1. Introduction and scope

XFX Capital, Inc. (“XFX,” “we,” “us,” or “our”) operates this website (the “Site”). This Privacy Policy (this “Policy”) explains how we collect, use, disclose, and protect the personal information of visitors to the Site, and the rights you may have in relation to that information.

The Site is an informational, business-to-business resource directed at institutional and professional market participants. It is not intended for, or directed to, consumers, retail investors, or individuals acting in a personal capacity.

This Policy applies only to personal information collected through the Site. It does not apply to:

• personal information processed in connection with any trading, dealing, settlement, onboarding, or counterparty relationship, which is governed by the separate agreements, notices, and terms applicable to those relationships (including information collected for know-your-customer, anti-money-laundering, sanctions, or recordkeeping purposes); or

• third-party websites, platforms, or services that we do not operate, even if linked from the Site.

Where we determine the purposes and means of processing personal information collected through the Site, XFX Capital, Inc. is the controller of that information.

2. Key terms

In this Policy, “personal information” (or “personal data”) means information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual; “processing” means any operation performed on personal information, such as collection, use, storage, disclosure, or deletion; and “you” means the individual visiting or submitting information through the Site. Additional defined terms used by specific laws are set out in the Annexes.

3. Information we collect

We collect only a limited amount of personal information through the Site:

We do not operate accounts, process transactions, or collect payment, financial-account, or trading information through the Site. The contact form is the only means by which you actively submit personal information to us.

Free-text and third-party information. Our contact form includes a free-text field. Please do not submit sensitive personal information, or personal information about other individuals, unless it is necessary for your inquiry and you are authorized to provide it. If you include personal information about another person, you confirm that you have the authority to do so and that they are aware of how we may process it as described in this Policy.

4. How and why we use personal information

We use personal information collected through the Site to:

• respond to and follow up on inquiries you submit, and discuss potential institutional business relationships;

• perate, maintain, secure, and improve the Site, and protect against fraud, misuse, and security incidents;

• understand, in aggregate, how the Site is used; and

• where you have opted in, send you marketing communications about our institutional products and services. You may withdraw your consent and unsubscribe at any time, without affecting the lawfulness of processing before withdrawal.

We use the free-text content of your inquiry only as needed to understand and respond to it. Where applicable data protection law requires a legal basis for processing (such as in the EEA and the UK), the bases on which we rely are set out in Annex B.

5. How we disclose personal information

We do not sell your personal information, and we do not disclose it for cross-context behavioral advertising. We may disclose personal information in the following limited circumstances:

•     Service providers. We use third-party providers to host and operate the Site and to manage inquiries and communications on our behalf, including our website hosting and site-builder provider, our customer-relationship-management provider, and, where applicable, our email communications provider. These providers process personal information only on our instructions and under appropriate confidentiality and data-protection obligations.

•     Affiliates. We may share personal information with our corporate affiliates to respond to your inquiry and operate our business, consistent with this Policy.

•     Legal and regulatory. We may disclose personal information where we believe in good faith that disclosure is required or permitted by applicable law, regulation, legal process, or governmental or regulatory request, or to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of XFX, our clients, or others.

•     Corporate transactions. We may disclose personal information in connection with a proposed or actual merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, subject to appropriate confidentiality protections.

6. International transfers

We are based in the United States, and personal information collected through the Site may be processed in the United States and in other countries where we or our service providers operate. These countries may have data-protection laws that differ from those in your country of residence. Where required by applicable law, we put in place appropriate safeguards for international transfers, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. Further information relevant to the EEA and UK is set out in Annex B.

7. Cookies and analytics

We use cookies and similar technologies on the Site and manage them through a consent banner. Cookies are small files placed on your device that help the Site function and help us understand how it is used.

When you first visit the Site, the banner lets you accept all cookies, decline non-essential cookies, or customize your choices by category. Strictly necessary cookies are always active and cannot be switched off; all other categories are off by default and are set only if and when you enable them. You can change or withdraw your choices at any time through the banner.

The banner groups cookies into the following categories:

• Necessary (always active) — required for the Site to load, operate, and remain secure, and to remember your cookie preferences.

• Preferences — used to remember choices you make so the Site can offer enhanced, more personal features.

• Analytics — with your consent, we use Google Analytics, deployed through Google Tag Manager, to understand how visitors use the Site so we can measure and improve it. These tags load only after you consent. We have disabled Google Analytics' advertising features and Google Signals, and we do not use it to build advertising profiles.

• Marketing — enables advertising-related cookies. We do not currently use marketing or advertising cookies; if this changes, we will update this Policy and the banner before any such cookies are set.

Our hosting platform also provides built-in analytics that measure Site usage on an anonymized, aggregated basis; this does not use cookies and does not identify you. You can also manage cookies through your browser settings and Google's opt-out tools; disabling some cookies may affect how the Site functions. Where applicable, we honor opt-out preference signals such as Global Privacy Control.

