Last Updated: September 24, 2026

Privacy Policy

1. Introduction

PAX Markets, Inc. and its affiliates, including PAX Markets Technology, LLC, PAX Markets USA, Inc., and PAX Markets International, Ltd. (collectively, "we," "us," "our", or "PAX"), are committed to protecting the personal information of our customers and users of our websites, applications, and APIs (including www.pax.markets) (collectively, our "Website") or our online platform. Each PAX entity with which you have entered into a Terms of Service or other customer agreement is the controller (your "data controller") of the personal information processed under that agreement. Your agreement names that entity and governs; Appendix A lists PAX's current contracting entities for reference. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our services ("Services"), such as when you:

• Visit, sign up, or access our Website or our online platform

• Download and use any application of ours that links to this Privacy Policy

• Use or access any of our application programming interfaces ("APIs") or software development kits ("SDKs")

• Engage with us in other related ways, including any sales, marketing, or events

Additionally, this Privacy Policy describes how and for which purposes we may use information we collect, where we store it, with whom we may share it, your choices and rights regarding such information, and how to contact us if you have any concerns.

If you do not agree with our policies and practices, please do not use our Services. By accessing or using our Website and any applicable Services, you agree to this Privacy Policy. Your continued use of our Website and Services after we make changes is deemed to be acceptance of those changes, so please check the Privacy Policy periodically for updates. We reserve the right in our sole discretion to change, modify, amend, or supplement this Privacy Policy from time to time.

When we say "you", we mean you or any individual whose personal information you provide, whether it's those who explore our Services or those who sign up for and access our Services. Before you provide information about an individual connected to your business to us, you must make sure that you have a lawful purpose or the agreement of the relevant individual and that they've been provided with this notice, which explains the way in which their information will be processed and their rights in relation to their information.

Please note that we do not control websites, applications, decentralized applications, networks, protocols, blockchains, or services operated by any third parties, and we are not responsible for their actions. We encourage you to review the privacy policies of other services you use to access or interact with our Services.

When we refer to "using" personal information in this Privacy Policy, we mean carrying out any operation on personal information, including collecting, obtaining, recording, holding, storing, organizing, adapting, altering, retrieving, transferring, consulting, disclosing, disseminating or otherwise making available, combining, blocking, erasing or destroying it. By "personal information", we mean any information from which an individual could be identified, directly or indirectly, by itself or when combined with other information or context.

2. Scope of the Privacy Policy

This Privacy Policy applies to all users of our Website and those who access our online platform, and it covers all PAX entities. We describe how we collect, use, store, and share personal information in compliance with the data-protection and financial-services laws applicable to us. Which laws apply, and the rights they give you, depend on where you are located and on which PAX entity you have entered into a Terms of Service (or other customer agreement) with (see Appendix A). These are described throughout this Policy — in particular the conditions for use in Section 5, the Bermuda rights in Section 10, and the U.S. federal and state rights (including under the GLBA and BSA) in Section 11 — and the responsible entities and their regulators are identified in the Appendices.

3. Information We Collect

3.1 Categories of Information Collected

Personal Information Provided by You. We collect various types of personal information when you interact with our Services, including but not limited to:

• Personal Identification Information. Names, date of birth, country of residence, nationality, addresses, email addresses, and other contact details.

• Profile Information. Username and password that you may set to establish an online account with us.

• Know Your Customer ("KYC"), Know Your Business ("KYB"), and other Due Diligence Information. Identity verification data such as government-issued IDs (e.g., passports or driver's licenses), beneficial ownership details, and background checks to comply with Anti-Money Laundering ("AML"), Counter-Terrorism Financing ("CTF"), and sanctions obligations, together with source of funds and source of wealth information and other information obtained through enhanced and ongoing due diligence.

