Privacy Policy

Last Updated: October 20, 2026

This Privacy Policy explains how Pay Verse HK Limited ("Duova," "we," "us," or "our") collects, uses, stores, discloses and otherwise processes personal information when you access or use the Duova website, platform, accounts, digital asset functionality and other products and services available through duova.io (collectively, the "Services").

For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, Pay Verse HK Limited acts as the data user in respect of personal data for which it determines the purposes and means of processing.

Under other applicable data protection laws, Pay Verse HK Limited may act as a data controller or equivalent.

Certain Service Providers may act independently in relation to personal information they process for their own services.

By using the Services, you acknowledge the practices described in this Privacy Policy.

This Privacy Policy should be read together with the Duova Terms & Conditions and any applicable product- specific privacy notices or terms.

1. Information We Collect

We may collect information that you provide directly to us, information generated through your use of the Services, and information received from Service Providers or other third parties.

Depending on the Services you use, this may include:

Account Information

• name;
• email address;
• phone number;
• username or account identifier;
• residential address;
• date of birth;
• nationality; and
• account preferences.

Identity and Verification Information

may process information including:

• government-issued identification documents;
• identification numbers;
• proof of address;
• occupation or employment information;
• source-of-funds or source-of-wealth information;
• tax-related information; and
• other information required for KYC, AML or compliance purposes.

Identity verification Service Providers may process photographs, facial images or other biometric-related information for identity verification purposes.

Duova generally receives verification results, status information and related compliance outputs from such providers rather than the underlying biometric data itself.

Financial and Transaction Information

We may collect information relating to:

• account balances;
• deposits and withdrawals;
• blockchain wallet addresses;
• transaction hashes;
• blockchain networks;
• transfers;
• payments;
• fees;
• product-specific transactions; and
• other account or transaction records.

Device and Technical Information

When you access the Services, we may automatically collect:

• IP address;
• device type;
• browser type;
• operating system;
• device identifiers;
• login information;
• approximate location derived from IP address;
• activity logs; and
• security and diagnostic information.

Communications

We may collect information contained in communications with us, including:

• customer support requests;
• complaints;
• emails;
• surveys;
• feedback; and
• other correspondence.

Where we request personal information from you, we will indicate where appropriate whether providing that information is mandatory or voluntary.

Where information is required to provide a Service, complete identity verification, satisfy compliance requirements or meet applicable legal or regulatory obligations, failure to provide the requested information may prevent us or the relevant Service Provider from providing some or all of the Services to you.

2. How We Use Your Information and Legal Bases

We use personal information only for purposes connected with providing, operating, securing and improving the Services, or for other purposes permitted by applicable law.

Depending on the applicable law and the nature of the relevant Service, processing may be based on:

• performance of a contract;
• compliance with legal obligations applicable to Duova or the relevant Service Provider;
• legitimate interests of Duova or a third party;
• your consent, where required; or
• another lawful basis recognized under applicable law.

We may use personal intormation to:

• create and manage your Duova account;
• provide and operate the Services;
• process deposits, withdrawals, transfers and other transactions;
• provide customer support;
• verify your identity;
• perform KYC, AML, sanctions and fraud checks;
• monitor transactions and blockchain activity;
• detect and prevent fraud, abuse or unauthorized access;
• maintain account and transaction records;
• comply with applicable legal, regulatory and reporting requirements;
• improve the security, reliability and performance of the Services;
• develop and improve Duova products;
• communicate with you about your account or transactions;
• send important legal, compliance or security notices;
• calculate and collect applicable fees;
• resolve disputes and investigate complaints; and
• protect the rights, property and security of Duova, our users and Service Providers.

Where permitted by applicable law, we may also use information for analytics, product improvement and marketing purposes.

Where consent is required, we will obtain it before carrying out the relevant processing.

3. KYC, AML and Compliance Processing

Duova operates in an environment involving digital assets and financial technology services.

We and our Service Providers may therefore process personal information for purposes including:

• identity verification;
• KYC checks;
• AML screening;
• sanctions screening;
• fraud prevention;
• blockchain analytics;
• Know Your Transaction ("KYT") monitoring;
• source-of-funds verification; and
• other regulatory or risk management purposes.

These activities may involve third-party identity verification, compliance, fraud prevention or blockchain analytics providers.

Where identity verification involves facial matching, liveness detection or other biometric-related processing, such processing may be performed by the relevant identity verification Service Provider.

