FinzoPark
Controller for this Policy · section 3
- Profile data
- Integration data (your API Key, stored encrypted)
- Activity data received from Binance and Bybit
- Technical data
- Screening data
- Communications data
- Marketing data
Privacy Policy
How FinzoPark processes personal data, and what is processed by Binance or Bybit instead.
FinzoPark-LEG-002 – Privacy Policy · Effective 14 August 2026
Who processes your data
Binance and Bybit
Independent controller · clause 1.2
- Identity documents and verification images
- Source of funds evidence
- Account balances and custody records
- Regulatory reporting
Governed by Binance's and Bybit's own privacy notices. Requests about this data must be made to Binance or Bybit, as applicable.
1Scope
1.1This Policy applies to personal data processed by FinzoPark in connection with visitors to our websites and applications, holders of a Platform profile, business contacts and suppliers, and applicants for employment.
1.2It does not describe Binance’s or Bybit’s processing. Your identity documents, verification images, source of funds evidence, account balances, custody records, and regulatory reporting may be processed by Binance or Bybit, as applicable, in their capacity as independent controllers. FinzoPark does not collect or hold your identity documents or biometric verification data, except where separately required for a service or legal obligation applicable to FinzoPark.
1.3Where processing is subject to Regulation (EU) 2016/679 (GDPR) or an equivalent regime, this Policy is provided to satisfy the applicable transparency obligations.
2Controller and Contacts
| Role | Details |
|---|---|
| Controller | FinzoPark, 2nd Floor, Ritter House, Wickham’s Cay II, Tortola, British Virgin Islands |
| Independent controller | Binance or Bybit, as applicable, in respect of identity verification, account, custody, transaction, AML, and regulatory processing arising from your respective Binance or Bybit account |
| Data protection contact | Privacy Lead, FinzoPark, privacy@finzopark.org |
| Rights requests | privacy@finzopark.org |
| Website | finzopark.org |
3Personal Data We Process
| Category | Examples |
|---|---|
| Profile data | Name or display name, email address, telephone number, country of residence as declared, password hash, two-factor settings, language and display preferences |
| Integration data | The API key or other API credentials you connect (stored encrypted), their permission scope, connection and revocation events, and the identifier linking your Platform profile to your Binance or Bybit account, as applicable |
| Activity data received from Binance or Bybit | Order and trade records, executed prices, balances and positions, account status flags and limits, retrieved through the applicable API to display your activity to you and to calculate commission |
| Technical data | IP address, approximate location derived from IP, device and browser identifiers, operating system, session and login records, error and performance logs, cookie identifiers |
| Screening data | Sanctions and restricted-jurisdiction screening results relating to Platform access, and records of any access restriction applied |
| Communications data | Support tickets, emails, in-Platform messages, chat transcripts and, where used, call recordings |
| Marketing data | Preferences, consent records and engagement with our communications |
3.1We do not knowingly collect special categories of personal data. Please do not send us identity documents, selfies, or source-of-funds evidence; where applicable, those are submitted to Binance or Bybit through their respective verification processes. If any such material is sent to FinzoPark in error, we will handle and delete it in accordance with our applicable data retention and data protection obligations.
3.2We never ask for, and you must never disclose to us, your Binance or Bybit password, recovery phrase, two-factor authentication codes, or an API key with withdrawal permissions.
4Sources
- directly from you, at registration, in support interactions and through your use of the Platform;
- automatically, through cookies and Platform telemetry;
- from Binance’s or Bybit’s APIs, as applicable, in respect of the account and transaction data listed in section 3;
- from sanctions and restricted-jurisdiction screening providers;
- from fraud prevention, security, hosting and analytics providers acting on our behalf.
5Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Creating and operating your Platform profile and providing the interface | Performance of a contract (Art. 6(1)(b)) |
| Connecting your API Key and transmitting your Instructions to Binance or Bybit, as applicable | Performance of a contract (Art. 6(1)(b)) |
| Displaying your balances, orders, positions and history retrieved from Binance or Bybit, as applicable | Performance of a contract (Art. 6(1)(b)) |
| Calculating, verifying and reconciling commission payable to us by Binance and/or Bybit, as applicable | Legitimate interests in operating our business and verifying amounts due (Art. 6(1)(f)); legal obligation for accounting records (Art. 6(1)(c)) |
| Sanctions screening and enforcement of geographic access restrictions | Legal obligation (Art. 6(1)(c)); legitimate interests in preventing financial crime and sanctions breaches (Art. 6(1)(f)) |
| Fraud prevention, security monitoring, abuse detection and incident response | Legitimate interests in protecting the Platform and its users (Art. 6(1)(f)) |
| Support, complaint handling and dispute resolution | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Service improvement, analytics, testing and product development | Legitimate interests in improving the Platform (Art. 6(1)(f)); consent where non-essential cookies are used (Art. 6(1)(a)) |
| Responding to lawful requests from authorities and to requests from Binance or Bybit in connection with their respective regulatory obligations | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)), or legitimate interests for existing users in respect of similar services (Art. 6(1)(f)), with an unconditional right to object |
5.1Where we rely on legitimate interests, we have carried out a balancing assessment, available on request. Where we rely on consent, you may withdraw it at any time without affecting prior processing.