• Biometric Information (Identity Verification; Liveness; Authentication; Transaction Authorization; Fraud Prevention). When you create an account, undergo identity verification, authenticate to your account, or authorize certain transactions or account actions (for example, a withdrawal), we and/or our identity verification and authentication service providers may collect and process biometric information and biometric identifiers, such as a scan of face geometry derived from a selfie image or video ("Biometric Data"), to verify your identity, confirm "liveness," authenticate you, authorize a specific transaction or account action, prevent fraud, secure accounts, and comply with legal and regulatory obligations.

• Financial Information. Bank account details, tax identification numbers, payment records, and transaction details.

• Wallet Address. Your public wallet address, digital transaction information, and information related to cryptographic integrations.

• Blockchain Data. Publicly available blockchain data.

• Transaction Data. Data about transactions you complete on our platform, including blockchain addresses, currency (fiat and/or digital), payment method, timestamps, digital signatures, transaction amounts, and counterparties.

• Device and Usage Data. Information collected through cookies and tracking technologies, such as IP addresses, browser types, operating systems, device identifiers, geolocation data, and website usage patterns.

• Aggregated Data. Non-personally identifiable information derived from personal data, used for analytical and reporting purposes.

• Feedback or Correspondence. Emails and information you provide when you contact us or otherwise correspond with us online.

• Marketing Information. Your preferences for receiving communications about our activities, events, and publications.

• Sensitive Personal Information (Bermuda PIPA). For purposes of Bermuda's Personal Information Protection Act 2016 ("PIPA"), "sensitive personal information" includes information relating to an individual's place of origin, race, colour, national or ethnic origin, sex, sexual orientation, sexual life, marital status, physical or mental disability or health, family status, religious beliefs, political opinions, trade union membership, biometric information, and genetic information. We collect sensitive personal information only where lawfully permitted: with your express consent, which we obtain as part of onboarding and identity verification (including for Biometric Data, as described in Section 3.2), or where another lawful basis applies, such as compliance with anti-money-laundering laws.

• Employment Information. If you apply to work with us, or are otherwise engaged through an employment, contractor, or referral relationship, we may collect application materials, supporting documents, references, and information generated during the course of any such relationship.

• Risk Rating Information. Risk ratings, credit risk information, financial crime-risk reviews, sanctions-screening results, adverse-media results, and other risk-related assessments generated about you in connection with our compliance program.

Information You Provide When Using Our Services.

• When you sign up for Services and/or login to our platform

• When you execute trades or transactions on our exchange

• When you deposit or withdraw digital assets or fiat currency

• When you contact us (e.g., customer support)

• When you subscribe to our email list

Information automatically collected. Some information—such as your IP address and/or browser and device characteristics—is collected automatically when you visit our Services.

We, our service providers, and third-party sources may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services.

• Device Data. Information about your computer, phone, tablet, or other device you use to access the Services.

• Location Data. Information about your device's location, which can be either precise or imprecise.

• Blockchain Data. We may analyze public blockchain data, including timestamps of transactions, transaction IDs, digital signatures, transaction amounts, and wallet addresses.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

3.2 Biometric Data Notice; Consent; Retention and Destruction

A. Notice of Collection and Use of Biometric Data. We collect, store, and use Biometric Data only for: (i) identity verification and authentication; (ii) liveness testing; (iii) authorizing specific transactions or account actions (such as withdrawals); (iv) fraud prevention, security, and risk management; (v) onboarding eligibility and account protection; and (vi) complying with applicable laws and regulations.

B. Consent / Written Release. Where required by applicable law, we will obtain your informed, written consent (which may include an electronic signature or affirmative electronic action) before collecting or otherwise obtaining your Biometric Data. By submitting your Biometric Data and completing the identity verification process, you authorize us and our service providers to collect, store, use, and disclose your Biometric Data for the purposes described above.

