Exotic.xyz Privacy Policy

Last updated: 19 October 2026

This Privacy Policy explains how 3-102-092450 SRL, a limited liability company (sociedad de responsabilidad limitada) organized and existing under the laws of the Republic of Costa Rica, trading as Exotic.xyz (“Exotic.xyz”, “we”, “us” or “our”), collects, uses, shares and protects personal data in connection with your use of the website at https://exotic.xyz and any associated subdomains (the “Website”), and the Interface and Services described in our Terms of Service (together with the Website, the “Services”).

Exotic.xyz is the person responsible for the database (responsable de la base de datos) for the purposes of Law No. 8968 of the Republic of Costa Rica, the Law for the Protection of Persons against the Processing of their Personal Data (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales), and its Regulations, Executive Decree No. 37554-JP, as amended (together, the “Costa Rica Data Protection Law”). Where the EU General Data Protection Regulation or the UK General Data Protection Regulation (together, the “GDPR”) applies, Exotic.xyz is the controller of your personal data. Our representative in the European Economic Area and the United Kingdom is DataRep.

Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in our Terms of Service.

Please read this Privacy Policy carefully. By accessing or using the Services, and by ticking the consent box or accepting the consent banner presented to you on the Website, you give your express, informed consent to the processing of your personal data, including its transfer to the Cayman Islands and the United States of America, as described in this Privacy Policy. If you do not agree with this Privacy Policy, you must not access or use the Services or provide your personal data to us.

1. The information we collect

Information you give to us

You may provide some or all of the following personal data to us when you interact with the Services:

(a) the public address of any self-custodied wallet you connect to the Interface, or of any wallet created for you through our third-party wallet provider, Privy, when you sign in with your email address;

(b) your email address, if you sign in to the Services with it, join a waitlist or subscribe to our newsletters or alerts;

(c) information about your trading experience, such as whether you consider yourself a “Beginner”, “Intermediate”, “Advanced” or “Professional” trader;

(d) referral codes, if you received a referral link to access the Services;

(e) information we need to carry out sanctions and wallet screening; and

(f) any other information you choose to include in your communications with us, for example when you send us an email or a message through the Website.

Information we collect automatically

When you visit the Website and use the Services, we collect information sent to us by your computer, mobile phone or other device. This information includes: (a) your IP address and the approximate location derived from it, which we use to apply the geographic access restrictions in our Terms of Service; (b) device information, including the name and type of operating system and browser you use; and (c) information about your use of the Services, collected through cookies and analytics tools (see section 5).

Information we collect from third parties

We may obtain information about you from third parties, including: (a) providers of sanctions screening, blockchain analytics and wallet screening services; (b) wallet providers and other third-party platforms you choose to link to the Services; and (c) public blockchains.

Public blockchain data

Transactions you submit through the Interface are recorded on public blockchains. Anyone can view your wallet address, transaction amounts, timestamps and other transaction details on those blockchains. We do not control public blockchains and cannot change, delete or restrict access to data recorded on them.

Sensitive data

We do not ask for, and you must not provide to us, sensitive data (datos sensibles) within the meaning of the Costa Rica Data Protection Law, such as information about racial or ethnic origin, political opinions, religious, spiritual or philosophical beliefs, health, or sex life or sexual orientation.

2. Whether you must provide your information

You do not have to provide any personal data to us. However, we cannot provide the Services to you without your wallet address, your email address (if you sign in with it) and the information we collect automatically, because we need that information to connect your wallet to the Interface, apply our access restrictions and carry out sanctions and wallet screening. Your trading-experience information is optional, and your email address is optional unless you choose to sign in with it.

3. How we use your information

We use your personal data, with your consent and, where the GDPR applies, on the legal bases set out below, for the following purposes:

To provide the Services to you (performance of our contract with you):

(a) to provide the Interface, content and Website functionality to you; and

(b) to let you sign in, connect your wallet to the Interface and prepare the transaction requests you submit.

With your consent:

(a) to sign you up for our waitlist, newsletters or alerts;

(b) to personalize the Services for you; and

(c) if you opt in to marketing, to tell you about products, services, promotions, events and other news we think will interest you. You can withdraw this consent at any time by using the unsubscribe link in our emails or by contacting us.

In our legitimate interests (to operate the Services and our business):

(a) to administer the Website and Services and for internal operations, including troubleshooting, data analysis, testing, research, and statistical and survey analysis;

(b) to keep our users, the Website, the Services and our business safe and secure;

(c) to send you announcements about security, privacy or administrative matters (these are not marketing messages, and you cannot opt out of them);

(d) to present content in the most effective manner for you and your device; and

(e) to improve and develop our products.

To comply with the law and protect our rights: we use your personal data to carry out sanctions and wallet screening, to apply the geographic access restrictions in our Terms of Service, to comply with applicable laws and lawful requests from authorities, to enforce our Terms of Service, and to protect or defend the Services, our rights, the rights of our users and others.

We will not use your personal data for purposes that are incompatible with those set out above without informing you and, where required by law, obtaining your consent.

4. How we share your information

We do not sell your personal data. We share your personal data only as described in this Privacy Policy:

(a) Service providers: with vendors who help us operate the Services, including wallet infrastructure, data analytics, security, website hosting, data storage, disaster recovery and communications providers. These providers process your personal data on our instructions.

(b) Third parties you choose: with third parties you ask us to share information with, such as wallet providers or other digital asset platforms.

