This Privacy Policy ("Policy") outlines how Ondo Global (Panama) Inc., a Corporation organized and existing under the laws of the Republic of Panama (“Ondo Perps”, “Company”, "we," "us," or "our"), collects, uses, shares, and protects personal information of users ("you" or "users") of our perpetual-contracts trading platform (the "Platform"). By accessing or using our Platform, you agree to the terms of this Privacy Policy.
1. Introduction
This section elaborates on the scope and applicability of this Privacy Policy. The "Platform" refers to our online permissionless, peer-to-peer perpetual-contracts trading platform where users can buy, sell, and trade digital assets and Perpetual Contracts (as defined in our Terms of Use). As a company incorporated and operating under the laws of Panama, we are committed to protecting your privacy while providing our services.
This Privacy Policy governs all aspects of information collection, processing, and protection across our Platform's services, including but not limited to account creation (via wallet authentication), market participation, transaction processing, and user interactions. It applies to all users accessing our Platform, whether as registered members or visitors.
By using our Platform, you acknowledge that you have read and understood this Privacy Policy and agree to be bound by its terms. If you do not agree with any aspect of this Policy, you should immediately discontinue use of our Platform. We recommend reviewing this Policy periodically as it may be updated from time to time in accordance with Section 9 of this document.
For purposes of this Policy, any capitalized terms not defined herein shall have the meanings assigned to them in our Terms of Use. This Policy should be read in conjunction with our Terms of Use, our Cookie Policy, and any other agreements between you and us governing your use of the Platform.
We are aware of our responsibilities to handle your personal data with care, to keep it secure, and comply with applicable privacy and data protection laws, including Law 81 of March 26, 2019, on the Protection of Personal Data and its Regulations, the Executive Decree 285 of May 28, 2021 (the "Data Protection Law").
2. Information We Collect
We collect and process two main categories of information about you when you use our Platform:
2.1 Personal Information
"Personal Information" refers to information that can directly or indirectly identify you as an individual. This may include your full name, email address, postal address, phone number, date of birth, government-issued identification documents, banking and financial information, and account login credentials. We collect this information when you create an account, complete your profile, make transactions, or communicate with us.
In addition, because the Platform facilitates Perpetual Contract trading, we may collect information related to your trading activity, including but not limited to: wallet addresses and on-chain transaction histories associated with your Account; order history, position data, margin balances, and liquidation events; and any information you provide to us in connection with customer-support inquiries relating to your trading activity.
2.2 Usage Data
"Usage Data" encompasses information about how you interact with our Platform. This includes your IP address, browser type and version, device information, operating system, time zone setting, access times and duration, pages viewed, features used, transaction history, trading patterns, and other diagnostic data. We collect this information automatically when you access and navigate our Platform through cookies, web beacons, software development kits (SDKs), pixels and tags, tag-management solutions (such as Google Tag Manager and equivalent platforms), mobile and device identifiers, log files, session-replay and product-analytics tools (such as PostHog, Google Analytics, and equivalent platforms), and other similar tracking, attribution, and analytics technologies (collectively, “Tracking Technologies”). Tracking Technologies may be deployed directly by us or by third-party analytics, advertising, marketing, and attribution partners acting on our behalf, and may operate as either first-party or third-party cookies or equivalent identifiers.
We maintain detailed records of all Perpetual Contract and digital-asset transactions conducted through the Platform, including orders placed, positions opened and closed, margin deposits and withdrawals, liquidation events, funding-rate payments, and associated timestamps. Your IP address and device identifiers are logged for security purposes and to comply with our legal obligations regarding market integrity, fraud prevention, and geographic-access restrictions.
Please note that certain features of the Platform may not be accessible if you choose not to provide some of the requested information. Any personal information you provide will be processed in accordance with this Privacy Policy and applicable data protection laws.
2.3 Blockchain Data
You acknowledge that blockchain transactions are publicly visible by design. Wallet addresses and on-chain transaction data associated with your use of the Platform may be observable by third parties independently of any action by us. We are not responsible for the public availability of such data.
2.4 Consent for Information Collection and Processing
In accordance with the Data Protection Law, we obtain your explicit consent before collecting, using, or processing your Personal Information. When you register for our Platform, you will be asked to provide explicit consent for:
(a) Collection and analysis of Usage Data to improve our services;
(b) Sharing your information with third parties as outlined in Section 4 of this Policy;
(c) Use of cookies and similar technologies as described in our Cookie Policy.
You have the right to withdraw your consent at any time by contacting our Data Protection Officer or through your account settings. Please note that withdrawal of consent for certain essential processing activities may impact our ability to provide you with access to all Platform features.
We maintain records of all consent provided by users in accordance with the Data Protection Law and make these records available to regulatory authorities upon legitimate request.
3. How We Use Your Information
We process the personal information we collect about you for the following purposes:
Account Management and Platform Operations: We use your information to create and maintain your account, process your transactions, provide customer support, and ensure the proper functioning of our Platform. This includes verifying your identity, processing deposits and withdrawals of digital assets, and communicating with you about your account activities, open positions, and margin status.
Platform Improvement and Analytics: We analyze user behavior and platform performance to enhance our services, develop new features, and optimize user experience. This includes conducting statistical analyses, performing market research, and generating aggregated insights about platform usage patterns. Such processing is conducted using industry-standard analytics tools with appropriate safeguards in place.
Legal Compliance and Risk Management: We process your information to comply with applicable laws, regulations, and legal obligations, including anti-money laundering requirements, sanctions screening, tax reporting, and response to legal requests from authorities. We also use your information to detect and prevent fraud, market manipulation (including wash trading, spoofing, and layering), unauthorized access, and other prohibited activities on our Platform.
Geographic Restriction Enforcement: We process certain information (including IP addresses and related geolocation data) to enforce geographic access restrictions applicable to the Platform, including restrictions on access by Restricted Persons and persons located in Restricted Territories as defined in our Terms of Use.
Risk Management and Market Integrity: We may use your trading data and associated metadata to monitor for abusive trading practices, enforce position limits, manage systemic risk to the Platform, and operate automated risk-management mechanisms (including auto-deleveraging and socialized-loss processes).
The processing of your personal information is necessary for the performance of our contract with you, compliance with our legal obligations, and our legitimate interests in operating, improving, and protecting our Platform. We retain your information only for as long as necessary to fulfill these purposes or as required by applicable law.
4. Information Sharing and Disclosure
We may share your personal information with third parties and service providers in the following circumstances:
-
With our affiliated companies and subsidiaries who assist in operating our Platform and providing services to you, subject to confidentiality obligations consistent with this Privacy Policy. These affiliates may be located in jurisdictions outside Panama.
-
With third-party service providers who help us operate, maintain, and enhance our Platform, including payment processors, cloud storage providers, analytics services, blockchain analytics and compliance vendors, oracle providers, and customer support services. These service providers are contractually bound to protect your information and may only use it for the specific services they provide to us.
-
When required by law, regulation, or legal process, including to respond to court orders, subpoenas, or government requests. We may also share information when we believe disclosure is necessary to protect our rights, investigate fraud or market manipulation, enforce our Platform's Terms of Use, or comply with sanctions and export-control obligations.
-
In connection with a merger, acquisition, bankruptcy, dissolution, reorganization, or similar corporate event. If we are involved in such a transaction, you will be notified via email and/or a prominent notice on our Platform of any change in ownership or uses of your personal information.
-
With law enforcement, regulatory bodies, or other governmental authorities where we determine, in our sole discretion, that disclosure is necessary to investigate, prevent, or take action regarding suspected illegal activity, market manipulation, sanctions evasion, or violations of our Terms of Use.
We do not sell, rent, or lease your personal information to third parties for their marketing purposes without your explicit consent. Any third parties who receive your information are prohibited from using it for any purpose other than providing services on our behalf.
5. Data Security
We implement and maintain appropriate technical and organizational security measures to protect your Personal Information from unauthorized access, disclosure, alteration, and destruction. These measures include industry-standard encryption protocols for data in transit and at rest, secure socket layer (SSL) technology, firewalls, and restricted access controls to our data centers and information systems.
Access to Personal Information is strictly limited to authorized employees, agents, and service providers who require such access to perform their assigned duties. These individuals are bound by confidentiality obligations and may be subject to discipline, including termination and criminal prosecution, if they fail to meet these obligations.
We conduct regular security assessments and audits of our infrastructure and security practices to ensure compliance with industry standards and applicable data protection laws. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security. Any transmission of personal information to and from our Platform is at your own risk.
In the event of a security breach that affects your Personal Information, we will notify you and the relevant authorities within 72 hours of becoming aware of the breach, as required by applicable law. We maintain incident response plans that specify the actions we will take to investigate and remediate security incidents.
6. Your Rights and Choices
You have certain rights regarding your personal information that we collect and process. You may exercise these rights by contacting our Data Protection Officer using the contact information provided in Section 10 of this Policy.
Your rights include: (a) the right to access your personal information and request details about how we process it; (b) the right to request correction of inaccurate personal information; (c) the right to request deletion of your personal information, subject to our legal obligations and legitimate business interests; (d) the right to object to or restrict certain processing activities; (e) the right to data portability.