C. Retention Schedule and Permanent Destruction. We do not retain Biometric Data longer than necessary for the purposes described above. Unless a longer period is required by law, court order, or a valid legal process, we will permanently destroy Biometric Data on or before the earliest of: (i) the date the initial purpose for collecting or obtaining the Biometric Data has been satisfied; (ii) twelve (12) months after the purpose for collection has expired; and (iii) three (3) years after your last interaction with us (for Texas residents, we will comply with the one-year destruction timing).

D. No Sale / No Profiting. We do not sell, lease, trade, or otherwise profit from Biometric Data.

E. Disclosure Limitations. We disclose Biometric Data only to service providers and processors that assist us with identity verification, security, fraud prevention, and compliance, and only for the purposes described in this Privacy Policy, unless disclosure is required or permitted by law.

F. Safeguards. We store, transmit, and protect Biometric Data using a reasonable standard of care within our industry and in a manner that is at least as protective as the manner in which we protect other confidential and sensitive information.

3.3 How We Collect Information

We collect data in several ways:

• Directly From You. When you apply or register for our Services, provide information through forms, complete identity verification, or communicate with us.

• Automatically Through Your Use of Our Services. When you use our Services or Website, we automatically collect data through cookies, server logs, and other tracking technologies.

• From Third Parties. We may receive information from third-party services, such as identity verification providers, public databases, and financial institutions to meet our compliance requirements.

• From Affiliates. We may obtain information about you from PAX affiliates as part of normal business practices or to adhere to applicable legal and regulatory requirements.

• From public, on-chain data.

4. How We Use Information

4.1 Primary Uses

We use your personal information for a variety of reasons, depending on how you interact with our Services or Website, including but not limited to:

• Facilitate Transactions. Process trades, deposits, withdrawals, and other transactional services on our exchange.

• Verify Your Identity. Conduct KYC/AML/CTF checks as required by law.

• Facilitate account creation and authentication. Process your information so you can create and log in to your account.

• Deliver Services. Provide you with the requested Services, present our Website and its contents to you.

• Provide Support. Respond to your inquiries, offer technical assistance, and resolve issues.

• Send information to you. Send you details about our products and services, changes to our terms and policies, and other similar information.

• Improve Our Services. Conduct analytics, fraud detection, and performance optimization to enhance our platform functionality.

• Third-Party Access. Provide tools such as APIs, SDKs, or other infrastructure for accessing our Services.

• Protect our Services. Keep our Services and Website safe and secure, including preventing security incidents and fraud.

• Identify usage trends. Better understand how our Services are used so we can improve them.

4.2 Legal and Regulatory Compliance

We use your information to comply with legal obligations, including:

• Responding to Legal Requests. Access, read, preserve, and share your data to comply with applicable law, regulations, subpoenas, legal orders, and investigations from regulatory authorities or law enforcement.

• AML and KYC Obligations. Verify your identity and conduct due diligence to comply with U.S. and international regulations.

• Determine your legal eligibility. Carry out additional checks for certain regulated products or advanced trading activities.

• Sanctions Screening. Screen you and your transactions against sanctions and watch lists maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), the United Nations, His Majesty's Treasury (UK), the European Union, Bermuda, and other applicable authorities.

• Suspicious Activity Reporting. File Suspicious Activity Reports ("SARs") and other regulatory reports as required by the Bank Secrecy Act, the Bermuda Proceeds of Crime Act 1997, the Digital Asset Business Act 2018, and analogous foreign laws. By law (including 31 C.F.R. § 1010.320), we cannot notify you when we have filed, or are considering filing, a SAR or similar report.

4.3 Marketing Communications

We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You may opt-out of receiving these communications at any time by contacting us or using the unsubscribe option in the email.

