Privacy Policy

Updated October 8, 2026

ABOUT THIS PRIVACY POLICY

1. Lustum and the App

1. LUSTUM HOLDINGS LIMITED (“Lustum”, “we”, “us” or “our”) is a company incorporated in Hong Kong. Lustum provides a platform through which users can create and manage a Lustum account, complete onboarding and verification, view information relating to their balances and transactions and access services made available by third-party service providers.

2. The Lustum web application available at www.lustum.com, the Lustum mobile application and the related software, user interfaces, features and content made available through or in connection with them are referred to collectively in this Privacy Policy as the “App”.

3. The third-party service providers involved in a particular service are identified in the App and in the terms and privacy notices applicable to that service.

2. Scope of this Privacy Policy

1. This Privacy Policy explains how Lustum collects, uses, stores and discloses personal data when an individual accesses or uses the App, creates or maintains a Lustum account, uses a service or feature available through the App or otherwise communicates with Lustum concerning the App.

2. This Privacy Policy applies both to individuals who use the App on their own behalf and to individuals who register for or use the App on behalf of a business or other organisation. Each such individual is referred to in this Privacy Policy as a user.

3. Personal data means information relating to an identified or identifiable individual.

3. Who is responsible

1. LUSTUM HOLDINGS LIMITED is responsible for the personal data that it controls through the App. For the purposes of the Personal Data (Privacy) Ordinance of Hong Kong, LUSTUM HOLDINGS LIMITED is the data user in relation to that personal data. Questions about this Privacy Policy may be sent to [email protected].

2. PRINCIPLES OF PERSONAL DATA PROCESSING

1. Principles that apply

1. Lustum processes personal data lawfully, fairly and transparently.

2. Lustum collects and uses personal data only for specified and legitimate purposes connected with the App and the services selected by the user. Lustum does not further process personal data in a manner that is incompatible with those purposes.

3. Lustum limits the personal data it collects and processes to information that is adequate, relevant and not excessive for the applicable purpose.

4. Lustum takes reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date having regard to the purpose for which it is used.

5. Lustum keeps personal data in an identifiable form only for as long as it is reasonably necessary for the applicable purpose or as required or permitted by law.

6. Lustum is responsible for protecting personal data under its control and applies reasonable and practicable administrative, technical and organisational measures to preserve its integrity and confidentiality and to prevent unauthorised or accidental access, processing, loss, erasure or disclosure.

3. PERSONAL DATA LUSTUM COLLECTS

1. Account data

1. When a user registers for the App, Lustum collects the user's first name, last name, username, email address and telephone number.

2. Where a user acts for a business, Lustum may also collect the business name, business contact information and information confirming the user's role or authority to act for that business, to the extent required to establish or administer the account.

2. Identity and business verification data

1. Lustum conducts identity and business verification through a third-party identity verification service provider so that the user may access the services available through the App.

2. Identity documents, photographs, video recordings and biometric data requested during the verification process are submitted directly to the identity verification service provider. Lustum does not receive, access, review or store those materials.

3. Lustum receives only a minimal applicant or reference identifier and the status or outcome of the verification. Lustum uses that information to show the progress of the verification, enable or restrict the relevant App features and coordinate any required follow-up.

4. Lustum may request additional information where it is reasonably required by law, risk considerations or a requirement of a third-party service provider involved in the requested service. The request will identify the information required, its purpose and the person to whom it will be provided.

3. Service and transaction data

1. When a user accesses or uses a service made available by a third-party service provider through the App, information is generated in connection with the user's account, instructions and use of that service. This information may include but not limited to provider account identifiers, onboarding and account status, balances, card or wallet details, transfer and transaction history, transaction amounts, currencies, fees, timestamps, payment or transfer status, wallet addresses and transaction hashes.

2. Lustum processes this information because it is displayed through the App or is otherwise needed to route user instructions, maintain an accurate service history, provide support and make the relevant third-party service available.

3. Where a user requests a blockchain transaction, the wallet address, transaction hash, amount, asset and timestamp may be recorded on a public blockchain. Public blockchain records are generally permanent and cannot be altered or deleted by Lustum.

