Privacy Policy

1. Overview & Commitment

BLOQEX ("we," "our," or "us") is dedicated to safeguarding the privacy, confidentiality, and integrity of your personal and financial data. This Privacy Policy details our policies regarding the collection, processing, storage, protection, and disclosure of personal data in compliance with ISO/IEC 27701 (Privacy Information Management System), ISO/IEC 27001 (Information Security Management System), the Digital Personal Data Protection (DPDP) Act, and applicable international data protection laws.

2. Information We Collect

We may collect and process the following categories of data:

• Identity & Profile Data: Full legal name, date of birth, gender, nationality, and corporate entity credentials (CIN, GSTIN) for business verification.
• KYC & AML Verification Data: Government-issued identification documents (e.g., Aadhaar, PAN card, Passport), biometric facial liveness recordings, and sanctions/PEP screening results processed via accredited verification providers.
• Financial & Settlement Data: Bank account numbers, IFSC/SWIFT codes, payment confirmation receipts, transaction UTR numbers, and public Web3 wallet addresses.
• Technical & Log Data: IP addresses, browser fingerprint, device identifiers, session timestamps, and audit security records required for anti-fraud monitoring and CERT-In compliance.

3. Purpose of Processing & Legal Basis

We process your personal information strictly for legitimate and lawful business purposes:

• Executing and settling OTC liquidity orders and digital asset exchange transactions.
• Fulfilling statutory KYC/KYB, Anti-Money Laundering (AML), and Prevention of Money Laundering Act (PMLA) requirements.
• Preventing fraud, unauthorized account takeovers, payment manipulation, and cyber threats.
• Maintaining immutable audit logs in accordance with ISO 27001 security standards.

4. Data Protection & Security Controls

In alignment with ISO/IEC 27001 controls, we implement rigorous organizational and technical safeguards:

• Encryption at Rest & in Transit: All sensitive databases and files utilize AES-256 encryption at rest and TLS 1.3 encryption in transit.
• Field-Level Tokenization: Sensitive identifiers (e.g., PAN, Aadhaar references) are hashed or encrypted before persistence.
• Multi-Factor Authentication (MFA): Strict multi-factor authentication and role-based access control (RBAC) restrict internal administrative access.
• Cross-Tab & Session Invalidation: Active sessions are synchronized across browser contexts to ensure immediate token revocation upon logout.

5. Data Retention & Erasure

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy, or to satisfy legal, regulatory, tax, or accounting retention obligations (such as statutory 5-year AML transaction logging periods). Once retention thresholds elapse, data is securely anonymized or permanently erased using cryptographically validated methods.

6. Your Privacy Rights

Subject to applicable laws, you retain the right to access, rectify, or request an export of your personal information, or request account closure. Requests can be submitted to our Data Protection Officer at privacy@bloqex.com.

7. Contact Information & Grievance Redressal

For questions, concerns, or data privacy inquiries, please contact our Compliance & Information Security Office: