UP FINANCE PRIVACY POLICY

Last Updated: Otc 8, 2025

This Privacy Policy outlines how Osmosis Limited, a company incorporated in Hong Kong and operating under the brand name UP Finance ("UP Finance", "we", "us", or "our"), collects, uses, stores, transfers, and safeguards personal data in connection with our services. This policy governs the collection and processing of personal information of individuals who access or use any aspect of the UP Finance ecosystem, including its websites, mobile applications, APIs, custodial and non-custodial wallets, card services, and virtual accounts (collectively, the "Services").

1. Data Controller

Osmosis Limited, with registered office at Flat/Rm 505, Block C, Queen's Garden, 9 Old Peak Road, Mid-Level Central, Hong Kong, acts as the data controller in relation to personal data processed under this Policy. All data-related inquiries may be directed to our appointed Data Protection Officer at legal@upfinance.ai.

2. Categories of Personal Data Collected

In the course of providing our Services, we collect and process the following categories of personal data:

Identity Information, including name, date of birth, nationality, identification documents (such as national ID or passport), and biometric identifiers (where applicable and permitted by law);
Contact Information, including physical address, email address, and telephone number;
Financial and Transactional Data, including wallet addresses, payment card details (masked or tokenized), bank account numbers, and records of fiat and crypto transactions;
Device and Technical Data, such as IP address, browser type, device identifiers, session logs, and metadata relating to the usage of the Services;
Behavioral and Analytics Data, including user interactions, clickstream behavior, support chat transcripts, and session recordings used for performance optimization and fraud prevention;
Marketing and Communication Data, such as newsletter subscriptions, preferences, and response data; and
Compliance Data, including employment background, source of funds, sanctions checks, and politically exposed person (PEP) status.

We do not knowingly collect personal data from individuals under the age of 18. If we become aware that such data has been collected, we shall promptly delete it.

3. Purposes for Processing Personal Data

We process your personal data only where it is lawful and necessary for the operation of our Services, for compliance with our legal obligations, or where we have a legitimate interest to do so. The primary purposes include:

To verify your identity and perform anti-money laundering and counter-terrorist financing screening, as required by applicable law;
To enable you to register, access, and use various components of the Services, including wallets, cards, swaps, and virtual accounts;
To monitor, detect, and investigate potentially fraudulent or suspicious behavior or violations of applicable law or our Terms of Use;
To maintain system functionality and enhance service performance through diagnostics, optimization, and analytics;
To deliver administrative and service-related communications, including policy updates, transactional alerts, and system notices;
To comply with our statutory recordkeeping, reporting, and regulatory disclosure obligations; and
To conduct automated risk assessments and eligibility determinations using tools that support fraud detection, identity verification, or customer profiling, subject to applicable safeguards.

4. Legal Basis for Processing

Our processing of personal data is based on one or more of the following legal grounds:

Where you have provided your explicit consent for a specific purpose, such as receiving marketing communications or biometric processing;
Where the processing is necessary for the performance of a contract to which you are party, including the provision of our Services;
Where the processing is required to comply with a legal obligation to which we are subject;
Where the processing is necessary to protect the vital interests of you or another natural person; and
Where the processing is necessary for the purposes of our legitimate interests, provided that such interests are not overridden by your rights or freedoms.

5. Data Retention

We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected, or to comply with legal, regulatory, and operational requirements. The retention periods we apply include:

Personal data collected for KYC and AML purposes is retained for a minimum of seven (7) years following account closure or inactivity;
Technical and session-related logs are retained for a period of thirty (30) to one hundred eighty (180) days, depending on security and operational needs;
Marketing preferences and opt-out indicators are retained indefinitely to ensure compliance with applicable marketing laws;
Customer service records and correspondence are retained for up to three (3) years following resolution, unless a longer period is required for dispute resolution or litigation.

6. Disclosure of Personal Data to Third Parties

We disclose personal data to third parties strictly on a need-to-know basis and only to the extent required for lawful and legitimate purposes. Recipients of personal data may include:

Regulated custodial partners such as Merits Bank & Trust for purposes of account safeguarding, settlement, and compliance;
Service providers performing functions on our behalf, such as KYC/AML vendors, cloud hosting platforms, analytics providers, and communication systems;
Legal, regulatory, or supervisory authorities, where disclosure is required by law, regulation, court order, or lawful request;
Professional advisors engaged in auditing, accounting, tax, or legal services pursuant to contractual confidentiality obligations.

All disclosures are subject to strict confidentiality arrangements and, where applicable, are governed by data processing agreements that reflect applicable legal standards.

7. International Transfers of Data

In certain cases, your personal data may be transferred to and processed in jurisdictions outside of your place of residence, including to countries that may not provide the same level of data protection as your home jurisdiction. In such circumstances, we implement appropriate safeguards, including:

Execution of Standard Contractual Clauses (SCCs) or equivalent legal mechanisms approved under applicable law;
Transfers to jurisdictions that have been formally recognized as providing adequate levels of data protection;
Reliance on your explicit consent, where permissible and required by law.

We ensure that any cross-border transfer of personal data is made in accordance with applicable data protection law.

8. Rights of Data Subjects

You have certain rights under applicable data protection laws with respect to your personal data. These rights may include:

The right to access and receive a copy of your personal data;
The right to request correction of inaccurate or incomplete personal data;
The right to request erasure of personal data, subject to any overriding legal retention requirements;
The right to object to or request restriction of processing in certain circumstances;
The right to data portability, where technically feasible and legally mandated;

To exercise your rights, you may contact us at legal@upfinance.ai. We reserve the right to verify your identity before responding to such requests.

9. Use of Cookies and Tracking Technologies

We use cookies and related tracking technologies to support platform functionality, perform usage analysis, and prevent fraudulent activity. You may control the use of non-essential cookies through your browser settings. Disabling certain cookies may impact the availability or functionality of the Services.

10. Security of Personal Data

We implement industry-standard technical and organizational measures designed to secure your personal data from accidental loss, unauthorized access, alteration, disclosure, or destruction. Such measures include:

End-to-end encryption for data in transit and at rest;
Role-based access controls and authentication mechanisms;
Regular vulnerability assessments and penetration testing conducted by independent auditors;
Incident response protocols, including detection, containment, and remediation processes.

While we endeavor to maintain a robust security posture, no system is immune to risk. Users are responsible for maintaining the confidentiality of their account credentials and are encouraged to notify us immediately of any suspected security incident.

11. Breach Notification

In the event that a data breach occurs and is likely to result in a high risk to your rights or freedoms, we will notify you and the appropriate supervisory authority promptly and in accordance with applicable legal obligations.

12. Updates to This Policy

We may amend this Privacy Policy from time to time to reflect changes in our legal obligations, processing activities, or Services. Any material changes will be communicated through our official channels, and the revised version will take effect upon publication. Continued use of the Services following such publication constitutes acceptance of the revised terms.

13. Regulatory Reference and Contact

UpFinance operates under the brand of UpGlobal Inc., registered with the U.S. Financial Crimes Enforcement Network (FinCEN) as a Money Services Business (MSB Reg. No. 31000308751680).

For questions about this Policy or your data rights, please email legal@upfinance.ai.