Privacy Policy

Last Updated: 23rd October, 2026

Chapter 1 – Introduction & Scope

1.1 Introduction

Infini Labs and the relevant affiliated entities that provide our products and services (collectively referred to as "Infini", "we", "us" or "our", as applicable) are committed to protecting your privacy and handling your personal data lawfully, fairly and transparently.

This Privacy Policy explains how we collect, use, disclose, share, store, transfer, protect and otherwise process your personal data when you interact with our websites, applications, platforms, application programming interfaces (APIs), or other products and services (collectively, the "Services").

It also explains the choices and rights available to you in relation to your personal data and how you can contact us with privacy-related questions or requests.

We process personal data in accordance with the privacy and data protection laws applicable to the relevant entity, service and processing activity.

1.2 Scope of This Privacy Policy

This Privacy Policy applies to personal data that we process in connection with:

(a) your registration for, application to, access to or use of our Services;

(b) identity verification, customer due diligence, account administration and ongoing customer relationship management;

(c) payment, card, digital asset and other financial or technology-enabled services, where offered by the relevant Infini entity;

(d) communications with our customer support, compliance, risk management or other business teams;

(e) your use of our websites, applications, APIs and other digital platforms; and

(f) your interactions with us as a customer, prospective customer, beneficial owner, director, authorised representative, payer, payee or other individual whose personal data is processed in connection with our Services.

This Privacy Policy applies to personal data obtained directly from you and, where relevant, from business customers, authorised representatives, service providers, business partners, public sources or other lawful sources.

Certain Services may be subject to additional or service-specific privacy notices. Where such notices apply, they should be read together with this Privacy Policy.

1.3 Responsible Infini Entity

Infini operates through different legal entities that may provide different Services or undertake different personal data processing activities.

The Infini entity responsible for your personal data will depend on the particular Service and the relevant processing activity.

Where an Infini entity determines the purposes and essential means of processing your personal data, that entity acts as a data controller or its equivalent under applicable law (a "Controller").

The relevant Controller will be identified through the applicable service agreement, onboarding information, service-specific privacy notice or other appropriate communication.

Where required by applicable law, we will provide the identity and contact details of the relevant Controller at the time personal data is collected or otherwise within the applicable legal timeframe.

An Infini affiliate is not automatically a Controller of your personal data solely because it belongs to the same corporate group.

In certain circumstances, different Infini entities may act as separate Controllers, joint Controllers or Processors, depending on their actual responsibilities and the relevant processing activities.

1.4 Our Role and Third-Party Services

In providing the Services, we may work with banks, payment service providers, card programme partners, identity verification providers, technology vendors and other third parties.

Depending on the relevant activity, these organisations may process personal data on our behalf as Processors or independently determine the purposes and means of their own processing as separate Controllers.

Where we engage a Processor, we require appropriate contractual and security safeguards in accordance with applicable data protection laws.

Where we disclose personal data to an independent Controller, each party is responsible for its own processing activities and applicable legal obligations.

Further information about the categories of recipients and purposes of data sharing is provided in Chapter 5 – How We Share Personal Data.

1.5 Meaning of Personal Data and Processing

For the purposes of this Privacy Policy:

"Personal Data" means information relating to an identified or identifiable individual, as defined under applicable data protection laws. Depending on the circumstances, this may include identity information, contact details, identification documents, financial information, transaction records, device identifiers and digital wallet addresses that can be linked to an individual.

"Processing" means any operation performed on personal data, including its collection, recording, organisation, storage, use, analysis, disclosure, transmission, restriction, deletion or destruction, whether carried out manually or by automated means.

"You" or "your" refers to an individual whose personal data is processed in connection with the Services.

Other data protection terms used in this Privacy Policy shall be interpreted consistently with applicable data protection laws.

1.6 Relationship with Other Agreements and Notices

This Privacy Policy explains our personal data processing practices and is intended to provide the information required by applicable privacy and data protection laws.

It does not replace any applicable service agreement, customer terms, data protection agreement or other legally required notice.

Where we provide a separate privacy notice for a specific Service or processing activity, that notice may provide additional information about the relevant Controller, processing purposes, legal bases, recipients or other applicable arrangements.

Nothing in this Privacy Policy limits any rights that you have under applicable data protection laws.

1.7 Acknowledgement and Consent

We encourage you to read this Privacy Policy carefully to understand how your personal data is processed.

Where we rely on consent as the legal basis for a particular processing activity, we will obtain consent in accordance with applicable law and provide relevant information about your ability to withdraw it.

We do not treat your use of the Services, by itself, as consent to all personal data processing described in this Privacy Policy.

Where processing is necessary to provide requested Services, comply with legal obligations or pursue another lawful purpose, we may rely on an appropriate legal basis other than consent, where permitted by applicable law.

Further details are provided in Chapter 3 – Purposes & Legal Bases.

Chapter 2 – Personal Data We Collect

2.1 General Principles

The categories of personal data we collect depend on the Services you use, your relationship with us and the activities involved.

We collect personal data that is reasonably necessary to provide our Services, verify identities, meet applicable legal and regulatory requirements, protect our Services, manage business relationships or carry out other lawful purposes described in this Privacy Policy.

We may collect personal data directly from you, through your use of our Services, from organisations you represent, or from third parties and publicly available sources where permitted by applicable law.

Not all categories of personal data described below are collected from every individual. Additional information may be requested where necessary for a particular Service, verification requirement or risk assessment.

2.2 Personal Identification and Contact Information

When you register for an account, apply for our Services or communicate with us, we may collect:

(a) full name, including any previous or alternative names;

(b) date of birth, nationality and country of residence;

(d) email address and telephone number;

(e) account identifiers, customer reference numbers and user identification numbers;

(f) occupation, employment status and employer information, where relevant; and

(g) other identification or contact information reasonably necessary for the relevant Service.

We may also collect records of your communications, enquiries, instructions and interactions with our customer support or compliance teams.

2.3 Identity Verification and Customer Due Diligence Information

Where identity verification, customer due diligence or other compliance checks are required, we may collect:

(a) government-issued identification documents, including passports, identity cards and other accepted identification documents;

(b) identification document numbers, issuing authorities, issue dates and expiry dates;

(d) proof of residential address and supporting documents;

(e) tax identification numbers and tax residency information, where required;

(f) occupation, employment and professional information;

(g) information and supporting documents relating to income, assets, net worth, source of funds and source of wealth;

(h) information concerning the purpose and intended nature of the business relationship;

(i) information required for enhanced due diligence or additional verification; and

(j) relevant verification results, document authenticity assessments and identity matching outcomes.

Where facial recognition, liveness detection or similar technologies are used for identity verification, the processing may involve biometric data.

Where such information constitutes special-category or otherwise protected personal data under applicable law, we will apply the relevant legal conditions and safeguards.

Further information about identity verification and compliance-related processing is provided in Chapter 4.

2.4 Corporate Customer and Related Individual Information

Where our Services are provided to businesses or other organisations, we may collect personal data relating to individuals associated with those organisations, including:

(a) directors, officers and senior management;

(b) ultimate beneficial owners and persons exercising ownership or control;

(d) shareholders and other relevant connected persons; and

(e) individuals involved in relevant business transactions.

Depending on the circumstances, this information may include:

identity and contact details;
positions, roles and authority to act;
ownership interests and control relationships;
identification and verification documents;
relevant professional or business background;
financial or source-of-wealth information where required; and
information necessary to establish ownership, control or authorisation.

We may obtain this information directly from the relevant individuals, from the organisation they represent, from authorised third parties or from lawful public sources.

2.5 Payment, Account and Transaction Information

When you use payment, virtual account, card or related financial Services, we may collect:

(a) account numbers, virtual account identifiers and other payment account references;

(b) payer, payee, sender, beneficiary and relevant counterparty information;

(d) transaction amounts, currencies, dates, times and reference numbers;

(e) merchant information, payment descriptions and transaction purposes;

(f) transaction status, settlement details and reconciliation records;

(g) card-related transaction information, where applicable;

(h) refund, dispute, chargeback and payment investigation records; and

(i) supporting documents or explanations reasonably required to verify or investigate a transaction.

The information collected will depend on the relevant payment product, transaction type and applicable legal or operational requirements.

2.6 Digital Asset and Wallet Information

Where you use digital asset or wallet-related Services, we may collect:

(a) digital wallet addresses and associated account identifiers;

(b) blockchain transaction identifiers and transaction details;

(d) deposit, withdrawal and transfer records;

(e) wallet ownership or control verification information, where required;

(f) relevant transaction counterparties and wallet relationships; and

(g) publicly available blockchain information associated with relevant transactions or wallet addresses.

We may also receive blockchain analytics results and information relating to potential transaction risks.

Although blockchain records may be publicly accessible, information linking a wallet address or transaction to an identifiable individual may constitute personal data.

Further information about blockchain-related data is provided in Chapter 8.

2.7 Financial and Supporting Information

Depending on the Services requested and applicable verification requirements, we may collect:

(a) income and employment information;

(b) bank statements, payslips and other financial supporting documents;

(d) source-of-funds and source-of-wealth information;

(e) account balances and relevant financial transaction history;

(f) tax-related information where required; and

(g) investment, subscription, redemption or yield-related information, where relevant to the Services actually provided.

We do not require all individuals to provide every category of financial information listed above.

Additional supporting documents may be requested where reasonably necessary to verify information, resolve material inconsistencies, assess relevant risks or meet applicable legal and regulatory obligations.

2.8 Compliance, Screening and Risk Assessment Information

Where necessary for customer due diligence, fraud prevention, financial crime compliance, account security or other lawful risk management activities, we may collect or generate information including:

(a) identity verification and document verification results;

(b) sanctions, politically exposed person (PEP) and adverse media screening results;

(d) customer, account, wallet or transaction risk indicators and assessments;

(e) inconsistencies identified during identity, financial or supporting document reviews;

(f) requests for information, additional verification requests and related responses;

(g) compliance review records, case notes, escalation outcomes and relevant decisions; and

(h) information obtained from authorised third-party verification, screening or risk assessment providers.

Some information in this category may be generated through automated systems or derived from other personal data.

We will apply appropriate safeguards and access restrictions to such information, taking account of its sensitivity and applicable legal requirements.

Further information about automated processing and decision-making is provided in Chapter 4.

2.9 Device, Technical and Usage Information

When you access or use our websites, applications or other digital Services, we may collect:

(a) IP addresses and approximate location information derived from network connections;

(b) device identifiers, device type and operating system;

(d) login information, authentication events and access timestamps;

(e) website or application usage information;

(f) system logs, error reports and technical diagnostic information;

(g) cookies and similar tracking technologies, where applicable; and

(h) technical information relevant to account security, fraud detection and the performance of our Services.

Certain technical information may be collected automatically when you use our Services.

Further information about cookies and similar technologies is provided in Chapter 7.

2.10 Information from Third Parties and Public Sources

Where permitted by applicable law, we may obtain personal data from:

(a) identity verification and KYC/KYB service providers;

(b) banks, payment service providers, card programme partners and other financial institutions;

(d) blockchain analytics and digital asset service providers;

(e) organisations you represent or persons authorised to provide information on your behalf;

(f) corporate registries, government records and other lawful public databases;

(g) publicly available blockchain networks;

(h) regulatory, supervisory or law enforcement authorities, where legally permitted; and

(i) other third parties lawfully authorised to disclose relevant information.

The information received may include identity details, verification outcomes, payment records, compliance screening information, risk indicators or other information relevant to the applicable Service or lawful purpose.

We do not assume that information received from a third party may be used for any purpose. Its collection and subsequent processing remain subject to applicable data protection laws and the relevant lawful basis.