4. Payment methods and financial account information

1. Where a payment option is made available, the App enables the user to select a payment method and initiate an order or transaction through the third-party payment service provider, credit institution or financial institution identified in the App.

2. Payment credentials and full financial account information entered directly into a third-party provider's interface are collected and handled by that provider. Lustum does not receive or retain full payment card numbers, bank account login credentials or financial account authentication data submitted directly to the provider. Lustum may receive and retain limited account identifiers, masked payment details, balances and transaction information to the extent necessary to display, administer and support the service through the App.

3. A payment service provider, credit institution or financial institution may collect and process personal data for its own purposes and legal obligations. Its processing is governed by its own privacy notice made available in the App or on its official website.

5. Technical and support data

1. Lustum collects basic technical and security information needed to authenticate users, operate the App and protect accounts. This may include but not limited to an internet protocol address, device and browser information, session identifiers, login records and security logs.

2. Lustum also processes communications and information provided when a user contacts support, reports a problem or otherwise communicates with Lustum about the App.

3. The App may use cookies, local storage and software development kits that are necessary for authentication, security, session management and core functionality. Lustum does not use these technologies to sell personal data or for targeted advertising. 

4. HOW LUSTUM RECEIVES PERSONAL DATA

1. Information received from the user

1. Lustum receives personal data directly from the user when the user registers, uses an App feature, gives an instruction, responds to a request for information or contacts Lustum.

2. Identity verification results

1. Lustum receives only a minimal verification identifier and the result or status of the identity or business verification process. Lustum uses this information to confirm whether the user has completed the required verification and to enable or restrict access to the relevant services made available through the App in accordance with applicable onboarding requirements.

3. Third-party services and API integrations

1. When a user accesses or uses a third-party service through the App, account, balance, card, wallet, transfer, transaction and other operational information is generated through the user's interaction with that service. The information may be made available to Lustum through an application programming interface or another technical integration to the extent needed to provide the service through the App.

2. Lustum accesses and processes personal data made available through third-party integrations only for the purposes described in this Privacy Policy and in accordance with applicable law.

4. Public sources and blockchain data

1. An identity verification or compliance service provider may check information supplied by the user against public databases and official sources, including company registers and lists of sanctioned, restricted or prohibited persons. Lustum receives only the verification, screening or risk status and any limited information reasonably required to address a follow-up request.

2. Where a user accesses or uses a blockchain-related service, Lustum may process publicly available blockchain data, including wallet addresses, transaction details and transaction hashes, to provide the service, protect the App and support fraud, risk and compliance controls.

5. Information generated through use of the App

1. When a user accesses or uses the App, Lustum may automatically collect technical and usage information necessary to operate, secure and support the App. Depending on the device, functionality used and system configuration, this information may include the user’s internet protocol address, device and browser type, operating system, session and authentication identifiers, login timestamps, interactions with App features, error and diagnostic data, and security logs. 

2. HOW LUSTUM USES PERSONAL DATA

1. Provision of the services

1. Lustum uses personal data to create, authenticate and administer the user's account and to provide the features of the App.

2. Lustum uses personal data to facilitate identity and business verification through a third-party identity verification service provider. Lustum uses the resulting minimal verification identifier and verification status to confirm whether the applicable onboarding requirements have been completed and to enable or restrict access to the relevant services.

3. Lustum uses personal data to facilitate the user’s access to and use of services made available through third-party service providers. This includes transmitting information and instructions submitted by the user or otherwise required for the selected service and processing the identifiers, statuses and operational information necessary to make that service available through the App.

4.  Where the user initiates an order or transaction through a third-party payment service provider, credit institution or financial institution, Lustum uses limited account identifiers, masked payment details and transaction information to facilitate, display and support that order or transaction. Lustum does not use or retain full payment credentials submitted directly to the relevant provider.

5. Lustum uses personal data to display balances, card or wallet status, transfer and transaction history and other information generated in connection with the services selected by the user.

6. Lustum uses personal data to provide customer support, assist with failed or disputed instructions or transactions, correct errors within the App or records controlled by Lustum and send account, security, legal and service communications.

2. Compliance and security

1. Lustum uses personal data to comply with applicable law, implement restrictions that apply to the services, respond to lawful requests and support fraud, sanctions, risk and security controls.

