Privacy Policy

1 Scope

This Privacy Policy applies only to personal information that DeepBook Trading processes in connection with the Services. The Interface allows users to access, connect to, and interact with separately provided websites, applications, wallets, data services, blockchain networks, protocols, smart contracts, products, technologies, and software (collectively, “Third-Party Services”), including separately operated smart contracts and protocols (“Protocol Services”). This Privacy Policy does not govern a Third-Party Service provider’s processing, direct interaction with a public blockchain or smart contract outside the Interface, or public blockchain activity that DeepBook Trading does not control. A Third-Party Service may be operated by an affiliate or related party; where that provider determines its own purposes and means of processing, its own privacy policy applies. You should review the privacy policy of each Third-Party Service you use.

2 Changes to Our Privacy Policy

We may revise this Privacy Policy from time to time. We will update the “Last Updated” date and provide any additional notice required by applicable law, which may include notice through the Interface or by email if you have provided an email address. If applicable law requires consent for a new processing purpose, we will seek that consent before beginning the new processing. Continued use of the Services after an update means the updated Privacy Policy applies to later processing, but does not itself constitute consent where consent is required by law.

3 Personal Information We Collect

The categories of personal information we collect depend on how you interact with us, the Services, and Third-Party Services, and on applicable legal and security requirements. We collect information that you provide, information obtained automatically when you use the Services, and information from other sources, including public blockchains and service providers. A wallet address and associated on-chain activity may constitute personal information when it identifies or can reasonably be linked to an individual.

3.1 Information You Provide to Us Directly

We may collect the following personal information that you provide or make available to us:

• Wallet and Transaction Information. When you connect a third-party wallet or request an interaction, we may receive or process your public wallet address, public keys, balances, token holdings, public transaction history, transaction instructions, selected routes or products, approvals, signatures, transaction hashes, asset types, amounts, fees, smart-contract interactions, counterparties, and transaction status. We do not ask for or collect your private key, seed phrase, recovery phrase, or wallet authentication credentials. Your wallet provider processes credentials and signing permissions under its own privacy policy.
• Eligibility and Compliance Information. We may collect information and certifications concerning your citizenship, nationality, country or region of residence, current location, legal eligibility, restricted-person or restricted-jurisdiction status, control of a wallet, and requested product or feature. Where reasonably necessary for legal, security, or risk purposes, we may request additional information concerning identity, residence, location, source of funds, or use of a wallet.
• Additional Information You Choose to Provide. We may collect information you provide in an eligibility certification, access or review request, incident report, feedback submission, or other interaction with us. Please do not provide sensitive personal information unless we specifically request it and explain why it is needed. Unless we identify information as optional, failure to provide information needed to assess eligibility, apply compliance controls, or provide a requested feature may result in restricted or denied access to that feature or the Services.
• Your Communications with Us. We may collect your email address, other contact details, message content, attachments, support history, and any wallet or transaction information you choose to include when you contact us.

3.2 Information Collected Automatically

We may collect personal information automatically when you access or use the Services:

• Technical and Usage Information. We may automatically collect Internet Protocol address, browser type, operating system, device type, language and user settings, cookie or similar identifiers, Internet service provider, referring and exit pages, timestamps, pages and links viewed, session duration, clicks and other interactions, errors and performance data, wallet-connection events, feature or route selections, and transaction-construction or routing events.
• Geofencing, Security, and Compliance Information. We may collect or generate approximate location derived from Internet Protocol address, precise location where authorized, device and network signals, VPN, proxy, Tor, data-centre, remote-desktop or location-spoofing indicators, eligibility certifications, wallet-risk and sanctions-screening results, illicit-finance, fraud, abuse, and market-manipulation indicators, risk scores and flags, and records of blocked or restricted access, feature, or transaction attempts.
• Automated Eligibility and Access Decisions. Some geofencing, wallet-screening, sanctions, fraud, and abuse controls may operate automatically. These controls compare technical, location, certification, wallet, and on-chain risk signals against restricted-jurisdiction, restricted-person, sanctions, security, and risk rules or thresholds. They may deny or suspend Interface access, disable a feature, decline to construct or route a transaction, or request additional information. We do not disclose details that would compromise these controls. Where applicable law provides, you may request meaningful information about a qualifying automated decision or request human review as described under “Your Privacy Rights.”
• Cookies and Similar Technologies. We and service providers may use cookies, local storage, pixels, software development kits, and similar technologies (collectively, “Technologies”) to operate, secure, remember settings for, measure, and improve the Services.
  • Essential Technologies. Some Technologies are necessary for security, geofencing, network management, load balancing, session continuity, fraud prevention, and core Interface functions. Disabling them may prevent the Services from functioning correctly.
  • Analytics Technologies and Cookie Choices. We may use analytics Technologies to understand use and performance. Where required by law, we will obtain consent before using non-essential Technologies. You may use an available cookie-preference tool or browser controls to manage them, although browser settings may not control every technology.

