Privacy Policy

This Privacy Policy describes how Banyx Capital LLC (“Banyx Capital”, “we”) collects, uses, shares and protects personal information of prospective and current clients (the “Client”, “you”) of its over-the-counter digital asset brokerage services (the “Services”). It applies wherever you interact with us - the client portal, onboarding flow, email, telephone, trade tickets and compliance correspondence. It should be read together with our Terms of Service.

• Onboarding & identity verification - to determine eligibility, verify your identity, and screen for sanctions, PEP and adverse media exposure.
• Transaction execution & settlement - to quote, execute, confirm and settle trades, and to route funds to and from your approved wallets and bank accounts.
• Regulatory compliance - to comply with anti-money-laundering, counter-terrorist-financing, tax reporting and recordkeeping obligations, including the filing of Suspicious Activity Reports where required by law.
• Client servicing - to respond to inquiries, issue statements, produce trade confirmations and tax documents, and to personalize portal content to your account.
• Risk management - to monitor for fraud, credit risk, concentration risk, and operational risk across our book.
• Service improvement - to diagnose errors, improve performance, and design new products. We do not build advertising profiles.

Where the General Data Protection Regulation or the UK GDPR applies to our processing, we rely on the following lawful bases: (a) performance of a contract (onboarding, execution, settlement, servicing); (b) compliance with a legal obligation (KYC/AML, sanctions screening, tax reporting, recordkeeping); (c) our legitimate interests (fraud prevention, risk management, information security, product improvement); and (d) your consent, where collected separately (for example, for optional marketing communications).

The Services are operated from the United States. Where we transfer personal information out of the EEA, the UK or Switzerland to a country that is not the subject of an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (together with the UK International Data Transfer Addendum where applicable) and implement supplementary technical measures including encryption in transit and at rest.

We retain personal information for as long as your account is active and for the additional period required by applicable law. In particular:

• KYC / KYB records, trade confirmations, and supporting compliance documentation: five (5) years after the end of the client relationship, in line with U.S. BSA recordkeeping rules.
• Tax reporting records: until the end of the applicable statute of limitations (generally seven (7) years in the U.S.).
• Portal access logs: eighteen (18) months from the date of access.
• Marketing preferences: until you withdraw consent.

After the applicable retention period, personal information is securely deleted or irreversibly anonymized.

We implement technical and organizational safeguards designed to protect personal information, including: TLS 1.2+ in transit, AES-256 at rest for portal data, encrypted session cookies authenticated with HMAC-SHA256, bcrypt password hashing, role-based access controls for employees, least-privilege HubSpot permissions, mandatory multi-factor authentication for all staff, quarterly access reviews, and third-party penetration testing.

Depending on your jurisdiction you may have the following rights with respect to your personal information:

• Access - request a copy of the personal information we hold about you.
• Correction - ask us to correct inaccurate or incomplete information.
• Deletion - request deletion where the information is no longer necessary for the purposes for which it was collected, subject to our regulatory recordkeeping obligations.
• Restriction / objection - ask us to restrict processing or object to processing based on legitimate interests.
• Portability - request a copy of your information in a structured, commonly used format.
• Withdrawal of consent - where processing is based on consent, you may withdraw it at any time.
• Complaint - lodge a complaint with your local data protection authority (for EEA residents) or the Information Commissioner's Office (for UK residents).

To exercise these rights, email privacy@banyxcapital.com. We will respond within thirty (30) days, or inform you if we need an extension permitted by law.

Residents of California, Virginia, Colorado, Connecticut, Utah and other U.S. states with comprehensive privacy laws have additional rights, including the right to know what categories of personal information are collected, the right to opt out of profiling used for significant decisions, and the right to non-discrimination for exercising these rights. Banyx Capital does not sell or share personal information for targeted advertising as those terms are defined by those laws.

The Services are directed at institutional and accredited individual investors. We do not knowingly collect personal information from persons under the age of eighteen. If you believe we may have collected such information, contact privacy@banyxcapital.com and we will delete it.

Banyx Capital uses automated tooling (including Persona's decisioning engine and Chainalysis risk scoring) to flag high-risk identities, wallets and transactions. These outputs inform - but do not solely determine - onboarding, settlement and ongoing monitoring decisions. All material decisions (including account closure, compliance hold, and Suspicious Activity Report filings) are reviewed by trained compliance staff. You have the right to request human review of, and to contest, any such decision that significantly affects you.

We may update this Privacy Policy to reflect changes in our practices or in applicable law. Material changes will be notified to you by email and posted to the client portal no fewer than thirty (30) days before they take effect.

Banyx Capital's Data Protection Officer can be reached at privacy@banyxcapital.com or by post at Banyx Capital LLC, Attn: Privacy, 1 State Street Plaza, New York, NY 10004, United States.