(c) Professional advisers: with our auditors, lawyers, accountants and other professional advisers, where needed.

(d) Legal, compliance and security: with providers of sanctions screening, blockchain analytics and wallet screening services, and with regulators, law enforcement agencies, courts and other public authorities, where we determine this is necessary: (a) to comply with a legal obligation, court order or regulatory inquiry; (b) to protect the interests, safety and security of Exotic.xyz, our users, third parties or the public; (c) to establish, exercise or defend legal claims; or (d) to enforce our Terms of Service or other agreements.

(e) Affiliates: with companies in our corporate group, for the purposes described in this Privacy Policy.

(f) Business transactions: with a prospective buyer, seller, investor or other relevant third party in connection with a merger, sale of assets or shares, financing, restructuring, insolvency or other change of control.

5. Cookies and analytics

We use cookies and similar technologies to recognize your device, count the number of users, see how users move around the Website, and improve the Services. We set non-essential cookies only with your consent, which you can give or withdraw through the cookie banner on the Website. You can also block or delete cookies through your browser settings, although parts of the Website may not work properly if you do.

6. Where we store and transfer your information

Exotic.xyz is established in the Republic of Costa Rica. Your personal data will be transferred to, stored in and processed in the Cayman Islands and the United States of America. Exotic.xyz is hosted by third parties that may replicate data in servers where users, we, our affiliates or our service providers operate. The data protection laws of those countries may differ from the laws of the country where you live.

As required by article 14 of Law No. 8968, we transfer your personal data to third parties and to other countries only with your express authorization, which you give by accepting this Privacy Policy as described above, or where the law otherwise permits it. We take reasonable steps to ensure that recipients protect your personal data in line with this Privacy Policy.

Where the GDPR applies, transfers of personal data outside the European Economic Area or the United Kingdom are governed by the European Commission’s standard contractual clauses (module one (controller to controller) and/or module two (controller to processor), as relevant) or the UK Information Commissioner’s international data transfer addendum to those clauses, unless the transfer is to a country that the European Commission or the relevant UK authority has found to provide an adequate level of protection. You may ask for a copy of these safeguards by contacting us using the details in section 13.

7. How long we keep your information

We keep your personal data for as long as we need it for the purposes for which we collected it, and for as long as we must keep it to comply with our legal obligations (including legal, regulatory, sanctions, tax, accounting and reporting requirements), resolve disputes and enforce our Terms of Service and policies. We then delete or anonymize it. We may keep and use anonymized and aggregated information, which does not identify you, without further notice to you.

8. Security

We use reasonable technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, alteration and destruction. No transmission over the internet and no method of electronic storage is fully secure, so we cannot guarantee the security of your personal data, and any transmission is at your own risk. You are responsible for keeping your wallet, private keys and seed phrases secure. We will never ask you for your private keys or seed phrase.

9. Your rights

All users

Under the Costa Rica Data Protection Law you have the right to informational self-determination, including the right to:

(a) Access: know whether we hold personal data about you and obtain a copy of it, free of charge;

(b) Rectification: have inaccurate or incomplete personal data corrected or updated;

(c) Deletion: have your personal data deleted where its processing does not comply with the law or is no longer necessary for the purposes for which we collected it; and

(d) Revocation of consent: withdraw your consent at any time. Withdrawal does not affect processing carried out before it.

We will respond to requests to access, rectify or delete your personal data within five (5) business days of receiving a complete request, as required by Law No. 8968. If you consider that we have not respected your rights, you may file a complaint with the Agencia de Protección de Datos de los Habitantes (PRODHAB) of the Republic of Costa Rica.

Users in the European Economic Area, the United Kingdom and Switzerland

If you are located in the European Economic Area, the United Kingdom or Switzerland, you may also have the following rights, subject to applicable law:

(a) Portability: to receive a copy of the personal data you have provided to us in a structured, machine-readable format, and to ask us to transfer it to a third party;

(b) Restriction: to require us to restrict the processing of your personal data to storage, in certain circumstances;

(c) Objection: to object to our processing of your personal data, including for direct marketing; and

(d) Complaint: to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where you think an infringement occurred.

You may contact our GDPR representative, DataRep, at [email protected] or www.datarep.com/data-request.

Limits on your rights

Some of these rights apply only in certain circumstances, and the law may limit them, for example where fulfilling your request would adversely affect other people or our trade secrets or intellectual property, where there is an overriding public interest, or where the law requires us to keep your personal data. We cannot delete or change data recorded on public blockchains. We may need to verify your identity before we act on your request.

To exercise any of your rights, please contact us using the details in section 13.

10. Children

The Services are not intended for anyone under 18 years of age, and we do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from a person under 18, we will delete it.

11. Third-party links and services

The Website may contain links to websites, plug-ins, wallets and applications operated by third parties. We do not control those third parties and are not responsible for their content, privacy policies or use of your information. Information you submit to a third party is subject to that third party’s privacy policy. Information you share on public or semi-public venues, including third-party social media platforms, may be visible to other users of those platforms.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Privacy Policy on the Website and change the “Last updated” date at the top. If we make material changes, we will take reasonable steps to notify you, such as by placing a prominent notice on the Website. Where the law requires it, we will ask for your consent to the changes.

13. Contact us

If you have questions, comments or concerns about this Privacy Policy or your personal data, or you wish to exercise your rights, please contact us at [email protected].

14. Language

Except as otherwise required by applicable law, if there is any inconsistency between the English version of this Privacy Policy and any other language version, the English version prevails.