3.3 Information Collected from Other Sources

• Third-Party Sources. We may obtain personal information from wallet providers, Third-Party Services, public blockchain networks, blockchain-data and analytics providers, sanctions and compliance providers, geolocation and network-intelligence providers, fraud and security providers, infrastructure and hosting providers, and other public or commercial sources. The categories received may include the wallet, transaction, technical, location, risk, and eligibility information described above.
• Blockchain Information. We may collect or analyze publicly available blockchain information, including wallet addresses, balances, token holdings, transfers, transaction hashes, signatures, approvals, smart-contract interactions, timing, asset types, amounts, counterparties, and related on-chain activity.

4 How We Use Your Information

We use personal information for the purposes described below and in any collection-point notice presented to you. The legal conditions and lawful bases that may support these purposes are described under “Supervisory Authorities and Legal Bases” below.

4.1 Provide Our Services

We use personal information to perform our Terms of Use, take steps at your request before providing the Services, and provide the Services you request, including:

• Connecting a compatible wallet and reading the public wallet information needed to establish that connection;
• Displaying wallet balances, public transaction history, market information, protocol information, and other Interface content;
• Constructing or routing transaction instructions to your wallet or a Third-Party Service at your request;
• Making selected integrations, products, routes, and other Interface features available to you;
• Determining feature availability and applying location, eligibility, wallet, and access controls associated with your requested use;
• Responding to customer, technical, privacy, or security support requests;
• Sending operational, security, legal, and policy notices concerning the Services; and
• Maintaining service availability, remembering settings, diagnosing errors, and supporting requested interactions.

4.2 Administrative Purposes

We use personal information for our legitimate interests, to comply with legal obligations, and for other administrative purposes permitted by applicable law, including:

• Operating, securing, monitoring, and improving the Services; preventing fraud, market manipulation, abuse, and circumvention of access controls; enforcing geographic restrictions and our agreements; protecting DeepBook Trading, users, and third parties; and understanding use of the Services, except where those interests are overridden by your rights under applicable law;
• Detecting, preventing, investigating, and responding to security incidents, malicious or deceptive activity, fraud, sanctions risk, illicit-finance risk, market abuse, unauthorized access, geoblocking evasion, and violations of our agreements or applicable law;
• Carrying out analytics concerning use, performance, availability, and security of the Services;
• Creating aggregated or de-identified information and not attempting to reidentify it except as permitted or required by applicable law;
• Measuring engagement with and demand for the Services and particular features;
• Improving, upgrading, and enhancing the Services;
• Developing and testing new or modified Interface features, integrations, and controls;
• Maintaining internal quality control, safety, business continuity, and recordkeeping;
• Authenticating and verifying individuals who submit privacy, support, or security requests;
• Debugging to identify and repair errors affecting the Services;
• Auditing Interface access, eligibility determinations, geofence decisions, wallet-screening decisions, security events, and transaction-construction or routing events;
• Disclosing personal information as reasonably necessary to provide and protect the Services;
• Enforcing our agreements, geographic restrictions, eligibility controls, and policies; and
• Complying with legal obligations, lawful requests, and the establishment, exercise, or defense of legal claims.

4.3 Communications

We may use contact information to respond to you and to send support, operational, security, legal, or policy communications. With your consent, or as otherwise permitted by applicable law, we may also send optional news or product updates. You may unsubscribe from promotional emails using the link in the message, but may continue to receive non-promotional communications concerning a request you made, security, or changes to the Services or our legal terms.

4.4 With Your Consent

Where we rely on consent, we will describe the relevant processing when consent is requested. You may withdraw consent at any time, without affecting processing that occurred before withdrawal. A feature may become unavailable if the withdrawn consent is necessary to provide it.

4.5 Other Purposes

We may also use personal information as you request, for compatible purposes permitted by applicable law, or after providing any additional notice or obtaining any additional consent required by law.

5 How We Disclose Your Information

We disclose personal information to provide and protect the Services, carry out transactions and integrations you request, comply with law, and complete corporate transactions, as described below.

5.1 Disclosures to Provide Our Services

The categories of recipients to whom we may disclose personal information are described below.

