Privacy Policy

EXJ.io Privacy Policy

Last updated: 23^rd October 2018

Your privacy is important to us. EXJ (“EXJ”, “we”, our” or “us) is committed to protecting the privacy, confidentiality and security of the personal information we collect and hold by complying with the requirements under the Hong Kong Privacy (Data Protection) Ordinance (Chapter 486 of the Laws of Hong Kong) (“PDPO”). We are equally committed to ensuring that all our employees and agents uphold these obligations. 

Please read this private policy carefully before accessing (which every User are required to actively acknowledge acceptance to the terms in accordance with the sign-up procedure) and/or using any of EXJ’s Services.

This Privacy Policy applies whenever you access and/or use any of our Services . This Privacy Policy explains how we manage personal information and describes:

• what information we collect, how we collect it, and why;
• how we use that information and with whom we share it;
• how you can access and update that information;
• the choices you can make about how we collect, use, and share your information; and
• how we protect the information we store about you.

IF YOU DO NOT WANT US TO COLLECT, STORE, USE OR SHARE YOUR INFORMATION IN THE WAYS DESCRIBED IN THIS PRIVATE POLICY, YOU SHALL NOT ACCESS AND/ OR USE ANY OF OUR SERVICES.

In this privacy policy, any reference to EXJ shall, where the context permits, include but not limited to any of the EXJ’s subsidiaries, parent companies, joint ventures, related companies, associates and other corporate entities under common ownership and/or any of their agents, consultants, employees, officers and directors.

Unless defined otherwise, capitalized terms in this private policy shall have the same meanings as ascribed to them in the private policy.

How do we collect personal information?

We collect personal information from you in the following circumstances: (i) when you register the Account with us; (ii) complete any application form to us; (iii) submit a query or request to us, (iv) or when you upload your data on the Platform. In some cases, we may be required by law to collect certain types of personal information about you. The personal information will be acquired through our channels, but sometimes we may obtain information through a third party, such as representatives, agents or contractors who provide services to us, or third parties whom may refer you to us as they think you may be interested in our products or services.

Who do we disclose your personal information to?

We may share personal information about you with:

• your representatives, advisers and others you have authorised to interact with us on your behalf;
• our staff who need the information to discharge their duties;
• related entities within our corporate group;
• our business partners, agents and service providers;
• payment system operators and financial institutions;
• prospective purchasers of all or part of our business or shares in our company or a related entity;
• professional advisers who we engage to provide advice on our business;
• government authorities who ask us to disclose that information, or to other people as required by law;
• third party service company who will assist us in verifying the personal information.

Under this privacy policy, you consent to your personal information being disclosed in such circumstances.

In some cases, the people to whom we disclose your personal information may be located overseas. There may not be in place data protection laws which are substantially similar to, or serve the same purposes as Hong Kong. As such, your personal information may not be protected to the same or similar extent as in Hong Kong.

What information do we collect?

The kinds of personal information that we collect and hold about you may include:

• identifying information, such as your name, gender and date of birth of users
• contact information, such as your postal address, email address and telephone number
• social media profile information that you make available to us or to the public
• financial information, such as credit card, bank account or other payment details
• blockchain identifiers, such as blockchain addresses and public keys
• usernames and passwords that you create when registering for an account with us
• details of any products or services that we provide to you
• information about how you use the products and services we provide
• records of our communications with you, including any messages you send us

• your physical location and technical information including but not limited to the devices you use to access our Services;

• any other information provided you or by third parties

If you access our Services from a third-party application or connect our Services to a third-party application, you should also read that third-party application’s Terms of Service and Privacy Policy. If you are unclear about what information a third-party application is sharing with us, please find out more about the privacy practices of that third-party application through that third-party application.

Without this information, we may not be able to provide you with our products or services (or with all of the features and functionality offered by our products or services) or to respond to queries or requests that you submit to us.  

You may, however, visit our site anonymously.

Cookies and Automated Information Collection
We and service providers acting on our behalf store log files and use tracking technologies such as:

• cookies;
• web beacons, which let us know if a certain page was visited or whether an e-mail was opened;
• tracking pixels, which allow us or our advertising partners to advertise more efficiently and effectively; and
• local shared objects (also known as flash cookies) which help us to reduce fraud, and speed up load times.

