Privacy Policy

Last updated: 31.05.2026

This Privacy Policy explains how Tokrava, operated by FLUXPAY FINANCIAL LTD., collects, uses, stores, shares, protects, and otherwise processes personal information when you access or use our website, onboarding process, verification process, compliance checks, transaction services, support channels, or other services.

By using Tokrava, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

Tokrava is operated by:

FLUXPAY FINANCIAL LTD.

Incorporated in Canada

Incorporation number: BC1576401

Canadian MSB registration number: N300000152

Website: tokrava.com

In this Privacy Policy, “Tokrava,” “we,” “us,” and “our” refer to FLUXPAY FINANCIAL LTD. operating under the Tokrava brand.

For privacy questions, contact:

Privacy email: support@tokrava.com

Compliance email: support@tokrava.com

2. Scope of This Policy

This Privacy Policy applies to personal information collected through:

• Our website;
• Account registration;
• Client onboarding;
• AML/KYC verification;
• KYB verification for business clients;
• Sanctions, PEP, and adverse media screening;
• Wallet screening and blockchain transaction monitoring;
• Client support;
• Legal, compliance, fraud-prevention, and security reviews;
• Communications with Tokrava.

This Privacy Policy does not apply to third-party websites or services that we do not control. Third-party providers may have their own privacy policies.

3. Our Self-Custody Model

Tokrava operates on a self-custody basis.

We do not provide hosted wallets, custodial wallets, private-key custody, recovery phrase storage, wallet-management services, or wallet addresses for clients.

Clients hold, control, and manage their own external crypto wallets. However, for compliance, AML, sanctions, fraud-prevention, wallet-risk screening, and transaction-monitoring purposes, we may collect and process information relating to wallet addresses, transaction hashes, blockchain networks, counterparties, source of funds, transaction purpose, and blockchain activity.

Providing a wallet address to Tokrava does not mean that Tokrava takes custody, control, or ownership of your crypto assets.

4. Personal Information We Collect

We may collect personal information directly from you, automatically through your use of the website, from third-party verification providers, from blockchain analytics tools, from public sources, and from service providers.

Personal information may include:

A. Identification Information

• Full legal name;
• Date of birth;
• Nationality;
• Citizenship;
• Country of residence;
• Residential address;
• Phone number;
• Email address;
• Government-issued identification document;
• Identification number;
• Document issue and expiry date;
• Proof of address.

B. Verification and Biometric Information

Where permitted by law and where required for onboarding or compliance, we or our verification providers may process:

• Selfie images;
• Liveness check data;
• Face-match results;
• Biometric templates or biometric indicators;
• Document authenticity results;
• Verification status;
• Fraud-detection signals;
• Device and session data related to verification.

Where consent is required for biometric processing, we will request consent or our verification provider will request consent before processing.

C. Financial and Transaction Information

• Transaction requests;
• Transaction history with Tokrava;
• Fiat payment details;
• Crypto asset type and amount;
• Exchange rates, fees, and timestamps;
• Source of funds;
• Source of wealth;
• Purpose of transaction;
• Expected account activity;
• Bank/payment provider references where applicable.

D. Wallet and Blockchain Information

Because Tokrava operates on a self-custody basis, we may collect information about external wallets and blockchain transactions, including:

• Wallet addresses you provide;
• Transaction hashes;
• Blockchain networks;
• Counterparty wallet addresses;
• Transaction risk scores;
• Blockchain analytics results;
• Exposure to high-risk categories;
• Sanctions, darknet, scam, ransomware, mixer, tumbler, theft, or fraud indicators;
• Transaction monitoring alerts;
• Case review notes.

Blockchain data may be publicly visible and may remain permanently recorded on the relevant blockchain network.

E. Business Client Information

For business clients, we may collect:

• Legal entity name;
• Trading name;
• Registration number;
• Incorporation documents;
• Registered address;
• Principal business address;
• Directors;
• Officers;
• Authorised representatives;
• Ultimate beneficial owners;
• Ownership and control structure;
• Business activity;
• Website;
• Source of funds and source of wealth;
• Expected transaction activity;
• Supporting corporate documents.

F. Technical and Device Information

We may collect:

• IP address;
• Device identifiers;
• Browser type;
• Operating system;
• Login timestamps;
• Session data;
• Cookie identifiers;
• Approximate location based on IP address;
• Security logs;
• Fraud-prevention signals;
• Website usage data.