5. Conditions for Use

PAX uses personal information only in accordance with this Privacy Policy and for the specific business purposes described in Section 4. Any such use requires that one or more of the following conditions is met: (i) you have knowingly consented; (ii) giving due weight to the sensitivity of the information, you would not reasonably be expected to object and the use does not prejudice your rights; (iii) the use is necessary for the performance of a contract with you or to take steps at your request to enter into one; (iv) the use is required or authorized by law; (v) the information is publicly available and the use is consistent with the purpose of that public availability; (vi) the use is necessary to respond to an emergency that threatens your life, health or security; (vii) the use is necessary to perform a task carried out in the public interest; or (viii) the use is necessary in the context of an employment relationship.

The foregoing conditions are consistent with Bermuda PIPA and the other privacy laws that apply to us. We use sensitive personal information only with your express consent or where another lawful condition applies.

6. Cookies and Tracking Technologies

We use cookies and similar technologies (like web beacons and pixels) to gather information about your interaction with our Website and Services. The types of cookies we use include:

• Necessary Cookies. Essential for the core functionality of our services (e.g., to authenticate users or secure transactions).

• Analytical Cookies. Help us understand how our users navigate and use the platform to improve performance.

• Security Cookies. Provide protection against security threats by preventing fraudulent or malicious activity.

We do not use third-party advertising cookies, we do not sell or share personal information for cross-context behavioral advertising, and we honor opt-out preference signals such as the Global Privacy Control ("GPC").

You can control or disable cookies through your browser settings, but please note that disabling some cookies may limit the functionality of our platform or services.

7. Information Sharing

We do not sell your personal data. However, we share information with third parties only when necessary:

• Affiliates. We may share your personal information with our affiliates, including our current and future parents and subsidiaries, for purposes consistent with this Privacy Policy.

• Service providers, processors, contractors and other third parties. Third parties that we use to support our Services and who are bound by contractual obligations to keep personal information confidential. This includes identity verification providers, IT infrastructure providers, and our token custodians.

• Legal compliance, fraud prevention, and safety. If we believe disclosure is necessary or appropriate to protect our rights, property, or safety, or if required by law.

• Financial Institutions and Licensed Partners. Your data may be shared with banks or financial institutions as part of transaction processing and, where regulated services (such as custody or fiat services) are provided by a licensed partner, with that partner so that it can onboard you and provide those services. Such partners act as independent controllers of the information they receive, under their own privacy notices.

• Lawyers and Other Professional Advisors. Where necessary to obtain legal, tax, accounting, audit, or similar advice, or to establish, exercise, or defend legal claims.

• Successors in a Business Transaction. Any party to whom we may transfer (or are considering transferring) our business, policies, or assets, including in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, provided that such party agrees to keep your personal information confidential.

• Employment Referees (with your consent). Individuals or organizations you have nominated as references in connection with an employment, contractor, or partner application.

• Governmental, Regulatory, and Law-Enforcement Authorities. Local or overseas governmental, regulatory, law-enforcement, tax, and judicial authorities where necessary to comply with applicable law or to respond to lawful requests.

8. International Transfers of Data

We may transfer, store, and process your information in countries other than your own. Our servers are located in various regions, including but not limited to the United States and Japan. If you are accessing our Services from outside these regions, please be aware that your information may be transferred to, stored, and processed in these or other jurisdictions.

Where PIPA applies to a transfer, we assess the level of protection afforded by the overseas third party and take appropriate steps to ensure compliance with PIPA.

9. How We Protect Personal Data and Data Retention

We implement administrative, technical, and organizational measures to protect your data, including:

• Encryption. We encrypt personal information in transit (TLS 1.3) and at rest.

• Access Controls. We limit access to personal data to authorized personnel only.

• Security Assessments. We conduct periodic security risk assessments and testing, including independent penetration testing of internet-facing services.

• Incident Response Plan. We have a plan in place to address data breaches and other security incidents quickly.

• Regulatory-aligned cybersecurity program. We maintain a group-wide cybersecurity program commensurate with the nature, size, and complexity of our business, designed to meet the information-security and cyber-risk requirements applicable to us, including the GLBA Safeguards Rule (16 C.F.R. Part 314), the Bermuda Digital Asset Business (Cyber Risk) Rules 2018, and the Digital Asset Business Operational Cyber Risk Management Code of Practice.