We and our service providers use these log files, tags, and tracking technologies to collect and analyse certain kinds of technical information, including:

• IP addresses;
• the type of computer or mobile device you are using;
• your operating system version;
• your mobile device’s identifiers, like your MAC Address, Identifier For Advertising (IDFA), and/or International Mobile Equipment Identity (IMEI);
• your browser types;
• your browser language;
• referring and exit pages, and URLs;
• platform type;
• the number of clicks on a page or feature;
• domain names;
• landing pages;
• pages viewed and the order of those pages;
• the amount of time spent on particular pages; and

In some cases, we will connect this information with your social network ID, or EXJ user ID.

Information About You That You Share With Us Directly
When you use our Services, you may give us information directly (for example, when you set-up your Account) and we will store that on our systems and use it for the purposes described in this Privacy Policy.

Parts of our Services may use a more traditional registration or account set-up process where you may be asked to give us some or all of the following information:

• your age or birthday;
• your first and last names;
• your e-mail address;
• a password; and
• other information that helps us make sure it is you accessing your Account or helps us improve our Services.

We may also let you create a player profile, that our other players can see. Your player profile may include information like:

• username(s);
• your gender;
• biographic details (for example, your age or age range);
• approximate location information that you provide;
• activities performed on the Website;

Trade Data

The trade data may include trade ID, initiated trades, payment method, offer information, buyer username, seller username, trade value (in fiat), trade value (in crypto-currency), crypto-currency price, currency, timestamps of trade, trade chats, possible merchant invoice information and ATM trade data. The source of the trade data is from you and your trading partner. The legal bases for this processing are consent; the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract and our legitimate interests, namely the operation of our business model.

Crypto-currency transaction data

Information stored on received transactions may include timestamp, bitcoin amount, deposit address (unique) and transaction ID and other publicly available data from the blockchain. Withdrawal transactions may include data such as timestamp, amount, sent address, transaction ID, and description. The source of the trade data is you and/or your trading partner. The legal bases for this processing are consent; the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract and our legitimate interests, namely the operation of our business model.

Communication data

Communication data includes 1) all your messages, requests and other communication with our customer support which may happen during the dispute review process or via support tickets, emails, or by means of any other communication tool; and 2) all your communication and file attachments that you generate when conducting trades with other users ("trade chat messages") or other data that you generated mainly by communicating to other users. Communication data may include, email address, username, IP address, full name, audio and video files and in the case of manual ID verification: photo of the user’s personal ID, photo of the user, and photo of the user’s utility bill or related document. The communication data may be processed for the purposes of communicating with you, record-keeping, in order to review and resolve disputes, serve our customers better and improve our service. The legal basis for this processing is our legitimate interests, namely the proper administration of our website and business.

Customer Support Correspondence
Except as provided herein, when you ask for help from us, we will collect and store the contact information you give us (generally, your name and e-mail address), activity on our Services, and your EXJ player ID. We will also store the communications you have with us and any information in those communications in order to provide support and improve the Services.

Information You Give Us For Text Messaging Services
We receive and store the information you provide, including your mobile telephone number, when you choose to sign up to receive SMS messages.

Other Sources
We may collect or receive information about you from other sources like third-party information providers. We use this information along with information you provide us directly.

What do we use your personal information for? 

The main use of the information we collect and store is to provide better Services, but there are other uses as well. We use personal data that we collect about you for the following purposes:

• to operate, improve and optimize our Services based on your information and feedback;
• to personalize our Services to you;
• to provide technical support and respond to your inquiries;
• to protect the safety and well-being of our users;
• to protect our rights and property in connection with our Services;
• to prevent fraud or potentially illegal activities, and to enforce our Terms of Service;
• to manage and deliver contextual and behavioural advertising;
• to administer rewards, surveys, sweepstakes, contests, or other promotional activities or events sponsored or managed by us or our business partners;
• to comply with our legal obligations, resolve any disputes we may have with you, and to enforce our agreements with third parties; and
• to conduct research.

One important use of your information is communication. If you have provided your e-mail address to us, we will use it to respond to customer support inquiries, and keep you informed of your activity. We may also send promotional e-mail messages and promotional SMS messages (e.g. text messages) ("Promotional Communications") directly or in partnership with other parties, in accordance with your marketing preferences. Each Promotional Communication will offer you choices about receiving additional messages. Receipt of such communications depends on us having certain contact information from you.

