In this policy, “we”, “us”, “our” or “OSL” means OSL Digital Securities Limited (“OSLDS”), OSL SG PTE. LTD. (“OSLSG”), OSL AU PTY LTD(“OSLAU”), OSL AUSTRALIA SERVICES PTY LTD (“Chatbot Service Provider”), “you”, “your” or “yours” means the persons to whom this policy applies and “OSL Group” means OSL Group Limited, its related corporations, affiliates and branches.

The security of your personal data is important to us. OSL has in place safeguards to protect the personal data stored with us. This policy describes how we may collect, use, disclose, process and manage your personal data.

This policy applies to any individual’s personal data which is in our possession or under our control.

In the event of any inconsistency between different language versions of this policy, the English version shall prevail.

Personal Data We Collect

We define “Personal data” as data that can be used to uniquely identify a natural person. Personal data can be collected from various sources and processed by us. Some examples of data which, on its own or jointly, can be used to identify a natural person are:

• personal particulars, such as name, contact details, residential address, date of birth, identity card/passport details, and/or education details;

• specimen signature(s);

• employment details, such as occupation, directorships and other positions held, employment history, salary, and/or benefits;

• tax and insurance information;

• information about your risk profile, investments, investment objectives, knowledge and experience and/or business interests and assets;

• banking and trading information, such as account numbers and transactions;

• your personal opinions made known to us, such as through feedback or surveys;

• financial details;

• wallet information;

• information relating to your activities, habits, preferences and interests arising from your use of products and services of OSL Group, our partners or vendors; and/or

• other electronic data or information relating to you such as IP addresses, cookies, activity logs, online identifiers and location data through your usage of our products and services or as part of their delivery to you.

Failure to supply any Personal Data may result in us or OSL Group being unable to provide you with our products or services (or with all of the features and functionality offered by our products or services), to respond to queries or requests that you submit to us or to comply with any laws, regulations, guidelines and codes issued by regulatory or other authorities.

You may, however, visit our websites anonymously.

How We Use Your Personal Data

We may use personal data for our core business purposes including but not limited to:

1. developing and providing brokerage, exchange, and other services related to digital assets (whether made available by us or through us), including but not limited to:

   1. executing brokerage, exchange or other transactions and requests, including processing, settlement, clearing or reporting on these transactions;

   2. carrying out research, planning and statistical analysis; or

   3. developing or improving our products, services, security, service quality, and advertising strategies, including algorithm-based or artificial intelligence powered tools and services;

2. assessing and processing applications, instructions or requests from you;

3. communicating with you, including providing you with updates on changes to brokerage, exchange, and other services related to digital assets (whether made available by us or through us) including any additions, expansions, suspensions and replacements of or to such services and their terms and conditions;

4. managing our infrastructure, business operations and complying with internal policies and procedures;

5. responding to queries or feedback;

6. addressing or investigating any complaints, claims or disputes;

7. verifying your identity for the purposes of providing brokerage, exchange, and other services related to digital assets;

8. conducting checks, screenings or due diligence checks as may be required under applicable law, regulation or directive;

9. complying with all applicable laws, regulations, rules, directives, orders, instructions, guidance and requests from any local or foreign authorities, including regulatory, governmental, tax and law enforcement authorities or other authorities;

10. monitoring products and services provided by or made available through us;

11. creating and maintaining risk related models;

12. financial reporting, regulatory reporting, management reporting, risk management, audit and record keeping purposes;

13. enabling any actual or proposed assignee or transferee, participant or sub-participant of OSL’s rights or obligations to evaluate any proposed transaction;

14. enforcing obligations owed to us;

15. in connection with performance of our duties and obligations when seeking consultancy or professional advice, including legal advice; and/or

16. administering benefits or entitlements in connection with our relationship with you or arising from your participation in events, campaigns, or marketing promotions by us or in conjunction with our partners.

In addition to the above purposes, we may also use personal data for purposes set out in the terms and conditions that govern our relationship with you.

Use of Personal Data for Marketing Purposes

We may use your personal data to recommend you products or services. Such marketing messages may be sent to you in various modes including but not limited to electronic mail, direct mailers, short message service, telephone calls, facsimile and other mobile messaging services.

You may also opt-out of such communications by following the directions provided in any marketing communication. To find out more on how you can change the way we use your personal data for marketing purposes, please contact us (please see the “Contact us” section below).

At the same time, we may continue to send you messages as part of our ongoing relationship with you and nothing in this section shall vary or supersede the terms and conditions that govern our relationship with you.

Disclosure and Sharing of Personal Data

We may from time to time and in compliance with all applicable laws on data privacy, disclose your personal data to any of the following parties, whether located domestically or abroad, in order to carry out the purposes set out above:

• any member of the OSL Group;

• any agents, contractors, sub-contractors or associates of the OSL Group, including their employees, officers, agents, contractors, service providers and professional advisers that we or any member of the OSL Group engage(s) in connection with the operation or maintenance of our business and services (“Sub-Processors”), including but not limited to:

  • account opening and maintenance, including Know-Your-Client processing;

  • trade execution and monitoring, including market surveillance; and

  • artificial intelligence and other algorithm based tools.

• any government or regulatory authorities;

• any persons under a duty of confidentiality to us or a member of the OSL Group which have undertaken to keep such Personal Data confidential;

• any persons acting on your behalf whose Personal Data are provided, including but not limited to authorised representatives or nominees;

• any persons to whom we are or any member of the OSL Group is under an obligation or required or expected to make disclosure by operation of law;

• any actual or proposed assignee(s) of ours;

• any actual or proposed participant(s), sub-participant(s) or transferee(s) of our rights in respect of you;

• any person(s) in whose favour of our obligations with respect to you are, or are intended to be a subject of any assignment, participation, sub-participation, transfer, novation or other similar arrangement; and

• any other person(s) directly related to the purpose set out above.

For more information about the third parties with whom we share your personal data, you may, where appropriate, wish to refer to the agreement(s) and/or terms and conditions that govern our relationship with you or as our customer. You may also contact us for more information (please see the “Contact Us” section below).

International Transfers

To facilitate our global operations, OSL Group, its partners, and vendors may transfer, store, and process your personal data throughout the world, including Hong Kong, Singapore, Australia and the United Kingdom (UK). If you reside in the European Economic Area (EEA), Switzerland, or the UK, we rely upon a variety of legal mechanisms to facilitate these transfers of your personal data (collectively, “European Personal Data”). We also rely on adequacy decisions from the European Commission where available and exemptions provided for under data protection law.

Keeping Personal Data Secure

We use security procedures and technology to protect the personal data we hold. Access to and use of personal data within OSL Group seeks to prevent misuse or unlawful disclosure of the personal data – this includes internal policies, auditing, training and monitoring of staff.

If other organisations provide support services, we require them to take appropriate technical and organisational measures to secure the privacy of the personal data provided to them.

Cookies and Related Technologies

Our websites use cookies. A cookie is a small text file placed on your computer or mobile device when you visit a website. Cookies collect information about users and their visit to the website, such as their Internet Protocol (IP) address, how they arrived at the website (for example, through a search engine or a link from another website) and how they navigate within the website. We use cookies and other technologies to facilitate your internet sessions, offer you products and/or services according to your preferred settings, track use of our websites and to compile statistics about activities carried out on our websites.

A pixel tag, also known as a web beacon, is an invisible tag placed on certain pages of our website but not on your computer. Pixel tags are usually used in conjunction with cookies and are used to monitor the behaviour of users visiting the website.

You have the choice to set up your web browser to block cookies which will in turn disable the pixel tags from monitoring your website visit. You may also remove cookies stored from your computer or mobile device. However, do note that when you enable blocking of cookies and pixel tags, it may limit certain features and functions in your use of our websites.

Other Websites

Our websites may contain links to other websites which are not maintained by OSL. This privacy policy only applies to the websites of OSL. When visiting these third party websites, you should read their privacy policies which will apply to your use of the websites.

Amendments and Updates of OSL Privacy Policy

We may amend this policy from time to time to ensure that this policy is consistent with any developments to the way OSL uses your personal data or any changes to the laws and regulations applicable to OSL. We will make available the updated policy on our website. All communications, transactions and dealings with us shall be subject to the latest version of this policy in force at the time.

Retention of Personal Data

Your personal data is retained as long as the purpose for which it was collected remains and until it is no longer necessary for any other legal or business purposes.

Access and Correction

You may request access or make corrections to your personal data held by OSL. OSL may charge a fee for processing your request for access. Such a fee depends on the nature and complexity of your access request. Information on the processing fee will be made available to you. We may also take a reasonable period after receiving your correction request to process and update the change.

There are also other data protection and privacy laws that provide relevant individuals with additional rights including the right to obtain information on how OSL processes your personal data, receive certain information provided in an electronic format and/or request that these be transmitted to a third party, withdraw consent to the processing of your personal data, request for your information to be erased, object or restrict the use or processing of your information in some circumstances, for example the GDPR. These will be subject to ongoing obligations imposed on OSL pursuant to any applicable law or regulation, and/or OSL’s legitimate reason or entitlement to continue processing your information, and/or to refuse that request.

Where a request is made to withdraw consent, we will inform you of the likely consequences of withdrawing consent and the timeframe to effect the withdrawal. Such request will be processed within a reasonable timeframe, taking ten business days or more depending on the complexity of the request. In some cases, not providing the personal data, or withdrawing consent to the use, processing, or disclosure of the personal data, may adversely affect OSL’s ability to continue our relationship with you.

Please contact us (please see the “Contact Us” section below) for details on how you may request access, correct or exercise your rights with respect to the processing of your personal data.

Contact Us

To contact us on any aspect of this policy or your personal data or to provide any feedback that you may have, please email us at [email protected].

OSLDS Data Protection and Privacy

Where OSLDS processes or uses your personal data, the provisions as set out below will apply:

• Hong Kong Personal Data (Privacy) Ordinance (PDPO) and other applicable data protection and privacy laws.

OSLSG Data Protection and Privacy

Where OSLSG processes or uses your personal data, the provisions as set out below will apply:

• Personal Data Protection Act of Singapore (PDPA) and other applicable data protection and privacy laws; and

• in respect of sending telemarketing messages to your Singapore telephone number via short message service, telephone calls (voice or video), facsimile and other mobile messaging services, please be assured that we shall only do so if:

  • you have provided your clear and unambiguous consent in writing or other recorded form for us to do so;

  • you have not indicated to us in our ongoing relationship that you do not wish to receive telemarketing messages sent to your Singapore telephone number and you have not registered that number with the National Do Not Call Registry.

OSLAU Data Protection and Privacy

Where OSLAU processes or uses your personal information, the provisions as set out below will apply:

• The Privacy Act 1988 and other applicable data protection and privacy laws.

Chatbot Service Provider Policy

Where Chatbot Service Provider processes or uses your personal information, the provisions as set out below will apply:

• we may collect personal information (such as account information, user content, communication information, and social media information);

• we may use personal information for OSL Chatbot including but not limited to:

• providing, administering, maintaining and/or analysing services, content, intellectual property, and functionalities that we may make available to you through the OSL Chatbot (collectively, “Chatbot Services”);

  • improving our Chatbot Services and conducting research; and

  • developing new programmes and services;

• we may aggregate or de-identify personal information and use the aggregated information to analyse the effectiveness of our Chatbot Services, to improve and add features to our Chatbot Services, to conduct research and for other similar purposes. In addition, from time to time, we may analyse the general behaviour and characteristics of users of our Chatbot Services and share aggregated information like general user statistics with third parties, publish such aggregated information or make such aggregated information generally available. We may collect aggregated information through the Chatbot Services, through cookies, and through other means described in this Privacy Policy. We will maintain and use de-identified information in anonymous or de-identified form; and

• Chatbot Services generate responses by reading a user’s request and then predicting the next most likely words that might appear in response. In some cases, the most likely next words may not be the most factually accurate ones. For this reason, you should not rely on the factual accuracy of output from our models. If you notice that Chatbot output contains factually inaccurate personal information about you and you would like us to correct the inaccuracy, you may submit a correction request to [email protected]. Given the technical complexity of how our models work, we may not be able to correct the accuracy.