Privacy Notice

Last Updated: 29 October 2026

1. INTRODUCTION

Thank you for visiting OKX.com. OKX, as a data controller, provides this Privacy Notice to describe our practices regarding the collection, storage, use, disclosure, and other processing of Personal Data. This includes the legal bases upon which we rely, your rights, safeguards applicable to cross-border data transfers, and how to contact us.

This Notice applies to users, prospective users, website visitors, and any individual whose Personal Data OKX processes in connection with the OKX Platform and Services (the "OKX Platform"). It does not apply where OKX acts as a data processor on behalf of a separate controller, nor does it apply to job applicants or employees (who are covered by a separate employee privacy policy).

This Notice should be read alongside any supplementary notices that apply to you, including the OKX Supplementary Notice on AML/CFT Cross-Border Data Sharing (which applies to multi-entity customers) and the OKX Biometric Data Policy.

By using the OKX Platform, you acknowledge that you have read and understood this Notice. Where your consent is required for specific processing activities, it will be obtained separately and in advance.

2. CONTROLLER AND CONTACT DETAILS

The OKX entity acting as Data Controller depends on your jurisdiction and registration date:

Check the entity named in your account agreement and any applicable local or product privacy notice to identify the controller for your service. If your relationship is not covered by the table below, contact privacyoffice@okx.com for clarification rather than assuming that a particular group entity is your controller. Where a separate local notice applies, read it together with this Notice as applicable.

Data Protection Officer

OKX has designated a Group Data Protection Officer (DPO) responsible for overseeing data protection compliance across the OKX Group. The DPO may be contacted at:

• Email: privacyoffice@okx.com

• Ioannis Giannakakis | OKX Europe Limited | Piazzetta Business Plaza, Office Number 4, Floor 2, Triq Ghar il-Lembi, Sliema, SLM 1562, Malta.

Joint Controllership (Multi-Entity Customers)

Where you hold accounts with more than one OKX Group entity simultaneously, each entity is an independent data controller in relation to the personal data it collects for its own regulatory obligations. In specific circumstances, in particular, the cross-border sharing of AML/CFT risk data described in Section 8, two or more OKX Group entities may act as joint controllers.

3. DEFINITIONS

4. PERSONAL DATA WE COLLECT

OKX collects Personal Data you provide directly, data collected automatically through your use of our Services, and data received from third parties.

Data You Provide

• Identity and contact: full name, email, telephone, date of birth, nationality, residential address, government-issued identification documents.

• Institutional (business accounts): corporate legal name, registration number, proof of legal existence, beneficial owner information, business description, source of funds / wealth.

• Commercial information: data related to transactions conducted on the OKX Platform.

• Financial: bank account details, credit/debit card numbers, source of funds, assets and liabilities.

• PEP and sanctions: information about whether you or a close associate holds a prominent public function.

• Correspondence and support information: customer-support messages, chat and ticket histories, survey responses, submitted images and screenshots, and voice or video recordings where calls or verification sessions are recorded. This may include account context, payment evidence and other information you provide to resolve an enquiry or dispute.

• Optional profile: avatar, display name, nickname.

• Tax information: your country or countries of tax residence, tax identification number, tax self-certification, and information about reportable crypto-asset transactions.

Data Collected Automatically

• Technical identifiers: IP address, MAC address, device fingerprint, unique device identifiers, operating system, browser type and version.

• Usage and behavioral: session data, clickstream, page interaction signals, approximate geolocation derived from IP address.

• Application data: information about applications installed on your device where necessary to detect malicious software or device compromise that may affect your account security.

Data Received from Third Parties

• Identity verification: information from identity-verification service providers and, where you use an available government or bank-based verification service, the relevant identity or address records. Biometric information may be processed during onboarding or subsequent verification; see Section 18. Providers vary by service and jurisdiction.

• AML / fraud: from sanctions screening, PEP database, and fraud intelligence providers (including Refinitiv World-Check, Dow Jones Risk & Compliance, Moody's).

• Payment: from banks and payment processors, including your name, account details, and transaction information.

• Referral: from referrers, affiliates, and marketing partners.

AML/CFT Data Shared Within the OKX Group (Multi-Entity Customers)

If you hold accounts with more than one OKX Group entity, authorized compliance personnel may share relevant personal data between those entities for the AML/CFT purposes described in Section 8. This may include identity and verification information, customer risk assessments, sanctions and transaction-monitoring information, biometric entity-matching data, and relevant device or technical information.

AI Agent Product

If you authorize a third-party AI agent to access your account, we process authorization records, account and verification status, device and network information, and any additional identity-verification information required for security purposes (see Section 18). Access is limited to the permissions you grant.

Support, AI processing and derived information. Where AI-assisted support or risk services are used, relevant messages, images, screenshots, account identifiers, transaction information and risk context may be processed as model inputs. We may retain relevant model outputs, support assessments, risk indicators and processing records for the purposes described in Sections 5–7, subject to Section 11. Not every service uses every data category.

Events and community participation. Where you participate in our events, surveys, community programmes or hospitality arrangements, we collect the information needed to administer your participation, such as your name, business contact details, company/title, social or community handles, registration details and survey responses.