• Privacy Officer. We have designated a Privacy Officer accountable for privacy across the PAX group; regulatory designations and contact details are in Appendix B.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law:

• KYC Data. Retained for the duration of the business relationship and at least seven years afterward.

• Transactional Data. Retained for a minimum of seven years, and longer at our discretion where business needs require (for example, enabling clients to review their historical transactions).

• Aggregated Data. Retained indefinitely for reporting and analytics purposes, as it does not identify specific individuals.

Where applicable law requires destruction or deletion of personal data — for example, Biometric Data destruction under Section 3.2 or a verified deletion request — those obligations prevail over the retention periods above.

10. Data Protection under Bermuda PIPA

Notice under PIPA. Customers whose agreement is with PAX Markets International, Ltd. are entitled under PIPA to request access to personal information, request corrections, request cessation of use for marketing purposes, request erasure, be informed of personal information breaches, and complain to the Privacy Commissioner. To exercise any of these rights, please contact us via the details in Section 14.

Withdrawing your consent. If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us at privacy@pax.markets.

Privacy Officer. PIPA (section 5) requires the appointment of a registered privacy officer; PAX's group Privacy Officer serves in that capacity (see Section 9 and Appendix B).

Response time. For PIPA rights requests, we will acknowledge your request promptly and respond within 45 days of receipt of a written request that contains sufficient information for us to verify your identity. In exceptional circumstances (for example, where the request is unusually large, requires third-party advice, or where meeting the 45-day deadline would unreasonably interfere with operations), we may extend the response time by a further 30 days and will notify you of the extension and the reasons for it.

Fee. We may charge a reasonable fee to process access requests under PIPA. Any such fee will not exceed any maximum amount prescribed by the Privacy Commissioner from time to time.

Manifestly unfounded or excessive requests. Where a request is manifestly unfounded or excessive - in particular due to its repetitive nature - we may refuse to act on the request and will provide you with our reasons in writing, including your right to complain to the Privacy Commissioner.

Breach notification. In the event of a breach of security leading to the loss or unlawful destruction or unauthorised disclosure of, or access to, personal information that is likely to adversely affect an individual, we will notify the Bermuda Privacy Commissioner without undue delay and, where required by PIPA, notify affected individuals.

Inaccurate information. Where we agree that personal information we hold about you is inaccurate, we will correct or destroy that information. If we decline a correction request because we believe the information to be accurate, we will inform you in writing of the decision and of your right to make a complaint to the Privacy Commissioner.

11. U.S. Privacy Rights

We comply with the U.S. privacy requirements applicable to us. We may collect categories of personal information including identifiers, personal information, biometric information, commercial information, internet activity, geolocation data, and sensitive personal information.

We do not disclose, sell, or share any personal information to third parties for profit or commercial purposes.

11.1 U.S. federal financial-services privacy (GLBA / BSA)

Gramm-Leach-Bliley Act. To the extent a PAX entity is a "financial institution" under the Gramm-Leach-Bliley Act ("GLBA") — for example, a money services business or money transmitter registered with or licensed by U.S. authorities — the GLBA governs how it handles the "nonpublic personal information" it collects to provide our Services (which may include name, address, Social Security or tax identification number, account number, balances, transaction history, and information from consumer reports). In general, and consistent with the GLBA, we share nonpublic personal information only as permitted by law and as described in Section 7; we do not sell it or share it with non-affiliated third parties for their own marketing purposes; and we protect it with the safeguards described in Section 9.

Bank Secrecy Act. Where a PAX entity is subject to the Bank Secrecy Act, it maintains records and files reports as required; federal law prohibits us from disclosing the existence or content of a suspicious activity report, as described in Section 4.

