Legal

Privacy Policy

Last updated: March 2025Convexo SAS

1. Introduction

Convexo SAS ("Convexo", "we", "us", or "our") is committed to protecting the personal information of its users. This Privacy Policy describes how we collect, use, share, and safeguard the information you provide when accessing or using the Convexo platform at pay.convexo.xyz (the "Platform").

By creating an account or using our services, you acknowledge that you have read and understood this Privacy Policy and agree to the processing of your personal data as described herein. If you do not agree, you must discontinue use of the Platform immediately.

This policy is subject to applicable Colombian data protection law (Law 1581 of 2012 and Decree 1377 of 2013), as well as any other applicable international regulations.

2. Information We Collect

We collect information you provide directly, including: full name, national identification number (NIN/CC/CE/Passport), email address, phone number, company name, tax identification number (RUT/NIT), residential and business address, and bank account details required for payment processing.

We also collect identity verification documents, including government-issued photo ID and RUT certificates issued by the DIAN. These are necessary to comply with our Anti-Money Laundering (AML) and Know Your Customer (KYC) obligations.

We automatically collect technical information such as IP address, browser type, operating system, device identifiers, and usage logs when you interact with the Platform. This data is used to maintain security and improve service quality.

Blockchain transaction data — including wallet addresses and on-chain activity — may be collected when you use USDC wallet or OTC services. This data is inherently public on the blockchain and is treated in accordance with its public nature.

3. How We Use Your Information

We use your personal data to: create and maintain your account; process payment and collection orders on your behalf; comply with legal and regulatory obligations including AML/CFT requirements; verify your identity before granting full access to the Platform; communicate important service updates, transaction confirmations, and alerts.

We may also use aggregated, anonymized data for product development, business intelligence, and improving the Platform's features. This data does not identify any individual user.

We do not use your personal data for automated decision-making or profiling that produces legal effects without human oversight.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We share your data only in the following limited circumstances:

Service Providers: We engage trusted third-party providers (including authentication services, cloud infrastructure, and email services) who process data on our behalf under strict confidentiality agreements.

Legal Obligations: We may disclose information to regulatory authorities, law enforcement, or government bodies when required by applicable law, court order, or to protect the rights, property, or safety of Convexo, our users, or the public.

Corporate Transactions: In the event of a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you prior to any such transfer.

5. Data Security

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include end-to-end encryption for sensitive transmissions, role-based access controls, regular security audits, and secure infrastructure hosted by certified cloud providers.

Despite our best efforts, no system is completely secure. We cannot guarantee absolute security of your data. In the event of a data breach that affects your rights and freedoms, we will notify you promptly in accordance with applicable law.

6. Your Rights

Under Colombian data protection law and applicable regulations, you have the right to: access a copy of the personal data we hold about you; request correction of inaccurate or incomplete data; request deletion of your data, subject to legal retention requirements; object to processing for marketing purposes; withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at the address provided in Section 9. We will respond to your request within the timeframe established by applicable law.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Following account closure, we retain certain data for a minimum of five (5) years to comply with AML/CFT regulatory requirements and applicable accounting obligations.

Identity verification documents and transaction records are retained for the period required by Colombian financial regulations and the applicable FATF recommendations.

8. Cookies

The Platform uses strictly necessary cookies to maintain your authentication session and language preference (NEXT_LOCALE). We do not use tracking, advertising, or analytics cookies. No third-party cookies are placed on your device through our Platform.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If changes are material, we will notify you via email or a prominent notice on the Platform. Continued use of the Platform after changes constitutes acceptance of the updated policy.

10. Contact

For questions, requests, or complaints regarding your personal data, please contact our Data Protection Officer at: legal@convexo.xyz. You may also submit a written request to: Convexo SAS, [Address to be completed], Colombia.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Superintendencia de Industria y Comercio (SIC), the Colombian data protection authority.