5. LEGAL BASIS FOR PROCESSING - PURPOSE-to-BASIS MAPPING 

Additional purpose-to-basis detail: VIP/fee-tier administration relies on contract performance where necessary to provide the service; relevant customer segmentation relies on legitimate interests in customer engagement, subject to applicable consent requirements for marketing. Event/community administration uses the basis explained at collection, such as consent or legitimate interests in organising participation. Travel Rule disclosures rely on applicable legal obligations; merchant-checkout, custody and protection/claims administration use contract performance where necessary for the requested service and applicable legal obligations. AI tools do not create a separate lawful basis: each support, risk or evaluation use must satisfy the basis and safeguards applicable to its specific purpose. Where biometric data is used, the additional conditions in Section 18 apply.

6. HOW WE USE YOUR PERSONAL DATA

In addition to the purposes mapped in Section 5, OKX uses your Personal Data to:

• Administer your account, process transactions, and deliver requested Services;

• Comply with applicable legal and regulatory obligations, including AML/CFT, sanctions, and tax reporting;

• Detect, investigate, and prevent fraudulent transactions, unauthorized access, and prohibited activities;

• Communicate with you about your account, material changes to our Services, and legal or operational notifications;

• Improve our platform, develop new products, and conduct internal analytics and research;

• Conduct group-wide AML/CFT risk assessment for multi-entity customers (see Section 8);

• Send you marketing communications about OKX products and services, with your consent.

Information Reporting Regimes

We use your tax residence, tax identification number, tax self-certification and information about reportable crypto-asset transactions to conduct required tax due diligence and comply with applicable laws implementing the Common Reporting Standard (including CRS 2.0), the OECD Crypto-Asset Reporting Framework (CARF), DAC8, or similar tax-reporting regimes. CARF and CRS are international frameworks implemented through applicable local laws, so requirements may vary by jurisdiction. Where legally required, we report relevant information to the competent tax authority, which may exchange it with tax authorities in jurisdictions where you are tax resident.

If you do not provide information that we are legally required to collect, we may be unable to open or maintain your account or provide certain services.

AI-assisted support and risk reviews. We use AI tools to assist with customer enquiries, assess support quality and evaluate fraud or compliance risks. Relevant information may be processed by model-service providers and retained in relevant processing records. Outputs may include responses, summaries, support assessments and risk indicators. Section 5 explains the purposes and bases; Section 7 describes account decisions and human-review arrangements.

Quality evaluation and testing. We may use relevant customer interactions, dispute records and model inputs/outputs for controlled quality evaluation and testing of support or risk tools, subject to an appropriate lawful basis and purpose limitations. We minimise the information used and anonymise or redact it where feasible. This evaluation is distinct from a provider’s use of customer data to train general-purpose models; any such use requires a separate assessment and any information or consent required by applicable law.

VIP tiers and customer engagement. Where applicable to your service, we use trading volume, holdings, account status and relevant engagement information to administer fee or VIP tiers and identify relevant service communications or offers. Tier administration supports provision of the service; customer segmentation supports our interest in relevant customer engagement, subject to applicable marketing-consent and objection requirements. These commercial purposes are distinct from the restricted AML/CFT sharing described in Section 8.

Transfer compliance and product participation. We process relevant originator and beneficiary information to meet applicable Travel Rule requirements. Where you use a merchant-checkout, insurance/protection or custody service, we process the information needed to administer that service, including relevant payment, identity, custody or claims information. Applicable product notices explain service-specific processing.

Events and communities. We use registration, contact and participation information to organise events, administer community programmes, arrange guest access and respond to surveys or enquiries. The applicable collection notice explains the purpose and basis for that interaction. Marketing communications remain subject to Section 17.

7. AUTOMATED DECISION-MAKING, PROFILING, AND ENTITY-MATCHING

OKX uses automated processing and AI-assisted systems for the purposes described below. Human-review arrangements differ by decision type. Final identity-verification decisions, potential sanctions matches, material changes to customer risk assessments and confirmation of biometric entity-matches are subject to the safeguards in the table. Some temporary security restrictions and AI-agent authorization blocks may take effect automatically before review; creditworthiness decisions may be reviewed on request. Your review and challenge rights are explained below. Third-party AI-agent trading is not subject to an OKX pre-trade human-review commitment.

Your Rights Regarding Automated Decisions

Where an automated decision produces a legal or similarly significant effect on you, you have the right to: (a) request human review by a qualified OKX employee; (b) express your point of view and provide additional information; and (c) contest the decision and request reconsideration. Contact privacyoffice@okx.com with subject 'AUTOMATED DECISION REVIEW REQUEST.'

Transparency About AI-Assisted Processing

The information in this section explains the purposes, relevant data inputs and potential effects of automated or AI-assisted processing. Additional information may be provided in the relevant product or interaction notice. The use of AI does not itself determine a system’s regulatory classification or the lawful basis for processing personal data.

AI-Driven Risk Check

Automated security checks may require additional identity verification before third-party agent access is authorized. If verification is not completed successfully, access may be blocked. You may request review by contacting privacyoffice@okx.com with the subject 'AUTOMATED DECISION REVIEW REQUEST.'