2.11 Information We Generate or Derive

In the course of providing our Services, we may generate or derive additional personal data from information collected or received.

This may include:

(a) customer or account reference identifiers;

(b) verification statuses and review outcomes;

(d) fraud or security indicators;

(e) records of account activity and service usage;

(f) compliance review histories and relevant decision records; and

(g) analytical information relating to the operation, security or integrity of our Services.

Where such information relates to an identified or identifiable individual, we treat it as personal data.

The generation or use of risk assessments and automated outputs does not, by itself, mean that all decisions are made solely by automated means.

The relevant decision-making arrangements and applicable safeguards are described in Chapter 4.

2.12 Information You Choose Not to Provide

Certain personal data is necessary for us to provide particular Services, verify your identity or comply with applicable legal and regulatory obligations.

Where required information is not provided, we may be unable to:

(a) complete registration or account opening;

(b) verify your identity or relevant business information;

(d) provide or continue certain Services;

(e) process or investigate particular transactions; or

(f) fulfil applicable legal or regulatory requirements.

Where information is optional, we will seek to distinguish it from information required for the relevant Service or processing activity.

We will not treat a refusal to provide optional information as grounds for denying unrelated Services unless there is an appropriate lawful or operational reason.

Chapter 3 – Purposes & Legal Bases

3.1 General Principles

We process your personal data only for specified, explicit and legitimate purposes and where we have an appropriate legal basis under applicable data protection laws.

The purposes for which we process personal data depend on the Services you use, your relationship with us and the activities involved.

Where the General Data Protection Regulation ("GDPR") or UK GDPR applies, we rely on one or more legal bases under Article 6, as appropriate to the particular processing activity.

These may include:

(a) Contractual Necessity: Processing necessary to perform a contract with you or to take steps at your request before entering into a contract.

(b) Legal Obligation: Processing necessary to comply with a legal obligation applicable to the relevant Infini entity.

(c) Legitimate Interests: Processing necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms.

(d) Consent: Processing based on your valid consent, where consent is required or is the appropriate legal basis.

(e) Other Applicable Legal Bases: Other legal bases, including vital interests or public-interest grounds, where the relevant legal requirements are satisfied.

Where other privacy or data protection laws apply, we process personal data in accordance with the applicable legal requirements, including any relevant consent, notification, permitted-use or other lawful processing conditions.

The legal bases described below do not necessarily apply to every Infini entity or Service.

3.2 Providing and Managing Our Services

We process personal data to establish, provide, operate and manage our Services.

This may include:

(a) receiving and reviewing applications for our Services;

(b) creating and maintaining customer accounts;

(d) providing requested products, features and functionalities;

(e) administering customer relationships and service arrangements;

(f) processing customer instructions and service requests; and

(g) maintaining records necessary for the operation of our Services.

Personal Data Involved: Identification and contact information, account information, authorised representative information, service records and relevant technical information.

Applicable Legal Bases:

Contractual necessity, where processing is necessary to provide Services under a contract with you or to take pre-contractual steps at your request.
Legitimate interests, where appropriate, including administering business relationships and providing Services to corporate customers.
Legal obligation, where specific account administration or recordkeeping requirements apply.

Where you act on behalf of an organisation rather than as an individual contracting party, contractual necessity may not be the appropriate legal basis for processing your personal data. In such cases, another applicable legal basis will be identified.

3.3 Identity Verification and Customer Due Diligence

We process personal data to verify identities, assess customer eligibility and conduct due diligence appropriate to the relevant Services and applicable requirements.

This may include:

(a) verifying identity documents and personal information;

(b) identifying and verifying beneficial owners, directors and authorised representatives;

(d) reviewing financial information, source of funds or source of wealth where relevant;

(e) conducting additional verification or enhanced due diligence where necessary;

(f) resolving inconsistencies or obtaining supporting information; and

(g) maintaining appropriate verification and due diligence records.

Personal Data Involved: Identity documents, contact details, biometric verification information where applicable, corporate relationship information, financial supporting documents, verification results and compliance review records.

Applicable Legal Bases:

Legal obligation, where identity verification or due diligence is required by laws or regulations applicable to the relevant Infini entity.
Legitimate interests, where appropriate and permitted by law, including fraud prevention, customer eligibility assessment and risk management measures not independently required by law.
Contractual necessity, where particular verification steps are objectively necessary to provide a requested Service and the relevant legal requirements are satisfied.

Where the processing involves biometric data or other specially protected information, we will identify and satisfy any additional legal conditions required under applicable law.

Further information is provided in Chapter 4 – Identity Verification, Compliance & Automated Decisions.

3.4 Processing Payments and Financial Transactions

We process personal data to facilitate and administer payment, virtual account, card, digital asset and related financial transactions, where such Services are provided.

This may include:

(a) processing deposits, withdrawals, payments and transfers;

(b) verifying payment instructions and transaction details;

(d) facilitating transaction execution, clearing and settlement;

(e) processing virtual account and card-related activities;

(f) handling refunds, disputes, chargebacks and transaction investigations;

(g) maintaining transaction confirmations and records; and

(h) performing reconciliation and related operational controls.

Personal Data Involved: Account information, transaction records, payment instructions, counterparty details, relevant financial information and supporting transaction documents.

Applicable Legal Bases:

Contractual necessity, where processing is necessary to perform a contract with the relevant individual.
Legitimate interests, where appropriate, including facilitating transactions involving corporate customers, preventing payment errors and maintaining accurate operational records.
Legal obligation, where specific payment, financial crime, accounting or regulatory requirements apply.

We share relevant personal data with financial institutions and payment partners where necessary and legally permitted, as further described in Chapter 5.

3.5 AML, Sanctions and Financial Crime Compliance

We process personal data to comply with applicable anti-money laundering, counter-terrorist financing, sanctions and other financial crime requirements.

Depending on the relevant Service and applicable law, this may include:

(a) conducting sanctions, politically exposed person and adverse media screening;

(b) assessing relevant customer, account, wallet and transaction risks;

(d) conducting ongoing due diligence and periodic reviews;

(e) investigating potential financial crime or sanctions concerns;

(f) preparing and maintaining legally required compliance records; and

(g) responding to competent regulatory, supervisory or law enforcement authorities.

Personal Data Involved: Identity information, financial information, transaction records, screening results, blockchain analytics information, risk indicators and compliance review records.

Applicable Legal Bases:

Legal obligation, where the processing is necessary to comply with laws or regulations applicable to the relevant Infini entity.
Legitimate interests, where appropriate and permitted by law, including financial crime prevention and risk management activities that are not independently required by a specific legal obligation.

Certain information or activities may be subject to legal restrictions on disclosure, including anti-tipping-off and confidentiality requirements.

Nothing in this Privacy Policy requires us to disclose information where doing so would violate applicable law.

3.6 Fraud Prevention, Account Security and Risk Management

We process personal data to protect customers, prevent fraud, manage relevant risks and maintain the security and integrity of our Services.

This may include:

(a) detecting suspicious account access or activities;

(b) identifying potentially fraudulent transactions or misuse of our Services;

(d) investigating security incidents and potential policy violations;

(e) applying proportionate account or transaction risk controls;

(f) reviewing relevant risk alerts and exceptions; and

(g) protecting our systems, customers and business partners from security threats or unlawful activities.

Personal Data Involved: Account information, transaction records, device and technical data, behavioural or security indicators, risk assessments and investigation records.

Applicable Legal Bases:

Legitimate interests, where necessary and proportionate to protect our Services, prevent fraud and manage relevant security risks.
Legal obligation, where specific security, fraud prevention or regulatory requirements apply.
Contractual necessity, where particular security or authentication processing is objectively necessary to provide a contracted Service.

Where we rely on legitimate interests, we assess the necessity and proportionality of the processing and consider the potential impact on individuals.

3.7 Automated Processing and Risk Assessment

We may use automated tools and technology-assisted processes to support identity verification, fraud detection, compliance screening, risk assessment and operational reviews.

Such processing may involve:

(a) automated document or identity verification;

(b) screening against relevant compliance databases;

(d) automated identification of incomplete or inconsistent information;

(e) generation of risk scores, classifications or alerts; and

(f) routing applications or cases for additional review.

Personal Data Involved: Identity information, verification results, financial and transaction information, technical data, screening results and relevant risk indicators.

Applicable Legal Bases: The applicable legal basis depends on the underlying purpose of the processing and may include legal obligation, legitimate interests or contractual necessity, as appropriate.

Where solely automated decision-making is subject to additional legal restrictions, we will assess the applicable requirements and implement the safeguards required by law.

Further information about automated decision-making and related rights is provided in Chapter 4 and Chapter 11.

3.8 Customer Support and Service Communications

We process personal data to communicate with you and provide customer support.

This may include:

(a) responding to enquiries, requests and complaints;

(b) providing information about your account or transactions;

(d) communicating material changes to our Services or relevant terms;

(e) assisting with verification, transaction or account-related issues; and

(f) maintaining appropriate records of customer communications.

Personal Data Involved: Contact information, account details, relevant transaction information and communication records.

Applicable Legal Bases:

Contractual necessity, where communications are necessary to provide contracted Services.
Legitimate interests, where appropriate, including responding to enquiries and managing customer relationships.
Legal obligation, where particular notifications or communications are required by law.

3.9 Improving and Developing Our Services

We may process personal data where reasonably necessary to maintain, evaluate, improve and develop our Services.

This may include:

(a) analysing service performance and usage trends;

(b) identifying technical issues and improving reliability;

(d) improving customer experience and operational efficiency;

(e) evaluating the effectiveness of security and risk controls; and

(f) developing or improving product features and internal processes.

Personal Data Involved: Service usage information, technical logs, account interaction records and other relevant operational data.

Applicable Legal Bases:

Legitimate interests, where the processing is necessary and proportionate for service improvement, security, quality assurance or related business purposes.
Consent, where required for a particular analytics or tracking activity.

Where reasonably practicable, we use aggregated, anonymised or appropriately pseudonymised information for these purposes.

We do not assume that personal data collected for compliance or identity verification may automatically be reused for unrelated product development, AI model training or other secondary purposes. Any such use must be separately assessed and supported by an appropriate legal basis and applicable safeguards.

3.10 Marketing and Promotional Communications

Where permitted by applicable law, we may process personal data to communicate information about our products, services, updates, events or promotional activities.

This may include:

(a) sending newsletters or promotional communications;

(b) providing information about new products or features;

(d) managing marketing preferences and unsubscribe requests.

Personal Data Involved: Contact information, marketing preferences and relevant communication records.

Applicable Legal Bases:

Consent, where required by applicable law.
Legitimate interests, where direct marketing is lawfully permitted on that basis and applicable notice and objection requirements are satisfied.

You may opt out of direct marketing or withdraw applicable marketing consent through the mechanisms provided in our communications or by contacting us.

We will respect applicable direct marketing restrictions, including any consent or opt-out requirements imposed by the laws relevant to the particular activity.

3.11 Legal Claims, Disputes and Regulatory Requests

We may process personal data where necessary to:

(a) establish, exercise or defend legal claims;

(b) investigate and resolve complaints or disputes;

(d) support internal or external audits;

(e) respond to lawful regulatory, supervisory or judicial requests; and

(f) comply with applicable legal, accounting, reporting or recordkeeping obligations.

Personal Data Involved: Relevant account, identity, transaction, communication, compliance and supporting records.

Applicable Legal Bases:

Legal obligation, where processing is necessary to comply with a specific applicable legal requirement.
Legitimate interests, where appropriate, including protecting legal rights and resolving disputes.
Other applicable legal bases or conditions, where required for the establishment, exercise or defence of legal claims.

