Privacy Policy

1. Who We Are and Legal Basis

This Privacy Policy explains how V Pawn Trading Limited, a company incorporated in Hong Kong (Company No. 77652638, registered address: Room 409, Beverley Commercial Centre, 87-105 Chatham Road South, Tsim Sha Tsui, Hong Kong) (the "Company"), handles personal data of Members of VPawn at vpawn.io (the "Service"). The Company handles personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.

The Service is currently in a testing phase. Statements about Partner Pawnshops describe what will happen once live operation begins.

2. Personal Data We Collect

The personal data a Member provides when signing up is an email address. The Company uses it to identify the Member and to send notices.

A Member may also choose to provide the following optional profile information: a profile image, a profile banner and a short biography ("optional information"). A Member may also choose a preferred display currency.

A Member who requests delivery of an item provides the recipient's name, phone number and delivery address. These are stored encrypted and are used for that delivery and for no other purpose.

3. Information Processed When You Use the Service

The following information is processed in the course of using the Service.

1. Password: if a Member sets a password, it is stored as a hash, not in readable form.

2. Wallet information: the connected wallet address, wallet address records linked to the Member's account, and a one-time signing nonce used when the Member signs in by wallet signature. If a Member creates a Wallet on the Service, an encrypted copy of the wallet key is stored so that the Member can restore the Wallet. The Company cannot open it without the Member's wallet password or recovery code.

3. On-chain transaction records: wallet addresses, transaction hashes and amounts of transactions made through the Service. This information is also publicly visible on the blockchain.

4. Newsletter subscription: if a person subscribes to the newsletter, the email address entered is stored for that purpose.

5. Verification codes: one-time codes sent to a Member's email address to confirm the address.

6. Access information: IP addresses are recorded in the web server access log and, for spam prevention, when forms are submitted. A session cookie keeps the Member signed in. The language setting is stored in the browser's local storage.

4. Information We Do Not Collect

The Company does not collect identity documents, dates of birth or any other identity verification information. The Company does not have access to wallet private keys or seed phrases. For card payments, identity verification is carried out by Wert under its own terms, and the Company does not receive or keep that information.

5. Purposes of Use

The Company uses personal data to: identify Members and operate accounts; send service notices and, with the Member's consent, newsletters; operate the Service and record transactions made through it; prevent spam, fraud and misuse; keep the Service secure; and meet legal obligations.

6. Disclosure to Third Parties and Service Providers

The Company does not sell personal data. The following parties are involved in the Service.

1. Wert (SHA2 Solutions OÜ, Estonia): for card payments, the buyer provides information directly to Wert, which carries out identity verification under its own terms and acts as merchant of record. The Company does not receive or keep that information.

2. Mailgun: the Company uses the Mailgun email delivery service to send emails such as verification codes and notices. The recipient's email address and the message content are processed by Mailgun for delivery. Mailgun processes this data in the United States.

3. Cloudflare: the Service is delivered through the Cloudflare network. Cloudflare processes visitors' IP addresses and request data to deliver and protect the website.

4. Vercel: the website is hosted on Vercel (Vercel Inc., United States). Vercel processes visitors' IP addresses and request data to deliver the website.

5. Image storage: if profile images and similar content are stored in external storage, the Company will state the storage operator and its country separately in this Policy.

6. Partner Pawnshops: after live operation begins, the Company will provide information to the issuing Partner Pawnshop where this is needed for the redemption of a pawned item.

7. Delivery companies: when a Member requests delivery, the recipient's name, phone number and delivery address are given to the delivery company that carries the item.

8. Authorities: the Company may disclose information where required by law or by a competent authority.

7. Cookies and Local Storage

The Service uses a session cookie to keep Members signed in and browser local storage to keep the language setting and wallet connection state. These are needed for the Service to work. A Member can remove them in the browser settings, but parts of the Service may then not work.

8. Retention

The Company keeps personal data for as long as it is needed for the purposes in section 5. The retention periods are: account information is deleted immediately when the account is deleted; access logs for 90 days; delivery details 90 days after the delivery is completed or cancelled; newsletter email addresses until the person unsubscribes. Transaction records on the blockchain cannot be deleted by the Company.

9. Where Data Is Stored

Personal data is stored on servers located in Japan. Providers named in section 6 may process data in other countries.

10. Security

The Company protects personal data with measures such as storing passwords as hashes, restricting access to servers and encrypting connections. No method of transmission or storage is completely secure.

11. Your Rights

Under Cap. 486, a Member may request access to personal data the Company holds about the Member and may request correction of data that is inaccurate. To make a request, email info@vpayv.com from the address registered with the Service, stating what is requested. The Company will respond within 40 days. A Member may also ask to delete the account or to stop receiving the newsletter by using the same contact.

12. Data Protection Officer

Taehoon Nam, info@vpayv.com.

13. Changes

The Company will announce changes to this Privacy Policy on the Service before they take effect, in line with the Terms of Service (/terms-of-services).

14. Related Documents

Terms of Service: /terms-of-services. General Risk Warning: /global-risk-warning.

15. Effective Date

This Privacy Policy takes effect on 13 November 2026.