Third-Party AI Agent Autonomous Trade Execution

Where you authorize a third-party AI agent via a delegated authorization flow, that agent may execute trades and access account data on your behalf within the scope of permissions granted. OKX provides the authentication infrastructure only and does not build, operate, or control the third-party AI agent's decision-making. Trading decisions are made autonomously by the third-party provider without real-time human review. Monitor AI agent activity and revoke access immediately if unexpected trades occur.

When authorizing a third-party AI agent, review the provider’s identity, the account-data and trading permissions requested, and the available access-revocation controls. The provider’s own notice explains how it handles information obtained through that authorization.

8. AML/CFT INTRA-GROUP DATA SHARING (MULTI-ENTITY CUSTOMERS)

The Information-Sharing Framework

Where required or permitted by applicable law, authorized compliance personnel may share relevant personal data with other OKX Group entities where you hold accounts to support group-wide customer due diligence, transaction monitoring and financial-crime prevention.

This sharing is subject to strict purpose limitation: it may only occur for the purposes of AML/CFT compliance and is limited to authorized Compliance personnel. It does not permit sharing for commercial, marketing, or other non-compliance purposes.

Account Restriction and Cross-Entity Freezing

Where an OKX Group entity is legally required to freeze or restrict your account under applicable sanctions legislation or regulatory direction:

• The entity imposing the restriction will notify other OKX Group entities in which you hold accounts of the fact of the restriction and, to the extent legally permissible, its regulatory basis.

• Each receiving entity independently assesses whether its applicable law requires a corresponding restriction. A restriction in one jurisdiction does not automatically result in a restriction in another.

• Sanctions obligations vary significantly between jurisdictions. A match under one jurisdiction's list does not automatically create a legal obligation in another jurisdiction, but will trigger a review.

Legal Basis

• Primary basis: Legal obligation (4AMLD Art. 45 group controls; applicable national AML law).

• Secondary basis: Legitimate interests in group-wide financial crime prevention.

• Biometric entity-matching: Substantial public interest (AML/CFT), supplemented by applicable national law. See Section 18 for the biometric processing purposes and legal basis, and any applicable jurisdiction-specific provisions in Section 21.

9. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

OKX may disclose Personal Data to the recipient categories below only for the relevant purpose. Service providers process data under appropriate contractual protections. Some product, payment, event or other partners act as independent controllers and explain their own processing in their privacy notices; disclosures to authorities are assessed against the applicable legal requirements.

• OKX Group companies: Subsidiaries, holding companies, and affiliated entities within the OKX Group — including for AML/CFT intra-group sharing as described in Section 8.

• Identity-verification service providers: providers supporting document, government/bank-based, video and biometric verification, depending on the service and jurisdiction, including Au10tix, Jumio and Sumsub. Their existing notice links appear in Section 18; further information is provided with the relevant verification service where applicable.

• AML, fraud, and sanctions service providers: Refinitiv World-Check, Dow Jones Risk & Compliance, Moody's, and equivalent providers.

• Biometric entity-matching service providers: providers supporting the verification described in Section 18, acting as processors under data processing agreements.

• Payment processors and banking partners: Entities facilitating fiat transfers, card issuance, and payment processing.

• IT, infrastructure, and analytics providers: Cloud hosting, data storage, customer support platforms, and analytics services.

• Professional advisors: Legal counsel, auditors, and compliance consultants.

• Regulators, FIUs, and law enforcement: Where required by applicable law, court order, or lawful regulatory request, including STR/SAR disclosures to Financial Intelligence Units.

• Tax authorities: Where required by applicable law, we disclose relevant tax and reportable crypto-asset transaction information to competent tax authorities. Those authorities may exchange the information with tax authorities in jurisdictions where you are tax resident.

• Prospective acquirers: In the context of a merger, acquisition, or sale of all or part of OKX's business, subject to confidentiality obligations.

• Prospective Service Providers: Before entering a service agreement, OKX may share a limited, pseudonymized dataset with a prospective provider to evaluate their technical capabilities. Any such sharing is governed by a data protection agreement, restricted to evaluation purposes, and the recipient must delete the data upon completion.

OKX does not sell your Personal Data to third parties for their own commercial use.

All third-party processors are subject to data processing agreements imposing data protection obligations at least equivalent to those in this Notice.

AI and model-service providers. Where used for support, risk reviews or controlled quality evaluation and testing, these providers process relevant messages, images, account/risk context and model inputs/outputs described in Sections 4–7. Supporting infrastructure providers may also process relevant processing records.

Travel Rule recipients. Where required for a transfer, relevant originator and beneficiary information is shared with the sending or receiving financial institution or virtual-asset service provider, directly or through Travel Rule compliance providers.

Product and event partners. Where you use the relevant service or participate in an event, we share necessary information with merchants, payment partners, insurers/underwriters, custody institutions, event organisers, ticketing partners or agencies. A partner acting as an independent controller handles that information under its own privacy notice. Relevant product or event notices provide further details.

10. INTERNATIONAL DATA TRANSFERS

OKX operates globally and transfers Personal Data to countries other than the country in which it was collected. All international transfers are conducted subject to appropriate safeguards.

