stop direct marketing at any time using the unsubscribe option in a message or by emailing info@bloxfi.com. We record the request and retain only the information needed to respect it and evidence lawful processing. A marketing opt-out does not stop essential security, contractual, transaction or legal communications.

Where Hong Kong direct-marketing rules apply, we provide the required information about the data and marketing use and obtain the consent or indication of no objection required before use. Any provision of personal data to another person for its own direct marketing must independently satisfy applicable notice and consent requirements. An introduction, referral commission or shared brand is not permission for unrestricted marketing.

Consent to marketing, receipt of an enquiry or a referral does not establish that a financial promotion or financial service is lawful for the recipient's jurisdiction. Section 16 addresses the separate UK financial-promotions requirements and related personal-data processing.

11 How long we keep data

Retention depends on the responsible entity, category, purpose and applicable law. We keep data only for as long as it is lawfully necessary and restrict retained records to the relevant purpose.

For services under the Victus Ventures GmbH Swiss MSA, the contractual recordkeeping baseline is ten years after the relationship ends for relevant identification, ownership and authority records, and ten years after the transaction for transaction records, subject to mandatory requirements or restrictions and lawful legal holds.

For services under the BloxFi Limited Hong Kong MSA, the baseline is seven years after the relationship ends for relevant identity and authority records, and seven years after the transaction for transaction records, subject to applicable law and any necessary, lawful longer provider or legal requirement. This is not a statement that every item collected by the website or every person’s data must be kept for seven or ten years.

Enquiry and prospect records are retained for responding and managing an active relationship, and thereafter only where a documented lawful purpose remains. Marketing preferences are retained while needed to administer your choices. Technical logs, support records and security evidence are retained according to their operational, security and legal purpose. A dispute, investigation or legal hold may justify keeping particular records longer; it does not justify indefinite retention of everything.

Once no lawful need remains, data is securely deleted, returned where appropriate or irreversibly anonymised. Protected backups are removed through the applicable deletion cycle and are not reused for unrelated purposes. Closing an account, withdrawing consent or revoking a mandate does not remove a continuing legal recordkeeping obligation. You can ask about the period or criteria applying to your particular data.

12 Security and incident handling

We maintain organisational and technical safeguards appropriate to the relevant data and risk, including access restrictions, secure transmission and storage, authentication, monitoring and arrangements with suppliers. Access is limited to people and systems with a legitimate need. No system or communication method can be guaranteed completely secure.

Suspected unauthorised access, exposed credentials or payment fraud should be reported promptly through your verified support or urgent incident channel. You may also contact info@bloxfi.com or compliance@bloxfi.com. Do not send private keys, passwords or complete identity documents by ordinary email unless an approved secure process specifically requires it.

Where an incident requires notification to individuals or an authority, the responsible entity makes that notification within the applicable legal requirements. Interparty notification periods in service contracts do not replace statutory obligations or create a universal promise to notify every individual within 24 hours.

13 Your rights

Depending on the law applying to your data, you may have rights to obtain confirmation and access, correct inaccurate information, request deletion or restriction, object to particular processing, receive or transfer qualifying data in a portable form, withdraw consent, and obtain the safeguards applicable to automated decisions. You may object to direct marketing at any time. Rights are not identical in every jurisdiction and some are subject to conditions and lawful exceptions.

Send a request to our privacy contact at info@bloxfi.com, identifying the relationship or transaction sufficiently for us to locate the relevant data. We may request proportionate information to verify identity or representative authority and use it for that purpose. You do not have to explain why you want access. We will use a suitable secure channel to return information.

We respond within the applicable statutory period. Swiss access requests are generally answered within 30 days; Hong Kong access and correction requests within 40 days; and EU or UK GDPR requests generally within one month, subject to the applicable conditions for an extension. If an extension, lawful refusal or permitted charge applies, we explain it as required. We do not impose a blanket charge for exercising rights.

A request may be restricted where necessary and lawful to protect another person’s rights, privileged information, a protected investigation or mandatory recordkeeping. We assess the particular request and explain the basis as far as permitted. We do not treat all compliance information as automatically exempt. If we act only as a processor, we refer the request to the responsible controller and assist as required; referral does not restart a legal deadline.

