Privacy Policy

1. Who we are

Avelor Financial Limited ("Avelor", "we", "us") operates the LedgerCard prepaid card programme, the LedgerCard web application and the website at which this policy is published (together, the "Services"). Avelor is a company incorporated in Hong Kong (Business Registration No. 76701947-000-06-26-8) with its registered office at 9th Floor, Amtel Building, 148 Des Voeux Road Central, Hong Kong.

For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the "PDPO"), Avelor is the data user responsible for personal data collected through the Services. Where cards are issued by our issuing partner, that partner is a separate data user for the personal data it holds under its own card-issuing obligations and its own privacy notice applies in addition to this one.

2. Personal data we collect

We collect only the personal data needed to open and operate your account, as required by the PDPO's Data Protection Principle 1. This includes:

• Identity and contact data — title, full name, date of birth, email address, phone number, country of residence and residential address, collected when you create an account and complete your profile.
• Verification data — copies of identity documents, proof of address and screening results obtained from our verification providers to meet our obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) ("AMLO").
• Card and transaction data — card identifiers, masked card numbers, card status, spending limits, balances, card payments, card-to-card transfers, loads, remittances, beneficiary details you save (name, bank, account number or IBAN, address) and the USDT deposit addresses and on-chain transaction identifiers associated with your loads.
• Account activity — sign-in codes sent to your email, active sessions, device and browser type, IP address, approximate location derived from IP, language and appearance preferences.
• Communications — messages you send to info@avelor.financial and records of change requests to verified details.

We do not collect your private keys or seed phrases, and we never ask for them.

3. How we use personal data

We use personal data for the purposes for which it was collected or directly related purposes, consistent with Data Protection Principle 3:

• opening and maintaining your account and issuing virtual and physical cards;
• verifying your identity, screening against sanctions and politically exposed persons lists, and monitoring transactions as required by the AMLO and the guidelines of the Hong Kong Monetary Authority and the Customs and Excise Department;
• crediting USDT deposits, processing card payments, card-to-card transfers and remittances to bank beneficiaries, and preventing fraud and misuse;
• sending transactional messages such as one-time sign-in codes, deposit confirmations and security alerts;
• producing statements and responding to your requests, complaints and data access or correction requests;
• complying with legal and regulatory obligations, court orders and lawful requests from authorities in Hong Kong or elsewhere;
• improving the Services, in aggregated or de-identified form where practicable.

4. Legal basis and the PDPO

We handle personal data in accordance with the six Data Protection Principles in Schedule 1 to the PDPO: lawful and fair collection for a stated purpose (DPP1); accuracy and limited retention (DPP2); use only for the collection purpose or a directly related purpose unless you give prescribed consent (DPP3); security (DPP4); openness about our policies and practices (DPP5); and your rights of access and correction (DPP6).

Providing identity, contact and verification data is mandatory. If you do not provide it we cannot open an account or issue a card, because we would be unable to meet our customer due diligence obligations under the AMLO.

5. Who we share personal data with

We share personal data only where necessary for the purposes above, with:

• our card-issuing partner and the relevant card scheme, to issue cards and authorise payments;
• identity verification, sanctions screening and fraud prevention providers;
• blockchain analytics providers, to assess the source of USDT deposits;
• banking and payment partners, to execute remittances to your beneficiaries (the beneficiary's bank will receive your name as the remitter);
• cloud hosting, email delivery and customer support providers acting as our data processors under written contracts that restrict their use of the data, as required by DPP2(3) and DPP4(2);
• regulators, law enforcement and courts where required by law, and professional advisers under duties of confidentiality;
• a purchaser or successor in the event of a merger, acquisition or reorganisation, subject to this policy.

We do not sell personal data.

6. Transfers outside Hong Kong

Some of our partners and processors operate outside Hong Kong. When we transfer personal data outside Hong Kong we take steps consistent with the guidance of the Office of the Privacy Commissioner for Personal Data, including contractual clauses that require the recipient to protect the data to a standard no less than the PDPO, and we transfer only what is necessary for the stated purpose.

7. Retention

We keep personal data for no longer than is necessary for the purpose for which it is used, in line with DPP2(2) and section 26 of the PDPO. Identity verification records and transaction records are retained for at least five years after the end of the business relationship or the completion of the transaction, as required by Schedule 2 to the AMLO. Sign-in codes expire within minutes and are deleted on expiry. Marketing preferences are kept until you withdraw consent.

8. Security

We protect personal data with technical and organisational measures appropriate to its sensitivity, as required by DPP4: encryption in transit and at rest, masking of full card numbers in the application until you choose to reveal them, access controls limited to staff who need the data, logging and session management that lets you review and sign out of active devices. No method of transmission or storage is completely secure; if a data breach is likely to cause real risk of harm to you we will notify you and the Privacy Commissioner without undue delay.

9. Your rights

Under Part 5 of the PDPO you have the right to request access to, and correction of, personal data we hold about you. We respond to data access requests within 40 days of receipt, as required by section 19 of the PDPO. Because your profile details are verified, corrections are made through a change request in Settings and are re-verified before taking effect.

You may also ask us to delete data we no longer need, or object to a particular use of your data, and we will comply where the PDPO and our regulatory record-keeping obligations allow. To exercise any right, email info@avelor.financial. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).

10. Direct marketing

We will not use your name, email address or phone number for direct marketing unless you have given consent in the manner required by Part 6A of the PDPO. Transactional messages (sign-in codes, deposit confirmations, security alerts, statements) are not direct marketing. You can withdraw marketing consent at any time, free of charge, by following the unsubscribe link in any marketing message or by emailing us.

11. Cookies and similar technologies

The Services use strictly necessary cookies and local storage to keep you signed in, remember your language and appearance preference, and protect against fraud. We do not use third-party advertising cookies. Where we use analytics, data is aggregated and does not identify you.

12. Blockchain data

USDT deposits are recorded on the public TRON and Ethereum blockchains. Deposit addresses and transaction identifiers are permanently visible to anyone and cannot be altered or deleted by us. We do not publish your identity on-chain, but a deposit address we assign to you is linked to your account in our systems and may be analysed by us or by our analytics providers for compliance purposes.

13. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in the application before they take effect. The effective date at the top of this page shows when it was last revised.

14. Contact

Data Protection Officer
Avelor Financial Limited
9th Floor, Amtel Building, 148 Des Voeux Road Central, Hong Kong
info@avelor.financial