Privacy Policy

​1. Application and Scope

 

This Privacy Policy applies to all personal information collected through the OTCX platform and related services (“Services”), which include but are not limited to: crypto-to-fiat and fiat-to-crypto conversions, institutional liquidity and settlement services, and international transfers conducted via SWIFT and SEPA networks. “Personal Information” means any information about an identifiable individual, including but not limited to name, contact details, identification documents, and transaction-related information. This Policy applies to both individual and institutional clients, counterparties, and business partners of OTCX. It does not apply to third-party websites or services that may be accessible through links on our platform.

 

 

2. Information We Collect

 

We collect and maintain various categories of personal information necessary to deliver our Services and ensure regulatory compliance. This includes:

 

a. Identification and Compliance Information

• Full legal name, contact details, date of birth, nationality, and address

• Government-issued identification, business registration documents, and verification data

• Tax identification numbers, beneficial ownership details, and supporting KYC/KYB records

 

b. Transaction and Financial Information

• Account details, payment instructions, transaction history, and settlement data

• Banking identifiers such as IBAN, SWIFT/BIC codes, and cryptocurrency wallet addresses

• Source and destination of funds, exchange rates applied, and related transaction metadata

 

c. Technical and Analytical Information

• IP address, browser type, device identifiers, login timestamps, and geolocation data

• Platform usage logs, access patterns, and session analytics used to enhance performance and security

 

We may collect information directly from you, automatically through your platform interactions, or from verified third parties in accordance with applicable laws and regulations.

 

 

3. Purposes for Collection and Use

 

We collect, use, and process personal information for the following legitimate business and regulatory purposes:

 

Account Management and Service Provision: To open, verify, and maintain OTCX accounts and facilitate the execution of fiat and digital asset transactions.
 

• Regulatory Compliance: To comply with AML, CTF, and sanctions obligations under FINTRAC and other applicable regulations.

• Fraud Prevention and Risk Management: To detect, investigate, and prevent unauthorized activities or violations of our policies.

• Service Improvement: To enhance platform functionality, optimize performance, and develop new features or services.

• Client Support and Communication: To provide support, respond to inquiries, and send relevant service notifications.

 

We will not use or disclose personal information for unrelated purposes without your consent, except where required or permitted by law.

 

 

4. Consent and Legal Basis

 

By using the OTCX platform and related services, you consent to the collection, use, and disclosure of your personal information as described in this Policy. You may withdraw your consent at any time, subject to legal or contractual restrictions. Withdrawal of consent may impact our ability to provide you with certain services. We may also process personal information without consent where authorized or required by law—for example, to comply with FINTRAC reporting requirements or court orders.

 

 

5. Disclosure of Personal Information

 

We may disclose personal information to trusted third parties under the following circumstances:

 

Service Providers: To banking, payment, and technology partners assisting in operations and transaction processing.

Regulatory and Law Enforcement Authorities: As required under FINTRAC regulations or applicable laws for reporting suspicious or unlawful activity. Corporate Transactions: In connection with mergers, acquisitions, or corporate restructuring, where personal information is transferred to a successor entity subject to the same protections.

 

We do not sell or rent personal information for marketing purposes.

 

 

6. Data Retention and Storage

 

We retain personal information only as long as necessary to meet the purposes outlined in this Policy or to comply with legal obligations. As an MSB, we are required by FINTRAC to maintain certain records for a minimum of five (5) years following the completion of a transaction or the termination of a client relationship. All personal information is securely stored in data centers located within Canada, using encryption, access control, and physical security safeguards. Once retention periods expire, information is securely deleted or anonymized.

 

 

7. Safeguards and Security

 

We implement advanced technical and organizational measures to protect personal information, including:

 

• AES-256 encryption for stored data and TLS 1.3 for all communications

• Multi-factor authentication and strict role-based access controls

• 24/7 system monitoring, intrusion detection, and regular penetration testing

• Mandatory employee security training and confidentiality protocols

 

While no system can guarantee absolute security, we take all reasonable precautions to safeguard information under our control.

 

 

8. Access, Correction, and Deletion Rights

 

You have the right to access, verify, and request correction or deletion of your personal information. Requests must be submitted in writing to our Privacy Officer (see Section 11). We may require proof of identity before fulfilling requests. Certain legal obligations (e.g., AML record retention) may limit deletion in specific cases, and we will notify you accordingly.

 

 

9. Cookies and Tracking Technologies

 

The OTCX platform uses cookies and similar technologies to:

 

• Enable secure login sessions and prevent fraud

• Gather analytics for performance optimization

• Personalize user experience and display relevant content

 

You may control cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

 

 

10. Cross-Border Data Transfers

 

Due to the international nature of financial operations, limited data transfers may occur to partners or institutions outside Canada. Where transfers are necessary, we ensure equivalent data protection standards through appropriate legal safeguards, including contractual clauses and jurisdictional adequacy assessments.

 

 

11. Contact and Privacy Complaints

 

For privacy inquiries, data access requests, or complaints, please contact:

 

Privacy Officer

Evendough Holdings Ltd

Email: compliance@evendough.com

 

If you are unsatisfied with our response, you may contact:

 

Office of the Privacy Commissioner of Canada

30 Victoria Street, Gatineau, Quebec K1A 1H3

Toll-Free: 1-800-282-1376

Website: www.priv.gc.ca

 

 

12. Changes to This Policy

 

We may update this Policy from time to time. Any material changes will be communicated through the OTCX platform at least 30 days prior to taking effect. Continued use of our Services after such notice constitutes acceptance of the revised Policy.

Archived versions of previous Policies are available upon written request to our Privacy Officer.