This Privacy Policy explains how BitFlux Limited (“BitFlux”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit www.bitflux.link, use the BITFLUX app (including app.bitflux.link and any BITFLUX mobile apps) or otherwise use our services (together, the “Services”).
1. Who we are
BitFlux Limited has its office at Room 602, 6/F, Kai Yue Commercial Building, No. 2C Argyle Street, Mong Kok, Kowloon, Hong Kong. We are responsible for the personal data described in this policy. You can contact us at info@bitflux.link.
2. Personal data we collect
Information you give us
- Account details: your name, email address, mobile phone number, password and transaction PIN.
- Identity verification (KYC) information: date of birth, nationality, residential address, details and images of government-issued identity documents, and facial images or video captured for identity and liveness checks. For higher verification tiers we may also ask for further information, such as proof of address or source of funds.
- Financial and transaction information: wallet addresses, deposit and withdrawal records, currency swaps, BF Card transactions, and the bank account details you provide for fiat withdrawals.
- Communications: messages you send us, support requests and feedback.
Information we collect automatically
- Device and log information: IP address, device model, operating system, app or browser version, device identifiers, language settings, login times and, if you turn on notifications, push notification tokens. We use this information to keep your account secure, for example to alert you to logins from a new device.
- Usage information: how you interact with the Services, such as the pages and features you use.
- Cookies and similar technologies: see Section 9.
Information from third parties
- Identity verification, fraud prevention and sanctions screening providers.
- Card issuing, payment, banking, custody and liquidity partners that help us provide the Services.
- Public blockchain data about addresses and transactions linked to your account.
- The person who invited you, if you signed up through a referral link.
3. How we use personal data
We use personal data to:
- open and manage your account and provide the Services, including deposits, swaps, the BF Card, withdrawals and referral rewards;
- verify your identity and meet our obligations under applicable anti-money laundering, counter-terrorist financing and sanctions laws;
- process transactions and keep accurate records;
- protect your account and the Services, including detecting and preventing fraud, unauthorised access and other prohibited activity;
- send you service messages, such as transaction confirmations, security alerts and changes to our terms;
- answer your enquiries and provide customer support;
- operate, analyse and improve the Services; and
- comply with legal and regulatory requirements, and establish, exercise or defend legal claims.
Direct marketing. We will only use your personal data for direct marketing with your consent. You can withdraw your consent at any time, free of charge, by contacting us or using the unsubscribe option in our messages.
4. How we share personal data
We do not sell your personal data. We share it only as follows:
- Service providers that act on our behalf, such as cloud hosting, identity verification, communications (SMS and email) and customer support providers.
- Financial and operating partners needed to provide the Services, such as card issuers, card networks, banks, payment and remittance providers, custodians and liquidity providers. Some of these partners process your personal data under their own privacy policies.
- Regulators, law enforcement agencies, courts and other authorities, where required or permitted by law.
- Professional advisers, such as lawyers, auditors and insurers.
- A buyer, investor or successor in connection with a merger, acquisition, financing or sale of all or part of our business, subject to appropriate confidentiality safeguards.
- Other parties, with your consent or at your direction.
5. International transfers
We and our partners operate in more than one jurisdiction, so your personal data may be transferred to, stored in or processed in places outside Hong Kong or your country of residence. When this happens, we take reasonable steps, such as contractual safeguards, to make sure your personal data is appropriately protected.
6. How long we keep personal data
We keep personal data while your account is open and afterwards for as long as necessary for the purposes in this policy, including to meet legal, regulatory, tax and accounting requirements. Identity verification and transaction records are generally kept for at least five years after our relationship with you ends, as anti-money laundering laws commonly require. When we no longer need personal data, we delete or anonymise it.
7. How we protect personal data
We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls and monitoring. Your account is also protected by a 6-digit transaction PIN and new-device login alerts. No method of transmission or storage is completely secure, so please keep your login details and PIN confidential and tell us immediately if you suspect unauthorised access to your account.
8. Your rights
Subject to applicable law, you have the right to:
- request access to the personal data we hold about you;
- request correction of personal data that is inaccurate;
- withdraw any consent you have given, including consent to direct marketing; and
- where the law that applies to you allows, request deletion of your personal data, or object to or restrict certain processing.
To make a request, email info@bitflux.link. We may need to verify your identity first. We will respond within the time required by applicable law; for data access requests under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), that is within 40 days. We may need to keep some personal data to meet legal obligations, even if you ask us to delete it.
9. Cookies and similar technologies
Our website does not use advertising or analytics cookies. It stores your language preference in your browser’s local storage and loads fonts from Google Fonts, which means Google receives your IP address when you visit. The BITFLUX app uses cookies, local storage or similar technologies that are necessary to keep you signed in and to secure your account. You can manage cookies in your browser settings, but some features may not work without them.
10. Children
The Services are only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, please contact us and we will delete it.
11. Third-party links and services
The Services may link to third-party websites and services, such as X (Twitter), app stores or blockchain explorers. Their privacy practices are governed by their own policies, and we are not responsible for them.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date. If the changes are material, we will notify you through the Services or by email before they take effect.
13. Contact us
This policy is available in English and Chinese. If the two versions differ, the English version prevails. For questions about this policy or your personal data, contact: