1. Information We Collect

1.1 Personal Information You Provide

When you create an account or use our services, we collect personal information that you voluntarily provide, including:

• Identity Information: Full name, date of birth, nationality, government-issued ID numbers
• Contact Information: Email address, phone number, residential address
• Financial Information: Bank account details, cryptocurrency wallet addresses, transaction history
• Verification Documents: Government-issued ID, passport, driver's license, proof of address, selfie photos
• Account Credentials: Username, password (encrypted), security questions and answers

1.2 Information Collected Automatically

When you access or use our Platform, we automatically collect:

• Device Information: IP address, device type, operating system, browser type and version
• Usage Data: Pages visited, time spent on pages, links clicked, features used
• Transaction Data: Investment activities, deposits, withdrawals, trading patterns
• Location Data: Approximate geographic location based on IP address
• Cookies and Similar Technologies: Session cookies, preference cookies, analytics cookies

1.3 Information from Third Parties

We may receive information about you from third-party sources:

• Identity Verification Services: KYC/AML compliance data from verification providers
• Payment Processors: Transaction confirmation and payment status information
• Blockchain Networks: Publicly available transaction data from cryptocurrency blockchains
• Analytics Providers: Aggregated usage statistics and behavior patterns

2. How We Use Your Information

2.1 Primary Purposes

We use your personal information for the following purposes:

• Account Management: Create, maintain, and manage your investment account
• Service Provision: Process transactions, execute investment orders, and provide Platform features
• Identity Verification: Verify your identity and comply with KYC/AML regulations
• Security: Detect, prevent, and respond to fraud, unauthorized access, and security threats
• Customer Support: Respond to inquiries, resolve issues, and provide assistance
• Communications: Send transaction confirmations, account updates, and important notices

2.2 Legal and Compliance

We process your information to:

• Comply with legal obligations and regulatory requirements
• Respond to law enforcement requests and court orders
• Prevent money laundering and terrorist financing
• Enforce our Terms of Service and other policies
• Protect our rights, property, and safety

2.3 Business Operations

• Analytics: Analyze Platform usage and user behavior to improve services
• Marketing: Send promotional communications about new features and services (with your consent)
• Research: Conduct market research and develop new products
• Risk Management: Assess and manage financial and operational risks

2.4 Legal Basis for Processing

We process your personal information based on:

• Contractual Necessity: Processing is necessary to provide services under our agreement with you
• Legal Obligation: Processing is required to comply with applicable laws and regulations
• Legitimate Interests: Processing is necessary for our legitimate business interests
• Consent: You have explicitly consented to processing for specific purposes

3. Information Sharing and Disclosure

3.1 When We Share Your Information

We may share your personal information in the following circumstances:

Service Providers

We share information with third-party service providers who perform services on our behalf:

• Identity verification and KYC/AML compliance providers
• Payment processors and cryptocurrency exchanges
• Cloud storage and hosting services
• Customer support and communication platforms
• Analytics and performance monitoring services

Legal and Regulatory Requirements

We disclose information when required by law or to protect our rights:

• In response to subpoenas, court orders, or legal processes
• To comply with regulatory reporting obligations
• To law enforcement investigating criminal activities
• To protect against fraud, security threats, or illegal activities
• To enforce our Terms of Service or other agreements

Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

With Your Consent

We may share your information for purposes not described in this policy with your explicit consent.

3.2 What We Don't Share

We do not:

• Sell your personal information to third parties
• Share your information for third-party marketing purposes
• Publicly disclose your personal information without your consent
• Share more information than necessary with service providers

4. Data Security

4.1 Security Measures

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest using AES-256 encryption
• Access Controls: Strict role-based access controls limit who can view your information
• Authentication: Multi-factor authentication (MFA) for account access and sensitive operations
• Monitoring: 24/7 security monitoring and intrusion detection systems
• Secure Infrastructure: Data stored in secure, SOC 2 compliant data centers
• Regular Audits: Periodic security assessments and penetration testing

4.2 Your Security Responsibilities

You play a critical role in protecting your account:

• Use strong, unique passwords and enable 2FA
• Keep your login credentials confidential
• Log out from shared or public devices
• Report suspicious activity immediately
• Keep your contact information up to date
• Be cautious of phishing attempts and scams

4.3 Data Breach Response

In the event of a data breach that affects your personal information, we will:

• Notify you promptly as required by applicable laws
• Describe the nature and extent of the breach
• Explain steps we're taking to address the breach
• Provide recommendations to protect your information
• Notify relevant regulatory authorities as required

5. Data Retention

5.1 Retention Periods

We retain your personal information for as long as necessary to:

• Provide our services to you
• Comply with legal and regulatory obligations
• Resolve disputes and enforce agreements
• Maintain business records and audit trails

5.2 Specific Retention Requirements

• Account Information: Retained while your account is active and for 7 years after closure
• Transaction Records: Retained for at least 7 years per financial regulations
• KYC/AML Documents: Retained for 7-10 years as required by law
• Communications: Retained for 3-7 years depending on content and purpose
• Marketing Data: Retained until you withdraw consent or for 2 years of inactivity

5.3 Secure Deletion

When information is no longer needed, we securely delete or anonymize it using industry-standard methods. Some information may be retained in backup systems for a limited time before permanent deletion.