G. Communications and Support Information

We may collect:

• Emails and messages you send us;
• Support requests;
• Complaint records;
• Call notes or recordings, where applicable and permitted;
• Documents you provide;
• Internal compliance and support notes.

5. Information We Do Not Collect

Tokrava does not ask you to provide your private keys, seed phrases, recovery phrases, wallet passwords, or full control credentials for your external wallet.

You should never send private keys, recovery phrases, seed phrases, or wallet passwords to Tokrava or to anyone claiming to represent Tokrava.

If you disclose such information to anyone, your crypto assets may be permanently lost or stolen.

6. How We Collect Information

We may collect information:

• Directly from you during registration, onboarding, verification, transaction requests, and support communications;
• Automatically when you use our website or systems;
• From identity verification providers;
• From AML/KYC/KYB providers;
• From sanctions, PEP, and adverse media screening tools;
• From blockchain analytics and transaction-monitoring providers;
• From payment processors, banks, and financial partners;
• From public databases, corporate registries, sanctions lists, and regulatory sources;
• From law enforcement, regulators, or other authorities where permitted or required by law.

7. Why We Use Personal Information

We may use personal information to:

• Create and manage accounts;
• Verify your identity;
• Verify business clients and beneficial owners;
• Conduct AML/KYC and KYB checks;
• Conduct sanctions, PEP, and adverse media screening;
• Conduct wallet screening and transaction monitoring;
• Assess source of funds and source of wealth;
• Detect, prevent, and investigate fraud;
• Detect and prevent money laundering, terrorist financing, sanctions evasion, cybercrime, scams, and other unlawful activity;
• Process transaction requests;
• Communicate with you;
• Provide customer support;
• Handle complaints;
• Protect the security and integrity of Tokrava;
• Comply with legal and regulatory obligations;
• Keep records required by law;
• Cooperate with regulators, financial intelligence units, law enforcement, courts, and competent authorities;
• Enforce our Terms of Service and policies;
• Improve our website, systems, and services;
• Manage risk, audits, legal claims, and business operations.

Canada’s private-sector privacy law, PIPEDA, is built around principles such as accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. (Office of the Privacy Commissioner)

8. Legal Bases for Processing — EU / EEA Users

Where the General Data Protection Regulation applies, we process personal data using one or more legal bases, including:

A. Performance of a Contract

We process personal data where necessary to provide Tokrava services, manage your account, process transaction requests, communicate with you, and perform our Terms of Service.

B. Legal Obligation

We process personal data where necessary to comply with AML, sanctions, fraud-prevention, tax, accounting, regulatory, reporting, recordkeeping, and law-enforcement obligations.

C. Legitimate Interests

We process personal data where necessary for legitimate interests, including:

• Preventing fraud;
• Protecting Tokrava and users;
• Securing systems;
• Monitoring suspicious activity;
• Enforcing Terms of Service;
• Managing legal claims;
• Improving services;
• Maintaining business records.

We rely on legitimate interests only where those interests are not overridden by your rights and freedoms.

D. Consent

We may rely on consent where required, including for certain cookies, marketing communications, biometric processing, or optional processing activities.

You may withdraw consent at any time, but withdrawal will not affect processing already carried out before withdrawal. In some cases, if you withdraw consent, we may be unable to provide services.

E. Establishment, Exercise, or Defence of Legal Claims

We may process personal data where necessary to establish, exercise, or defend legal claims.

The European Commission explains that EU data protection law includes the GDPR and is designed to protect personal data inside and outside the EU. (European Commission)

9. AML/KYC, Sanctions, and Compliance Processing

Because Tokrava provides crypto asset exchange services, we must apply strong compliance controls.

We may process personal information to:

• Verify your identity;
• Confirm your address;
• Check your source of funds;
• Check your source of wealth;
• Screen for sanctions exposure;
• Screen for politically exposed person status;
• Screen for adverse media;
• Screen wallet addresses;
• Monitor blockchain transactions;
• Investigate suspicious activity;
• Prepare internal compliance records;
• Report activity where required or permitted by law.

You may be required to provide personal information and documents before using Tokrava or before completing a transaction.

If you do not provide required information, we may refuse onboarding, restrict services, delay transactions, reject transactions, close your account, or report activity where required or permitted by law.

