Privacy Policy

Updated: April 2025

Elephants (HK) Limited, along with our affiliates and subsidiaries (collectively referred to as “Elephants”, “us”, or “our”), presents this privacy policy and personal information collection statement (the "Policy") to delineate our practices regarding the collection, use, handling, store, transfer, safeguarding, acquisition, application, sharing, deletion or otherwise of your personal information (collectively, “process”). This applies when you interact with our websites (“Site”) and services (“Services”) including:

  1. Website and Online Platforms: Our digital content is accessible via http://elephants.inc, Elephants Inc App and other online platforms we manage.
  2. Social Media and Online Presence: Our official digital channels across various social media platforms.
  3. API and Service Usage: When utilizing the Elephants API or third-party applications that depend on our API, alongside other related services.

This Policy sets out our data protection standard and measures in relation to providing adequate protection for your Personal Data and your rights concerning the processing of such information. We shall only process your Personal Data and such other information provided by you in accordance with this Policy and any applicable laws and regulations of any relevant jurisdiction.

Depending on the jurisdiction in which you are a resident, the relevant data privacy laws and regulations of that jurisdiction may apply.

Please thoroughly review this Policy as it is crucial for understanding our practices and your interaction with our services. If you have any queries, reach out to us at support@elephants.inc. Your use of our services signifies your acceptance of these terms. If you disagree with any part of this policy, please refrain from using our services.

Definitions:

Personal data, as defined here, includes any information that:

  1. Directly or indirectly pertains to a living person.
  2. Allows for the identification of an individual, either directly or indirectly.
  3. Is accessible and processable.

“Personal Data” means any information, whether on its own or when combined with other information, directly or indirectly relating to an individual and his/her business from which it is practicable for his/her identity to be directly or indirectly ascertained, or such other wider definition as may be prescribed by any applicable law or regulation of any relevant jurisdiction. This includes information about an individual that is personally identifiable, such as his/her personal information and contact information that is not otherwise publicly available. When you register with us and use the Site or Services, Elephants collects your Personal Data, including but not limited to your name, email address, mailing address, phone number, HKID number (to the extent permissible under applicable laws and regulations), date of birth (solely for identity verification purposes), as well as and business information, including but not limited to business/company name, business/company address, business registration number, credit card number(s) and billing information. For the avoidance of doubt, business information is not considered Personal Data provided that it is used for business-to-business transactions. We do not seek to collect sensitive information about you, unless it is necessary for our business purposes and the purposes stated in this Policy and collected in accordance with the relevant laws or regulations or otherwise required by law or relevant authorities. Sensitive information we may collect includes your political or trade union membership or associations, criminal record, and biometric information.

“Transaction Data” means any information about your transactions with or through us. We automatically receive and record such information on our server logs from your browser, including your IP address, Elephants cookie information, and the page you requested.

“Third-Party Data” means any information relating to your payment recipient (“Recipient”) that may be required by Elephants to process your payments or transactions and/or to comply with regulations and perform compliance or verification checks. Such information may include Personal Data of the Recipient or third parties, such as the Recipients’ name, bank account number, and a copy of your contract, invoice or receipt with the Recipient. By providing us with such information, you warrant that you have obtained the consent of the Recipient or third party to the provision of such information to Elephants, and to Elephants’ processing such information for the above-stated purposes. You hereby warrant that such information provided to us is accurate to the best of your knowledge and that you will comply with all applicable laws and regulations (including applicable data privacy and confidentiality laws) in relation to the processing of such information.

General

General To ensure that you have full confidence in our handling of personal data, you are advised to read and understand the terms of this Privacy Policy in detail. By using our Site(s) or Services and by providing or making available your Personal Data and such other information as described above to us, you acknowledge that such provision is fair and reasonable and you shall be deemed to accept, agree, undertake and confirm that:

  1. You, on the basis of your own free will and your requisite consent, agree to the processing, sharing or disclose your Personal Data and/or such other information by us for the purposes of providing the Site(s) or Services to you, improving our Site and features, contacting you, conducting research, and such other purposes as stated in this Policy;
  2. You will comply with all the terms and limitations of this Privacy Policy;
  3. You agree that we may collect your information through your log into the Site(s), your registration with the Site(s) and/or your using the Services offered by us.

Your consent means that Elephants will not be held accountable for any data breach not due to its default. You may withdraw your consent by written notice at legal@elephants.inc. Please note that it is mandatory to provide certain Personal Data or such other information to us, otherwise you may not be able to register for an Account and continuously and fully use the Site(s) or Services.