6. Your Privacy Rights

6.1 Access and Correction

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate or incomplete information
• Portability: Receive your data in a structured, machine-readable format

6.2 Deletion and Restriction

• Deletion: Request deletion of your personal information (subject to legal obligations)
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests

6.3 Marketing Communications

You can opt out of marketing communications at any time by:

• Clicking "unsubscribe" links in emails
• Adjusting notification preferences in your account settings
• Contacting our support team

Note: You will still receive transactional and account-related communications necessary for providing our services.

6.4 Exercising Your Rights

To exercise any of these rights, contact us at privacy@nexusinvestmentfx.com. We will respond within 30 days of receiving your request. We may need to verify your identity before processing requests.

6.5 Regional-Specific Rights

European Economic Area (EEA) - GDPR Rights

If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with a supervisory authority.

California - CCPA Rights

California residents have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to opt out of sales (though we do not sell personal information).

7. Cookies and Tracking Technologies

7.1 What Are Cookies

Cookies are small text files stored on your device when you visit our Platform. We use cookies and similar technologies to enhance your experience, analyze usage, and provide personalized content.

7.2 Types of Cookies We Use

Essential Cookies

• Required for Platform functionality and security
• Enable account login and authentication
• Remember your preferences during your session
• Cannot be disabled without affecting functionality

Analytics Cookies

• Help us understand how users interact with our Platform
• Provide insights into usage patterns and popular features
• Allow us to improve Platform performance and user experience
• May be provided by third-party analytics services

Functionality Cookies

• Remember your preferences and settings
• Personalize content and features based on your activity
• Improve user experience across sessions

Marketing Cookies

• Track your activity for targeted advertising (with consent)
• Measure effectiveness of marketing campaigns
• Prevent showing repeated advertisements

7.3 Managing Cookies

You can control cookies through:

• Browser Settings: Most browsers allow you to block or delete cookies
• Cookie Preferences: Adjust settings in our cookie consent banner
• Opt-Out Tools: Use industry opt-out tools for advertising cookies

Note: Blocking essential cookies may prevent you from using certain Platform features.

7.4 Other Tracking Technologies

We may also use:

• Web Beacons: Small graphics that help track email opens and user engagement
• Local Storage: Browser storage for preferences and session data
• Device Fingerprinting: Collecting device attributes for security and fraud prevention

8. International Data Transfers

8.1 Global Operations

Nexus Investment FX operates globally, and your information may be transferred to, stored, and processed in countries other than your own. These countries may have different data protection laws than your jurisdiction.

8.2 Transfer Safeguards

When we transfer your information internationally, we implement appropriate safeguards:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection
• Binding Corporate Rules for transfers within our organization
• Your explicit consent for specific transfers

8.3 Data Processing Locations

Your information may be processed in the following locations:

• United States - Primary data centers and operations
• European Union - Regional data centers and support
• Other regions where we have business operations or service providers

9. Children's Privacy

9.1 Age Restrictions

Our Platform is not intended for individuals under 18 years of age (or the age of majority in their jurisdiction). We do not knowingly collect personal information from children.

9.2 Parental Notice

If we become aware that we have collected personal information from a child without parental consent, we will:

• Delete the information as quickly as possible
• Terminate the account
• Take steps to prevent future registration
• Notify the parent or guardian if contact information is available

9.3 Reporting

If you believe we have collected information from a child, please contact us immediately at privacy@nexusinvestmentfx.com so we can take appropriate action.

10. Third-Party Links and Services

10.1 Third-Party Websites

Our Platform may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing personal information.

10.2 Third-Party Services

We integrate with various third-party services:

• Payment Processors: Handle cryptocurrency and fiat currency transactions
• Identity Verification: Verify your identity for KYC/AML compliance
• Analytics Providers: Help us understand Platform usage and performance
• Communication Tools: Enable customer support and notifications

These services have their own privacy policies governing how they collect and use your information.

10.3 Social Media

Our Platform may include social media features and widgets. These features may collect your IP address, track pages you visit, and set cookies. Your interactions with these features are governed by the privacy policies of the companies providing them.

11. Changes to This Privacy Policy

11.1 Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you via email or Platform notification for material changes
• Provide a summary of significant changes
• Give you an opportunity to review the updated policy

11.2 Your Acceptance

Your continued use of the Platform after changes become effective constitutes your acceptance of the updated Privacy Policy. If you do not agree to the changes, you should stop using the Platform and contact us to close your account.

11.3 Material Changes

For material changes that significantly affect your rights or how we handle your information, we will:

• Provide at least 30 days' notice before changes take effect
• Seek your explicit consent where required by law
• Offer options to withdraw consent or close your account

12. Contact Us

12.1 Privacy Questions and Requests

If you have questions about this Privacy Policy or want to exercise your privacy rights, please contact us:

12.2 General Support

12.3 Data Protection Officer

For EEA residents, you can contact our Data Protection Officer:

12.4 Mailing Address

12.5 Response Time

We aim to respond to all privacy inquiries within:

• General Questions: 5 business days
• Data Requests: 30 days (may be extended to 60 days for complex requests)
• Security Issues: 24-48 hours for urgent matters