Transfers from the EEA

• To countries with a European Commission adequacy decision: transfers proceed without additional safeguards.

• For transfers to countries not covered by an applicable European Commission adequacy decision, OKX uses an applicable lawful transfer mechanism, including the EU Standard Contractual Clauses with the module appropriate to the parties’ roles, such as controller-to-controller or controller-to-processor, together with transfer assessments and supplementary measures where required.

• In exceptional circumstances, we may rely on a derogation under Article 49 GDPR only where its specific legal conditions are met. For transfers necessary for important reasons of public interest, that interest must be recognised in applicable EU or Member State law. These exceptions are not a routine substitute for appropriate transfer safeguards

Transfers from the United Kingdom

• OKX relies on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU SCCs for transfers to non-adequate countries.

Transfers from Other Jurisdictions

• Malaysia: PDPA 2010 s. 129 contractual arrangements ensuring equivalent protection.

• Singapore: PDPA section 26 and the applicable transfer regulations; contractual arrangements ensuring a standard of protection comparable to that under the PDPA.

• Australia: APP 8.1 contractual obligations binding the overseas recipient to the Australian Privacy Principles.

• Brazil: LGPD Art. 33, CD/ANPD n. 19/2024 - standard contractual clauses or other approved mechanisms.

The OKX Group operates globally, and your Personal Data may be stored or processed in any country where we are licensed, maintain a presence, or engage service providers, including Vietnam and other jurisdictions where OKX or its service providers operate. All such transfers comply with applicable data protection laws and your Personal Data is protected to the standards in this Notice. Courts, law enforcement, and regulatory authorities in those countries may have lawful access to your Personal Data.

A Transfer Impact Assessment has been conducted in relation to OKX Group transfers to the Seychelles, having regard to the Seychelles Data Protection Act 2023.

You may request information about the transfer safeguards relevant to your personal data, including a copy of applicable contractual safeguards, by contacting privacyoffice@okx.com. Copies may be redacted where necessary to protect confidential information or others’ rights.

11. DATA RETENTION SCHEDULE

OKX stores Personal Data in its own systems and those of its affiliates and third-party storage providers. All storage arrangements are subject to contractual data protection obligations, at least equivalent to those set out in this Notice. A summary of our information security safeguards is provided in Section 12.

For information about international storage, processing and transfer safeguards, see Section 10 (International Data Transfers).

OKX retains your Personal Data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. Where no statutory period applies, data is held only for as long as the original purpose requires, then securely deleted or irreversibly anonymized. Retention periods may be extended where required by a legal hold, regulatory direction, or pending legal proceedings.

The criteria used to determine retention differ by record type:

• Account, KYC, AML and transaction records: the duration of the relationship or relevant transaction, followed by the recordkeeping period required by the applicable entity’s legal and regulatory obligations.

• Support messages, tickets and recordings: the time needed to resolve the enquiry or dispute, review service quality and address relevant complaint, fraud or legal-claim periods. Images and recordings may have shorter retention than the related case record.

• Biometric inputs and verification results: the time needed for the particular verification purpose, subject to applicable biometric destruction rules and any separately justified recordkeeping obligations. Raw biometric inputs and pass/fail or audit records are assessed separately; see Section 18.

• Marketing, community and event records: the time needed to administer participation, maintain applicable consent or suppression records and address relevant follow-up or legal requirements. Withdrawal of consent does not necessarily require deletion of the minimum record needed to respect your marketing preference.

• AI inputs, outputs, processing records and evaluation datasets: the time needed for the specific support, risk, security or quality-evaluation purpose. Evaluation datasets and uploaded images are assessed separately from the underlying account or support record. Retention remains subject to applicable legal compliance and recordkeeping obligations.

Contact privacyoffice@okx.com for information about retention applicable to your records. Any service-specific period provided in a supplementary notice applies to that service, subject to applicable legal holds and mandatory recordkeeping requirements.

12. INFORMATION SECURITY

We use technical and organizational safeguards appropriate to the personal information and processing involved, including encryption, authentication and access controls, security monitoring and testing, and secure disposal.

To report a security concern, contact security@okx.com.

13. YOUR RIGHTS

Subject to verification of your identity and applicable legal exceptions, you have the following rights. Rights specific to California residents are set out in Section 19. GLBA disclosures and the separate OKX and WebBank GLBA Privacy Notices for US customers are in Section 20. Visit this Portal to exercise your rights.

GDPR / UK GDPR Rights

Supervisory Authority Contacts

• EEA: The competent data protection authority in your EEA country of habitual residence or work. See the EDPB authority directory.