EEA Residents: For individuals who reside in the European Economic Area (including the United Kingdom) or Switzerland (collectively “EEA Residents”), pursuant to Article 6 of the EU General Data Protection Regulation (GDPR) or any equivalent legislation (collectively “EEA Data Protection Law”), we process this personal information based on our contract with you to comply with our legal obligations, to satisfy our legitimate interests as described above and to satisfy on your consent.

How We Share Your Information

We may disclose or publish aggregated information and other non-personal information about our customers for industry analysis, demographic profiling, marketing, analytics, advertising, and other business purposes.

In addition, we may share your information (which may include personal information) with third parties (in other words, parties other than us) or allow third parties to collect this information from our Services in the following circumstances:

Your Consent
By using our site, providing personal information and/or using any of our products or services, you agree that you consent to our privacy policy, as updated from time to time. With your consent, we may share your information with third parties or allow them to collect your information from our Services in some ways not specifically described in this Privacy Policy.

Third-Party Advertising Including Tailored Advertising and Analytics
We have advertising on our Services so we can continue to offer many of our Services for free.

We do not actively share personal information with third-party advertisers for their direct marketing purposes unless you give us your consent.

When advertisers or ad networks place ads in our Services, they may collect or we may share the following types of information from within our Services:

• performance data (like the number of clicks on an advertisement);
• aggregated and/or de-identified information about you and other players collectively that is not intended to specifically identify you (like people between the ages of 30 and 45);
• certain technical information

The information collected may be used to:

• measure how effective ads are, to offer you targeted advertising in order to personalize your experience by showing you advertisements for products and services that are more likely to appeal to you (a practice known as behavioural advertising), and/or
• undertake web analytics (like Google Analytics which is used to analyse traffic and other player activity to improve your experience).

Advertisers or ad networks may collect this information through the use of tracking technologies like browser cookies and web beacons, and they may use a single tracking technology or multiple tracking technologies at the same time.

Please note, after clicking on a third-party advertisement, you may no longer be on a site hosted by us.

Safety, Security and Compliance with Law
Your information, and the contents of all of your online communications in our Services and between You and us may be accessed and monitored as needed to provide our Service and may be disclosed:

• when we have a good faith belief that we have to disclose the information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, or legal process (for example, a court order, search warrant or subpoena);
• to satisfy any laws or regulations that apply;
• where we believe in our sole discretion that the Service is being used in committing a crime, including to report such criminal activity or to share information with other companies and organizations for the purposes of fraud protection, credit risk reduction, and other security precautions;
• when we have a good faith belief that there is an emergency that poses a threat to the health and/or safety of you, another person or the public generally; and
• to protect the rights or property of us and other applicable third parties, including to enforce our Terms of Services.

Third-Party Service Providers
We will share your information with third-party companies to perform services on our behalf, like processing payments, analysing data, e-mail delivery, hosting services, customer service and to help us in our marketing efforts, including managing and delivering contextual and tailored advertisements. We contractually require these third-party service providers to maintain the confidentiality of the information we share with them, and we contractually require them not use your information for anything other than to provide services on our behalf.

Sale or Merger
In the event that we undergo a business transition (including proposed transactions), like a merger, acquisition by another company, or sale of all or part its assets, we may disclose or transfer all of your information, including personal information, to the successor organization in the transition. We will make reasonable efforts to let you know of the business transition before transferring your personal information.

Accessing and Updating Your Information Held by us
If you want to review, delete, or change the information we have about you or have additional questions, e-mail us. To protect the integrity and security of the information we hold, we may ask that you follow a defined access procedure, which may include steps to verify your identity. In certain cases we may charge you an administration fee for providing you with access to the information you have asked for, but we will inform you of this before proceeding. There may be cases where we are unable to provide the information you request, such as where it would interfere with the privacy of others or result in a breach of confidentiality. In these cases we will let you know why we cannot comply with your request.

Even if you do not request access to and/or correct your personal data held by us, if we are satisfied that, having regard to the reasons for which we hold your personal data, that personal data is inaccurate, incomplete, out-of-date, irrelevant or misleading, we may take reasonable steps to correct that data.