Duova generally receives the outcome of the verification process, such as verification status, risk indicators or related compliance results, rather than the underlying biometric data.

Where required by applicable law or reasonably necessary for compliance purposes, we may restrict, delay or suspend access to the Services while a review is being conducted.

4. Information We Receive From Third Parties

We may receive personal information from third parties involved in providing or supporting the Services, including:

• identity verification providers;
• financial institutions;
• digital asset custodians;
• payment service providers;
• blockchain infrastructure providers;
• compliance and fraud prevention providers;
• blockchain analytics providers;
• technology providers;
• analytics providers; and
• other Service Providers.

Information received from third parties may include:

• identity verification results;
• transaction information;
• payment information;
• account status information; and
• fraud or security indicators.

We may combine this information with other information we hold about you where reasonably necessary for the purposes described in this Privacy Policy.

5. How We Share Information

We may share personal information where reasonably necessary to provide, secure, operate or improve the Services, or to comply with legal obligations.

Service Providers

We may share information with third parties that provide services such as:

• digital asset custody;
• blockchain deposits and withdrawals;
• payment and other product-specific financial services;
• asset conversion;
• identity verification;
• KYC and AML screening;
• blockchain analytics and KYT services;
• cloud infrastructure;
• cybersecurity;
• communications;
• customer support; and
• other operational or technology services.

Service Providers may act on our behalf or, depending on the service and applicable law, as independent data users, controllers or equivalent.

Where a Service Provider independently determines how it processes your personal information, its own privacy notice may also apply.

We may disclose personal information where required or permitted by applicable law, including to:

• regulators;
• law enforcement agencies;
• courts;
• tax authorities;
• government agencies; and
• other competent authorities.

Corporate Transactions

If Duova is involved in a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, personal information may be disclosed to relevant advisers, counterparties or successors, subject to appropriate confidentiality and data protection safeguards.

Protection of Rights and Security

We may disclose information where reasonably necessary to:

• prevent fraud;
• investigate security incidents;
• protect users;
• enforce our agreements;
• protect our legal rights; or
• protect the safety and integrity of the Services.

6. International Data Transfers

Duova operates internationally and works with Service Providers located in different countries and regions.

As a result, your personal information may be transferred to, stored in or processed in jurisdictions outside Hong Kong or outside your country of residence.

These jurisdictions may have data protection laws that differ from those in your home jurisdiction.

Where required by applicable law, Duova will take appropriate measures designed to protect personal information transferred across borders.

Such measures may include:

• standard contractual clauses or equivalent mechanisms where applicable;
• confidentiality and security requirements;
• appropriate access controls;
• encryption where appropriate; and
• other safeguards required under applicable law.

We seek to transfer personal information only to the extent reasonably necessary for the purposes described in this Privacy Policy.

7. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or otherwise processed.

These purposes may include:

• providing the Services;
• maintaining account and transaction records;
• complying with legal and regulatory obligations;
• meeting KYC, AML and financial recordkeeping requirements;
• resolving disputes;
• enforcing agreements;
• preventing fraud;
• maintaining audit records; and
• protecting our legal rights.

Retention periods vary depending on:

• the type of personal information;
• the purpose of processing;
• applicable legal requirements;
• the relevant product or Service; and
• requirements applicable to the relevant Service Provider.

Account, identity and transaction information may be retained for the minimum period required under applicable anti-money laundering, financial services, tax, accounting or other recordkeeping requirements.

Certain Service Providers may also be required to retain information for periods prescribed by laws and regulations applicable to them.

Closing your Duova account does not necessarily result in immediate deletion of all personal information.

Certain records may need to be retained after account closure for legal, regulatory, compliance, audit, fraud prevention or dispute resolution purposes.

When personal information is no longer reasonably required, we will take appropriate steps to delete, anonymize or otherwise securely dispose of it in accordance with applicable requirements.

8. Security

Duova uses technical, administrative and organizational measures designed to protect personal information against:

• unauthorized access;
• loss;
• misuse;
• alteration;
• unauthorized disclosure; and
• destruction.

These measures may include:

• encryption;
• authentication;
• access controls;
• monitoring;
• logging;
• internal security procedures; and
• other appropriate safeguards.

However, no electronic system, network or storage method can be guaranteed to be completely secure.

You are responsible for maintaining the security of your Duova account credentials and the devices you use to access the Services.

If you believe that your account or personal information has been compromised, you should contact us promptly.