8. Data retention

We keep personal information only for as long as necessary for the purposes described in this Policy. Inquiry and contact information is retained for as long as needed to respond to and follow up on your inquiry and to pursue any resulting business relationship, and for a reasonable period afterward, after which it is deleted or anonymized. We routinely purge inquiries that do not lead to engagement. Where you have opted in to marketing, we retain your contact details until you withdraw consent or unsubscribe.

The retention of personal information relating to onboarded counterparties — including information held for know-your-customer, anti-money-laundering, sanctions, and recordkeeping purposes — is governed by separate agreements and notices and is subject to longer retention periods required by law.

9. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information collected through the Site against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Children

The Site is directed to institutions and professional users and is not intended for, or directed to, individuals under 18 years of age. We do not knowingly collect personal information from children.

11. Third-party links

The Site may contain links to third-party websites or resources. We do not control and are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party site you visit.

12. Your privacy rights

Depending on where you are located and the applicable law, you may have rights in relation to your personal information, including the rights to access, correct, delete, or obtain a copy of it, and to object to or restrict certain processing. If you have opted in to marketing, you may withdraw consent at any time. Specific rights and how to exercise them are described, for California residents, in Annex A, and, for individuals in the EEA and the UK, in Annex B.

You are not required to provide personal information to us, but if you do not provide the information requested in the contact form, we may be unable to respond to your inquiry. To make a request, or if you have questions about this Policy, contact us using the details in Section 14.

13. Changes to this Policy

We may update this Policy from time to time. The “Effective date” above indicates when this Policy was last revised. Material changes will be reflected on this page, and your continued use of the Site after an update constitutes acknowledgment of the revised Policy.

14. How to contact us

XFX Capital, Inc.

Attn: Legal 

1395 Brickell Avenue, Suite 938, Miami, Florida 33131, USA

Email: legal@xfx.io

Annex A — Additional disclosures for California residents

This Annex supplements the Policy and applies to residents of California whose personal information we collect through the Site, as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”). These disclosures apply to personal information collected through the Site, including personal information of individuals acting in a business or professional capacity.

Categories of personal information. In the preceding 12 months, we have collected the following categories of personal information through the Site: identifiers (such as name and business email address); commercial or professional information (such as company name and the contents of your inquiry); and internet or other electronic network activity information (such as the technical and usage information described in Section 3). We do not collect Social Security numbers, financial-account numbers, government identifiers, or precise geolocation through the Site, and we do not intentionally collect “sensitive personal information” as defined by the CCPA.

Sources. We collect this information directly from you (through the contact form) and automatically from your device when you visit the Site.

Purposes. We use this information for the business purposes described in Section 4 of the Policy.

Disclosures. In the preceding 12 months, we have disclosed identifiers and commercial/professional information to the categories of recipients described in Section 5 for the business purposes described in this Policy.

No sale or sharing. We do not “sell” personal information and do not “share” personal information for cross-context behavioral advertising, as those terms are defined under the CCPA, and we have not done so in the preceding 12 months. Where applicable, we honor opt-out preference signals such as Global Privacy Control.

Your California rights. Subject to certain exceptions, you have the right to: (i) know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients; (ii) request deletion of your personal information; (iii) request correction of inaccurate personal information; and (iv) not receive discriminatory treatment for exercising your rights.

How to exercise your rights. You or your authorized agent may submit a request by emailing legal@xfx.io. We will verify your request using the information you provide and may ask for additional information to confirm your identity. We will respond within the timeframes required by law. An authorized agent must provide proof of authorization, and we may still require you to verify your identity directly.

Annex B — Additional disclosures for individuals in the EEA and the United Kingdom

This Annex supplements the Policy and applies where the EU General Data Protection Regulation (the “GDPR”) or the UK GDPR applies to our processing of personal information collected through the Site.

Controller. XFX Capital, Inc. is the controller of personal information collected through the Site. Contact details are in Section 14.

Legal bases for processing. We process personal information on the following legal bases:

•     Legitimate interests — to respond to and follow up on your inquiry, to operate, secure, and improve the Site, and to pursue potential institutional business relationships. Our legitimate interest is in operating and developing our business as an institutional dealer, balanced against your rights and interests.

•     Consent — where you opt in to marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

•     Legal obligation — where we must process personal information to comply with applicable law or regulatory requirements.

Your rights. Subject to the conditions and exemptions in applicable law, you have the right to access your personal information; have it corrected or erased; restrict or object to its processing; obtain a copy in a portable format; and, where processing is based on consent, withdraw that consent. To exercise any of these rights, contact us using the details in Section 14.

International transfers. As described in Section 6, personal information may be transferred to the United States and other countries outside the EEA and the UK. Where we transfer personal information to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. You may request a copy of the relevant safeguard by contacting us.

Retention. We retain personal information as described in Section 8.

Complaints. If you have concerns about how we process your personal information, we encourage you to contact us first. You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner’s Office (ICO), and in the EEA, the data protection authority in your country of residence.