5.2Providing profile and integration data is necessary to use the Platform. If you do not provide it, we cannot give you access.
6Automated Processing
6.1We apply automated sanctions and geographic screening to Platform access, and automated fraud and abuse detection. These may result in access being blocked or restricted.
6.2Decisions about your Binance or Bybit account, including verification outcomes, limits, freezes, restrictions, and closures, are made by the respective provider and not by us. We cannot review, explain, or reverse those decisions; matters concerning Binance must be raised with Binance, and matters concerning Bybit must be raised with Bybit.
6.3Where an automated decision by us significantly affects you, you may request human review by writing to privacy@finzopark.org. We may be prohibited by law from explaining the basis of a financial crime restriction.
7Recipients
- Binance, for the operation of the integration, transmission of your Instructions, and its own compliance and reconciliation purposes;
- cloud hosting, database, communications, customer support, analytics and security providers acting as processors on our documented instructions;
- sanctions and restricted-jurisdiction screening providers;
- payment and accounting providers, in respect of any charges we levy and of commission reconciliation;
- professional advisers, auditors and insurers, and prospective purchasers in a corporate transaction;
- regulators, tax authorities, law enforcement and courts, where required or permitted by law.
7.1We do not sell personal data.
7.2Public blockchains.Transfers you make through your Binance or Bybit account are recorded on public, immutable ledgers that neither we nor Binance or Bybit control and from which data cannot be erased.
8International Transfers
8.1Personal data may be transferred outside the European Economic Area, including to Binance or Bybit entities and to service providers located in third countries.
8.2Transfers rely on an adequacy decision where one applies, or otherwise on Standard Contractual Clauses together with supplementary measures identified through a transfer impact assessment, or on another lawful mechanism. Copies of the safeguards may be requested from privacy@finzopark.org.
9Retention
| Data | Retention |
|---|---|
| Profile and integration records | Duration of the profile, plus 12 months after deletion or last activity |
| API Key material | Deleted immediately on disconnection or profile deletion; connection and revocation events retained for 24 months as an audit record |
| Activity data received from Binance or Bybit, and commission reconciliation records | Seven (7) years from the end of the relevant financial period, to satisfy applicable accounting, audit, and tax obligations |
| Screening results and access restriction records | Five (5) years from the date of the decision |
| Support communications and complaint records | Five (5) years from closure |
| Security, access and system logs | 12 to 24 months, or longer where an investigation is ongoing |
| Marketing consent records | Until withdrawal, plus three (3) years for evidential purposes |
9.1Retention is extended where data is subject to a legal hold, investigation, regulatory request or unresolved dispute. On expiry, data is securely deleted or irreversibly anonymised.
9.2Deleting your Platform profile does not delete anything held by Binance or Bybit. Requests concerning data held by Binance must be made to Binance, and requests concerning data held by Bybit must be made to Bybit.
10Security
10.1We apply measures appropriate to the risk, including encryption in transit and at rest, encrypted storage of API Key material with restricted decryption, role-based access control and least privilege, multi-factor authentication for staff, network segregation, logging and alerting, vulnerability management and penetration testing, secure development practices, vendor due diligence and staff training.
10.2We enforce the rule that connected API Keys must not carry withdrawal permissions, which materially limits the consequences of any compromise of our systems.
10.3Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where the risk is high.
11Your Rights
11.1Subject to applicable law you may request access, rectification, erasure, restriction, portability, and may object to processing based on legitimate interests or to direct marketing at any time. You may withdraw consent where processing relies on it.
11.2Requests should be sent to privacy@finzopark.org. We respond within one (1) month, extendable by two (2) further months for complex requests. We may need to verify your identity first.
11.3Rights are constrained where we must retain records for accounting, tax, sanctions, or legal-claims purposes. Rights in respect of data held by Binance or Bybit must be exercised with the respective provider.
11.4We do not charge for handling requests unless they are manifestly unfounded or excessive.
12Cookies
12.1Strictly necessary cookies support authentication, session management and security and do not require consent. Analytics, preference and marketing cookies are used only with your consent, which may be given, refused or withdrawn through the cookie banner or preference centre.
12.2Full details are in the Cookie Notice published on finzopark.org.
13Children
The Platform is not directed at persons under 18 and we do not knowingly process their personal data. If we become aware that we have, we will delete it and close the profile.
14Changes
We may update this Policy. Material changes are notified by email or Platform notification at least thirty (30) days before taking effect, except where a change is required immediately by law. The current version is always published on finzopark.org with its effective date.
15Complaints
15.1Please contact privacy@finzopark.org first so we can try to resolve the matter.
15.2You may also lodge a complaint with the data protection supervisory authority of your habitual residence, place of work, or place of the alleged infringement, or with the authority competent for FinzoPark in the British Virgin Islands. Complaints about processing carried out by Binance or Bybit should be directed to the respective provider and, if unresolved, to the supervisory authority identified in its applicable privacy notice.
End of Privacy Policy.