10. Automated Screening and Decision-Making

Tokrava may use automated tools to support identity verification, document checks, liveness checks, sanctions screening, fraud detection, wallet-risk screening, transaction monitoring, and risk scoring.

Automated tools may flag accounts, wallets, or transactions for manual review.

Tokrava may delay, reject, restrict, or escalate a transaction or account based on automated screening results, manual compliance review, or a combination of both.

Where GDPR applies and a decision produces legal or similarly significant effects, you may have rights relating to automated decision-making, including the right to request human review where applicable.

11. Biometric Data

Identity verification may involve facial images, liveness detection, or face matching to confirm that you are a real person and that your identity document belongs to you.

Depending on applicable law, this information may be treated as biometric data or sensitive personal data.

We process this information only for identity verification, fraud prevention, AML/KYC, account security, and compliance purposes.

We may use third-party providers such as Didit, Sumsub, or similar verification providers to perform these checks. These providers may process data on our behalf or as independent controllers depending on the service and legal arrangement.

12. Sharing Personal Information

We may share personal information with:

• Identity verification providers;
• AML/KYC/KYB providers;
• Sanctions, PEP, and adverse media screening providers;
• Blockchain analytics providers;
• Transaction-monitoring providers;
• Fraud-prevention providers;
• Payment processors;
• Banking and financial partners;
• Liquidity providers where necessary;
• Cloud hosting and infrastructure providers;
• Cybersecurity providers;
• Customer support tools;
• Email and communication providers;
• Analytics providers, where permitted;
• Legal, audit, tax, and compliance advisers;
• Regulators, courts, law enforcement, financial intelligence units, government agencies, and competent authorities;
• Business successors in the event of merger, acquisition, restructuring, financing, sale of assets, or corporate transaction.

We do not sell your personal information.

13. Third-Party Verification Providers

Tokrava may use third-party providers such as Didit, Sumsub, or other compliance providers to perform identity verification, document verification, liveness checks, biometric checks, AML screening, wallet screening, transaction monitoring, and fraud-prevention services.

When you complete verification, you may be redirected to or interact with a third-party provider’s interface. That provider may collect and process your information according to its own terms and privacy notices, as well as our instructions where it acts on our behalf.

You should read the privacy notices of any third-party provider used during onboarding or verification.

14. International Transfers

FLUXPAY FINANCIAL LTD. is a Canadian company. Your personal information may be processed in Canada, the European Union, the United Kingdom, the United States, or other countries where we or our service providers operate.

If personal data is transferred from the EU or EEA to a country outside the EU or EEA, we will use appropriate safeguards where required, such as:

• Adequacy decisions;
• Standard contractual clauses;
• Transfer impact assessments;
• Contractual protections;
• Technical and organisational safeguards;
• Other lawful transfer mechanisms.

Canadian privacy law also addresses information that crosses borders, and PIPEDA applies to private-sector organisations that collect, use, or disclose personal information in commercial activities. (Office of the Privacy Commissioner)

15. Data Retention

We keep personal information only for as long as necessary for the purposes described in this Privacy Policy, including:

• Account operation;
• AML/KYC and KYB compliance;
• Sanctions screening;
• Fraud prevention;
• Transaction monitoring;
• Legal and regulatory reporting;
• Audit;
• Tax and accounting;
• Complaint handling;
• Dispute resolution;
• Legal claims;
• Security and risk management.

Certain compliance records may need to be retained after your account is closed, even if you request deletion, where retention is required or permitted by law.

When information is no longer required, we will delete, anonymise, or securely archive it according to our retention procedures and legal obligations.

16. Security

We use technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

Safeguards may include:

• Access controls;
• Encryption where appropriate;
• Secure hosting;
• Logging and monitoring;
• Internal policies;
• Staff access limitations;
• Vendor due diligence;
• Security reviews;
• Incident response procedures.

No system is completely secure. You are responsible for protecting your own account credentials, email account, devices, wallet passwords, private keys, recovery phrases, and two-factor authentication methods.

17. Cookies and Similar Technologies

Tokrava may use cookies, pixels, local storage, device identifiers, and similar technologies.

We may use these technologies for:

• Website functionality;
• Login and session management;
• Security and fraud prevention;
• Preference storage;
• Analytics;
• Performance monitoring;
• Legal and compliance records;
• Marketing, where permitted and consented to where required.

Where required by law, we will request consent before using non-essential cookies.

