Ibex Mercado SV, S.A. de C.V. - El Salvador
‍Last updated: September 10, 2026   -   Version: 1.2   -   English

1. Introduction

This Privacy Policy explains how Ibex Mercado SV, S.A. de C.V. ("Ibex", "we", "us"), as data controller, collects, uses, stores, and protects the personal data of users of our website, applications, and services. We are committed to protecting your privacy and to processing your data lawfully and transparently.

This document also constitutes the privacy notice required under Article 24 of the Law for the Protection of Personal Data and is made available to data subjects prior to the collection and processing of their personal data.

2. Data controller and contact

• Controller: Ibex Mercado SV, S.A. de C.V.

• Registered address: Calle Circunvalación, Avenida La Revolución, Local 09, Colonia San Benito, Edificio Plaza Presidente, Nivel 06, San Salvador, El Salvador.

• Privacy contact/Data Protection point of contact: soporte@poweredbyibex.io.

• Applicable Law: Law for the Protection of Personal Data (Decree No. 144 of 2024).

• Data Protection Officer: Jose Luis Lemus Leonard

• Contact: legal@poweredbyibex.io

Requests relating to personal data protection and the exercise of ARCO-POL rights may also be submitted at Ibex’s registered address indicated above.

3. Personal data we collect

Depending on how you interact with us, we may collect:

• Identification data: name, date of birth, nationality, government-issued identification, tax ID.

• Contact data: email address, telephone number, postal address.

• Corporate data (for legal entities): company documents, beneficial-ownership information, representatives' data.

• Verification data: documentation and information gathered during KYC/KYB, including selfies or liveness checks where applicable.

• Transaction data: records of Conversion Orders, amounts, wallet addresses, and settlement details.

• Technical and usage data: IP address, device information, log data, and usage of our platform.

• Sensitive and biometric data: where our identity verification processes involve the generation or processing of biometric information, including facial biometric data or biometric templates derived from selfies or liveness checks, such information will be treated as sensitive personal data. Where consent is the applicable legal basis, we will obtain the data subject’s express and unequivocal consent and inform the data subject of the right not to provide such consent, without prejudice to any applicable legal mandate or exception.

4. How we use your data (purposes and legal bases)

We process personal data for the following purposes:

• to provide, operate, and manage the Services and your relationship with Ibex (performance of a contract);

• to verify identity and conduct KYC/KYB, AML/CTF, sanctions screening, transaction monitoring, and regulatory reporting activities (compliance with legal and regulatory obligations);

• where identity verification involves sensitive or biometric personal data, on the basis of express and unequivocal consent or an applicable legal mandate or exception, as applicable;

• to prevent fraud, protect our systems and Services, and manage operational and compliance risks (legitimate interests and/or legal obligations);

• to communicate with you regarding your account, transactions, and the Services (performance of a contract and/or legal obligations); and

• to improve our Services, systems, and website (legitimate interests, where permitted by Applicable Law).

Where processing is based on consent, the specific purpose requiring consent will be clearly identified. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

5. Sharing and disclosure

We may share your data with:

• Service providers who support our operations (identity verification, transaction monitoring, blockchain analytics, cloud hosting), under confidentiality and data-processing obligations;

• Competent authorities and regulators, where required by law or in response to lawful requests;

• Entities within the Ibex group, where necessary for the provision of the Services and under adequate safeguards.

We do not sell your personal data.

Where a service provider acts as a data processor or subcontracted entity on behalf of Ibex, its identity, purpose of processing, location, and relevant contact information are identified in Appendix A (Data Processors), which forms an integral part of this Privacy Policy and Notice.

6. International transfers

Personal data may be processed or accessed outside El Salvador in connection with the provision of our Services and the use of service providers. Where an international transfer is subject to the transfer requirements of Applicable Law, Ibex will ensure that the recipient country or entity provides an adequate level of protection or that appropriate contractual, technical, and organizational safeguards are implemented.

Where required by Applicable law, we will inform the data subject of the purpose of the transfer and the identity or identifiable characteristics of the recipient and obtain any consent required for such transfer. Relevant international recipients and their locations are identified in Appendix A, where applicable.

7. Data retention

We retain personal data for as long as necessary to fulfill the purposes described with the Applicable Law, and thereafter as required to comply with legal, regulatory, and AML record-keeping obligations.

8. Your rights

Subject to Applicable Law, you may exercise your rights of Access, Rectification, Cancellation, Opposition, Portability, Right to be Forgotten, and Limitation (ARCO-POL), as well as withdraw your consent where processing is based on consent.

Requests may be submitted to our Data Protection Officer at legal@poweredbyibex.io or at Ibex’s registered address. The request should include sufficient information to verify the identity of the applicant, identify the right being exercised, describe the personal data or processing concerned, and provide a means for receiving our response.

Ibex will respond to requests within twenty (20) business days, which may be extended once for justified reasons for up to an additional twenty (20) business days, in accordance with Applicable Law.

The exercise of certain rights may be restricted where Ibex is legally required to retain or process personal data, including under applicable AML/CTF, regulatory, accounting, or legal obligations.

9. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, or misuse. No system is entirely secure, but we work continuously to safeguard your information.

10. Cookies and similar technologies

Our website may use cookies and similar technologies. Non-essential cookies are used only with your consent, which you can manage through the cookie settings on our website. 

11. Children

The Services are not directed to persons under the age of 18, and we do not knowingly collect their personal data.

12. Changes to this Policy

We may update this Privacy Policy. The updated version will be published on our website with its effective date. Where a change is material or affects processing based on consent, we may also notify affected data subjects through email, account notifications, or other appropriate means..

13. Contact

For any privacy-related question or to exercise your ARCO-POL rights, please contact our Data Protection Officer at: legal@poweredbyibex.io.