3.12 Other Purposes and Further Processing

We will not process personal data for purposes that are incompatible with the purposes for which it was originally collected, unless the further processing is permitted by applicable law.

Before using personal data for a new purpose, we will assess whether:

(a) the new purpose is compatible with the original purpose;

(b) an appropriate legal basis applies;

(d) consent or another specific legal condition is required; and

(e) additional safeguards are necessary.

Where required by applicable law, we will provide relevant information before undertaking further processing.

3.13 Legitimate Interests and Your Rights

Where we rely on legitimate interests, we assess whether the processing is necessary for the relevant purpose and whether our interests are overridden by your rights, freedoms or reasonable expectations.

Our legitimate interests may include:

(a) maintaining secure and reliable Services;

(b) preventing fraud and misuse;

(d) improving operational efficiency and service quality;

(e) protecting our legal rights; and

(f) managing proportionate business and financial risks.

Where applicable, you may have the right to object to processing based on legitimate interests.

Further information about your rights is provided in Chapter 11 – Your Privacy Rights.

3.14 Consent and Withdrawal

Where we rely on consent, we will seek consent that meets the requirements of applicable law.

Where applicable, you may withdraw your consent at any time.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

Where the same personal data is processed for separate purposes under different legal bases, withdrawal of consent for one purpose does not automatically require us to cease other processing that remains independently lawful.

We will not rely on consent where it is not freely given or otherwise does not satisfy applicable legal requirements.

3.15 Processing Under Other Applicable Privacy Laws

The legal bases described in this Chapter primarily reflect the framework applicable under the GDPR and UK GDPR.

Where other privacy or data protection laws apply, including laws governing collection, use, disclosure, consent, notice or permitted processing, we will comply with the requirements applicable to the relevant Infini entity and processing activity.

References to contractual necessity, legitimate interests or legal obligation shall not be interpreted as automatically establishing a lawful basis under every jurisdiction's privacy laws.

Chapter 4 – Identity Verification, Compliance & Automated Decisions

4.1 Identity Verification and Customer Due Diligence

To provide certain Services and meet applicable legal, regulatory and risk management requirements, we may conduct identity verification and customer due diligence checks before establishing or continuing a business relationship.

Depending on the relevant Service and applicable requirements, these checks may include:

(a) verifying your identity and contact information;

(b) reviewing identification documents and supporting materials;

(d) understanding the purpose and intended nature of your relationship with us;

(e) reviewing financial information, including source of funds or source of wealth where relevant;

(f) conducting sanctions, politically exposed person (PEP) and adverse media screening; and

(g) assessing relevant customer eligibility, compliance and financial crime risks.

The extent of verification and due diligence may vary depending on the Service, applicable legal requirements and relevant risk factors.

We may request additional information or supporting documents where reasonably necessary to complete verification, resolve inconsistencies or meet applicable obligations.

4.2 Third-Party Identity Verification Providers

We may engage third-party identity verification and compliance service providers to assist with customer onboarding, document verification, identity authentication and related checks.

Depending on the relevant service, these providers may assist with:

(a) verifying identification documents;

(b) comparing identification documents with photographs or selfies;

(d) validating submitted information;

(e) screening relevant individuals against sanctions, PEP or adverse media databases; and

(f) providing verification results, alerts or supporting evidence.

We share personal data with such providers only where there is an appropriate lawful basis and the disclosure is necessary and proportionate for the relevant purpose.

The provider's responsibilities and the applicable data protection arrangements depend on its actual role in the processing activity.

Further information about third-party data sharing is provided in Chapter 5.

4.3 Biometric Verification

Where biometric verification is used in connection with identity verification, the process may involve facial images, facial matching, liveness detection or other biometric technologies.

Depending on the technology and service provider involved, this processing may include the creation or analysis of biometric identifiers or templates.

We will assess whether the relevant information constitutes biometric data or special-category personal data under applicable law and apply the corresponding legal requirements and safeguards.

Biometric verification will be used only for specified and lawful purposes, subject to the applicable necessity, proportionality and data protection requirements.

Where required by applicable law, we will provide additional information or obtain appropriate consent before carrying out the relevant biometric processing.

The collection, storage, access and retention of biometric information may differ depending on the verification technology and the responsibilities of the relevant service provider.

Further information about applicable retention practices is provided in Chapter 10.

4.4 Risk-Based Customer Review and Enhanced Due Diligence

We may apply a risk-based approach when reviewing customer applications and maintaining customer relationships.

Relevant factors may include:

(a) the nature of the requested Services;

(b) customer identity and business characteristics;

(d) geographic and jurisdictional considerations;

(e) relevant financial and transaction information;

(f) sanctions, PEP, adverse media and other screening results; and

(g) information relevant to fraud, financial crime or other applicable risks.

Where additional review is warranted, we may conduct enhanced due diligence, request further supporting documents or refer an application or account for additional assessment.

The information requested and the level of review will depend on the relevant circumstances and applicable requirements.

Risk classifications or assessments may be updated where new information becomes available or relevant circumstances change.

4.5 Ongoing Due Diligence and Monitoring

Where appropriate or required by applicable law, we may continue to review customer information and relevant activities after an account or business relationship has been established.

This may include:

(a) updating identification or customer information;

(b) reviewing changes in ownership, control or authorised representatives;

(d) reviewing relevant account, payment or digital asset transactions;

(e) investigating unusual or potentially suspicious activities;

(f) requesting additional information or explanations; and

(g) reassessing relevant customer, account or transaction risks.

The nature and frequency of these activities may depend on the applicable Service, relevant legal requirements and risk factors.

Certain compliance-related information or investigations may be subject to legal restrictions on disclosure.

4.6 Automated Verification and Technology-Assisted Reviews

We may use automated systems, rules-based tools and other technology-assisted processes to support identity verification, compliance checks, risk assessment and operational reviews.

These tools may assist with:

(a) extracting or validating information from submitted documents;

(b) identifying missing, incomplete or inconsistent information;

(d) detecting potential fraud or compliance risk indicators;

(e) generating risk scores, classifications or alerts;

(f) identifying applications or transactions requiring further review; and

(g) supporting the organisation, prioritisation and assessment of review cases.

Automated outputs may be used as part of our verification, compliance and risk management processes.

The extent to which automated outputs influence an outcome depends on the relevant system, Service and decision-making process.

4.7 AI-Assisted Processing

Certain verification, compliance or operational processes may be supported by artificial intelligence or machine learning technologies.

Where such technologies are used, they may assist with tasks such as document analysis, information extraction, consistency checks, identification of potential anomalies and preparation of review information.

AI-generated results may contain inaccuracies or require additional verification.

We will assess the appropriate safeguards for AI-assisted processing, taking account of the nature of the personal data, the purposes of processing, the risks to individuals and applicable legal requirements.

The use of AI-assisted processing does not necessarily mean that a decision is made solely by automated means.

Where personal data is used for the development, testing or training of AI systems for purposes beyond the original processing activity, we will assess the relevant legal basis, transparency requirements and applicable safeguards before undertaking such processing.

4.8 Automated Decision-Making and Profiling

Certain processing activities may involve profiling or automated decision-making.

Profiling may include the automated evaluation of information relating to an individual for purposes such as identity verification, fraud detection, compliance screening or risk assessment.

Depending on the relevant Service and system configuration, automated processing may contribute to decisions concerning:

(a) identity verification outcomes;

(b) customer application assessments;

(d) transaction risk alerts or reviews; and

(e) account security or risk control measures.

Where a decision is made solely by automated means and produces legal effects or similarly significant effects concerning an individual, additional requirements and protections may apply under relevant data protection laws.

We will assess whether such processing is permitted and, where applicable, implement the safeguards required by law.

Where the GDPR or UK GDPR applies, solely automated decisions within the scope of Article 22 will be subject to the applicable conditions, restrictions and safeguards.

Where required, we will provide meaningful information about the relevant decision-making process, including the logic involved and the significance and envisaged consequences of the processing.

4.9 Human Review and Escalation

Depending on the relevant processing activity, verification results, risk assessments or automated outputs may be reviewed by authorised personnel.

Human review may be appropriate where:

(a) submitted information is incomplete or inconsistent;

(b) verification results are inconclusive;

(d) additional supporting information is necessary;

(e) an exception or escalation is required under the applicable review process; or

(f) a review is required by applicable law.

Where meaningful human involvement is required by applicable law, we will assess and implement the necessary arrangements.

A review will not be treated as meaningful human involvement merely because a person formally approves an automated result without appropriate authority or ability to assess and change the outcome.

4.10 Decisions Affecting Access to Services

Depending on the outcome of applicable verification, compliance or risk assessments, we may:

(a) request additional information or supporting documents;

(b) require further verification or review;

(d) decline an application or particular Service where legally and contractually permitted;

(e) restrict certain account or transaction activities where appropriate; or

(f) take other lawful and proportionate actions necessary to comply with applicable requirements or protect our Services.

Any such action will be subject to the relevant legal requirements, applicable contractual arrangements and internal decision-making procedures.

Where required by law, we will provide appropriate information about decisions affecting you.

However, certain information may be withheld where disclosure is prohibited by law or would compromise legally protected investigations or compliance obligations.

4.11 Rights Relating to Automated Decisions

Where applicable data protection laws provide rights in relation to automated decision-making or profiling, you may have the right to:

(a) obtain relevant information about qualifying automated decision-making;

(b) request human intervention where required by law;

(d) contest an applicable decision; and

(e) exercise other rights provided under applicable law.

The availability and scope of these rights depend on the relevant processing activity, applicable legal framework and circumstances.

You may contact us using the details provided in Chapter 14 – Contact Us.

Further information about your privacy rights is provided in Chapter 11.

4.12 Accuracy, Data Minimisation and Safeguards

We seek to ensure that personal data used for verification, compliance and risk assessment is relevant, reasonably accurate and appropriate for the intended purpose.

Where necessary, we may request updated information or additional evidence to verify material information or resolve inconsistencies.

We apply appropriate access controls and other safeguards to protect personal data processed in connection with identity verification, compliance and risk management activities.

Access to sensitive verification information, compliance records and risk assessments is limited according to relevant responsibilities and applicable requirements.

We do not regard a risk score, automated alert or third-party verification result as automatically establishing the accuracy of all underlying information.

Where appropriate, such information may be subject to additional checks, review or correction.

Further information about data security, retention and privacy rights is provided in Chapters 9, 10 and 11.

Chapter 5 – How We Share Personal Data

5.1 General Principles

We may share or disclose your personal data with third parties where necessary to provide our Services, comply with applicable legal or regulatory obligations, protect our Services, manage legitimate business activities or fulfil other lawful purposes described in this Privacy Policy.

We do not sell your personal data.

Before sharing personal data, we consider the purpose of the disclosure, the categories of information involved, the role of the recipient and the applicable legal requirements.

We seek to limit disclosures to personal data that is relevant and reasonably necessary for the specified purpose.

Where required by applicable law, we implement appropriate contractual, technical and organisational safeguards.

A recipient's access to personal data does not automatically authorise it to use that information for unrelated purposes.

The categories of recipients described below may vary depending on the relevant Service and processing activity.

5.2 Third-Party Service Providers

We may engage third-party service providers to support the operation, administration, security and delivery of our Services.

These may include providers of:

(a) cloud hosting, infrastructure and data storage;

(b) identity verification and authentication;

(d) fraud prevention and cybersecurity;

(e) software development, maintenance and technical support;

(f) customer support and communication services;

(g) data analytics and operational reporting;

(h) payment technology and transaction processing; and

(i) other services necessary for our business operations.

Where a service provider processes personal data on our behalf as a Processor, we require appropriate contractual arrangements governing its processing activities, including instructions, confidentiality, security, permitted subprocessors and other obligations required by applicable law.