• UK: Information Commissioner's Office (ICO) - ico.org.uk | 0303 123 1113

• Australia: Office of the Australian Information Commissioner (OAIC) - oaic.gov.au

• Malaysia: Personal Data Protection Commissioner (PDPC) - pdp.gov.my | Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, Federal Government Administration Center, 62100 Putrajaya, Malaysia | Tel: +60 3 7456 3888 | aduan@pdp.gov.my

• Singapore: Personal Data Protection Commission (PDPC) - pdpc.gov.sg

• Brazil: Agência Nacional de Proteção de Dados (ANPD) - gov.br/anpd

• California: California Privacy Protection Agency (CPPA) - cppa.ca.gov

• Seychelles: Information Commission, Republic of Seychelles - infocom.sc | P.O. Box 1342, KLA Residence, 3rd Floor, Room 9, Mont Fleuri | Tel: +248 4303188 | enquiries@infocom.sc

• El Salvador: Agencia de Ciberseguridad del Estado (ACE) - ace.gob.sv | Tel: +503 7530-6114 | contacto@ace.gob.sv

• Argentine: Agencia de Acceso a la Informacion Publica (AAIP) - argentina.gob.ar/aaip

• The Bahamas: Office of the Data Protection Commissioner - dataprotection.gov.bs | dataprotection@bahamas.gov.bs | +1 242 604 1001.

14. CONSENT WITHDRAWAL

Where OKX processes your Personal Data on the basis of consent, you may withdraw that consent at any time via:

• Email: privacyoffice@okx.com | Subject: 'CONSENT WITHDRAWAL REQUEST'

Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

15. COOKIE POLICY

Manage cookie preferences via the Cookie Preference Centre. A full Cookie Notice listing each cookie by name, provider, purpose, and duration is available at the site.

16. CHILDREN’S PERSONAL DATA

OKX does not knowingly offer Services to or collect Personal Data from individuals under the age of 18. If OKX becomes aware of inadvertent collection of a minor's data, it will be promptly deleted. Notify us at privacyoffice@okx.com if you are aware of a minor using our Services.

17. COMMUNICATIONS AND MARKETING

OKX will only send direct marketing communications with your prior consent. Opt out at any time via the unsubscribe link in any marketing communication or by contacting our Customer Support at the Support Center.

Service communications such as account notifications, policy updates, security alerts, and transaction confirmations are sent on the basis of contract performance or legal obligation and cannot be opted out of during an active account.

18. BIOMETRIC DATA

OKX processes biometric data for the distinct purposes described below, with the applicable legal basis identified for each purpose.

Identity Verification (Onboarding)

Biometric verification during account onboarding is performed by the following third-party processors:

• Au10tix: Au10tix Biometric Data Policy | Au10tix Privacy Notice

• Jumio: Jumio Privacy Notice

• Sumsub: Sumsub Privacy Notice

Legal basis: Explicit consent. Explicit consent is obtained prior to biometric data collection during onboarding.

Support, Account Recovery and Security Re-Verification

We may request identity re-verification when you contact support, recover your account or complete security checks. Depending on the method, we process identity documents, selfies or video, biometric verification data and verification results, directly or through verification providers.

Where biometric processing relies on consent, we obtain explicit consent before collection. The verification notice explains the purpose and applicable retention arrangements; Section 11 provides our general retention criteria.

You may withdraw consent through the process in Section 14 or contact Customer Support about available alternatives. Withdrawal does not affect prior lawful processing. We may be unable to complete the requested action until applicable verification requirements are met.

Biometric Entity-Matching Across Group Entities (Multi-Entity Customers)

For multi-entity customers, OKX Group may process biometric data, specifically, facial geometry and biometric confidence scores derived from selfie photographs and liveness checks submitted during onboarding to determine whether individuals who have submitted different identity credentials to different OKX Group entities are the same individual ('entity-matching').

Legal basis: Processing necessary for reasons of substantial public interest (AML/CFT prevention, detection, and investigation of financial crime), read together with applicable national implementing legislation. Where required by applicable national law, explicit consent or an alternative derogation may additionally be relied upon.

Identity Verification for AI-Agent Authorization

We may request biometric identity verification when you authorize a third-party AI agent to access your account. We obtain explicit consent before collecting biometric verification data for this purpose. Raw biometric data is deleted when the verification session ends, unless retention is required by applicable law. Verification results may be retained for security, audit and legal compliance purposes, subject to the retention criteria in Section 11. The applicable verification notice provides further details.

US State Biometric Laws

• Illinois (BIPA, 740 ILCS 14/15): OKX collects biometric identifiers (facial geometry) solely for identity verification. A written policy on collection, retention, and destruction is maintained. Written consent is obtained prior to collection. OKX does not sell, lease, trade, or profit from biometric identifiers.

• Texas (CUBI Act, Bus. & Com. Code Ch. 503): Informed consent is obtained prior to collection. OKX does not sell biometric identifiers.

• Washington (HB 1493): Biometric identifiers are collected only for the specific purposes described in this section with appropriate consent.

Exercising Rights in Relation to Biometric Data

Submit requests to privacyoffice@okx.com with subject 'BIOMETRIC DATA REQUEST.' Deletion of biometric data prior to KYC completion may affect your ability to access certain Services. Deletion requests in relation to entity-matching data are subject to any applicable AML retention requirements and restrictions.

19. ADDITIONAL RIGHTS FOR CALIFORNIA RESIDENTS (CCPA/CPRA)

This Section applies to California residents and supplements the general rights set out in Section 13. In the event of conflict, this Section governs for California residents. The rights described in this section apply to the extent provided by applicable law and are subject to relevant exceptions and exemptions. For information covered by the GLBA-related exemption, please also refer to the applicable GLBA Privacy Notices in Section 20.