By providing your email address associated with your Account, selecting the check box on the registration page or subscribing to our email list via your Account profile page, you consent to us sending emails to you relating to the Services, including transactional and product updates. You may withdraw your consent to receive electronic marketing communications at any time by opting out on your profile page, emailing us at support@elephants.inc, or following the unsubscribe procedure contained in any electronic communication you receive from us. Elephants reserves the right to send users that have provided an email address updates that are transactional in nature including, but not limited to payment receipts, updates such as administrative messages, password reset notifications, and other Account related information.

Data Collection

As a visitor or user of our Site and Services, we collect necessary personal information to provide our Services, comply with legal requirements, or as detailed herein. Providing Personal Data marked with asterisks is mandatory for service provision.

What do we collect? How do we use it?
Information collected by using our official website, app or webapp: pages visited, country location, date and time of requests, IP address, interaction with our Site(s), device, operating system and web browser user.We use the anonymous information to recognize your repeat visits and preferences, personalize the browsing experience, measure the effectiveness of campaigns, and statistically analyze the usage of our Site(s).
Information collected when you register an account: email address, full name, phone number, and PIN*We use the contact information to display in the user interface and verify your identity when required. The information may also be used to:
  1. Manage risks, or detect, prevent, and/or remediate fraud or other potentially illegal or prohibited activities or violations of policies or applicable agreements;
  2. Provide you with customer support services;
  3. Measure the performance of the Services and improve their content and layout;
  4. Manage and protect our information technology infrastructure;
  5. Inform you regarding your account or any updated security measures; and
  6. Manage your account with us.
Information collected when messaging us through our contact form: Name, Email address, Company, and the message contentWe use this information to contact you to reply to your request and provide the most relevant information to you in our answers
Information collected when you proceed with AML requirement: Full name, residency, email, ID, Date of Birth, pictureWe may use your contact information to verify your identity and conduct necessary KYC checks to comply with legal and regulatory requirements. This includes contacting you to request additional information, KYC status or documentation to complete the KYC process.
Information collected when subscribing to our newsletter: Name, Email address, Company profileIf you explicitly agree to subscribe to our newsletter, we will use this data to provide personalized business information about new services and products as well as for industry trends research purposes
Information collected when you request access to your data or correction of data: Name, ID/Passport, email address*We use this information to verify your identity to proceed with your request for DAR or DCR
Information collected when you use the service, your activity and information you provide: Information and content you provide, including your contact information like email address, phone number, nameApp, browser and device information: Device identifiers
Providing marketing communications (including but not limited to promotional materials, newsletters, and information about our products and services that we believe may be of interest to you) to you:
  1. Depending on your settings and subject to applicable law, we'll share marketing communications with you.
  2. We'll collect and store your information and use it to send marketing communications to you, like an email, subject to applicable laws.
Information collected when you have access to a wallet: account number, API private keys, withdrawal and deposit transactions, trading operationsAllowing the correct and complete provision of services by the Custodian Partner;
Information collected: device and other identifiers such as Android ID, iOS ID, IMEI, Advertising ID, and MAC address.Improving the functionality of the app and enable key features like user identification, usage analytics, and app performance tracking.
Information collected when you want to access regulated services: Full name, residency address, passport, nationality, pictureAllowing the correct and complete provision of regulated services. The personal information will be shared with partner providing regulated services (such as issuance of card, custody)

Third-Party Data Collection

We may obtain your data from partners, affiliates, and external sources, including social media connections. This may encompass demographic information and identity verification via KYC processes (hereinafter referred to as the “KYC”).

Data Sharing With Third Parties

We might share your information with affiliates, service providers, government bodies, or other third parties under certain conditions with our affiliates or subsidiaries, service providers (e.g. AML, CRM, communication services) vendors, agents, relevant government ministries, regulators, partners, or any third party, including but not limited to when third parties perform part of our Services on our behalf (e.g. for data processing, analytics, delivery of Services, and verification), when complying with legal obligations, to protect the rights, property, or safety of our company, clients or others. By using our Site and Services, you have also agreed to the Privacy Policy of our service providers, which sets out information about the cookies on the website and the terms with which we may process any personal data collected from you or that you provided to us. By accessing and using the Services, you consent to such processing and you warrant that all data provided by you is accurate.

Some third-party processing your personal data either on Elephants' behalf or any other circumstance may be located in a different country from the point of collection of your personal data including but not limited to the location of servers or cloud-based services.