Where a provider acts as an independent Controller for a particular activity, the applicable responsibilities and safeguards are determined according to its actual role and relevant legal requirements.

We do not assume that every third-party service provider acts solely as our Processor.

5.3 Identity Verification and Compliance Providers

We may share relevant personal data with identity verification, screening and compliance service providers to support customer onboarding, due diligence, ongoing monitoring and financial crime prevention.

Depending on the relevant activity, the information shared may include:

(a) identification and contact information;

(b) identification documents, photographs and verification materials;

(d) relevant financial or supporting information;

(e) information necessary for sanctions, PEP or adverse media screening; and

(f) other information reasonably necessary for the specified verification or compliance purpose.

These providers may return verification results, screening outcomes, alerts, supporting evidence or other relevant information.

The nature of the data shared and the provider's role depend on the particular service and applicable arrangements.

Where biometric verification is involved, additional legal requirements and safeguards may apply.

Further information about identity verification and compliance-related processing is provided in Chapter 4.

5.4 Banks, Financial Institutions and Payment Partners

Where necessary to provide payment, account or other financial Services, we may share personal data with banks, financial institutions, payment service providers and other authorised financial partners.

These may include:

(a) account-providing or settlement banks;

(b) payment service providers and payment processors;

(d) virtual account providers;

(e) payment orchestration and transaction processing partners;

(f) settlement and liquidity service providers; and

(g) other financial institutions involved in the relevant transaction or Service.

Depending on the circumstances, information shared may include:

customer identification and verification information;
payer, payee, beneficiary and counterparty details;
bank account and payment account information;
payment instructions and transaction records;
transaction purposes and supporting documents;
information necessary for fraud prevention or regulatory compliance; and
information reasonably required to investigate or resolve payment-related issues.

Such disclosures may be necessary to establish or maintain a financial service, execute transactions, perform verification, comply with applicable obligations or investigate relevant operational issues.

A receiving financial institution may process personal data as an independent Controller where it determines its own processing purposes and responsibilities.

5.5 Virtual Account Services

Where we provide virtual account-related Services through financial institution or payment partners, we may share personal data necessary to establish, administer and operate the relevant virtual account arrangements.

Depending on the Service and partner requirements, this may include:

(a) customer identification and contact information;

(b) business and beneficial ownership information;

(d) virtual account identifiers and relevant account records;

(e) payer, beneficiary and transaction information;

(f) payment-related supporting documents; and

(g) information required for ongoing verification, monitoring or investigation.

The relevant financial institution or virtual account provider may conduct its own verification, compliance and transaction monitoring activities.

We seek to ensure that the information shared is appropriate to the relevant purpose and applicable legal or contractual requirements.

5.6 Card Services and Card Programme Partners

Where you use card-related Services, we may share relevant personal data with card issuers, programme managers, card networks, processors, acquiring institutions and other parties involved in providing or supporting the card programme.

Depending on the relevant activity, the information shared may include:

(a) customer identity and verification information;

(b) card application and account information;

(d) card transaction and merchant information;

(e) information necessary for transaction authorisation, settlement and reconciliation;

(f) fraud prevention and card security information; and

(g) information relevant to disputes, refunds, chargebacks or regulatory requirements.

These disclosures may support card issuance, transaction processing, fraud prevention, programme administration and other related activities.

The role and responsibilities of each recipient depend on the relevant card programme arrangements and applicable law.

5.7 Digital Asset, Blockchain and Transaction Monitoring Providers

Where relevant to our digital asset or blockchain-related Services, we may share information with blockchain analytics providers, wallet verification services, transaction monitoring providers and other authorised digital asset service partners.

Such information may include:

(a) wallet addresses and associated identifiers;

(b) blockchain transaction hashes and transaction details;

(d) wallet ownership or control verification information;

(e) relevant customer or counterparty information, where necessary and legally permitted; and

(f) information required for compliance screening, transaction investigation or applicable information-sharing obligations.

We may receive blockchain risk indicators, transaction analysis results or other relevant information from these providers.

Where applicable laws require the exchange of originator, beneficiary or other transaction information, including under applicable virtual asset transfer requirements, we may disclose the information necessary to meet those obligations.

The disclosure of personal data to a blockchain analytics provider does not automatically authorise the provider to use identifiable customer information for unrelated purposes.

Further information about blockchain-related processing is provided in Chapter 8.

5.8 Compliance Requests and Transaction Investigations

In connection with payment processing, customer due diligence, transaction monitoring or financial crime compliance, we may receive requests for information from banks, payment partners, other financial institutions or authorised compliance counterparties.

We may disclose relevant personal data where there is an appropriate lawful basis and the disclosure is necessary and proportionate for a specified purpose.

Depending on the circumstances, this may include information required to:

(a) verify the identity of a customer or transaction counterparty;

(b) confirm the purpose or nature of a transaction;

(d) resolve material discrepancies or incomplete information;

(e) investigate potentially suspicious or fraudulent activity; or

(f) satisfy applicable legal or regulatory requirements.

We assess such requests according to the relevant circumstances, including the purpose, requesting party, information requested and applicable restrictions.

We may decline, limit or seek clarification of a request where the disclosure is not sufficiently justified, exceeds the necessary scope or is otherwise inconsistent with applicable law.

Nothing in this Privacy Policy requires us to disclose information where disclosure is prohibited by law, including where applicable confidentiality or anti-tipping-off restrictions apply.

5.9 Companies Within the Infini Group

We may share personal data between relevant Infini group entities where necessary for lawful and specified purposes, including:

(a) providing or supporting the Services;

(b) customer relationship and account administration;

(d) technology, operational and customer support;

(e) financial administration and reconciliation; and

(f) other legitimate internal business activities.

Such sharing is subject to applicable data protection requirements and appropriate safeguards.

Different Infini entities may act as separate Controllers, joint Controllers or Processors depending on their actual roles in the relevant processing activity.

Membership of the same corporate group does not, by itself, provide an unrestricted right to access or use personal data.

Where personal data is transferred across borders within the group, the applicable international transfer requirements also apply.

5.10 Regulatory Authorities, Courts and Law Enforcement

We may disclose personal data to competent regulatory, supervisory, judicial, tax or law enforcement authorities where required or permitted by applicable law.

Such disclosures may occur in connection with:

(a) regulatory supervision or examination;

(b) legally required reporting or recordkeeping;

(d) judicial proceedings, court orders or other binding legal processes;

(e) financial crime, sanctions or tax compliance; and

(f) other applicable legal or regulatory obligations.

Where appropriate and legally permitted, we assess the validity and scope of the request and limit the disclosure to information reasonably necessary for the relevant purpose.

We may be legally restricted from notifying you of certain disclosures.

5.11 Professional Advisers and Independent Service Providers

We may disclose personal data to professional advisers and independent service providers where reasonably necessary for legitimate business or legal purposes.

These may include:

(a) lawyers and legal advisers;

(b) auditors and accountants;

(d) insurers and insurance advisers;

(e) independent compliance or security assessors; and

(f) other professional advisers engaged for a specified purpose.

Such disclosures are subject to applicable confidentiality, professional and data protection requirements.

The recipient's legal role and responsibilities depend on the nature of the engagement and the relevant processing activity.

5.12 Corporate Transactions

We may disclose personal data in connection with a proposed or completed merger, acquisition, financing, investment, corporate restructuring, reorganisation, business transfer or sale of assets.

Such disclosures will be limited to information reasonably necessary for the relevant transaction and subject to appropriate safeguards.

Where required by applicable law, we will provide relevant notice or take other required steps before personal data is transferred to a new Controller or processed for materially different purposes.

5.13 Disclosures at Your Request or with Your Consent

We may disclose personal data to a third party where you request or authorise the disclosure, or where you provide valid consent and consent is an appropriate legal basis.

The scope of the disclosure will depend on the relevant request, authorisation or consent and applicable legal requirements.

Where consent is required, we will seek to ensure that it is appropriately informed, specific and otherwise valid under applicable law.

Your consent to one disclosure does not automatically authorise unrelated disclosures or uses of your personal data.

5.14 Safeguards and Restrictions on Data Sharing

When sharing personal data, we apply safeguards appropriate to the nature of the information, the purpose of disclosure, the recipient's role and the relevant risks.

Depending on the circumstances, these may include:

(a) assessing the necessity and legal basis of the disclosure;

(b) limiting the categories and volume of information shared;

(d) applying appropriate contractual confidentiality and data protection requirements;

(e) using secure transmission methods and access controls;

(f) restricting onward disclosure or secondary use where appropriate;

(g) maintaining relevant disclosure or access records; and

(h) reviewing relevant service providers and data-sharing arrangements.

Where a recipient processes personal data on our behalf, we implement appropriate processing arrangements as required by applicable law.

Where a recipient acts as an independent Controller, its processing activities remain subject to its own legal obligations.

The existence of a confidentiality agreement, data processing agreement or data sharing agreement does not, by itself, establish that every disclosure is lawful or necessary.

5.15 International Data Sharing

Some recipients of personal data may be located outside the jurisdiction in which the information was originally collected.

Where personal data is transferred internationally, we assess and implement the relevant legal requirements and safeguards.

Further information is provided in Chapter 6 – International Data Transfers.

Chapter 6 – International Data Transfers

6.1 International Processing of Personal Data

Infini operates internationally and may process personal data across different countries and territories in connection with the provision, administration and security of our Services.

Depending on the relevant Service, legal entity and processing activity, your personal data may be transferred to, stored in or accessed from a country or territory outside the jurisdiction in which it was originally collected.

International processing may occur in connection with:

(a) providing and administering our Services;

(b) customer onboarding, identity verification and due diligence;

(d) digital asset services and transaction monitoring;

(e) customer support, compliance and risk management;

(f) technology infrastructure, cloud hosting and system maintenance;

(g) internal administration and cooperation between Infini group entities; and

(h) applicable legal, regulatory or reporting requirements.

We assess international transfers according to the nature of the personal data, the relevant processing purpose, the recipient's role and the applicable data protection laws.

6.2 Transfers Within the Infini Group

We may transfer or make personal data accessible between relevant Infini group entities where necessary for specified and lawful purposes.

Such activities may include:

(a) customer account and relationship administration;

(b) identity verification and compliance support;

(d) customer service and operational support;

(e) information technology and system maintenance; and

(f) other lawful internal business activities.

Access to personal data by personnel located in another country may constitute an international transfer or otherwise be subject to cross-border processing requirements under applicable law, even where the information remains stored in its original location.

Where required, we implement appropriate intra-group arrangements and other safeguards to govern international access, transfers and processing.

Group membership does not, by itself, authorise unrestricted access to personal data.

6.3 Transfers to Financial Institutions and Business Partners

Where necessary to provide our Services, we may transfer personal data to financial institutions and business partners operating in other jurisdictions.

These may include:

(a) banks and virtual account providers;

(b) payment service providers and settlement institutions;

(d) digital asset service providers and transaction counterparties; and

(e) other authorised financial or operational partners.

Such transfers may involve customer identification information, account information, transaction details, payment instructions, relevant counterparty information or supporting documents.

The information transferred depends on the relevant Service, transaction and applicable legal or operational requirements.

Some recipients may act as independent Controllers and process personal data in accordance with their own applicable legal obligations.

We seek to limit such disclosures to information reasonably necessary for the relevant purpose.

6.4 Transfers to Third-Party Service Providers

We may engage service providers operating or supporting infrastructure in different jurisdictions.

These may include providers of:

(a) cloud hosting and data storage;

(b) identity verification and authentication;

(d) blockchain analytics and transaction monitoring;

(e) customer support and communications;

(f) software development and technical support; and

(g) other technology and operational services.