You can manage cookies through your browser settings or through any cookie settings tool provided on the website.

18. Marketing Communications

We may send service-related communications, compliance notices, transaction updates, security alerts, and legal notices.

We may send marketing communications only where permitted by law and where any required consent has been obtained.

You may opt out of marketing communications at any time. You cannot opt out of essential service, compliance, legal, security, or transaction-related communications.

19. Your Privacy Rights

Depending on where you live and which laws apply, you may have rights to:

• Access your personal information;
• Correct inaccurate or incomplete information;
• Request deletion;
• Restrict processing;
• Object to processing;
• Withdraw consent;
• Request data portability;
• Ask about automated decision-making;
• Challenge our compliance with privacy obligations;
• Lodge a complaint with a privacy or data protection authority.

Under PIPEDA, organisations are responsible for personal information under their control and individuals can request access and challenge the accuracy and completeness of their information. (Office of the Privacy Commissioner)

20. Limits on Privacy Rights

Your rights may be limited where we must retain or process information for:

• AML/KYC compliance;
• Sanctions compliance;
• Fraud prevention;
• Transaction monitoring;
• Security;
• Legal claims;
• Regulatory reporting;
• Court orders;
• Law-enforcement requests;
• Tax or accounting obligations;
• Recordkeeping requirements.

For example, we may not be able to delete verification, transaction, or compliance records immediately if we are required or permitted to retain them.

21. How to Exercise Your Rights

To exercise privacy rights, contact:

Privacy email: support@tokrava.com

We may need to verify your identity before responding to a request.

Please include:

• Your full name;
• Account email;
• Country of residence;
• Right you wish to exercise;
• Details of your request.

We will respond within the timeframe required by applicable law.

22. Children

Tokrava is not intended for persons under 18 years old.

We do not knowingly provide services to children or knowingly collect personal information from persons under 18.

If we become aware that a person under 18 has provided personal information, we may delete the information and close or restrict the account, subject to legal and compliance obligations.

23. Blockchain Data

Blockchain transactions are recorded on public or permissioned blockchain networks. Blockchain data may be visible to anyone and may not be capable of deletion or modification by Tokrava.

If you provide or use a wallet address, information about that address and related transactions may be analysed for AML, sanctions, fraud-prevention, and transaction-monitoring purposes.

You should understand that blockchain activity may be linkable to your identity if you use Tokrava or provide wallet information during onboarding or transactions.

24. Business Transfers

If Tokrava or FLUXPAY FINANCIAL LTD. is involved in a merger, acquisition, financing, reorganisation, sale of assets, change of control, insolvency process, or similar transaction, personal information may be transferred or disclosed as part of that transaction.

Any successor entity may continue to process personal information in accordance with this Privacy Policy or a replacement policy.

25. Complaints

If you have a privacy complaint, contact:

Privacy email: support@tokrava.com

We will review your complaint and respond in accordance with applicable law.

You may also have the right to complain to a privacy regulator or data protection authority in your jurisdiction.

26. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

The updated version will be posted on the website with a revised “Last updated” date.

Where required by law, we may notify you of material changes.

Your continued use of Tokrava after the updated Privacy Policy becomes effective means you acknowledge the updated policy.

27. Contact Us

For privacy questions, requests, or complaints, contact:

Tokrava / FLUXPAY FINANCIAL LTD.

Website: tokrava.com

Privacy email: support@tokrava.com

Compliance email: support@tokrava.com

Short Privacy Notice for Onboarding

You can place this before the KYC/verification step:

Privacy and Verification Notice

Tokrava, operated by FLUXPAY FINANCIAL LTD., collects and processes personal information for account registration, identity verification, AML/KYC checks, sanctions screening, fraud prevention, wallet screening, transaction monitoring, legal compliance, security, and service delivery.

Tokrava operates on a self-custody basis and does not provide hosted wallets or private-key custody. However, Tokrava may collect wallet addresses, transaction hashes, blockchain networks, and related transaction information for compliance and risk-monitoring purposes.

Tokrava may share information with identity verification providers, AML/KYC providers, blockchain analytics providers, transaction-monitoring providers, payment partners, banks, regulators, law enforcement, and other parties where required or permitted by law.

By continuing, you confirm that you have read and understood Tokrava’s Privacy Policy and consent to verification and compliance checks where consent is required.

☐ I agree.