Privacy Policy
Effective Date: March 2026
Introduction
Echlon Ltd (“we,” “us,” or “our”) is a British Virgin Islands incorporated fintech company that operates software infrastructure enabling cross-border payments, settlement, and treasury workflows through regulated third-party financial institutions. Echlon provides technology only and does not custody user assets, control private keys, or execute transactions on behalf of users.
This Privacy Policy explains how we collect, use, share, and protect your personal information when you access our website, platform, and related services (the “Services”). By using our Services, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree, please do not use our Services.
This Policy is designed to comply with the British Virgin Islands Data Protection Act, 2021 (the “DPA”) and is aligned with applicable international data protection standards to the extent relevant to our operations.
Information We Collect
2.1 Information You Provide
- Identity Data: Full name, date of birth, nationality, government-issued identification, selfie photographs, and liveness check results
- Contact Data: Email address, phone number, and physical address
- Business Data: Entity name, registered address, incorporation documents, tax ID, beneficial ownership information, and business activity documentation
- Financial Data: Bank account information, wallet addresses, source of funds documentation, and transaction history. Financial data is collected as provided by you or received from our regulated partners for compliance and service facilitation purposes only. Wallet addresses are user-controlled; Echlon does not have custody or control over associated digital assets
2.2 Information Collected Automatically
- Device and Usage Data: Hardware model, operating system, browser type, unique device identifiers, pages visited, session duration, and clickstream data
- Location Data: IP address, IP geolocation, and timezone settings
- Cookies: Information collected through cookies and similar technologies (see Section 8)
2.3 Information from Third Parties
We may receive personal data from identity verification providers, sanctions and PEP screening providers, blockchain analytics providers, our regulated financial partners, and publicly available sources such as government registries.
How We Use Your Data
We process your personal data on the following lawful bases under the BVI DPA: your consent, performance of a contract, compliance with legal obligations (including AML/CFT/CPF and sanctions requirements), and our legitimate business interests where we have determined that such interests are not overridden by your data protection rights and freedoms.
We use your data for the following purposes:
- Account creation, onboarding, and identity verification (KYC/KYB)
- Facilitating payments, settlement, and treasury transactions through our regulated partners
- AML/CFT/CPF compliance, sanctions screening, transaction monitoring, and suspicious activity reporting
- Fraud detection and prevention, including geo-blocking enforcement
- Communicating with you about your account and our Services
- Improving and optimising our Services
- Complying with legal obligations, court orders, and regulatory requests
- Marketing communications, where you have opted in
International Data Transfers
Your personal data may be transferred to and processed in jurisdictions outside the BVI, including the United States and other countries where our partners and vendors operate. Under the BVI DPA, such transfers require adequate data protection safeguards or your consent.
We implement appropriate safeguards for international transfers, including data processing agreements, standard contractual clauses, and other contractual protections requiring recipients to maintain security standards consistent with applicable law. We also implement technical and organisational security measures to protect data in transit and at rest. Transfer recipients may be located in the United States, the European Union, and other jurisdictions where our financial partners, identity verification providers, and infrastructure vendors operate. By using our Services, you consent to these transfers where adequate protections are in place.
Data Security
We implement administrative, technical, and physical safeguards to protect your data from unauthorised access, disclosure, alteration, and destruction, including:
- Encryption of sensitive data at rest and in transit
- Multi-factor authentication and role-based access controls
- Secure cloud infrastructure with firewalls, network segmentation, and monitoring
- Contractual security requirements for third-party service providers
No system is completely secure. While we cannot guarantee absolute security, we continuously evaluate and improve our security practices.
Data Retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, except where a longer or indefinite retention period is required to comply with our legal obligations. Where more than one retention period applies to the same data, the longest applicable period governs.
Our retention periods are as follows:
- KYC/KYB and transaction records: Minimum five (5) years after the end of the business relationship, per BVI AML Regulations
- Compliance records (SARs, sanctions screening): Retained indefinitely, or for such period as required by applicable law
- Account and usage data: Minimum five (5) years following termination of the business relationship, or such longer period as required by applicable law or the Company’s retention schedule
When data is no longer required — and is not subject to a legal, regulatory, or indefinite retention obligation — it is securely and irreversibly deleted in accordance with our disposal protocols.
We take reasonable steps to ensure that the personal data we hold is accurate, complete, and up to date. You are responsible for notifying us of any changes to your information, and you may request correction of inaccurate data at any time.
Cookies and Tracking Technologies
We use cookies and similar technologies to operate our Services, remember your preferences, and understand how users interact with our platform. Essential cookies are required for authentication and security and cannot be disabled. We may also use analytics cookies (such as Google Analytics) to measure performance and improve functionality.
You can manage cookie preferences through your browser settings, though disabling certain cookies may affect functionality. Our Services do not currently respond to “Do Not Track” browser signals.
Your Rights
Under the BVI Data Protection Act, 2021, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Be informed of the purposes of data collection, the categories of third parties who may receive your data, and how to contact us
- Object to the processing of your personal data where we rely on legitimate interests as the lawful basis
- Request erasure of your personal data, subject to our legal obligations to retain certain records under AML/CFT/CPF regulations and applicable law
- Lodge a complaint with the BVI Information Commissioner or other applicable supervisory authority if you believe your data protection rights have been violated
Certain rights may be limited where we have a legal obligation to retain data, such as under AML/CFT/CPF regulations. Additional rights may apply depending on your jurisdiction of residence. Where we process data based on your consent, you may withdraw that consent at any time by contacting us; withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
To exercise your rights or submit an inquiry, contact us at [email protected]. We may verify your identity before processing your request and will respond within the timeframes required by applicable law.
Other Important Information
Third-Party Links
Our Services may link to third-party websites or services. This Policy does not apply to those services, and we are not responsible for their privacy practices.
Children’s Privacy
Our Services are not intended for individuals under 18. We do not knowingly collect data from minors. If you believe we have, contact us at [email protected].
Automated Decision-Making
As part of our onboarding and compliance processes, we use automated tools and third-party providers to verify your identity, screen against sanctions and PEP databases, and assess risk. These automated processes may result in decisions that affect your ability to access our Services, including the denial of an application. Where an automated decision has been made that significantly affects you, you have the right to request human review of that decision by contacting us at [email protected]. We will review such requests promptly and communicate the outcome to you.
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with the BVI DPA and applicable law. Notification will include the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
Changes to This Policy
We may update this Policy to reflect changes in our practices or legal requirements. Material changes will be communicated by updating the Effective Date and, where practicable, by notice through our Services or by email. We will provide at least thirty (30) days’ advance notice before material changes take effect, unless a shorter period is required by law. Continued use after changes constitutes acceptance.
Contact Us
For questions, concerns, or data-related requests:
Echlon Ltd
British Virgin Islands
Email: [email protected]
General Inquiries: [email protected]