Privacy Policy

1. Introduction

Ultimo ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the rights you have over it. By using the Platform you consent to the practices described in this policy. This policy applies to all users of the Ultimo platform and associated services.

2. Information We Collect

We collect information you provide directly — such as your name, email address, government-issued identification documents, date of birth, and financial information required for KYC/AML compliance. We also collect information automatically when you use the Platform, including your IP address, browser type, device identifiers, pages visited, time spent on the Platform, and transaction data. We may also receive information about you from third-party identity verification providers, fraud prevention services, and blockchain analytics tools.

3. How We Use Your Information

We use your information to: provide, maintain, and improve the Platform; verify your identity and comply with our legal obligations; process your transactions; detect and prevent fraud, money laundering, and other illegal activity; communicate with you about your account, updates, and promotional offers (where you have opted in); analyse usage patterns to improve user experience; and comply with applicable law and regulatory requirements. We do not sell your personal information to third parties.

4. Legal Basis for Processing

We process your personal data on the following legal bases: performance of a contract (to provide the Platform services); compliance with a legal obligation (including KYC/AML requirements); our legitimate interests (including fraud prevention, security, and product improvement); and your consent (for marketing communications, where applicable). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Disclosure

We may share your information with: service providers who assist us in operating the Platform (subject to confidentiality obligations); identity verification and fraud prevention partners; regulators, law enforcement, and government authorities where required by law; and successor entities in connection with a merger, acquisition, or sale of assets. We require all third parties to respect the security of your personal data and to treat it in accordance with applicable law.

6. Data Retention

We retain your personal data for as long as necessary to provide the Platform services and to comply with our legal obligations. KYC/AML records are typically retained for a minimum of five years following the end of your relationship with us, or such longer period as may be required by law. After the applicable retention period, your data will be securely deleted or anonymised.

7. Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security assessments. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to: access the personal data we hold about you; correct inaccurate or incomplete data; request deletion of your data (subject to our legal obligations); object to or restrict certain processing activities; data portability; and withdraw consent where processing is based on consent. To exercise any of these rights, please contact us through the support channels on the Platform.

9. Cookies & Tracking

We use cookies and similar tracking technologies to enhance your experience on the Platform, analyse usage, and deliver relevant content. Analytics cookies are set only after you consent via the cookie banner — see section 10 (Analytics) below. You can control cookie preferences through your browser settings, and you can withdraw analytics consent at any time via the Cookie Settings link in the app. Disabling certain cookies may affect the functionality of the Platform. We do not use cookies to track you across third-party websites for advertising purposes.

10. Analytics

We use Google Analytics 4, a web analytics service provided by Google LLC ("Google"), to understand how visitors use the Ultimo app at app.ultimox.io — for example the number of visitors, the pages they view, the country and device they visit from, and the site that referred them. Google Analytics is not used on this website (ultimox.io).

Google Analytics is activated only after you consent via the cookie banner shown in the app. If you decline, no analytics cookies are set and no data is sent to Google. You can withdraw your consent at any time via the Cookie Settings link in the app; withdrawal stops all further measurement and deletes the analytics cookies.

When active, Google Analytics collects: pages viewed in the app (address path only — never the content of forms, account details, balances, or transactions), approximate location (country/region level), device, browser and operating system information, and the referring website. We do not send your name, email address, account identifiers, or any financial information to Google. IP addresses are not stored by Google Analytics.

This data is processed by Google on our behalf and may be transferred to and stored on Google servers outside your country, including in the United States. User- and event-level analytics data is retained for 14 months. For more information, see Google’s Privacy Policy (policies.google.com/privacy) and "How Google uses information from sites or apps that use our services" (policies.google.com/technologies/partner-sites).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Platform or by email. Your continued use of the Platform after changes are effective constitutes acceptance of the updated policy. We encourage you to review this policy periodically.