9. Cookies and Similar Technologies

Duova may use cookies and similar technologies to:

• operate the website and Services;
• maintain user sessions;
• remember preferences;
• improve website and platform performance;
• understand how users interact with the Services;
• detect fraud or security risks; and
• support analytics.

Where required by applicable law, we will obtain consent before using non-essential cookies or similar technologies.

You may be able to manage cookie preferences through your browser settings or any cookie management tools made available by Duova.

Disabling certain cookies may affect the functionality of the Services.

10. Marketing Communications

Where permitted by applicable law, Duova may send you information about:

• new products;
• platform updates;
• promotions;
• rewards;
• events; and
• other Duova services.

Where required by applicable law, we will obtain your consent before using your personal information for direct marketing.

You may opt out of direct marketing at any time, free of charge, by:

• using the unsubscribe mechanism included in the communication; or
• contacting us using the details provided in this Privacy Policy.

We will not use or provide your personal information for direct marketing in a manner inconsistent with applicable Opting out of marketing communications will not prevent us from sending necessary communications relating to:

• your account;
• transactions;
• security;
• compliance;
• legal notices; or
• the operation of the Services.

11. Your Privacy Rights

Depending on your location and applicable law, you may have rights relating to your personal information.

Rights Under Hong Kong Law

Under applicable Hong Kong data protection law, you may have the right to:

• request access to personal data held about you; and
• request correction of inaccurate personal data.

These rights are subject to applicable legal requirements and exceptions.

Additional Rights in Other Jurisdictions

Depending on where you are located, you may also have additional rights, including the right to:

• request deletion of certain personal information;
• object to certain processing;
• request restriction of certain processing;
• withdraw consent where processing is based on consent;
• request information about how personal information is used or shared;
• request portability of personal information where applicable;
• request human review of certain significant decisions made solely by automated means, where applicable;

and

• exercise other rights available under applicable data protection laws.

Certain rights may be restricted where continued processing or retention is necessary for:

• compliance with legal obligations;
• KYC or AML requirements;
• fraud prevention;
• regulatory reporting;
• dispute resolution;
• transaction recordkeeping; or
• establishment, exercise or defence of legal claims.

To submit a privacy request, please contact:

compliance@duova.io We may need to verify your identity before processing your request.

You may also have the right to lodge a complaint with a competent privacy or data protection authority in your jurisdiction.

In Hong Kong, this includes the Office of the Privacy Commissioner for Personal Data ("PCPD").

12. Children's Privacy

The Services are not intended for individuals under the age of 18 or the applicable legal age required to use the Services.

We do not knowingly provide the Services to children.

If we become aware that personal information has been collected from a person who is not eligible to use the Services, we may take reasonable steps to delete or restrict the relevant information, subject to applicable legal and regulatory requirements.

13. Third-Party Services and Websites

The Duova platform may contain links to or integrations with third-party websites, applications or services.

Those third parties may collect or process personal information independently under their own privacy policies.

Where a third party acts independently from Duova, its privacy practices are governed by its own privacy documentation.

Duova is not responsible for the privacy practices of independent third parties.

We encourage you to review the privacy policy of any third-party service before providing personal information to it.

14. Automated Risk and Fraud Monitoring

Duova and its Service Providers may use automated tools, rules, analytics or risk models to identify:

• suspicious transactions;
• fraud;
• security threats;
• sanctions risks;
• unusual account activity; or
• potential violations of applicable requirements.

These processes may result in transactions or account activity being:

• flagged;
• delayed;
• reviewed;
• restricted; or
• declined.

Where required by applicable law, you may have the right to request human review of certain significant decisions based solely on automated processing.

Manual review may also be performed as part of Duova's or a Service Provider's risk and compliance procedures.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to the Services;
• new products or features;
• changes to Service Providers;
• legal or regulatory developments;
• changes to our data processing practices; or
• changes to applicable compliance requirements.

Updated versions will be published on duova.io with a revised "Last Updated" date.

Where required by applicable law, we will provide notice of material changes.

Your continued use of the Services following an update constitutes acknowledgment of the revised Privacy Policy to the extent permitted by applicable law.

16. Contact Us

If you have questions, concerns or requests regarding this Privacy Policy or the handling of your personal information, please contact:

Pay Verse HK Limited Hong Kong Website: duova.io Customer Support: service@duova.io Privacy & Compliance: compliance@duova.io For data access, correction or other privacy-related requests, please contact:

compliance@duova.io

© 2026 Pay Verse HK Limited. All rights reserved.