Depending on the provider's role, personal data may be processed on our behalf or by the provider as an independent Controller.

Where required by applicable law, we enter into appropriate contractual arrangements and implement relevant safeguards governing international transfers and processing.

We also assess relevant service provider arrangements, taking account of the nature of the information and the risks associated with the processing.

6.5 Safeguards for Transfers Subject to the GDPR or UK GDPR

Where personal data is subject to the GDPR or UK GDPR and is transferred to a recipient in a country or territory that is not covered by an applicable adequacy decision or adequacy regulation, we assess the requirements governing the relevant restricted transfer.

Depending on the circumstances, an appropriate transfer mechanism may include:

(a) an applicable adequacy decision or adequacy regulation;

(b) the European Commission's Standard Contractual Clauses ("EU SCCs"), where applicable;

(d) approved Binding Corporate Rules, where applicable;

(e) another transfer mechanism recognised under the relevant data protection laws; or

(f) a permitted derogation in the limited circumstances provided by applicable law.

The availability and suitability of a particular mechanism depend on the relevant transfer, recipient, countries involved and applicable legal framework.

We do not rely on the existence of a contractual agreement alone as evidence that every international transfer is lawful.

Where required, we assess the circumstances of the transfer and whether additional measures are necessary to provide the level of protection required by applicable law.

6.6 Transfer Risk Assessments and Supplementary Measures

Where required by applicable data protection laws, we assess the risks associated with international transfers.

Depending on the circumstances, this may include consideration of:

(a) the destination country and applicable legal environment;

(b) the nature and sensitivity of the personal data;

(d) the recipient's role and processing activities;

(e) relevant access or disclosure risks; and

(f) the technical, organisational and contractual safeguards available.

Where appropriate and required, supplementary measures may include:

(a) encryption or pseudonymisation;

(b) access restrictions and authentication controls;

(d) contractual confidentiality and security obligations;

(e) appropriate service provider assessments; and

(f) other measures suitable for the relevant processing activity.

The safeguards applied may vary according to the nature of the transfer and the applicable requirements.

6.7 Transfers Under Other Applicable Privacy Laws

Where international transfers are subject to privacy or data protection laws other than the GDPR or UK GDPR, we assess and comply with the relevant requirements.

These may include applicable restrictions, notification requirements, contractual obligations, consent requirements or other conditions governing the transfer, access, use or disclosure of personal data outside a jurisdiction.

We do not assume that compliance with the GDPR or UK GDPR automatically satisfies the requirements of every other applicable privacy law.

Where multiple legal frameworks apply, the relevant transfer arrangements will be assessed accordingly.

6.8 Transfers Based on Specific Legal Exceptions

In limited circumstances, an international transfer may be permitted under a specific exception or derogation recognised by applicable data protection law.

Depending on the relevant legal framework, such circumstances may include:

(a) explicit consent that meets the applicable legal requirements;

(b) a transfer necessary for the performance of a contract with the individual or for qualifying pre-contractual measures;

(d) the establishment, exercise or defence of legal claims; or

(e) another specifically permitted exception.

We will not treat such exceptions as a general substitute for appropriate international transfer arrangements.

Where a specific exception is relied upon, we will assess whether its legal conditions are satisfied.

6.9 Security and Access Controls

We apply security measures appropriate to the nature of the personal data and the risks associated with international processing.

Depending on the relevant activity, these may include access controls, secure transmission, confidentiality requirements, logging, service provider oversight and other technical or organisational safeguards.

Access to personal data is limited according to relevant business responsibilities and applicable requirements.

Further information about our approach to data security is provided in Chapter 9 – Data Security.

6.10 Information About International Transfers

Where required by applicable law, we provide information about relevant international transfers, including applicable transfer safeguards and how individuals may obtain further information.

You may contact us using the details provided in Chapter 14 – Contact Us to request information about international transfers affecting your personal data.

Where applicable, you may request information about the safeguards used for a relevant transfer or how to obtain a copy of the applicable transfer safeguards.

We may redact commercially sensitive or confidential information where permitted by law, provided that doing so does not prevent us from meeting applicable transparency obligations.

Chapter 7 – Cookies & Tracking Technologies

7.1 Use of Cookies and Similar Technologies

We may use cookies and similar technologies when you access or interact with our websites, applications and other digital Services.

Cookies are small text files that may be stored on your device when you visit a website. Similar technologies may include local storage, software development kits (SDKs), pixels, device identifiers and other technologies used to support website or application functionality.

Depending on the technology and its configuration, these tools may collect information such as your device type, browser settings, IP address, usage activity, session information and preferences.

Where such information identifies or can reasonably be linked to an individual, we treat it as personal data in accordance with applicable data protection laws.

7.2 Categories of Cookies and Tracking Technologies

Depending on the relevant Service and technologies in use, we may use the following categories:

(a) Strictly Necessary Cookies

These cookies or technologies are necessary for the operation, security or essential functionality of our websites or Services.

They may support functions such as user authentication, session management, security controls, fraud prevention and the maintenance of user-selected privacy preferences.

Where permitted by applicable law, strictly necessary cookies may be used without consent. Their use remains subject to applicable transparency and data protection requirements.

(b) Functional Cookies

These cookies or technologies support additional functionality and user preferences, such as remembering language settings or other optional preferences.

Where required by applicable law, we obtain consent before using functional cookies that are not strictly necessary.

(c) Analytics and Performance Cookies

These cookies or technologies may help us understand how visitors interact with our websites or applications, identify technical issues and improve the performance and usability of our Services.

Information collected may include page visits, navigation activity, performance information and other usage statistics.

Where required by applicable law, we obtain consent before using non-essential analytics or performance cookies.

(d) Marketing and Advertising Cookies

Where applicable, marketing or advertising cookies and similar technologies may be used to measure the effectiveness of promotional activities or support relevant advertising.

We will not use non-essential marketing or advertising cookies without obtaining consent where required by applicable law.

The use of these technologies depends on the relevant website, application and services actually deployed.

7.3 First-Party and Third-Party Technologies

Cookies and similar technologies may be placed or operated by Infini or by third-party service providers.

First-party cookies are generally set by the website or service you are visiting.

Third-party cookies or similar technologies may be operated by external providers supporting functions such as analytics, security, customer support or other website features.

Where third-party technologies are used, the relevant provider may process information on our behalf or, in some circumstances, act as an independent Controller.

We assess the relevant purposes, data-sharing arrangements and applicable legal requirements before deploying such technologies.

Further information about sharing personal data with third parties is provided in Chapter 5.

7.4 Cookie Consent and Preferences

Where applicable law requires consent for particular cookies or tracking technologies, we will seek the required consent before activating them.

Where an applicable consent mechanism is provided, you may use it to manage your preferences and withdraw consent for relevant non-essential technologies.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Where required by law, we will provide an appropriate means to revisit or change your cookie preferences.

We will not treat continued browsing or general use of our Services, by itself, as valid consent where applicable law requires an affirmative choice.

7.5 Browser and Device Controls

You may be able to manage certain cookies through your browser or device settings.

Depending on the browser or device, these settings may allow you to view, restrict, block or delete cookies.

Please note that disabling certain cookies may affect the functionality or availability of particular website features.

Browser cookie controls may not apply to every tracking technology, including some application-based identifiers, SDKs or server-side technologies.

Where additional controls are required by applicable law, we will provide them through appropriate mechanisms.

7.6 Retention of Cookies and Related Information

Cookies and similar technologies may operate for different periods depending on their purposes and configuration.

Session cookies generally expire when the relevant browsing session ends, while persistent cookies may remain on a device for a defined period unless deleted earlier.

The retention of personal data collected through cookies or similar technologies is subject to applicable data protection requirements and the relevant retention criteria described in Chapter 10 – Data Retention.

Where required by applicable law, we will provide additional information about the specific technologies used, their purposes, providers and applicable durations.

7.7 Changes to Cookie Practices

We may update the cookies and similar technologies used in connection with our Services as our websites, applications and technical requirements evolve.

Where required by applicable law, we will update the relevant cookie information, consent mechanisms or other notices before implementing material changes.

For questions about our use of cookies and tracking technologies, you may contact us using the details provided in Chapter 14 – Contact Us.

Chapter 8 – Blockchain & Digital Asset Data

8.1 Blockchain Information and Public Networks

Certain Services may involve digital assets, blockchain networks, digital wallet addresses or transactions recorded on public blockchains.

Public blockchain networks generally maintain transaction records that are accessible to participants or other persons who can examine the relevant network.

Depending on the relevant blockchain and Service, publicly available information may include:

(a) public wallet addresses;

(b) blockchain transaction identifiers and hashes;

(d) token balances and transaction histories;

(e) transfers, deposits and withdrawals;

(f) interactions with smart contracts or other blockchain applications; and

(g) other information recorded on or made available through the relevant blockchain network.

We may collect, access or analyse such information where necessary for the lawful purposes described in this Privacy Policy.

The fact that information is publicly available on a blockchain does not automatically mean that it falls outside the scope of applicable data protection laws.

8.2 Wallet Addresses and Personal Data

A public wallet address may constitute personal data where it relates to an identified or identifiable individual.

Although a wallet address may not directly identify an individual, it may become associated with a particular person through account records, identity verification information, transaction records or other available information.

Where we associate a wallet address or blockchain transaction with an identifiable customer, we treat the relevant information as personal data in accordance with applicable law.

We may maintain records linking customers, accounts, wallet addresses and relevant transactions where necessary for providing Services, verifying transactions, complying with applicable requirements or managing relevant risks.

Such information is subject to the data protection principles and safeguards described in this Privacy Policy.

8.3 Digital Asset Transactions and Wallet Verification

Where relevant to our Services, we may process blockchain and wallet-related information to:

(a) identify and verify relevant transactions;

(b) confirm deposits, withdrawals or transfers;

(d) verify wallet ownership or control where required;

(e) identify relevant transaction counterparties;

(f) investigate transaction errors, discrepancies or disputes; and

(g) support applicable compliance and risk management activities.

Wallet verification may involve information or evidence intended to demonstrate a customer's relationship with or control over a particular wallet.

The nature of the information collected depends on the verification method, relevant Service and applicable requirements.

We seek to limit such processing to information reasonably necessary for the relevant purpose.

8.4 Blockchain Analytics and Transaction Monitoring

We may use blockchain analytics, transaction monitoring or related compliance technologies to assess relevant digital asset activities.

Depending on the relevant Service, these activities may involve:

(a) reviewing wallet addresses and transaction histories;

(b) identifying potential sanctions or financial crime exposure;

(d) identifying potential connections to higher-risk wallets or activities;

(e) generating transaction or wallet risk indicators; and

(f) supporting the investigation of unusual or potentially suspicious transactions.

We may obtain relevant information or analytical results from third-party blockchain analytics and compliance providers.

Such results may involve estimates, classifications or risk indicators derived from available information and analytical methodologies.

We do not assume that a blockchain risk indicator, wallet classification or automated alert conclusively establishes unlawful activity or the identity of an individual.

Where appropriate, such information may be subject to further verification or review.

Further information about compliance assessments and automated processing is provided in Chapter 4.

8.5 Virtual Asset Transfer Information

Where applicable laws or regulations require the collection, verification, transmission or retention of information relating to virtual asset transfers, we may process the relevant information for those purposes.

Depending on the applicable requirements, such information may include:

(a) originator identification and account information;

(b) beneficiary identification and account information;

(d) transaction identifiers, amounts and other transfer details; and

(e) additional information required under applicable virtual asset transfer rules.

Where necessary and legally permitted, relevant information may be shared with authorised financial institutions, virtual asset service providers or other appropriate counterparties.

The information collected or disclosed will depend on the relevant transaction, the role of the parties involved and the applicable legal requirements.

Not every digital asset transaction is necessarily subject to the same information-sharing obligations.

Further information about data sharing is provided in Chapter 5.

8.6 Public Blockchain Records and Data Permanence

Information recorded on a public blockchain may remain accessible for an extended or indefinite period, depending on the design and operation of the relevant network.

Public blockchain networks may be decentralised and operated independently of Infini.

As a result, we may not have the technical ability or legal authority to modify, erase or remove information recorded on an independent public blockchain.

Closing an account or ceasing to use our Services does not necessarily remove historical transaction information from the relevant blockchain.

This limitation does not mean that all blockchain-related personal data held by Infini is exempt from applicable privacy rights or retention requirements.

Where personal data is held in systems under our control, we assess requests for access, correction, erasure or other applicable rights according to the relevant legal requirements.

Where appropriate, we may be able to correct or delete off-chain records, remove unnecessary associations between personal data and wallet addresses, or take other measures within our control.

Further information about data retention and your privacy rights is provided in Chapters 10 and 11.

8.7 Sharing of Blockchain and Wallet Information

Where necessary for specified and lawful purposes, we may share relevant blockchain or wallet-related information with:

(a) blockchain analytics and transaction monitoring providers;

(b) financial institutions and payment partners;

(d) authorised compliance and risk management providers; and

(e) competent authorities where required or permitted by applicable law.

The information shared may include public wallet addresses, transaction details, relevant verification information or other data necessary for the particular purpose.

Where blockchain information is linked to an identifiable individual, we assess the applicable personal data sharing requirements.

The public availability of a wallet address or transaction record does not, by itself, authorise unrestricted disclosure of associated customer identification information.

Further information about personal data sharing and international transfers is provided in Chapters 5 and 6.

8.8 Third-Party Wallets and Blockchain Services

Certain Services may allow you to connect to or interact with third-party wallets, wallet connection services or blockchain applications.

Where you choose to use such functionality, we may receive information necessary to facilitate the requested interaction, such as public wallet addresses, relevant blockchain network information and transaction details.

Third-party wallet providers and blockchain services may independently collect or process personal data in accordance with their own privacy notices and applicable legal obligations.

Where a third party operates independently from Infini, its processing activities are not automatically governed by this Privacy Policy.

We encourage you to review the relevant third-party privacy information before using such services.

The handling of private keys, seed phrases and wallet credentials depends on the design of the relevant Service and wallet integration. Any applicable access or custody arrangements should be described accurately in the relevant service documentation.

8.9 Data Protection Safeguards

We apply safeguards appropriate to the nature of blockchain-related personal data and the risks associated with its processing.

Depending on the relevant activity, these may include:

(a) limiting access to customer identity and wallet association records;

(b) restricting unnecessary disclosure of identifiable customer information;

(d) limiting the use of blockchain analytics results to authorised purposes;

(e) maintaining appropriate records of compliance-related reviews and decisions; and

(f) applying relevant retention and deletion controls to off-chain personal data.

We assess the processing of blockchain-related personal data according to applicable data protection requirements, including lawfulness, transparency, purpose limitation, data minimisation and security.

Further information about our security practices is provided in Chapter 9.

Chapter 9 – Data Security

9.1 Our Approach to Data Security

We recognise the importance of protecting personal data against unauthorised access, disclosure, alteration, loss, destruction or other unlawful processing.

We implement technical, organisational and, where appropriate, physical security measures designed to protect personal data processed in connection with our Services.

The measures we apply take into account the nature, scope, context and purposes of the processing, the sensitivity of the information, the risks to individuals and applicable legal requirements.

We review and adapt relevant security measures as appropriate to changes in our Services, technology, risks and legal obligations.

9.2 Technical and Organisational Security Measures

Depending on the relevant systems, processing activities and risks, our security measures may include:

(a) encryption of personal data during transmission and, where appropriate, at rest;

(b) identity and access management controls;

(d) multi-factor authentication for relevant systems and access privileges;

(e) network, infrastructure and application security controls;

(f) system activity logging, monitoring and security event detection;

(g) vulnerability management, security assessments and testing;

(h) secure software development and change management practices;

(i) backup, recovery and business continuity measures; and

(j) information security policies, procedures and personnel awareness activities.

The specific measures implemented may vary according to the relevant Service, system and processing activity.

We seek to ensure that security measures remain appropriate to the risks associated with the personal data being processed.

9.3 Access to Personal Data

Access to personal data is restricted to authorised personnel and service providers who require such access for legitimate and specified business purposes.

Access permissions are determined according to relevant roles, responsibilities and operational requirements.

Where appropriate, we apply access approval, authentication, monitoring and periodic review procedures.

Personnel with access to personal data are subject to applicable confidentiality and information security obligations.

We also seek to ensure that relevant personnel receive appropriate information security and data protection guidance or training.

Access to sensitive customer information, identity verification materials, financial information and compliance records is subject to safeguards appropriate to the nature of the information and applicable requirements.

9.4 Third-Party Service Provider Security

We may engage third-party service providers to process, store, transmit or otherwise handle personal data in connection with our Services.

Where a provider processes personal data on our behalf, we require appropriate contractual and security arrangements in accordance with applicable data protection laws.

Depending on the nature of the engagement, these arrangements may address:

(a) confidentiality and authorised processing;

(b) appropriate technical and organisational security measures;

(d) security incident reporting and cooperation;

(e) permitted subprocessors and onward processing;

(f) assistance with applicable data protection obligations; and

(g) return or deletion of personal data, where required.

We assess relevant security risks associated with third-party processing and apply appropriate oversight measures.

Where a third party acts as an independent Controller, its responsibilities are determined according to its own processing activities and applicable legal obligations.

Further information about third-party data sharing is provided in Chapter 5.

9.5 Security Monitoring and Incident Response

We maintain arrangements designed to identify, assess and respond to information security incidents affecting our systems or personal data.

Depending on the nature of the incident, our response may involve:

(a) investigating the circumstances and potential impact;

(b) taking appropriate containment or mitigation measures;

(d) determining whether the incident constitutes a personal data breach under applicable law;

(e) documenting relevant findings and response actions; and

(f) implementing appropriate corrective or preventive measures.

Our response will take account of the nature and severity of the incident, the personal data involved, the potential impact on affected individuals and applicable legal requirements.

9.6 Personal Data Breach Notifications

Where a personal data breach occurs, we assess whether notification to a competent supervisory authority, affected individuals or other relevant parties is required under applicable law.

Where notification is legally required, we will provide it within the applicable timeframe and in accordance with the relevant legal requirements.

The timing, content and recipients of any notification depend on the applicable law and the circumstances of the breach.

Where we process personal data on behalf of another Controller, we will fulfil our applicable obligations to inform and assist that Controller, including under relevant contractual arrangements.

We may also cooperate with relevant service providers, financial institutions or other parties where necessary and appropriate to investigate or address an incident.

9.7 Security of Communications and Customer Accounts

The security of customer accounts and communications may also depend on the appropriate use of authentication credentials, devices and communication channels.

We encourage you to take reasonable precautions when using our Services, including protecting account credentials, using appropriate authentication measures and notifying us of suspected unauthorised access.

You should not disclose passwords, authentication codes, private keys or other sensitive credentials to unauthorised persons.

Where you suspect that your account or personal data has been compromised, please contact us promptly using the details provided in Chapter 14 – Contact Us.

9.8 Limitations of Security Measures

Although we implement measures designed to protect personal data, no method of electronic transmission, storage or processing can be guaranteed to be completely secure.

Accordingly, we cannot guarantee that personal data will be protected against every possible security threat or incident.

This statement does not limit any statutory rights or legal obligations that cannot lawfully be excluded.

We remain responsible for complying with applicable data protection and information security requirements in relation to processing activities for which we are legally responsible.

9.9 Reporting Security Concerns

If you believe that your personal data has been accessed, disclosed, altered or otherwise processed without authorisation, or if you become aware of a potential security issue affecting our Services, please contact us using the details provided in Chapter 14 – Contact Us.

We will assess relevant reports and take appropriate action in accordance with applicable law and our security incident response arrangements.

Chapter 10 – Data Retention

10.1 General Retention Principles

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected or otherwise processed, including providing our Services, meeting applicable legal and regulatory requirements, maintaining appropriate business records and protecting our legal rights.

The applicable retention period depends on the nature of the personal data, the relevant processing purpose, the Service involved and the legal obligations applicable to the responsible Infini entity.

We do not apply a single retention period to all categories of personal data.

Where personal data is no longer required for a lawful purpose, we will take appropriate steps to delete, anonymise or otherwise securely dispose of it, subject to applicable legal and technical requirements.

10.2 How We Determine Retention Periods

When determining how long personal data should be retained, we consider relevant factors, including:

(a) the purpose for which the information was collected or processed;

(b) the nature, volume and sensitivity of the personal data;

(d) applicable legal, regulatory, accounting, tax and recordkeeping obligations;

(e) applicable limitation periods and the need to establish, exercise or defend legal claims;

(f) the need to investigate or resolve relevant disputes, fraud or security incidents;

(g) the availability of less intrusive methods of retaining necessary information; and

(h) other relevant requirements under applicable data protection laws.

Where applicable law specifies a minimum or maximum retention period, we assess and apply the relevant requirement.

Where no specific statutory period applies, we determine an appropriate retention period by reference to the relevant purpose and applicable data protection principles.

10.3 Customer Identification and Due Diligence Records

We may retain personal data collected or generated in connection with customer identification, KYC, KYB, customer due diligence, enhanced due diligence and ongoing due diligence.

Depending on the relevant circumstances, such information may include:

(a) identification and verification records;

(b) beneficial ownership and authorised representative information;

(d) sanctions, PEP and adverse media screening records;

(e) source-of-funds and source-of-wealth information;

(f) verification results and relevant review decisions; and

(g) records of compliance-related communications and investigations.

Where applicable anti-money laundering, counter-terrorist financing or other laws require the retention of such records, we retain them for the period prescribed by the relevant legal framework.

The applicable retention period and its commencement may depend on factors such as the termination of a business relationship, completion of a transaction or another legally specified event.

We do not assume that the same statutory retention period or commencement date applies to every Infini entity or Service.

10.4 Account, Payment and Transaction Records

We may retain records relating to customer accounts, payments, virtual accounts, card services, digital asset transactions and other financial activities.

These records may include:

(a) account opening and administration information;

(b) payment instructions and transaction records;

(d) settlement, reconciliation and accounting records;

(e) card transaction, refund, dispute and chargeback information;

(f) relevant wallet addresses and blockchain transaction identifiers; and

(g) transaction-related compliance and supporting documentation.

Such information may be retained as necessary to provide the relevant Services, meet financial recordkeeping obligations, support reconciliation, investigate transaction issues, comply with applicable laws or resolve disputes.

Different categories of records may be subject to different retention requirements.

10.5 Compliance, Fraud Prevention and Investigation Records

We may retain personal data relevant to compliance reviews, fraud prevention, sanctions screening, transaction monitoring, security investigations and other risk management activities.

Where necessary and legally permitted, relevant records may be retained to:

(a) comply with applicable legal or regulatory obligations;

(b) investigate suspected fraud, financial crime or unauthorised activity;

(d) respond to lawful requests from competent authorities;

(e) establish, exercise or defend legal claims; or

(f) maintain appropriate evidence of actions taken in connection with a relevant matter.

Retention for these purposes will be assessed according to the applicable legal basis, necessity and relevant circumstances.

We do not retain all compliance-related information indefinitely merely because it may be useful for future risk analysis.