• Service Providers. We may disclose personal information to providers of hosting, cloud, network and blockchain infrastructure, RPC services, analytics, security, geolocation, network intelligence, VPN, proxy and Tor detection, wallet screening, sanctions and illicit-finance screening, fraud prevention, customer support, communications, data storage, and professional services. Depending on the service and law, a provider may process information on our instructions or for independently determined purposes disclosed in its own privacy policy.
• Wallet, Protocol, and Other Third-Party Service Providers. When you connect a wallet, select an integration, or request a transaction, we may disclose your public wallet address, transaction instructions, selected route or product, and other information necessary to carry out the request to the relevant wallet provider, Protocol Service, data provider, blockchain network, or other Third-Party Service. Those providers may process the information independently under their own privacy policies.
• Affiliates. We may disclose personal information to our parent or other corporate affiliates where reasonably necessary for shared administration, infrastructure, security, compliance, support, professional advice, or a corporate transaction, in each case consistently with this Privacy Policy and applicable law. A corporate relationship does not make DeepBook Trading the controller of a service for which another entity independently determines the purposes and means of processing.
• Directed Transactions and Integrations. We disclose information to transaction recipients, public blockchain networks, validators, smart contracts, protocols, and integrations when you direct us to construct or route a transaction or interaction. Information submitted on-chain becomes public as described above.
• Other Users and Public Participants. Other users, researchers, analytics providers, market participants, and members of the public may view information recorded on a public blockchain. Information you voluntarily publish in a public channel may also be visible to others.

5.2 Disclosures to Protect Us or Others

We may access, preserve, and disclose information to governmental, regulatory, judicial, law-enforcement, or other third parties where we reasonably believe disclosure is required or appropriate to comply with law or legal process; protect the rights, property, or safety of DeepBook Trading, users, or others; enforce our agreements and access controls; investigate or prevent fraud, sanctions violations, illicit finance, market manipulation, geoblocking evasion, security incidents, or other unlawful conduct; collect amounts owed; or establish, exercise, or defend legal claims.

5.3 Disclosure in the Event of Merger, Sale, or Other Asset Transfers

If DeepBook Trading is involved in a merger, acquisition, financing, due diligence, reorganization, insolvency, sale of assets, or transition of the Services, personal information may be disclosed or transferred as part of that transaction, subject to applicable law and appropriate confidentiality protections.

6 Your Privacy Choices and Rights

The choices and rights available to you depend on applicable law and the processing involved. Exercising a privacy right will not result in unlawful discrimination.

• Email Communications. You may unsubscribe from optional promotional emails using the link in the message. You may still receive non-promotional communications relating to support requests, security, legal notices, or changes to the Services, Terms of Use, or this Privacy Policy.
• Browser Privacy Signals. Browsers may transmit Global Privacy Control, Do Not Track, or similar signals. We process legally recognized preference signals as required by applicable law. Because other signals are not governed by a uniform standard, the Services may not respond to them. Security, geofencing, and fraud-prevention processing may continue where permitted or required by law.
• Cookies and Similar Technologies. You may manage non-essential Technologies through any preference tool we make available and through browser or device settings. Settings are generally browser- and device-specific. Blocking Technologies may impair portions of the Services and will not remove information already recorded on a public blockchain.

Your Privacy Rights. Depending on applicable law, you may have the rights listed below. Under Panama Law No. 81, the rights of access, rectification, cancellation, opposition, and portability are available subject to applicable conditions and exceptions.

• Be informed about the categories, sources, purposes, legal conditions, recipients, transfers, and retention of your personal information;
• Access personal information about you and obtain information about its origin, processing, and purposes;
• Request rectification of personal information that is inaccurate, incomplete, irrelevant, outdated, false, or otherwise improper;
• Request cancellation or deletion of personal information where the applicable legal conditions are satisfied;
• Object to or request restriction of particular processing and, where applicable, opt out of a sale or sharing of personal information for targeted advertising or qualifying profiling;
• Request portability of personal information in a structured, commonly used format where applicable;
• Withdraw consent at any time, without retroactive effect, where processing is based on consent;
• Request information about, contest, or request human review of a qualifying decision based solely on automated processing where applicable law provides that right;
• Receive notice of a personal-information breach where required by applicable law; and
• Lodge a complaint with the Autoridad Nacional de Transparencia y Acceso a la Información (“ANTAI”) or another competent supervisory authority.

To exercise a right, contact us as described under “Contact Us” below. We will process your request in accordance with applicable law and generally will not charge a fee unless a request is manifestly unfounded, excessive, or otherwise subject to a lawful fee.

