Privacy Notice El Salvador

2. CONTROLLER AND CONTACT DETAILS (El Salvador)

The OKX group is made up of different legal entities, details of which can be found in the table below (“OKX,” “we,” “us” or “ours”). OKX acts as a controller of your personal data where we determine how and why personal data can be used, and the OKX entity is the primary controller of your personal data. This Privacy Notice does not apply where we act as a processor or service provider to another controller (including our customers).

22. ADDITIONAL INFORMATION FOR PERSONS SUBJECT TO EL SALVADOR’S DATA PROTECTION LAW

This Section applies to users who reside in El Salvador or whose personal data is processed under the scope of the Ley para la Protección de Datos Personales enacted by the Legislative Assembly of the Republic of El Salvador (Decree No. 144, 2024). OKX Fintech Sociedad Anónima de Capital Variable acts as controller in accordance with this law.

A. Identity Verification and Biometric Data Privacy Notice

To comply with applicable laws, regulations, and other legal obligations in El Salvador, including “know your customer” obligations, we require all users to verify their identity before using our Services. 

In order to verify a user’s identity for the use of certain Services, the user is asked to capture an image of their government ID (e.g., a Documento Único de Identidad, passport or driver’s license) and take a real-time selfie image of their face. We provide those images to our identity verification service providers, who then use a combination of machine learning tools and statistical algorithms to confirm the authenticity of the government ID and selfie image, and to perform biometric facial comparisons to determine whether the face contained in the government ID and selfie image belong to the same person. Through this process, the verification service providers will typically generate a confidence score representing the confidence level that the images of the individuals match, which we or the relevant service providers may use in determining the level of confidence that the individual submitting the selfie image is the same person as the individual on the government ID.

We do not receive, store, or collect any facial biometric information generated by our third-party identity verification service providers from the images, and our identity verification service providers retain biometric information only as long as necessary for us to provide our Service to you and to help us comply with our legal obligations. We do not use, disclose, or retain facial biometric information for any other commercial purpose. However, we do retain the information and images you provide in connection with the identity verification process, along with the results of the identity check, as long as necessary to provide our service to you and to comply with our legal obligations. 

B. El Salvadour Data Subject Rights (ARCO-POL Rights)

Under Salvadoran law, you have the following rights with respect to their Personal Data, subject to certain exceptions provided under the law. We will advise you in our response to your request where we are relying on such exemptions. You should include adequate information to identify yourself and other relevant information that will reasonably assist us in fulfilling your request.

• Access: Obtain a copy or view your personal data held by OKX.

• Rectification: Request correction of inaccurate, incomplete or outdated information.

• Cancellation: Request deletion when data is no longer needed, consent is withdrawn, or processing is unlawful.

• Opposition: Object to the processing of your data for legitimate reasons or direct marketing purposes.

• Portability: Request a structured, machine-readable copy of your data for transfer to another controller.

• Oblivion: Request erasure of personal data made publicly accessible, including online search results, when outdated or excessive.

• Limitation: Request restriction of processing under specific legal conditions (e.g., while verifying accuracy).

To exercise your privacy rights, please send an email with your request to privacyoffice@okx.com with the subject “DATA INQUIRY REQUEST”. Alternatively, to exercise your privacy rights, click HERE to submit; or by mail to OKX at the address set out in Section 2 above.

We will respond within 20 business days from receipt of the request, extendable by another 20 days if needed. Requests may be denied when required to protect third-party rights, comply with legal mandates, or if the requester cannot be properly authenticated.

C. Informed Consent and Sensitive Data

OKX processes personal data of Salvadoran residents on the lawful bases established under Decree No. 144, including performance of a contract, compliance with a legal obligation, and, where applicable, the freely given, specific, informed, and unambiguous consent of the data subject. Where consent is the applicable basis, it will be obtained prior to the relevant processing activity and separately from acceptance of general terms. For sensitive data (datos sensibles), explicit consent is required and will be obtained through a dedicated consent mechanism, not inferred from acceptance of this Privacy Notice. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal, provided that no other legal basis applies.

D. Privacy Notice and Security Measures

We maintain and publish a Privacy Notice that discloses:

• the identity of the controller and contact details of our data protection officer,

• the purpose and legal basis for processing,

• applicable security and protection measures,

• methods to exercise your rights,

• and details of data transfers or cloud processing.

If we have technical proof that a data breach has occurred, we will take steps to assess whether the data breach is notifiable under the Ley de Protección de Datos Personal of El Salvador. Once we assess that a data breach is a notifiable data breach, we will notify the Agencia de Ciberseguridad de el Estado, the Attorney General’s Office (Fiscalía General de la República), and you within 72 hours, detailing the nature of the breach, affected data and corrective actions. If we share your personal data with our third party Service providers, we will require them to process it strictly in accordance with our instructions or as otherwise required by the Ley de Protección de Datos Personales.

E. International Transfers

The Ley para la Protección de Datos Personales (Decree No. 144, Art. 34) restricts transfers of personal data to countries that do not ensure an adequate level of protection. For transfers to non-adequate third countries, OKX relies on appropriate contractual safeguards, including standard data transfer clauses or equivalent mechanisms recognised under Salvadoran law and supervised by the Agencia de Ciberseguridad del Estado (ACE). Transfers are carried out only to the extent necessary to provide our Services to you, to comply with applicable legal obligations, or where you have provided explicit consent.