10.6 Technical, Security and Usage Data

We may retain technical information, system logs, security records and website or application usage information for periods appropriate to their respective purposes.

These purposes may include:

(a) maintaining the operation and security of our Services;

(b) detecting or investigating unauthorised access;

(d) supporting security incident investigations; and

(e) meeting applicable legal or regulatory requirements.

Retention periods may differ according to the type of record, the system involved and the relevant security or operational requirements.

Where appropriate, we may aggregate or anonymise information when identifiable personal data is no longer necessary.

10.7 Customer Communications and Marketing Information

We may retain customer communications, service requests, complaints and related correspondence for periods reasonably necessary to manage customer relationships, respond to enquiries, resolve disputes and meet applicable obligations.

Where we process personal data for direct marketing, we retain the information only for as long as there is an appropriate lawful basis and a continuing legitimate purpose.

If you withdraw consent or object to direct marketing, we will stop the relevant processing as required by applicable law.

We may retain limited information necessary to record and respect your communication preferences or opt-out request, where lawful and appropriate.

10.8 Retention Following Account Closure

Closing an account or terminating a customer relationship does not necessarily require the immediate deletion of all associated personal data.

We may retain relevant information after account closure where necessary and legally permitted for purposes such as:

(a) complying with applicable legal or regulatory recordkeeping obligations;

(b) completing outstanding transactions or financial reconciliation;

(d) investigating relevant fraud or security matters;

(e) responding to lawful regulatory or law enforcement requests; and

(f) establishing, exercising or defending legal claims.

Where continued retention is necessary, we seek to limit the information retained and any further processing to the relevant lawful purposes.

Personal data that is no longer required will be subject to appropriate deletion, anonymisation or disposal procedures.

10.9 Legal Holds and Exceptional Retention

In certain circumstances, we may need to preserve relevant personal data beyond its ordinary retention period.

This may arise where information is subject to a lawful preservation requirement, ongoing investigation, regulatory request, litigation or reasonably anticipated legal proceedings.

Where such retention is justified, we seek to preserve only information relevant to the particular matter and limit its use to appropriate purposes.

We will review the continued need for retention as appropriate and apply the relevant disposal requirements when the legal or other lawful basis for extended retention no longer applies.

10.10 Deletion, Anonymisation and Secure Disposal

When personal data is no longer required, we take appropriate steps to delete, anonymise or securely dispose of it in accordance with applicable law and relevant retention arrangements.

The method used may depend on the nature of the information, the system in which it is stored and applicable technical or legal requirements.

Where personal data is anonymised, we seek to ensure that the resulting information is no longer reasonably capable of identifying an individual, taking account of applicable legal standards and relevant re-identification risks.

Pseudonymised information that can still be linked to an identifiable individual remains subject to applicable personal data protection requirements.

We may retain information in an anonymised form for lawful statistical, analytical or other purposes where applicable requirements are satisfied.

10.11 Backups and Archived Records

Personal data may also be contained in backup systems or archived records maintained for security, recovery, legal or operational purposes.

Where immediate deletion from a particular backup or archive is not technically feasible, we assess the appropriate safeguards and applicable legal requirements.

Depending on the circumstances, these may include restricting access, preventing unnecessary further use and applying deletion or replacement through the relevant backup or archive lifecycle.

The existence of backup or archived copies does not, by itself, justify retaining personal data indefinitely.

10.12 Third-Party Retention

Where third-party service providers process personal data on our behalf, we seek to ensure that relevant retention, return and deletion requirements are addressed through appropriate contractual and operational arrangements.

Where a third party acts as an independent Controller, it may be subject to its own retention obligations and applicable privacy notice.

A request to delete personal data held by Infini does not necessarily result in the deletion of information independently retained by another Controller under its own lawful obligations.

Further information about third-party data sharing is provided in Chapter 5.

10.13 Public Blockchain Records

Certain transaction information recorded on public blockchain networks may remain publicly accessible independently of Infini.

We may not have the technical ability or legal authority to delete or modify information recorded on an independent public blockchain.

However, personal data and customer-to-wallet association records maintained in systems under our control remain subject to applicable retention and privacy requirements.

Further information is provided in Chapter 8 – Blockchain & Digital Asset Data.

10.14 Requests for Deletion and Retention Information

You may request the deletion of your personal data or seek information about its retention where permitted by applicable data protection law.

We will assess such requests in accordance with the relevant legal requirements.

Where we are required or otherwise lawfully entitled to retain particular information, we may be unable to fulfil a deletion request in full.

Where required by law, we will explain the relevant limitation or reason for retaining the information, subject to applicable restrictions on disclosure.

You may contact us using the details provided in Chapter 14 – Contact Us.

Further information about your privacy rights is provided in Chapter 11 – Your Privacy Rights.

Chapter 11 – Your Privacy Rights

11.1 Overview of Your Privacy Rights

Depending on your location, the responsible Infini entity, the nature of the processing and applicable data protection laws, you may have certain rights in relation to your personal data.

These rights may include the right to access, correct or delete personal data, restrict or object to certain processing, receive personal data in a portable format, withdraw consent and exercise rights relating to automated decision-making.

The availability, scope and conditions of these rights depend on the applicable legal framework.

We assess requests to exercise privacy rights in accordance with the relevant legal requirements.

Nothing in this Privacy Policy is intended to restrict any privacy right that cannot lawfully be excluded or limited.

11.2 Right of Access

Where applicable law provides a right of access, you may request confirmation as to whether we process your personal data.

You may also have the right to obtain a copy of your personal data and relevant information about its processing, including, where required by law:

(a) the purposes of processing;

(b) the categories of personal data involved;

(d) the applicable retention period or criteria used to determine it;

(e) relevant information about the source of the personal data; and

(f) other information required under applicable law.

We may limit or withhold particular information where a lawful exemption or restriction applies, including where necessary to protect the rights of others or comply with applicable legal restrictions.

11.3 Right to Rectification

Where applicable law provides a right to rectification, you may request the correction of inaccurate personal data concerning you.

You may also request the completion of incomplete personal data, taking account of the purposes for which the information is processed.

We may request relevant supporting information where reasonably necessary to verify a proposed correction.

Where particular information must be preserved as part of an accurate historical, transaction or compliance record, we may retain the original record while adding an appropriate correction, update or supplementary statement, as permitted or required by applicable law.

11.4 Right to Erasure

Where applicable law provides a right to erasure, you may request the deletion of your personal data in circumstances recognised by the relevant legal framework.

The right to erasure is not absolute.

We may be required or permitted to retain certain information where necessary for purposes such as:

(a) compliance with applicable legal or regulatory obligations;

(b) anti-money laundering, counter-terrorist financing or other legally required recordkeeping;

(d) the protection of legally recognised rights or interests; or

(e) another applicable statutory exception.

Where only part of the information is subject to a valid retention requirement, we will assess whether other information can be deleted.

Certain information recorded on independent public blockchain networks may not be technically capable of modification or deletion by Infini.

Further information about retention and blockchain data is provided in Chapters 8 and 10.

11.5 Right to Restriction of Processing

Where applicable law provides a right to restriction of processing, you may request that we restrict certain uses of your personal data in qualifying circumstances.

Such circumstances may include disputes concerning the accuracy of personal data, objections to particular processing activities or other situations recognised by applicable law.

Where a valid restriction applies, we will handle the relevant information in accordance with the applicable requirements.

Restrictions may be subject to legal exceptions, including where processing is necessary for certain legal claims, protection of rights or other purposes permitted by law.

11.6 Right to Data Portability

Where applicable law provides a right to data portability, you may be entitled to receive certain personal data concerning you in a structured, commonly used and machine-readable format.

Where the relevant legal conditions are satisfied and it is technically feasible, you may also request that such data be transmitted directly to another Controller.

The right to data portability does not necessarily apply to every category of personal data we hold.

For example, under the GDPR and UK GDPR, the right generally applies to qualifying personal data provided by the individual where processing is based on consent or contract and carried out by automated means.

The exercise of this right must not adversely affect the rights and freedoms of others.

11.7 Right to Object

Where applicable law provides a right to object, you may object to certain processing of your personal data.

Under the GDPR and UK GDPR, this may include processing based on legitimate interests or the performance of a task carried out in the public interest, subject to the applicable conditions and exceptions.

Where a valid objection is made, we will assess whether the relevant processing must cease or whether a lawful basis for continuing the processing applies.

Where we process personal data for direct marketing purposes, you may object to that processing at any time.

Where the GDPR or UK GDPR applies, we will stop processing your personal data for direct marketing purposes following such an objection, including related profiling to the extent connected with that marketing.

11.8 Right to Withdraw Consent

Where we rely on your consent as the legal basis for a particular processing activity, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Where consent is withdrawn, we will cease the relevant consent-based processing unless another lawful basis permits or requires continued processing.

Withdrawal of consent for one purpose does not necessarily affect processing carried out for a separate purpose under a different lawful basis.

Where required by applicable law, withdrawing consent will be as easy as giving it.

11.9 Rights Relating to Automated Decision-Making

Where applicable data protection laws provide rights relating to automated decision-making or profiling, you may be entitled to additional information or safeguards.

Under the GDPR and UK GDPR, specific protections may apply to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects concerning an individual.

Where such protections apply, and subject to the relevant legal conditions and exceptions, you may have rights to obtain human intervention, express your point of view and contest the decision.

We will assess requests relating to automated decisions according to the relevant processing activity and applicable legal requirements.

Further information about automated processing, profiling and human review is provided in Chapter 4 – Identity Verification, Compliance & Automated Decisions.

11.10 Rights Under Other Applicable Privacy Laws

In addition to the rights described above, applicable privacy laws may provide other rights or protections.

These may include rights relating to the disclosure of personal data, certain uses of sensitive information, direct marketing, automated processing or other activities regulated under the relevant legal framework.

Where such rights apply to our processing activities, we will assess and respond to requests in accordance with the relevant requirements.

The rights available to an individual may differ according to the jurisdiction, relevant Infini entity and nature of the processing.

11.11 How to Exercise Your Rights

You may submit a privacy rights request by contacting us using the details provided in Chapter 14 – Contact Us.

To help us identify and process your request, please provide sufficient information to explain the right you wish to exercise and the personal data or processing activity concerned.

We may request additional information where reasonably necessary to identify the relevant records, clarify the request or verify your identity.

We will not require more personal data than is reasonably necessary for these purposes.

Where a request concerns processing carried out by another Controller, we may direct you to the relevant organisation or assist with the request where required by applicable law or relevant arrangements.

11.12 Identity Verification and Authorised Representatives

To protect personal data against unauthorised disclosure or alteration, we may need to verify your identity before responding to certain privacy rights requests.

The verification measures used will be proportionate to the nature of the request, the sensitivity of the information and the risks involved.

Where a request is submitted by an authorised representative, we may request appropriate evidence of that person's authority to act on your behalf.

We will not disclose personal data to a person whose identity or authority has not been sufficiently established where verification is necessary.

11.13 Response Timeframes and Fees

We will respond to privacy rights requests within the timeframe required by applicable law.

Where the GDPR or UK GDPR applies, we will generally respond without undue delay and within one month of receiving a valid request, subject to any lawful extension or other applicable procedural requirements.

Where an extension is permitted and necessary, we will provide the relevant notification and explanation within the applicable timeframe.

We generally do not charge a fee for exercising privacy rights where applicable law requires requests to be handled free of charge.

Where permitted by law, we may charge a reasonable fee or decline to act on requests that are manifestly unfounded or excessive, subject to the applicable legal conditions.

11.14 Limitations and Legal Restrictions

In certain circumstances, we may be required or permitted to limit, delay or refuse a privacy rights request.