We may decline or limit a request where permitted by law, including where information must be retained for security, fraud prevention, sanctions or illicit-finance controls, legal claims, regulatory obligations, public blockchain immutability, transaction integrity, or the rights of others. If deletion of DeepBook Trading-controlled records is available, it will not delete information independently recorded on a public blockchain or held by a Third-Party Service.

To protect privacy and security, we may take proportionate steps to verify a request, including asking you to confirm an email address, wallet address, relevant transaction information, or control of a wallet through a signed message. We will never ask for your private key, seed phrase, or recovery phrase.

Where applicable law permits an authorized representative to act for you, we may require proof of the representative’s authority and may verify your identity directly.

If applicable law gives you a right to appeal a decision concerning a privacy request, you may appeal by contacting us and identifying the decision and reasons for your appeal.

7 International Data Transfers

DeepBook Trading and the service providers and recipients described in this Privacy Policy may process personal information in Panama, the United States, and other countries in which they operate. Those countries may have privacy laws that differ from the laws where you live. We disclose this intention to transfer personal information outside Panama and apply the transfer conditions and safeguards required by applicable Data Protection Legislation.

For personal information originating or stored in Panama, a cross-border transfer will rely, as applicable, on your consent, necessity for a contract or requested transaction, an intra-group transfer for consistent purposes, contractual safeguards, protection standards equal to or higher than those required by Panama law, or another condition permitted by Article 33 of Law No. 81 of 2019. Where European Economic Area, United Kingdom, or Swiss transfer rules apply, we may use adequacy decisions, standard contractual clauses, or another recognized safeguard.

For more information about safeguards used for international transfers, contact us as described below.

8 Security and Retention of Personal Information

We use administrative, technical, and organizational measures designed to protect personal information against loss, misuse, unauthorized access, disclosure, alteration, and destruction. These measures may include access controls, confidentiality obligations, logging, vendor diligence, incident-response procedures, and protection appropriate to the nature and risk of the processing. No system or transmission method is completely secure.

If we become aware of a personal-information security breach, we will investigate, document, mitigate, and notify ANTAI, affected individuals, or other authorities where and within the time required by applicable law.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services; maintain security and business records; document eligibility, geofencing, wallet-screening, and access decisions; investigate fraud, abuse, sanctions risk, market manipulation, and incidents; resolve disputes; enforce agreements; and comply with legal, tax, accounting, or regulatory obligations.

Retention periods depend on the category and sensitivity of the information, the purpose and risk of processing, applicable limitation periods and legal requirements, and whether the purpose can be achieved through deletion, aggregation, or de-identification. When retention is no longer justified, we will delete, de-identify, or securely dispose of DeepBook Trading-controlled information in accordance with applicable law.

Information recorded on a public blockchain may be permanent and outside DeepBook Trading’s control.

9 Children’s Information

The Services are not directed to individuals under 18, and the Terms of Use do not permit them to use the Interface. We do not knowingly collect personal information from individuals under 18. If you believe an individual under 18 has provided personal information to us, contact us as described below. We will take appropriate steps to delete the information unless we are legally required to retain it.

10 Third-Party Websites, Applications, and Protocols

The Services may link to or integrate Third-Party Services, including wallets, public blockchains, decentralized applications, protocols, smart contracts, data providers, exchanges, marketplaces, and other websites or applications. Those providers are not controlled by DeepBook Trading merely because the Interface links to, displays, constructs a transaction for, or routes an instruction to them. Their processing is governed by their own privacy policies and terms, except to the extent DeepBook Trading separately processes personal information for the purposes described here. We encourage you to review each provider’s privacy policy before use.

11 Supervisory Authorities and Legal Bases

You may lodge a complaint with ANTAI if you believe DeepBook Trading’s processing violates Panama law. If another Data Protection Legislation applies to you, you may also have the right to complain to the competent authority in the relevant jurisdiction. We encourage you to contact us first so that we can address your concern.

Our Legal Bases for Processing Personal Information. Depending on the processing and applicable law, we rely on performance of a contract or steps requested before a contract; legitimate interests such as operating, securing, improving, and protecting the Services, enforcing geographic restrictions, preventing fraud, manipulation, and abuse, and protecting legal rights; consent; compliance with legal obligations; processing authorized by law; and processing of information from public sources or within an established commercial relationship as permitted by law. The table below summarizes the principal bases.

12 Contact Us

The DeepBook Trading Foundation is the controller of personal information processed for the purposes described in this Privacy Policy unless a collection-point notice expressly states otherwise.

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise a privacy right, contact us at: