1. Introduction

Dexbit (Pty) Ltd ("Dexbit", "we", "us", or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our cryptocurrency exchange platform and related services.

This policy complies with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA") and other applicable South African data protection laws.

2. Information We Collect

2.1 Personal Information

We collect personal information that you provide directly to us, including:

• Full legal name
• Date of birth
• South African ID number or passport number
• Residential address
• Email address
• Phone number
• Bank account details
• Proof of identity documents
• Proof of address documents
• Selfie/biometric data for verification

2.2 Transaction Information

• Trading history and transaction records
• Deposit and withdrawal records
• Wallet addresses
• Order history
• Account balances

2.3 Technical Information

• IP addresses
• Device information and identifiers
• Browser type and version
• Operating system
• Login times and session data
• Cookies and similar technologies

3. How We Use Your Information

We use your personal information for the following purposes:

• Account Management: To create, maintain, and secure your account
• KYC/AML Compliance: To verify your identity and comply with regulatory requirements
• Transaction Processing: To process deposits, withdrawals, and trades
• Customer Support: To respond to inquiries and provide assistance
• Security: To detect, prevent, and investigate fraud and unauthorized activities
• Legal Compliance: To comply with applicable laws and regulatory obligations
• Communication: To send important notices, updates, and promotional materials (with consent)
• Platform Improvement: To analyze usage patterns and improve our services

4. Legal Basis for Processing

We process your personal information based on the following legal grounds under POPIA:

• Consent: Where you have given explicit consent for specific purposes
• Contract: Where processing is necessary to perform our contractual obligations
• Legal Obligation: Where processing is required by law (e.g., FICA, tax laws)
• Legitimate Interest: Where processing is necessary for our legitimate business interests

5. Information Sharing and Disclosure

We may share your personal information with:

• Service Providers: Third-party vendors who assist with KYC verification, payment processing, and platform operations
• Regulatory Authorities: Government bodies, law enforcement, and regulators when required by law
• Financial Intelligence Centre: For reporting obligations under FICA
• Banking Partners: To facilitate deposits and withdrawals
• Professional Advisors: Lawyers, auditors, and consultants bound by confidentiality

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6. International Data Transfers

Your information may be transferred to and processed in countries outside South Africa. When we transfer data internationally, we ensure adequate protection through:

• Data processing agreements with appropriate safeguards
• Transfers to countries with adequate data protection laws
• Binding corporate rules or standard contractual clauses

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations:

• Account information: Duration of account plus 5 years after closure
• Transaction records: Minimum 5 years as required by FICA
• KYC documents: Minimum 5 years after account closure
• Communication records: 5 years

8. Your Rights

Under POPIA, you have the following rights regarding your personal information:

• Right of Access: Request access to your personal information we hold
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of your information (subject to legal obligations)
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Restriction: Request restriction of processing in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact our Information Officer at privacy@dexbit.co.za.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Multi-factor authentication
• Regular security assessments and penetration testing
• Access controls and employee training
• Cold storage for crypto assets
• Incident response procedures

10. Cookies and Tracking

We use cookies and similar technologies to enhance your experience. You can manage cookie preferences through your browser settings. Essential cookies required for platform functionality cannot be disabled.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a minor, we will take steps to delete such information.

12. Information Officer

13. Complaints

If you are not satisfied with how we handle your personal information, you may lodge a complaint with the Information Regulator:

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through our platform. Your continued use of our services after such notification constitutes acceptance of the updated policy.