11.2 State privacy rights

State comprehensive privacy laws. For residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Utah, and Virginia, we comply with the applicable state comprehensive privacy law (in California, the CCPA as amended by the CPRA) to the extent it applies to us. Several of these laws contain entity-level or data-level exemptions for financial institutions and information subject to the Gramm-Leach-Bliley Act ("GLBA"), the Bank Secrecy Act ("BSA"), and other federal financial-services laws, and for information collected for AML/CTF, sanctions-screening, fraud-prevention, and similar compliance purposes. Subject to those exemptions and to verification of your identity, residents generally have the right to (i) confirm whether we are processing their personal data and access that data, (ii) correct inaccuracies, (iii) request deletion of their personal data, (iv) obtain a portable copy of the data, (v) opt out of targeted advertising, the sale of personal data, and certain types of profiling, (vi) limit the use of sensitive personal data where applicable, and (vii) appeal our denial of any of these rights. To exercise these rights, contact us at privacy@pax.markets.

Illinois. Illinois Biometric Information Privacy Act ("BIPA") Notice: If you are an Illinois resident, this Privacy Policy informs you that Biometric Data is being collected or stored and the specific purpose and length of term for which it is being used.

Texas. If you are a Texas resident, we may capture biometric identifiers (such as face geometry derived from a selfie) for identity verification, authentication, authorizing specific transactions or account actions (such as withdrawals), fraud prevention, and compliance with applicable laws. Consistent with Texas Business and Commerce Code § 503.001 we will destroy biometric identifiers within one (1) year after the purpose for collection has expired. Where federal law (including the Bank Secrecy Act and FinCEN regulations) requires us to retain identity verification records, the purpose for collection continues for so long as that retention obligation applies.

Washington State. If you are a Washington resident, our identity verification process may "enroll" a biometric identifier for identity verification, authentication, authorizing specific transactions or account actions (such as withdrawals), fraud prevention, and account security.

To exercise your rights, contact us at privacy@pax.markets.

12. Minors

We do not knowingly collect personal information from, or market to, anyone under 18 years of age, and we verify age as part of onboarding. By using the Services, you represent that you are at least 18. If information provided during signup or verification indicates that an applicant is under 18, we will decline to open the account and delete the information collected, except as needed for fraud prevention or where retention is required by law. If we learn that an existing account holder was under 18, we will immediately deactivate the account; information collected in connection with identity verification and transactions will be retained for as long as anti-money-laundering and other applicable laws require, and deleted thereafter. If you become aware of any personal information we may have collected from anyone under 18, please contact us at privacy@pax.markets.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or through our platform. The latest version of this Privacy Policy will be posted on our website.

14. Questions About This Privacy Policy

If you have any questions, concerns, or requests regarding this Privacy Policy or your data protection rights, please contact us:

PAX Markets Technology, LLC

626 Jefferson Ave., Suite 6

Redwood City, CA 94063

Email: privacy@pax.markets

PAX Markets USA, Inc.

626 Jefferson Ave, Suite 6

Redwood City, CA 94063

Email: privacy@pax.markets

PAX Markets International, Ltd.

Park Place, 55 Par La Ville Road, Third Floor

Hamilton HM 11, Bermuda

Email: privacy@pax.markets

Appendix A. Your Data Controller

Your data controller is the PAX entity with which you have entered into a Terms of Service or other customer agreement, as named in that agreement, which governs. If you have entered into agreements with more than one PAX entity, each is the controller of the personal information processed under its agreement. PAX's current contracting entities include, without limitation:

PAX Markets, Inc. (Delaware, USA) is the group holding company and does not itself contract with customers.

Appendix B. Privacy Officer

PAX has designated a single Privacy Officer responsible for the entire PAX group. The current Privacy Officer is Benjamin Kilimnik, who may be contacted at privacy@pax.markets or bk@pax.markets. The Privacy Officer's designations for specific privacy regulators are:

New affiliates and additional regulator designations will be added to this Appendix.