Categories of Personal Information Collected During the Preceding 12 Months

• Identifiers: Name, email, IP address, account username, government ID number.

• Personal records: Financial account information, bank account details.

• Protected classification characteristics: Nationality, date of birth.

• Commercial information: Transaction history, trading activity, account balances.

• Biometric information: Facial geometry for identity verification and entity-matching.

• Internet or electronic network activity: Usage data, log information, device identifiers.

• Geolocation data: IP-derived approximate location.

• Sensitive personal information: Government ID, financial account details, biometric identifiers.

• Audio, electronic and visual information: recorded support calls or verification sessions, submitted images and screenshots, where collected.

• Inferences: relevant support-quality/sentiment assessments, fraud/risk indicators and customer segments or VIP/fee-tier classifications derived from the data described in this Notice.

Section 4 describes the sources of personal information, and Sections 5–7 describe the purposes for which we process it. Business-purpose disclosures. During the preceding 12 months, as described in Section 9, we have disclosed relevant identity and verification information to identity-verification providers; account, transaction and risk information to banking, payment, AML and fraud-prevention partners; and relevant technical, usage and support information to infrastructure, analytics, customer-support and AI-service providers. We have also disclosed necessary information to group companies, professional advisers, product or event partners and competent authorities for the purposes described in Sections 5–7. The categories involved depend on the service and purpose; not every recipient receives every category. Section 11 explains retention criteria. This 12-month disclosure period does not limit how long information may be retained or your right to request access to older retained information.

Sensitive personal information. We use and disclose sensitive personal information only for purposes permitted under California law without offering a right to limit, and only to the extent reasonably necessary and proportionate to those purposes. These include providing requested services and protecting account security and preventing fraud.

Sale or Sharing of Personal Information

OKX does not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under California law, and has not done so during the preceding 12 months. This is distinct from the business-purpose disclosures described above and in Section 9.

California Consumer Rights

• Right to Know (s. 1798.110): Categories and specific pieces of PI collected; sources; business purposes; third-party categories.

• Right to Delete (s. 1798.105): Request deletion, subject to applicable exceptions.

• Right to Correct (s. 1798.106): Request correction of inaccurate PI.

• Right to Opt-Out of Sale/Sharing (ss. 1798.120, 1798.135): Where applicable, opt out of the sale of personal information or its sharing for cross-context behavioral advertising.

• Right to Non-Discrimination (s. 1798.125): No adverse treatment for exercising rights.

Submit requests through our Privacy Request Portal or email privacyoffice@okx.com. Please identify the privacy right you wish to exercise. You may use an authorized agent; we may request proof of authorization and, for access/deletion/correction requests, appropriate identity verification. For requests to know, delete or correct personal information, we respond within 45 calendar days of receipt and may extend this by an additional 45 calendar days where permitted, with notice and an explanation. We provide responses to requests to know free of charge up to twice in a 12-month period, subject to applicable law; this is not a general limit on exercising your privacy rights. Where we retain your personal information for longer than 12 months, you may request access to older information collected on or after January 1, 2022, subject to applicable law and exceptions. Where applicable, sale/sharing opt-outs and requests to limit the use and disclosure of sensitive personal information do not require identity verification and are handled within their applicable statutory deadlines, rather than the 45-day response period above.

20. GLBA PRIVACY NOTICES FOR US CUSTOMERS

For details on how your personal information is collected, shared and protected, see the notice applicable to your relationship:

• OKX GLBA Privacy Notice — for your relationship with OKX INC.

• WebBank GLBA Privacy Notice — where you apply for or use the WebBank-issued  OKX Card.

21. JURISDICTION-SPECIFIC SUPPLEMENTS

This Privacy Notice is available in multiple languages. In the event of any discrepancy, the English version shall prevail, except where local law requires otherwise.

United Kingdom (UK GDPR and Data Protection Act 2018)

• Data controller: Refer to your account agreement and applicable privacy notice to identify the entity responsible for your personal data. Section 2 lists the entities covered by this Notice. If you need clarification about your UK controller or applicable notice, contact privacyoffice@okx.com.

• Legal basis: UK GDPR equivalent provisions apply throughout.

• Supervisory authority: Information Commissioner's Office (ICO) - ico.org.uk.

• International transfers: UK IDTA and/or UK Addendum to EU SCCs for non-adequate countries.

Malaysia (Personal Data Protection Act 2010, Act 709, as amended 2024)

• Data Controller: Aux Cayes FinTech Co. Ltd. (catch-all entity, Section 2).

• Applicable law: Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727). The amendment provisions commenced in phases on 1 January, 1 April and 1 June 2025 under the gazetted commencement notification. Processing is governed by seven data protection principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity, and Access.

• Access requests: OKX will respond to access requests from Malaysian residents within 21 days of receipt.

• Supervisory authority: Personal Data Protection Commissioner (PDPC) - pdp.gov.my | Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, Federal Government Administration Center, 62100 Putrajaya, Malaysia | Tel: +60 3 7456 3888 | aduan@pdp.gov.my.

Singapore (PDPA)

• Data Controller: OKX SG Pte. Ltd.

