> For the complete documentation index, see [llms.txt](https://info.xrex.io/xrex-general-terms-and-conditions/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://info.xrex.io/xrex-general-terms-and-conditions/xrex-taiwan-lian-ke-gu-fen-you-xian-gong-si/xrex-taiwan-user-legal-agreements/xrex-exchange-privacy-policy.md). # XREX Exchange Privacy Policy Effective Date: October 20, 2026 | Version No.: PE\_TW\_20261020 Welcome to the XREX Taiwan virtual asset trading platform ( and the XREX cryptocurrency exchange app, hereinafter referred to as the "Exchange" or "XREX Exchange"） provided by XREX Inc. (i.e. 鏈科股份有限公司, hereinafter referred to as the "Company"). The Company is committed to strictly protecting your data and privacy in accordance with the applicable law. To ensure that you can safely use the services and information provided by the XREX Exchange, we hereby set our Privacy Policy (hereinafter referred to as the "Policy") to protect your rights. By starting to use the relevant functions of XREX Exchange or providing your personal data to the Company, you acknowledge that you have read and agreed to this Policy: Article 1: Scope of the Privacy Policy This Policy covers how XREX Exchange collects, processes, uses and internationally transfers personal data provided by you when using the Exchange’s services. However, this Policy does not apply to external websites linked from the Exchange, nor does it apply to personnel who are not commissioned by, or involved in the management of the Exchange. Article 2: Collection, Processing, and Use of Personal Data The Company will collect, process, use and internationally transfer your personal data within the scope of the specific purposes set forth in this Policy, as permitted by law, as required by competent authorities or judicial authorities, as necessary for the performance of contracts or provision of services, legal compliance, risk control, anti-fraud, dispute resolution or other reasonable and necessary purposes. Except as set forth in this Policy or as permitted by law, the Company will not use your personal data beyond the necessary scope of the specific purposes. 1. Categories of Personal Data Collected 1. When you participate in online activities or surveys, visit the website, register as an individual account holder, or use the functions and services provided by XREX Exchange, the Company may request that you provide necessary personal data, including but not limited to your name, address, date of birth, national identification number or Alien Resident Certificate number, passport number, nationality and supporting documents, email address, telephone number, telephone or utility bills, occupation, proof of financial resources, or bank account information. 2. When registering as a corporate account holder, the Company will collect relevant information, including information on the legal representative, beneficial owners, shareholder register, transaction agents, business licenses or permits, and proof of actual operations. 3. When you search or browse on XREX Exchange, the server will automatically retain relevant records, including the IP address of the device used for connection, time of use, browser used, and browsing and clickstream records, as reference materials for improving the Exchange’s services. 4. For the purposes of providing XREX Exchange services and handling operations related to virtual asset transactions, fiat currency deposits and withdrawals, services interfacing with cooperating institutions, accounting, reconciliation, legal compliance, risk control and anti-fraud, the Company may also collect, process and use data related to the foregoing operations, including but not limited to information of persons related to transactions or fund flows, transaction counterparties, account holders or other necessary related persons, transaction amount, currency, transaction purpose, transaction records, paying or receiving bank accounts, remittance or transfer instructions, transaction notes, processing status, accounting and reconciliation records, source of funds, source of assets, transaction background, sanctions screening results, risk assessment results, supplementary document submission and review records, login records, operation records, IP address, device identifiers, cookies, SDKs or other online identifiers. 5. When processing a virtual asset transfer, the Company may also, depending on the value of the transfer, whether the originator or beneficiary is a natural person or legal entity, and applicable legal requirements, collect the name of the originator and beneficiary, date of birth, residential address, country and city of residence, official identification number, registered address, country and city of registration, information relating to the wallets from and to which the virtual assets are transferred (including wallet addresses, account identifiers or other identifying information), and other information required by applicable laws for processing the virtual asset transfer. Such information may be provided by you, a person related to the transaction or another virtual asset service provider, and may be obtained through an information transmission mechanism used in accordance with applicable laws. 6. **Third-Party Data**: If, in connection with your use of XREX Exchange services, virtual asset transactions, withdrawals, fiat currency deposit and withdrawal operations, or functions related to services interfacing with affiliates, cooperating financial institutions or other cooperating institutions, you provide data of a third party, including but not limited to data of recipients, beneficiaries, transaction counterparties, legal representatives, beneficial owners, agents or other transaction-related persons, you shall confirm that you have lawful authority or an appropriate basis to provide such data to the Company. The Company may collect, process and use such data within the reasonable and necessary scope of providing XREX Exchange services, transaction processing, support for or interfacing with fiat currency deposit and withdrawal operations, legal compliance, risk control, anti-fraud, dispute resolution or other reasonable and necessary purposes. 2. Purposes of Collection\ The Company will collect, process, use and internationally transfer your personal data within the scope of the specific purposes set forth in this Policy, as permitted by law, as required by competent authorities or judicial authorities, as necessary for the performance of contracts or provision of services, legal compliance, risk control, anti-fraud, dispute resolution or other reasonable and necessary purposes. 1. Personal data collected during registration is used by the Company to perform statutory obligations such as customer identification and verification, customer due diligence and transaction monitoring, and to contact you. The foregoing statutory obligations also include periodic review of existing users, data updates, reverification and related compliance review procedures. 2. To comply with laws and regulations relating to anti-money laundering, countering the financing of terrorism, anti-fraud and other financial crime prevention, and to meet the Company’s needs for risk control and industry joint defense, the personal data collected by the Company may also be used for risk assessment, detection of suspicious or abnormal conduct, investigation, dispute resolution and necessary compliance operations. 3. For various online activities, such personal data will be used for reviewing activity eligibility, responding to inquiries, notifying lottery or prize results, and conducting commercial and market analysis. 4. To provide more accurate and smoother services, the Company will conduct statistical analysis of the collected survey content. The analysis results may be used for internal research and may be publicly disclosed as necessary, provided that the data has been processed by the provider or disclosed by the collector in a manner that does not allow identification of any specific data subject. 5. To improve overall services quality, the Company may use contact information provided by you, such as your mobile phone number or email address, to send services notifications, including security and compliance notices. 6. For the purposes of providing, processing, performing and managing XREX Exchange services, virtual asset transactions, , the collection, provision, receipt, verification, identification of anomalies and retention of virtual asset transfer information, fiat currency deposits and withdrawals, handling of transaction-related funds, services interfacing with cooperating institutions, accounting, reconciliation, refunds, returns, dispute resolution, customer services, system maintenance, information security, legal compliance, risk control, anti-fraud, sanctions screening, transaction monitoring, customer identification and verification, customer due diligence, ongoing review, including periodic review and ad hoc review, anti-money laundering and countering the financing of terrorism, the Company may collect, process, use and internationally transfer your personal data within the necessary scope. 7. To provide or support products, services or related operations jointly carried out, allocated or interfaced among the Company and its affiliates or cooperating institutions, the Company may, within the necessary scope, provide your personal data to the Company’s affiliates for product interfacing, services provision, operational support, customer services, accounting, reconciliation, legal compliance, risk control, anti-fraud or dispute resolution. 8. The Company may also use the personal data provided by you, including but not limited to your name, email address and telephone number, for marketing and advertising purposes, and may provide such data to third-party marketing companies or platforms to assist in promoting the services, products or offers of the Company or its partners. To assist in the implementation of the foregoing marketing and promotional activities, the Company may commission or cooperate with third parties that provide marketing, advertising placement, performance analysis or customer relationship management (CRM) services, and may provide necessary data to them for processing within the necessary scope of the purposes. 3. Period\ To comply with legal requirements and achieve the purposes of collection, including but not limited to customer identification and verification, customer due diligence, transaction monitoring, ongoing review of existing users, anti-fraud, industry joint defense, accounting, dispute resolution and necessary compliance operations, the Company may retain your personal data, transaction details and necessary records relating to notifications, supplementary document submissions, reviews, investigations, inquiries, reports, complaints or dispute resolution during the services period and for the statutory period after termination of the services. 4. Territory\ Taiwan, the locations of the Company’s affiliates, the locations of cooperating financial institutions or banks, the locations of cloud services, information systems, customer services, legal compliance, risk control or other commissioned services providers, and any territories necessary for providing the Exchange’s services, virtual asset transactions, fiat currency deposits and withdrawals, handling of transaction-related funds, services interfacing with cooperating institutions, accounting, legal compliance, risk control, anti-fraud or dispute resolution. 5. You may choose whether to provide personal data. However, if you refuse to provide personal data, the Company may be unable to perform necessary reviews and processing, and therefore may be unable to provide relevant services to you or may reject your applications and rights claims relating to transactions, services or related activities. 6. If you refuse to receive marketing or advertising information from the Company or third-party services providers commissioned by the Company, you may at any time contact our customer services team through the in-app Help Center to request “marketing opt-out.” Article 3: Data Protection 1. The Company adopts information security protection mechanisms consistent with industry standards, including access controls, encryption for data transmission and storage, and network security safeguards, to protect the Platform and your personal data. Access is limited to authorized personnel or commissioned third parties within the scope necessary for business purposes, and all such parties are bound by strict confidentiality obligations. 2. If it becomes necessary to engage a third party to provide services for business purposes, the Company will require such third party to comply with confidentiality obligations and will implement the necessary due diligence or management procedures to reasonably verify its compliance with the Personal Data Protection Act and relevant legal provisions. 3. When the Company provides or exchanges data externally for legal compliance, anti-fraud, industry joint defense or cooperation with inquiries from competent authorities, the Company will, to the extent of its internal procedures, adopt appropriate security measures to reduce the risk of unauthorized access to or leakage of data during transmission or processing. 4. In the event of theft, leakage, alteration, damage, loss or other personal data security incidents involving personal data, the Company will adopt necessary response measures in accordance with applicable laws and regulations, and will make relevant notifications to data subjects or reports to competent authorities when required by law. Article 4: External Links XREX Exchange provides links to other external websites. You may access other external websites through links provided by the Exchange. However, such external websites are not subject to the Exchange’s privacy policy, and you will be bound by the privacy policies of those external websites. Article 5: Processing, Use and Third-Party Disclosure of Personal Data 1. Processing and Use Within the Necessary Scope of the Specific Purposes of Collection\ The Company may process and use your personal data within the necessary scope of the purposes of collection and the period, territory, recipients and methods of use of personal data set forth in Article 2 of this Policy. The foregoing processing and use include storage, organization, review, comparison, transmission, commissioned processing, internal management and other reasonably necessary operations required to achieve such purposes of collection. 2. Use Outside the Specific Purposes of Collection\ Where otherwise permitted by laws or regulations, or where any of the following circumstances applies, the Company may use your personal data outside the specific purposes within the necessary scope: 1. Where expressly provided by law; 2. Where necessary to promote public interests; 3. Where necessary to prevent danger to your or a third party’s life, body, freedom or property; 4. Where necessary to prevent material harm to the rights and interests of others; 5. Where a government agency or academic research institution needs the data for statistics or academic research based on public interest, and the data has been processed or disclosed in a manner that does not allow identification of any specific data subject; 6. Where you have given consent; 7. Where it benefits your rights and interests; 8. Other circumstances where processing or use outside the specific purposes is permitted under the Personal Data Protection Act or relevant laws and regulations. 3. Third-Party Disclosure\ The Company may, within the necessary scope of the purposes of collection set forth in Article 2 of this Policy, or where a statutory ground for use outside the specific purposes under the preceding paragraph applies, disclose or provide your personal data to the following recipients: 1. Judicial, tax, competent, law enforcement or other government authorities that are legally entitled to request such data; 2. The Company’s affiliates; 3. Cooperating financial institutions, banks, financial institutions related to receipts and payments, domestic or foreign virtual asset service providers that are duly registered, established or regulated (including those acting as the originating or beneficiary VASP in a virtual asset transfer), or other cooperating institutions necessary for providing the Exchange's services, transaction processing, the provision, receipt or verification of virtual asset transfer information, fiat currency deposits and withdrawals, accounting, reconciliation, legal compliance, risk control, anti-fraud, dispute resolution or services interfacing with cooperating institutions; 4. Third-party services providers commissioned by the Company to process matters or provide services, including but not limited to providers of identity verification, account verification, blockchain analytics, transaction monitoring, sanctions screening, risk management, information systems, cloud services, information security, customer services, accounting, marketing and advertising, market research, legal, accounting, audit or other professional services; 5. Within the necessary scope of any merger, acquisition, business transfer, asset transfer, organizational restructuring, change of control or other similar transaction, the relevant transaction counterparties, their advisors or successor entities; 6. Other recipients to whom you have consented or to whom disclosure is permitted by law. Article 6: Use of Cookies To provide you with the best service, XREX Exchange will, by itself or through cooperating vendors, use cookies to record, access and collect data relating to your online activities. If you do not wish to accept access through cookies, you may adjust the privacy settings in your browser functions to disable cookies. However, doing so may cause certain functions of the Exchange to become unavailable or not operate properly. Article 7: Exercise of Rights 1. In accordance with the Personal Data Protection Act, you may exercise the following rights with respect to your personal data held by the Company. The Company may charge necessary costs for inquiries, requests to review personal data, or requests for copies: 1. Inquiry or request for review. 2. Request for copies. 3. Request for supplementation or correction. 4. Request to cease collection, processing or use. 5. Request for deletion. 2. If the Company conducts marketing to you in accordance with the Personal Data Protection Act or this Policy, you may at any time request to stop receiving marketing information in the manner set forth in this Policy. However, the foregoing “marketing opt-out” applies only to the cessation of marketing and advertising promotional messages. Notifications required by laws or regulations, competent authorities, or necessary for the provision of services, such as transaction, accounting, security or compliance notifications, are not subject to such opt-out. Article 8 Amendments to the Policy The Company reserves the right to amend this Policy at any time. Any amendment will be published on the Company’s website, and the last updated date will be stated at the top of this Policy. If you do not agree to the amended content of this Policy, please contact the Company’s customer service personnel so that they may assist with subsequent handling and protect your rights and interests. Article 9: Severability If any part of this Policy is held to be invalid or unenforceable, the remaining parts will remain valid. Article 10: Force Majeure Clause The Company shall not be liable for damages for any cause or circumstance beyond its reasonable control that directly or indirectly results in any delay, failure of performance or interruption of the Services, including but not limited to interruptions of telecommunications, network services or internet service providers, hardware, firmware or software failures, war, riot, embargo, strike or other labor dispute, typhoon, flood, fire, earthquake, cyberattack, blockchain validation congestion or rapid fluctuation in the price of any virtual asset, other disasters or any other events beyond reasonable control. Article 11: Governing Law and Dispute Resolution This Policy shall be governed by the laws of Taiwan. Any dispute, controversy or issue arising out of or in connection with this Policy, including any issue concerning breach, termination or invalidity of this Policy, shall be subject to the Taiwan Taipei District Court as the court of first instance by agreement.