Such circumstances may include:

(a) applicable legal or regulatory recordkeeping obligations;

(b) legally protected investigations or reporting requirements;

(d) protection of the rights and freedoms of other individuals;

(e) legal privilege or the establishment, exercise or defence of legal claims; or

(f) another lawful exemption or restriction.

Any limitation will be assessed according to the relevant legal framework and the circumstances of the request.

We will not rely on general business convenience or a broad reference to compliance requirements as sufficient justification for refusing an otherwise valid request.

Where required and legally permitted, we will explain the reason for a limitation or refusal and inform you of relevant options for further review or complaint.

11.15 Complaints and Supervisory Authorities

If you have concerns about how we process your personal data or handle a privacy rights request, you may contact us using the details provided in Chapter 14 – Contact Us.

We will assess privacy-related complaints and take appropriate action in accordance with applicable legal requirements.

Where applicable law provides the right, you may also lodge a complaint with a competent data protection or supervisory authority.

Under the GDPR or UK GDPR, you may have the right to complain to the relevant supervisory authority, including in the jurisdiction where you habitually reside, work or where an alleged infringement occurred, as applicable.

Your right to contact a supervisory authority does not depend on first obtaining a satisfactory response from Infini, unless a particular legal framework provides otherwise.

Nothing in this Privacy Policy limits any administrative or judicial remedy available under applicable law.

Chapter 12 – Children & Third-Party Services

12.1 Children's Personal Data

Our Services are not directed to children or individuals who do not meet the applicable minimum age requirements for the relevant Service.

The minimum age required to use a particular Service may differ from the age at which an individual can validly consent to certain processing of personal data under applicable privacy laws.

We do not knowingly offer Services to individuals who are ineligible to use them because of applicable age restrictions.

Where age verification or other eligibility checks are required, we may process relevant personal data for those purposes in accordance with applicable law.

If we become aware that personal data has been collected or processed in circumstances that violate applicable requirements relating to children, we will take appropriate steps to address the matter, including deleting the information where required and legally permitted.

Certain information may need to be retained where required by applicable law.

If you believe that a child has provided personal data to us in circumstances that may violate applicable requirements, please contact us using the details provided in Chapter 14 – Contact Us.

12.2 Information About Minors in Business Relationships

In certain circumstances, information relating to a minor may be relevant to a lawful business relationship or compliance process, even where the minor is not eligible to use our Services directly.

For example, information about an individual may be relevant to ownership, control, beneficial ownership or other legally required verification processes.

Where such information is processed, we assess the necessity, legal basis and applicable safeguards, taking account of the individual's age and the nature of the information.

We do not treat the collection of information about a minor for a legitimate compliance purpose as automatically authorising that minor to access or use our Services.

12.3 Third-Party Websites and Services

Our Services may contain links to, integrate with or provide access to websites, applications, platforms or services operated by third parties.

These may include financial institutions, payment service providers, identity verification providers, blockchain services and other external service providers.

When you access or interact directly with an independent third-party service, that third party may collect and process personal data under its own privacy notice and applicable legal obligations.

This Privacy Policy governs personal data processing for which the relevant Infini entity is responsible. It does not automatically govern independent processing activities carried out by another organisation.

We encourage you to review the relevant third party's privacy information before providing personal data or using its services.

12.4 Third-Party Roles and Responsibilities

The data protection responsibilities of Infini and a third-party provider depend on their respective roles in the relevant processing activity.

Where a third party processes personal data on our behalf as a Processor, we implement appropriate arrangements in accordance with applicable data protection laws.

Where a third party independently determines the purposes and means of processing, it may act as an independent Controller and be responsible for complying with its own applicable data protection obligations.

In certain circumstances, the parties may have other legally recognised arrangements, including joint controllership, where the relevant legal conditions are met.

The use of a third-party service does not, by itself, remove Infini's obligations in relation to processing activities for which we remain legally responsible.

Further information about third-party data sharing is provided in Chapter 5.

12.5 Third-Party Wallets and Wallet Connections

Certain Services may allow you to connect to or interact with third-party digital asset wallets, wallet connection services or blockchain applications.

Where you choose to use such functionality, we may receive or process information necessary to facilitate the requested interaction.

Depending on the relevant integration, this may include:

(a) public wallet addresses;

(b) blockchain network information;

(d) wallet connection or verification information; and

(e) other information necessary for the requested Service.

The third-party wallet provider may independently process information in connection with its own wallet services.

Your use of a third-party wallet may also be subject to that provider's terms and privacy notice.

The handling of private keys, seed phrases and other wallet credentials depends on the relevant wallet architecture and integration. Applicable custody and credential-handling arrangements should be accurately described in the relevant Service documentation.

Further information about blockchain and digital asset data is provided in Chapter 8.

12.6 External Links and Independent Services

The availability of a link, integration or connection to an independent third-party service does not necessarily constitute an endorsement of that provider or its privacy practices.

Independent third parties may maintain their own security measures, privacy practices and service arrangements.

To the extent permitted by applicable law, Infini is not responsible for processing activities undertaken independently by third parties where those activities are outside Infini's legal responsibility or control.

Nothing in this section excludes or limits any responsibility that Infini cannot lawfully exclude, including applicable obligations concerning our selection, engagement, disclosure of personal data to or oversight of relevant service providers.

12.7 Questions and Concerns

If you have questions about the processing of personal data in connection with a third-party integration or Service, you may contact us using the details provided in Chapter 14 – Contact Us.

Where the relevant processing is carried out independently by another Controller, you may also need to contact that organisation directly to exercise applicable privacy rights concerning its processing activities.

Where required by applicable law, we will provide appropriate assistance or information concerning the relevant processing arrangements.

Chapter 13 – Changes to This Policy

13.1 Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, business operations, data processing practices, technology or applicable legal and regulatory requirements.

When we update this Privacy Policy, we will revise the "Last Updated" date displayed at the beginning of the document.

We encourage you to review this Privacy Policy periodically to remain informed about how we collect, use, disclose and protect personal data.

13.2 Notification of Material Changes

Where changes materially affect how we process personal data or the rights of individuals, we will provide appropriate notice as required by applicable law.

Depending on the nature of the changes and the relevant Service, notice may be provided through our website, application, email, account notifications or other appropriate communication channels.

Where a change involves a new processing purpose, a materially different use of personal data or another activity requiring additional transparency or consent, we will assess and fulfil the applicable requirements before carrying out the relevant processing.

13.3 Consent and Continued Use

Where applicable law requires consent for a new or changed processing activity, we will obtain the necessary consent before undertaking that processing.

Continued use of our Services does not, by itself, constitute valid consent where applicable law requires an affirmative indication of agreement.

An update to this Privacy Policy does not automatically establish a lawful basis for processing personal data for a new or incompatible purpose.

13.4 Previous Versions

Where required by applicable law, we will make relevant information about changes to this Privacy Policy available through appropriate channels.

You may contact us using the details provided in Chapter 14 – Contact Us if you have questions about an update to this Privacy Policy.

Chapter 14 – Contact Us

14.1 Privacy Enquiries and Requests

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your personal data is collected, used, disclosed, retained or protected, you may contact us using the details below.

Privacy Contact

Email: [email protected]

Website: https://www.infini.money

Please provide sufficient information to help us understand your enquiry or request.

Where necessary and appropriate, we may request additional information to verify your identity or authority before disclosing personal data or processing certain requests.

We will handle privacy-related enquiries and requests in accordance with applicable data protection laws.

14.2 Responsible Infini Entity

The Infini entity responsible for processing your personal data may depend on the Service you use, the relevant contractual relationship and the nature of the processing activity.

Where required by applicable law, we will provide the identity and relevant contact details of the responsible Controller, including any additional information required to enable you to exercise your privacy rights.

Further information about the scope of this Privacy Policy and the responsible Infini entities is provided in Chapter 1 – Introduction & Scope.

14.3 Data Protection Officer and Local Representatives

Where applicable law requires the appointment of a Data Protection Officer ("DPO"), an EU Representative, a UK Representative or another designated privacy contact, we will provide the relevant contact information as required.

Where such appointments are not legally required, privacy enquiries may be directed to the contact details provided above.

14.4 Complaints and Further Assistance

If you are dissatisfied with our handling of a privacy-related enquiry or request, you may contact us for further review.

Where applicable law provides the right, you may also lodge a complaint with the relevant data protection or supervisory authority.

Further information about your privacy rights and complaint options is provided in Chapter 11 – Your Privacy Rights.

Accounts & money

Get paid

Spend management

Business operations

Treasury management

Solutions

Pricing

Resources

Personal account

Manage your money

Get started

Privacy Policy

Chapter 1 – Introduction & Scope

1.1 Introduction

1.2 Scope of This Privacy Policy

1.3 Responsible Infini Entity

1.4 Our Role and Third-Party Services

1.5 Meaning of Personal Data and Processing

1.6 Relationship with Other Agreements and Notices

1.7 Acknowledgement and Consent

Chapter 2 – Personal Data We Collect

2.1 General Principles

2.2 Personal Identification and Contact Information

2.3 Identity Verification and Customer Due Diligence Information

2.4 Corporate Customer and Related Individual Information

2.5 Payment, Account and Transaction Information

2.6 Digital Asset and Wallet Information

2.7 Financial and Supporting Information

2.8 Compliance, Screening and Risk Assessment Information

2.9 Device, Technical and Usage Information

2.10 Information from Third Parties and Public Sources

2.11 Information We Generate or Derive

2.12 Information You Choose Not to Provide

Chapter 3 – Purposes & Legal Bases

3.1 General Principles

3.2 Providing and Managing Our Services

3.3 Identity Verification and Customer Due Diligence

3.4 Processing Payments and Financial Transactions

3.5 AML, Sanctions and Financial Crime Compliance

3.6 Fraud Prevention, Account Security and Risk Management

3.7 Automated Processing and Risk Assessment

3.8 Customer Support and Service Communications

3.9 Improving and Developing Our Services

3.10 Marketing and Promotional Communications

3.11 Legal Claims, Disputes and Regulatory Requests

3.12 Other Purposes and Further Processing

3.13 Legitimate Interests and Your Rights

3.14 Consent and Withdrawal

3.15 Processing Under Other Applicable Privacy Laws

Chapter 4 – Identity Verification, Compliance & Automated Decisions

4.1 Identity Verification and Customer Due Diligence

4.2 Third-Party Identity Verification Providers

4.3 Biometric Verification

4.4 Risk-Based Customer Review and Enhanced Due Diligence

4.5 Ongoing Due Diligence and Monitoring

4.6 Automated Verification and Technology-Assisted Reviews

4.7 AI-Assisted Processing

4.8 Automated Decision-Making and Profiling

4.9 Human Review and Escalation

4.10 Decisions Affecting Access to Services

4.11 Rights Relating to Automated Decisions

4.12 Accuracy, Data Minimisation and Safeguards

Chapter 5 – How We Share Personal Data

5.1 General Principles

5.2 Third-Party Service Providers

5.3 Identity Verification and Compliance Providers

5.4 Banks, Financial Institutions and Payment Partners

5.5 Virtual Account Services

5.6 Card Services and Card Programme Partners

5.7 Digital Asset, Blockchain and Transaction Monitoring Providers

5.8 Compliance Requests and Transaction Investigations

5.9 Companies Within the Infini Group

5.10 Regulatory Authorities, Courts and Law Enforcement

5.11 Professional Advisers and Independent Service Providers

5.12 Corporate Transactions

5.13 Disclosures at Your Request or with Your Consent

5.14 Safeguards and Restrictions on Data Sharing

5.15 International Data Sharing

Chapter 6 – International Data Transfers

6.1 International Processing of Personal Data