In the case where your personal information must be shared with third parties in circumstances that are not standard with our relationship with you, Elephants will request your consent unless the disclosure of your personal information is:

  1. requested by Authority, law enforcement agency, or public agency;
  2. without a doubt in your interests, and if consent cannot be obtained in a timely way;
  3. necessary to respond to an emergency that threatens the life, health, or safety of yourself or another individual; or
  4. required, permitted, or authorized based on the applicable laws and/or regulations.

We do not rent, sell, transfer, or disclose your Personal Data or such other information provided by you with non-affiliated companies or other parties. Notwithstanding the preceding, under the following circumstances and to the extent permissible under applicable laws and regulations of the relevant jurisdiction(s), we may, with your consent, share your personal data or such other information provided by you:

  1. With our third-party service providers or data centres of third-party data storage providers, whether in or out of jurisdiction and who have entered into appropriate confidentiality arrangements with us, for background check, customer screening and identity verification and customer care services to provide the Site(s) and/or Services you have requested;
  2. With our employees on a need-to-know basis to provide the Site(s) and/or Services to you or to fulfil their duties;
  3. With third parties, who have entered into appropriate confidentiality arrangements with us, where it is necessary to satisfy the purposes as stated in this Policy, or any person, entity, or authority to whom we are under an obligation to make disclosure in accordance with any applicable laws, regulations, or regulatory or accounting requirements;
  4. When it is necessary to share information in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or violations of Elephants' terms of use;
  5. With prospective parties and their advisers and new owners of the business for due diligence purpose when Elephants or any subsequent future successor company is acquired by or merged with another company;
  6. When required by law or relevant regulatory authorities to make any disclosures of any breach of the security, confidentiality, or integrity of your unencrypted electronically stored Personal Data (or “personal data“ otherwise defined in applicable law) to you via email or conspicuous posting on the Site in the most expedient time possible and without unreasonable delay, insofar as consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

We may share statistical and demographic information about you and your transactions with suppliers of advertisements and programming. For the avoidance of doubt, this would not include your Personal Data. For each payment made through our Services, the Recipient may request your information solely for the purpose of identifying your payment and its origins.

External Links on Elephants Platforms

Our websites and services may feature links to external sites or applications not operated by Elephants. When you follow these links, our Privacy Policy will no longer apply. We encourage you to review the privacy policies of these external platforms. Elephants does not bear responsibility for the privacy practices of third-party websites or applications.

Cookies Elephants may use

What Are Cookies? Cookies are small amounts of data that are sent to your browser and stored on your computer's hard drive to collect standard internet log information and visitor/user behavior information. When you visit our Sites or Channels, Elephants can automatically collect information from you through cookies or similar technologies. There may also be third-party cookies on our Websites and Channels.

For more information, please visit: www.allaboutcookies.org

How Do We Use Cookies? We use cookies in a range of ways to make your experience on our Sites and Services more enjoyable, including but not limited to:

  1. to keep you signed in;
  2. to record your habits and preferences when browsing our Sites and Services;
  3. to record our performance and verify the effectiveness of online advertising through Google Stats with cookies;
  4. Manage and improve the design of the Site and Services We may collect your personal information, anonymized, to support us in our business. Such information may be shared, disclosed, leased, assigned, licensed, sold, and transferred

How to Manage Your Cookies? Most browsers are automatically accepting cookies. You can adjust your browser setting to prevent cookies or to notify you as soon as cookies are loaded. However, stopping all cookies might mean that you cannot access or use some of our Services or features.

What is Do Not Track (DNT)? DNT is a concept that has been promoted by regulatory agencies, for the Internet industry to develop and implement a mechanism for allowing Internet users to control the tracking of their online activities across websites by using browser settings. However, please be aware that cookies placed by third parties may continue to track your activities online even after you have left our Services, and those third parties may not honor 'Do Not Track' requests that you have set using your browser or device. Therefore, this Privacy Policy does not cover third-party policies related to cookies.

Data Storage and Processing

We may transfer, store, and process your personal data in various locations, including facilities operated by third parties like Google or Amazon Web Services or others. Despite the international nature of our data processing, we are committed to enforcing robust data and privacy protection standards.

Securing Personal Data

Our commitment to your data's security is unwavering. We adhere to the Personal Data (Privacy) Regulation and other relevant regulations to safeguard the confidentiality and integrity of your personal information. Despite rigorous electronic safeguards, we must acknowledge the possibility of unauthorized data disclosure. In such instances, our liability for any resulting harm to users or third parties is limited to the maximum extent permitted by law.