Stopping Use of Your Information
If you no longer want us to make active use of your information, you may send an e-mail to Us. Place "Delete My Account" in the subject line and include your first name, last name, e-mail address from which you access our Services (if applicable) in the body of the e-mail. Please note that certain records, for example those relating to payments or customer service matters, will be held for legal and accounting purposes. If you have sent content through or posted content on the Service, we may not be able to delete it.

Opting Out of Promotional Emails from us
If you want to stop receiving promotional e-mails from EXJ, click on the "unsubscribe" link in any promotional email from EXJ. Please note that once we receive your request, it may take an additional period of time for your opt-out to become effective. Your decision to unsubscribe or e-mail preference change will be processed promptly.

Opting Out of Cookie Tracking

You can set your web browser to warn you about attempts to place cookies on your computer or limit the type of cookies you allow. Flash cookies operate differently than browser cookies and cookie management tools available in a web browser may not remove flash cookies.

Privacy Policies of Linked Third-Party Services and Advertisers

Our websites may contain advertisements from Third-Party Services, which are companies other than us that may link to their own websites, online services or mobile applications. These Third-Party Services have separate and independent privacy policies. Further, we do not verify their content. We therefore have no responsibility or liability for the private practices, content and/or activities of these Third-Party Services.  Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these Third-Party Services.  

If you have any questions about how these Third-Party Services use your information, you should review their policies and contact them directly.

How Long We Keep Your Information

How long we retain your information depends on why we collected it and how we use it. We will not retain your personal information for longer than is necessary for our business purposes or for legal requirements. For instance, we may retain some information for a few years after you have closed your EXJ Account with us if this is necessary to meet our legal or regulatory obligations or to exercise, defend or establish legal rights.

Security of Your Information

We implement security measures to help protect the security of your information both online and offline. We take steps to ensure that your data is treated securely and in accordance with this Privacy Policy. These measures vary based upon the sensitivity of your information.

If you have an account registered directly with us, your profile information is protected by the password you use to access your EXJ account. It is important that you protect and maintain your EXJ account’s security and that you immediately tell us of any unauthorized use of your EXJ account. If you forget the password to your EXJ account, the Service allows you to request that instructions be sent to you that explain how to reset your password. We urge you to log out of your EXJ account after you use it.

When you sign into your EXJ account or enter payment information, we or our third-party payment processor use encryption to transmit that information. While we take precautions against security breaches of our Services and our customer databases and records, no website or Internet transmission is completely secure. We cannot guarantee that unauthorized access, hacking, data loss, or other breaches will never occur, and we cannot guarantee the security of your information while it is being transmitted to our Service. Any transmission is at your own risk.

Changes to Our Privacy Policy

We may make changes to this policy from time to time, to take into account changes to our standard practices and procedures or where necessary to comply with new laws and regulations.  If we decide to make material changes to our Privacy Policy, we will tell you and other players by placing a notice on the Website or by sending you a notice to the e-mail address we have on file for you prior to the change becoming effective. You should periodically check the Website and this privacy page for updates.

European Economic Area Users & Data

If you are a resident of the European Economic Area (the “EEA”), the Company is the controller with respect to your personal information. We determine the means and purposes of processing data in relation to e-wallet and cryptocurrency transactions.

Legal bases for processing personal information

Our legal bases for processing under General Data Protection Regulation are described above in the sections entitled “What do we use your personal information for?”. We may process your personal information if you consent to the processing, to satisfy our legal obligations, if it is necessary to carry out our obligations arising from any contracts we entered with you, or to take steps at your request prior to entering into a contract with you, or for our legitimate interests to protect our property, rights or safety of the Company, our customers or others.

Direct Marketing

If you are a current customer residing in the EEA, we will only contact you by electronic means (email) with information about our services that are similar to those which were the subject of a previous sale or negotiations of a sale to you.

If you are a new customer and located in the EEA, we will contact you if you are located in the EU by electronic means for marketing purposes only if you have consented to such communication. If you do not want us to use your personal information in this way, or to pass your personal information on to third parties for marketing purposes, please contact us to opt-out immediately. You may raise such objection with regard to initial or further processing for purposes of direct marketing, at any time and free of charge. Direct marketing includes any communications to you that are only based on advertising or promoting products and services]

Individual Rights

EEA residents have the following rights, which can be exercised by contacting us at [e-mail] so that we may consider your request under applicable law.

All EEA users will have the following rights which can be exercised anytime by contacting us:

• Right to withdraw consent. You have the right to withdraw your consent to the processing of your personal information collected on the basis of your consent at any time. Your withdrawal will not affect the lawfulness of the Company’s processing based on consent before your withdrawal.

• Right of access to and rectification of your personal information. You have a right to request that we provide you a copy of your personal information held by us. This information will be provided without undue delay subject to some fee associated with gathering of the information (as permitted by law), unless such provision adversely affects the rights and freedoms of others. You may also request us to rectify or update any of your personal information held by the Company that is inaccurate. Your right to access and rectification shall only be limited where the burden or expense of providing access would be disproportionate to the risks to your privacy in the case in question, or where the rights of persons other than you would be violated.

• Right to delete. You have the right to request deletion of your personal information that: (a) is no longer necessary in relation to the purposes for which it was collected or otherwise processed; (b) was collected in relation to processing that you previously consented, but later withdraw such consent; or (c) was collected in relation to processing activities to which you object, and there are no overriding legitimate grounds for our processing. If we have made your personal information public and are obliged to delete the personal information, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other parties that are processing your personal information that you have requested the deletion of any links to, or copy or replication of your personal information. The above is subject to limitations by relevant data protection laws.

• Right to data portability. If we process your personal information based on a contract with you or based on your consent, or the processing is carried out by automated means, you may request to receive your personal information in a structured, commonly used and machine-readable format, and to have us transfer your personal information directly to another “controller”, where technically feasible, unless exercise of this right adversely affects the rights and freedoms of others. A “controller” is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of your personal information.

• Right to restriction of or processing. You have the right to restrict or object to us processing your personal information where one of the following applies:

(a) You contest the accuracy of your personal information that we processed. In such instances, we will restrict processing during the period necessary for us to verify the accuracy of your personal information.

(b) The processing is unlawful and you oppose the deletion of your personal information and request the restriction of its use instead.

(c) We no longer need your personal information for the purposes of the processing, but it is required by you to establish, exercise or defence of legal claims.

(d) You have objected to processing, pending the verification whether the legitimate grounds of the Company’s processing override your rights.

Restricted personal information shall only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. We will inform you if the restriction is lifted.

• Notification of deletion rectification and restriction. We will communicate any rectification or deletion of your personal information or restriction of processing to each recipient to whom your personal information has been disclosed, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients if you request this information.
• Right to object to processing. Where the processing of your personal information is based on consent, contract or legitimate interests you may restrict or object, at any time, to the processing of your personal information as permitted by applicable law. We can continue to process your personal information if it is necessary for the defence of legal claims, or for any other exceptions permitted by applicable law.
• Automated individual decision-making, including profiling. You have the right not to be subject to a decision based solely on automated processing of your personal information, including profiling, which produces legal or similarly significant effects on you, save for the exceptions applicable under relevant data protection laws.
• Right to lodge a complaint. If you believe that we have infringed your rights, we encourage you to contact us first at [e-mail] so that we can try to resolve the issue or dispute informally. You can also complain about our processing of your personal information to the relevant data protection authority. You can complain in the EU member state where you live or work, or in the place where the alleged breach of data protection law has taken place. In the UK, the relevant data protection authority is the Information Commissioner's Office (ICO).

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, [e-mail].

• Storage of your personal information. The Company will try to limit the storage of your personal information to the extent that storage is necessary to serve the purpose(s) for which the personal information was processed, to resolve disputes, enforce our agreements, and as required or permitted by law.

Your rights to personal information are not absolute. Access may be denied when:

• Denial of access is required or authorized by law;
• Granting access would have a negative impact on other's privacy;
• To protect our rights and properties; and
• Where the request is frivolous or vexatious.

Complaints

We try to meet the highest standards in order to protect your privacy. However, if you are concerned about the way in which we are managing your personal data and think we may have breached any applicable privacy laws, or any other relevant obligation, please contact us by using the contact details set out below. We will make a record of your complaint and refer it to our internal complaint resolution department for further investigation. We will deal with the matter as soon as we can, and keep you informed of the progress of our investigation.

If we have not responded to you within a reasonable time or if you feel that your compliant has not been resolved to your satisfaction, you are entitled to make a complaint to the Hong Kong Privacy Commissioner for Personal Data.