You may opt-out of receiving marketing communications from us at any time by: (i) clicking the "unsubscribe" link in any marketing email we send; or (ii) contacting our Data Protection Officer. Please note that even if you opt-out of marketing communications, we may still send you important Platform-related notifications and updates, including notifications relating to your open positions, margin requirements, liquidation warnings, and material changes to the Platform or these policies.
If you wish to delete your account, you may do so through your account settings or by contacting us. Please note that some information may be retained in our records to comply with legal obligations (including anti-money laundering record-keeping requirements), resolve disputes, enforce our agreements, or protect our legitimate business interests. Additionally, information recorded on a public blockchain cannot be deleted or modified by us.
We will respond to all legitimate requests within ten (10) days from the date of submission. For requests to modify data, we will process these within five (5) business days.
7. Data Retention
We retain your Personal Information and Usage Data for as long as your Account remains active and for a minimum period of five (5) years following account closure, or such longer period as may be required by applicable law (including anti-money laundering and tax record-keeping requirements). Trading data, transaction records, and associated metadata may be retained for longer periods where required for regulatory compliance, dispute resolution, or the enforcement of our Terms of Use.
Aggregated or anonymized data that can no longer reasonably be used to identify you may be retained indefinitely for analytical and research purposes.
8. International Data Transfers
We may transfer, store, and process your personal information in countries other than Panama. By using the Platform, you acknowledge and consent that your personal information may be transferred to and processed in countries that may have different data protection rules than your country of residence.
For transfers of personal data to countries outside the European Economic Area (EEA), we implement appropriate safeguards and mechanisms to ensure adequate protection of your personal information. These safeguards include entering into Standard Contractual Clauses approved by the European Commission with our service providers and partners.
We maintain appropriate technical and organizational measures to protect your personal information during international transfers, including encryption of data in transit and storage. Where we engage third-party service providers who may access your personal information from other countries, we require them to provide at least the same level of privacy protection as required under applicable data protection laws.
If you are located in the European Union, you have the right to obtain information about the safeguards we use for transferring your personal information outside the EEA. You may contact our Data Protection Officer using the contact information provided in Section 10 to request such information.
9. Children's Privacy
The Platform is not directed to, designed for, or intentionally targeted at children under the age of 18. We do not knowingly collect personal information from children under 18 years of age. If you are under 18, you may not use or provide any information on the Platform, register an account, open any Perpetual Contract positions, or engage in any transactions.
If we become aware that we have inadvertently collected personal information from a child under the age of 18, we will take steps to delete such information from our records as soon as possible. If you believe we might have any information from or about a child under 18, please contact our Data Protection Officer immediately at the contact information provided in Section 10 of this Policy.
Parents and legal guardians who believe their child has submitted personal information to our Platform without their consent should contact us to request the deletion of that information. We reserve the right to request proof of identity and/or legal guardianship to process such requests.
10. Changes to This Privacy Policy
We reserve the right to update or modify this Privacy Policy at any time and from time to time without prior notice. We will post any revised version of the Privacy Policy on the Platform and update the "effective date" referenced at the beginning of this Privacy Policy. If we make any material changes to this Privacy Policy, we will notify you through a prominent notice on our Platform, by sending you an email to the last email address you provided to us, or through other appropriate communication channels.
Your continued use of the Platform following the posting of changes to this Privacy Policy will constitute your acknowledgment and acceptance of such changes. We encourage you to periodically review this Privacy Policy to stay informed about how we collect, use, and protect your personal information. If you do not agree with any changes to this Privacy Policy, you must discontinue using our Platform.
Any changes or modifications will be effective immediately upon posting the revised Privacy Policy on the Platform. These changes will apply to all information we have about you, as well as any information we may receive in the future.
11. Governing Law and Dispute Resolution
This Privacy Policy shall be governed by and construed in accordance with the laws of Panama, without regard to its conflict of law provisions. To the extent permitted by applicable law, any dispute, controversy or claim arising out of or relating to this Privacy Policy, or the breach, termination or invalidity thereof, shall be settled by binding arbitration in Panama City, Panama, in accordance with the Rules of Arbitration of the International Chamber of Commerce by one or more arbitrators appointed in accordance with said Rules.
The arbitration shall be conducted in the English language. The arbitral tribunal shall consist of three arbitrators, with each party appointing one arbitrator and the two party-appointed arbitrators selecting the third arbitrator who shall serve as the presiding arbitrator. The award rendered by the arbitrators shall be final and binding on the parties, and judgment upon the award may be entered in any court having jurisdiction thereof.
Nothing in this Privacy Policy shall limit your rights under the Data Protection Law, including your right to file complaints with the National Authority for Transparency and Access to Information (ANTAI) for matters related to personal data protection. However, disputes arising from other contractual matters shall be resolved through arbitration.