Your Rights Regarding Personal Information

As a user of Elephants services, you have specific rights regarding your personal data:

  1. Data Access and Correction: You can request a copy of your personal data we hold (Data Access Request, “DAR“) or request corrections (Data Correction Request, “DCR“) by writing to us.
  2. Objecting to Data Use: You can object to our use of your personal information by contacting support@elephants.inc. Note that this may impact your ability to use our services.
  3. Response Time: We aim to respond to your requests within 40 calendar days.

In some circumstances, we may decline to comply with your request in the following circumstances:

  1. a government agency or regulator with jurisdiction over Elephants, directs Elephants not to comply with a visitor or user's request;
  2. the information may, in our discretion, affect the safety of any person or persons;
  3. the data may be relevant to a regulator or official investigators (criminal conduct or breach of applicable laws)
  4. the data correction request is not made in English writing;
  5. it is unable to verify the identity and authority of the requestor;
  6. it is not satisfied that the personal data to which the DCR relates is inaccurate;
  7. it is not provided with sufficient information to ascertain that the data is inaccurate; or
  8. it is not satisfied that the correction provided in the DCR is accurate.

In case you decide to withdraw your consent for the use of your personal data by Elephants, you are advised to immediately discontinue using our services and inform us via email at support@elephants.inc. Upon receiving your request, we will process it promptly. Be aware that withdrawing consent may have legal implications and could impact our ongoing relationship. The extent of your consent withdrawal might necessitate the termination of your access to our services.

You have the right to request the erasure of your personal data in our control, commonly known as the “right to be forgotten.“ However, we may not always be able to fully comply due to legal obligations or technical limitations. We commit to erasing personal data when it's no longer needed for its original purpose, except where law or public interest prevents such erasure. When you submit an erasure request, we may ask for identification to verify your identity. For efficient processing, please specify the right you are exercising and provide necessary details. Incomplete information might result in a delay in processing your request.

You have the right to request information about the nature of your Personal Data that is processed by us or in our possession or control and how your Personal Data collected by us is processed.

You have the right to request access to and correction of your Personal Data in our possession or control and the right to opt out of direct marketing. If any Personal Data that you have provided changed, for example if you change your name, email address, or payment details, please inform us by editing your Account profile page or by sending an email to our data officer at support@elephants.inc. You may ask us, or we may ask you, to correct information that is deemed inaccurate, and you may also ask us to remove information which is inaccurate.

Children Restriction

Any individual below the age of 18 (or applicable age required for you to legally access or use the Services) shall obtain permission from their parents or legal guardians before accessing or visiting our Site(s) and Services.

Elephants does not have any intention to collect any personal data about individuals below the age of 18, Elephants may not stop such individuals from accessing and visiting the Site. If you act as a parent or guardian, by providing us with the personal data of an individual below the age of 18, you hereby consent to the processing of his/her personal data as per applicable laws and agree to be personally bound by the terms of this Privacy Policy and take full responsibility for his/her actions.

Retention

Elephants retains your personal data for as long as your account remains active or as necessary for providing services, including for legal, accounting, or reporting requirements. This includes retention periods post-termination of our business relationship as mandated by applicable laws, such as anti-money laundering regulations. For further inquiries, contact us at support@elephants.inc. Upon account closure or when data is no longer needed, we may delete or destroy your information, except where retention is legally required or for other regulatory or audit purposes.

We will retain your Personal Data and any such other information provided by you for as long as is necessary for providing the Site(s) or Services to you subject to any legal, regulatory or accounting requirements, after which it will be erased or destroyed permanently using all practicable steps.

Unless you have expressly opted out of communications and deactivated or terminated your Account and removed payment details therein, you acknowledge that your Personal Data, payment history, username and password may remain in our system including for the purpose of legal compliance. If your Account is not used for more than 7 years, we will keep your Account alive and may retain non-personal information, but we will erase your other Personal Data.

Update Elephants Privacy Policy

We may change this Privacy Policy from time to time. If we do, we will let you know by revising the date at the top of the policy. If the changes, in our sole discretion, are material, we may also notify you by sending an email to the address associated with your account (if you have chosen to provide an email address) or by otherwise providing notice through our Services. We encourage you to review the Privacy Policy whenever you access or use our Services or otherwise interact with us to stay informed about our information practices and the ways you can help protect your privacy. By continuing to use our Services after Privacy Policy changes go into effect, you agree to be bound by the revised policy.

Notice

If you wish to ask or notify us for:

  1. DAR or DCR;
  2. Queries related to this privacy policy;
  3. Remove your consent for us to use your personal data; or
  4. Erase personal data.

Please send us a notice to: support@elephants.inc