You may complain to the competent data-protection authority without first contacting us. Depending on the processing, this may be the Hong Kong Privacy Commissioner for Personal Data at www.pcpd.org.hk, the Swiss Federal Data Protection and Information Commissioner at www.edoeb.admin.ch, the UK Information Commissioner’s Office at ico.org.uk, or the competent EEA supervisory authority. Other applicable local rights and complaint routes remain available.

14 Children and information about others

Our website and business onboarding are directed at adults acting in a business capacity. We do not invite children to open business accounts or submit information through public enquiry forms. Any proposed service involving a minor’s data requires a specifically approved lawful arrangement, appropriate authority and the necessary notices and safeguards. If you believe data about a child has been supplied inappropriately, contact us so that we can assess and address it.

15 Other websites providers and changes to this Policy

Links, embedded services and provider interfaces may be operated by third parties. Review the notice of the operator responsible for your interaction. BloxFi remains responsible for its own processing, including any data it lawfully receives or discloses through an integration.

We may update this Policy to reflect changes in our activities or applicable law and will display the updated version date. Material changes are brought to your attention by an appropriate means where required. A new version does not retrospectively authorise an incompatible use, create consent or amend your service agreement. Any new purpose, recipient, transfer or automated decision requiring additional information, consent or arrangements must satisfy those requirements before the relevant processing begins.

16 UK Financial Promotions Compliance Acknowledgment

This section explains personal-data processing relevant to the UK financial-promotions regime, sometimes referred to as “FinProm”. Each entity remains responsible for the data-processing obligations applicable to its own actual role. This acknowledgment is privacy information; it does not constitute approval of a financial promotion, establish a UK regulatory permission or waive an individual's rights.

Where a proposed communication or service has a UK connection, the responsible entity may need relevant information to assess whether the communication is permitted, identify the intended audience, apply geographic restrictions and evidence the conditions of an applicable approval or exemption. Depending on the actual activity, this may include identity and residence information, evidence of business or investor classification, the communication and approval version, required declarations and warnings, records of a cooling-off period and the individual's decision to proceed, and knowledge-and-experience responses and assessment outcomes. We collect these records only where necessary and lawful for the particular activity. This list does not mean that every person must complete an investor assessment or that BloxFi offers a UK retail cryptoasset service.

The purposes are to assess and evidence lawful communications, eligibility, required safeguards and regulatory compliance, and to investigate complaints or establish or defend legal claims. Where a specified legal basis is required, the responsible entity relies on a qualifying applicable legal obligation or, where appropriate, legitimate interests in preventing unlawful promotion and maintaining lawful services, subject to the assessment described in Section 4. Separate conditions are required for protected sensitive data. A business contract, acknowledgment of risks or decision to proceed is not automatically consent to personal-data processing or direct marketing.

Where a legally competent financial-promotion approver or another provider is involved, we disclose only the information it needs for its defined lawful role and identify the relevant recipient and controller or processor arrangements in the applicable notice. Any international disclosure must meet Section 7. No UK approver, partnership or regulatory permission is established by this Policy, and one entity's privacy or regulatory arrangements do not automatically cover another entity, client or partner.

Records are retained for the applicable documented regulatory, evidential and claims periods, subject to the necessity and deletion principles in Section 11. The Swiss and Hong Kong contractual retention baselines do not automatically apply to every marketing or promotion record. Significant automated decisions remain subject to Section 8 and any required additional information, conditions and safeguards. You can ask our privacy contact about the processing, applicable retention period or your rights.

Compliance with privacy and marketing-consent rules and compliance with the UK financial-promotions regime are separate requirements. Satisfying one does not satisfy the other. This Policy does not transfer a party's statutory responsibilities, substitute for a required financial-promotion approval or permit an otherwise unlawful communication or service. Any contractual allocation of responsibilities or indemnity is governed by the applicable validly accepted agreement and mandatory law, not by acceptance of this privacy notice.