• This Notice fulfills the notification obligation under PDPA s. 20.

• Cross-border transfers: PDPA section 26 and the applicable transfer regulations; overseas recipients are subject to arrangements ensuring a standard of protection comparable to that under the PDPA.

• Access and correction requests are handled in accordance with applicable law. If we cannot respond within 30 days, we will inform you when a response can be expected.

Australia (Privacy Act 1988 - APPs)

• Data Controller: OKX Australia Pty Ltd.

• This Notice is OKX Australia's Privacy Policy for APP 1 purposes.

• Cross-border disclosure: APP 8.1; reasonable steps taken to ensure overseas recipients comply with APPs.

• Complaints: DPO in first instance; then Office of the Australian Information Commissioner (OAIC) - oaic.gov.au.

Brazil (LGPD - Lei 13.709/2018)

• Data Controller: OKX Serviços Digitais Ltda.

• Encarregado (DPO): Rodrigo Alves Rodrigues - privacyoffice@okx.com (LGPD Art. 41).

• Legal bases: contract performance, legal obligation, legitimate interest, and consent (LGPD Art. 7).

• International transfers: LGPD Art. 33, Resolution CD/ANPD n. 19/2024 - standard contractual clauses or approved mechanisms.

• LGPD Art. 18 rights: confirmation of processing, access, correction, anonymisation/blocking/deletion, portability, sharing information, revocation of consent.

• Supervisory authority: Agência Nacional de Proteção de Dados (ANPD) - gov.br/anpd.

Seychelles (Data Protection Act 2023)

• Data Controller: Aux Cayes FinTech Co. Ltd.

• The Information Commission, Republic of Seychelles. infocom.sc

• AML/CFT data sharing: governed by the intra-group SCC framework described in Section 10.

Argentina (Ley de Proteccion de los Datos Personales - Law No. 25.326)

• Data Controller: See the Argentina branch entry in Section 2 for the controller’s legal name and contact details.

• Applicable law: Ley de Proteccion de los Datos Personales, Law No. 25.326 (2000) and Implementing Decree No. 1558/2001; AAIP Resolution 47/2018 on information security measures. Argentina holds a European Commission adequacy decision (Decision 2003/490/EC), enabling lawful data transfers from the EEA without additional safeguards.

• Database registration: OKX is required to register personal data databases with the AAIP pursuant to Law 25.326 Art. 21. Registered databases are listed in the AAIP's National Registry of Databases.

• Under Article 5 of Law No. 25.326, we obtain your freely given, express and informed consent, recorded in writing or an equivalent form, unless a statutory exception applies. Relevant exceptions include processing pursuant to a legal obligation or where data arises from a contractual relationship and is necessary for its development or performance. Where consent is required, it is obtained before the relevant processing. Sensitive personal data, as defined in Article 2, is subject to Article 7’s additional restrictions: no person may be compelled to provide it, and its collection and processing require legally authorised reasons of general interest or another applicable statutory permission. Consent alone does not override those restrictions. Biometric processing is addressed separately below and in Section 18.

• Data subject rights under Law 25.326: (i) Right of access (habeas data - Art. 14): data subjects may request, free of charge, a full copy of their personal data held in any database within 10 calendar days of the request; (ii) Right to rectification and updating (Art. 16): data subjects may request correction of inaccurate or outdated data; (iii) Right to deletion (supresión - Art. 17): data subjects may request deletion of personal data that is excessive, irrelevant, outdated, or unlawfully processed. This right is subject to applicable retention obligations, including mandatory retention periods under AML/CFT legislation applicable in Argentina, which require OKX to retain customer identification and transaction records for a minimum of ten (10) years following the end of the business relationship; (iv) Right to confidentiality: data subjects may request that data used for commercial advertising purposes be kept confidential (Art. 27); (v) Right to object to processing for direct marketing (Art. 27(3)).

• International transfers: Law 25.326 Art. 12 restricts transfers to countries that do not provide an adequate level of protection, unless an exception applies (consent, contractual necessity, or public interest). OKX ensures that any transfer of Argentine residents' personal data to jurisdictions not recognised as adequate is subject to appropriate contractual safeguards.

• Security measures: OKX implements the technical and organisational security measures required by AAIP Resolution 47/2018 for controllers handling personal data in Argentina, including measures proportionate to the sensitivity of the data processed.

• Biometric information: We process biometric information for the purposes described in Section 18, subject to applicable Argentine data-protection requirements. Where that information constitutes sensitive personal data under applicable law, the additional restrictions on its collection and processing apply.

• Supervisory authority: Agencia de Acceso a la Informacion Publica (AAIP) - argentina.gob.ar/aaip | Av. Pte. Gral. Julio A. Roca 710, piso 2, Ciudad Autónoma de Buenos Aires, C1067ABP | Tel: +54 11 5300-4357. Argentine residents may lodge complaints directly with the AAIP.

El Salvador (Ley de Proteccion de Datos Personales - Legislative Decree No. 144, 2024)

• Data Controller: See the El Salvador entry in Section 2 for the controller’s legal name and contact details.

• Applicable law: Ley para la Protección de Datos Personales, Legislative Decree No. 144, approved on 12 November 2024 and published in the Official Gazette on 15 November 2024, in force since 28 November 2024. The law establishes the general data protection framework in El Salvador, drawing substantially from the GDPR model. OKX Fintech S.A. de C.V. is a regulated entity under Salvadoran law and is subject to this law in relation to the personal data of Salvadoran residents

• Definitions: The LPDP adopts definitions broadly aligned with the GDPR, including 'dato personal' (personal data), 'responsable del tratamiento' (data controller), 'encargado del tratamiento' (data processor), and 'titular de los datos' (data subject).

• Principles: OKX processes personal data of Salvadoran residents in accordance with the LPDP principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability (Art. 5 LPDP).

• Legal bases for processing: Processing of personal data requires a lawful basis under Art. 12 LPDP: (i) consent of the data subject; (ii) performance of a contract to which the data subject is party; (iii) compliance with a legal obligation applicable to the controller; (iv) protection of the vital interests of the data subject; (v) performance of a task carried out in the public interest; or (vi) legitimate interests of the controller, provided they do not override the fundamental rights of the data subject.

• Sensitive data: The LPDP establishes a heightened protection regime for datos sensibles, including biometric data, health data, sexual orientation, racial or ethnic origin, political opinions, and religious beliefs (Art. 16 LPDP). Processing of sensitive data requires explicit consent or reliance on a narrowly defined statutory exception, including compliance with AML/CFT obligations where expressly required by law.

• Data subject rights under the LPDP: (ARCO-POL rights): (i) Right of access: data subjects may request confirmation of processing and a copy of their personal data; (ii) Right to rectification: data subjects may request correction of inaccurate data without undue delay; (iii) Right to cancellation/deletion: data subjects may request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful, subject to applicable retention obligations under AML and financial services law; (iv) Right to object: data subjects may object to processing based on legitimate interest; (v) Right to portability: data subjects may request their personal data in a structured, machine-readable format for transfer to another controller, where technically feasible; (vi) Right to erasure / right to be forgotten: data subjects may request removal of their personal data from digital environments where continued availability is no longer justified; (vii) Right to restriction of processing: data subjects may request temporary suspension of processing in specified circumstances; (viii) Right not to be subject to solely automated decisions: data subjects have the right to human review of decisions producing significant effects.

• International transfers: The LPDP restricts transfers of personal data to third countries that do not ensure an adequate level of protection (Art. 34). OKX relies on contractual safeguards (standard data transfer clauses or equivalent mechanisms recognised under Salvadoran law) for all transfers of Salvadoran residents' data to non-adequate third countries.

• Data breach notification: Under the LPDP (Decree No. 144, Art. 25), upon becoming aware of a personal data breach, OKX is required to notify the Agencia de Ciberseguridad del Estado (ACE), the Fiscalía General de la República, and the affected data subjects, within a maximum of 72 hours from the moment the breach is discovered.

• Responsible for data protection: OKX Fintech S.A. de C.V. has designated Rodrigo Alves Rodrigues as the responsible contact for data protection matters in El Salvador, accessible via privacyoffice@okx.com.

• Supervisory authority: Agencia de Ciberseguridad del Estado (ACE) — ace.gob.sv. Salvadoran residents may lodge complaints with the ACE if they believe their rights under the LPDP have been infringed.

The Bahamas (Data Protection (Privacy of Personal Information) Act, 2003)

This supplement applies where the processing of your personal data falls within the scope of the Bahamian Act. Where OKX Bahamas FinTech Company Limited is your data controller, its contact details are set out in Section 2.

Personal data is handled in accordance with the Act's requirements for lawful and fair collection, specified purposes, accuracy, relevance, retention and security (Section 6).

Subject to applicable statutory conditions and exceptions, you may request access to your personal data (Section 8), rectification or erasure of personal data (Section 10), and cessation of processing for direct marketing (Section 11). Exceptions to access are set out in Section 9. Requests may be submitted to privacyoffice@okx.com.

International transfers: The Data Protection Commissioner may prohibit transfers from The Bahamas where equivalent protection is not provided by contract or otherwise, subject to Section 17 of the Act. Relevant transfer arrangements are assessed under applicable law and the safeguards described in Section 10 of this Notice.

Retention: Personal data is retained only for as long as needed for the relevant purpose or as required by applicable law, including applicable AML/CFT recordkeeping requirements, as described in Section 11.

Supervisory authority: Office of the Data Protection Commissioner, The Bahamas. Email: dataprotection@bahamas.gov.bs. Telephone: +1 242 604 1001. Website: dataprotection.gov.bs.

22. CHANGES TO THIS PRIVACY NOTICE

OKX will notify you of material changes to this Notice by: (a) email notification at least 30 days prior to the change taking effect; and (b) a prominent platform notice for at least 30 days. Non-material changes (typographical errors, updated contact details) may be made without prior notice. The effective date at the top of this Notice will be updated to reflect all revisions. Where a change requires fresh consent, it will be obtained separately before the change takes effect.

23. CONTACT US

If you have any questions about this Privacy Notice or the use of your Personal Data, please contact us with the subject 'PRIVACY REQUEST' via: privacyoffice@okx.com.