Privacy Policy

OKNexus Exchange is a digital asset trading platform operated by Legal entity name, registered at Registered address ('OKNexus', 'we', 'us'). We are the controller of the personal information described in this policy.

This policy explains what we collect when you use oknexusexchange.com and the OKNexus platform, why we collect it, who we share it with, and the choices you have. Questions about it can go to privacy@oknexusexchange.com or through the Help Center in your account.

When you open an account we collect your email address and, optionally, your name. If you set a password we store only a one-way hash of it, never the password itself.

If you sign in with a social provider such as Google, that provider sends us your email address, your name, your profile picture and an account identifier. We do not receive your password for that provider, and we do not gain access to anything else in your account there.

If you turn on two-factor authentication we store the shared secret for your authenticator app in encrypted form.

When you contact support, subscribe to the newsletter, or send messages to a counterparty in a peer-to-peer trade, we keep the content of those messages.

Financial regulation requires us to verify who our customers are before they can trade at higher limits. Identity verification is carried out through our verification partner, Didit, which collects and checks your documents directly.

Depending on your country, that may include:

• A government-issued identity document and a photograph or short video of your face, used to confirm the document belongs to you.
• Your full legal name, date of birth, nationality and country of residence.
• In Nigeria, your National Identification Number (NIN) or Bank Verification Number (BVN), checked against the issuing database.
• The result of anti-money-laundering, sanctions and politically-exposed-person screening.

We receive and store the outcome of that process together with a limited set of fields: your legal name, country, identity document number, verification status, the date it was reviewed, and the reference for the verification session. Where a case is flagged for manual review, a member of our compliance team will look at it.

Operating an exchange means keeping a complete and accurate record of activity on your account. We hold:

• Wallet balances and a full ledger of every credit, debit and locked amount.
• Orders, trades, instant swaps, buy and sell transactions, OTC quotes and peer-to-peer orders, including amounts, assets, prices, fees and timestamps.
• Deposit addresses issued to you, together with on-chain deposits and withdrawals and their transaction hashes.
• For fiat withdrawals, the bank country, bank name, bank code, account number and the account holder name returned by the payout provider.
• Notifications, price alerts and staking positions you create.

Each time you sign in we record the time, your IP address and your browser's user agent string, and show that history back to you under Settings, Security, so you can spot a sign-in you do not recognise. We also use this information to detect automated attacks and to rate-limit sign-in and verification attempts.

We do not use advertising networks, analytics services, tracking pixels or third-party cookies. The only cookies we set are the ones the platform needs to work:

• A session cookie that keeps you signed in.
• Short-lived cookies that protect sign-in forms against cross-site request forgery and that carry the state of a social sign-in while it is in progress.
• A short-lived cookie that holds a pending two-factor challenge after you sign in with a social provider.

Your light or dark theme preference is stored in your browser and never sent to us.

• To open and operate your account, execute your transactions and maintain your balances.
• To meet our legal obligations, including customer due diligence, sanctions screening, transaction monitoring, record keeping and reporting to competent authorities.
• To protect your account and the platform: authentication, two-factor verification, fraud and abuse detection, and investigating disputes.
• To communicate with you about your account, security events and transactions, and, if you have asked for it, about products and news.
• To resolve peer-to-peer disputes, which may involve a member of staff reading the messages and evidence exchanged in that trade.
• To understand and improve how the platform is used, and to produce internal and regulatory reporting.

Where data protection law applies to you, we rely on the performance of our contract with you, compliance with a legal obligation, our legitimate interest in securing and improving the platform, and, for marketing messages, your consent.

We do not sell your personal information. We share it only with the parties below, and only as far as each of them needs it:

• Didit, our identity verification and anti-money-laundering partner, which processes your documents and screening.
• Bitnob, our payout partner, which receives the bank details and amount needed to send a fiat withdrawal.
• Turnkey and the blockchain infrastructure providers we use to derive addresses and broadcast transactions.
• Resend, which delivers our transactional email such as verification codes and security notices.
• Peer-to-peer counterparties, who see the display name, payment details and messages you choose to share within a trade.
• Regulators, law enforcement and courts, where we are legally required or permitted to disclose.
• Professional advisers, auditors and any party involved in a corporate transaction, under confidentiality obligations.

Market prices shown on the platform are sourced from public exchange data feeds. No personal information is sent to those feeds.

When you deposit or withdraw crypto, that transaction is written to a public blockchain. It is visible to anyone, it cannot be edited, and it cannot be deleted, by us or by you. Anyone who can connect a blockchain address to your identity may be able to see the transactions associated with it. Please keep that in mind before sending funds.

Our service providers operate in a number of countries, so your information may be transferred outside the country you live in. Where the law requires it, we put appropriate safeguards in place, such as standard contractual clauses, before transferring personal information abroad. Details of the safeguards used are available on request.

We keep your account information for as long as your account is open. After it closes, anti-money-laundering law requires us to keep your identity records and transaction history for a further period, generally at least five years, and longer where an investigation or legal claim is ongoing. The exact period that applies to us is Retention period per applicable law.

Records that we are not required to keep are deleted or anonymised once they are no longer needed.

All traffic to the platform is encrypted in transit. Passwords are stored as salted one-way hashes and two-factor secrets are encrypted at rest. We support app-based two-factor authentication, we rate-limit sign-in and verification attempts, and you can sign out of every device at once from Settings, Security, which immediately invalidates all existing sessions.

No system is completely secure. Please use a unique password, turn on two-factor authentication, and tell us straight away if you think someone else has access to your account.

Depending on where you live, you may have the right to ask us for a copy of your personal information, to correct it, to delete it, to receive it in a portable format, to object to or restrict certain uses, and to withdraw consent you have given.

You can unsubscribe from marketing email at any time using the link in the message. Requests to delete your information are subject to the record-keeping obligations described above: we cannot delete records that the law requires us to keep, and we cannot remove a transaction that has already been written to a blockchain.

To exercise a right, contact privacy@oknexusexchange.com. You also have the right to complain to your local data protection authority.

The platform is not for anyone under 18. We do not knowingly collect information from children, and we will close any account we find belongs to one.

We may update this policy as the platform and the law change. The date at the top always shows the current version, and we will notify you of a significant change by email or a notice in the app before it takes effect.