2. Lustum uses personal data to protect the App, users and providers, to prevent misuse and to exercise or defend legal rights under the Lustum Terms and Conditions.

3. Purpose limitation

1. Lustum uses personal data only to provide, administer, secure and support the App and the services selected by the user, and to meet legal or provider requirements directly connected with those services.

2. Lustum does not sell, rent or license personal data. Lustum does not provide personal data to any person for advertising, data brokerage, unrelated marketing or any other independent form of monetisation. Lustum does not itself use personal data for those purposes.

3. If Lustum wishes to use personal data for a materially different purpose, it will first provide any notice and obtain any consent or other legal basis required by applicable law. 

4. LEGAL GROUNDS FOR PROCESSING

1. Grounds that apply

1. Where applicable law requires Lustum to identify a legal ground for processing, Lustum processes personal data because it is necessary to enter into or perform the agreement with the user, including the Lustum Terms and Conditions.

2. Lustum also processes personal data where this is necessary to comply with a legal obligation or to pursue the legitimate interests of operating, securing and supporting the App and making the requested third-party services available, provided that those interests are not overridden by the user's rights.

3. Where consent is required for a specific activity, Lustum will request that consent before the activity begins. The user may withdraw that consent at any time, without affecting processing that lawfully occurred before the withdrawal. 

4. HOW LUSTUM DISCLOSES PERSONAL DATA

1. Disclosures needed to provide the services

1. Lustum discloses personal data to the third-party service providers, issuers and regulated partners identified in the App or the applicable terms only to the extent required to onboard the user and provide, administer, secure or support the service selected by the user.

2. Lustum uses an identity verification service provider to provide identity and business verification. The verification materials described in clause 3.2.2 are provided directly to that provider and are not received or held by Lustum.

3. Lustum may disclose limited personal data to technical service providers that host, authenticate, secure, maintain or support the App. They may process the data only to provide the relevant service to Lustum and subject to appropriate confidentiality, security and data protection obligations.

4. Lustum limits each disclosure to the personal data reasonably necessary for the relevant service or purpose.

5. Lustum requires third-party service providers acting on its behalf to process personal data only for the agreed and lawful purpose and subject to appropriate confidentiality, security and data protection obligations.

2. Disclosures required by law

1. Lustum may disclose personal data to a court, regulator, law enforcement body or other competent authority where the disclosure is required by law or is reasonably necessary to protect the rights, safety or security of Lustum, its users, the providers or the App.

3. No unrelated disclosure

1. Lustum does not disclose personal data to any third party outside the purposes described in this Privacy Policy and the services disclosed through the App and the Lustum Terms and Conditions.

2. Lustum does not receive payment or any other value for disclosing personal data. Publication of transaction information on a public blockchain where required to complete a user-requested transaction is part of the requested service and is not a disclosure for advertising or monetisation.

8. THIRD-PARTY PRIVACY NOTICES

1. Notices available through the App

1. The App identifies the third-party service providers involved in each service and makes their applicable terms and privacy notices available to users. The privacy notice of each other third-party service provider is made available under the provider’s name or another clear label identifying the service to which it applies.

2. Separate processing by third-party service providers

1. This Privacy Policy governs processing carried out by Lustum. Each third-party service provider's privacy notice separately governs the processing that the provider carries out for its own purposes or under its own legal obligations.

2. The terms and privacy notices made available in the App form part of the legal information applicable to the relevant third-party service. Users should read them before requesting that service.

9. INTERNATIONAL TRANSFERS

1. Why transfers occur

1. Lustum is established in Hong Kong. The third-party service providers used to provide the services or operate the App may process personal data in other countries. Personal data may therefore be transferred to or accessed from a country outside Hong Kong or the country in which the user is located.

2. Lustum makes an international transfer only where it is necessary for a purpose described in this Privacy Policy or where the transfer is otherwise required or permitted by law.

2. Protection of transferred data

1. Lustum takes all reasonable and practicable steps required by the laws applicable to Lustum to ensure that personal data transferred outside Hong Kong remains protected.

2. Where appropriate, Lustum uses contractual or other measures that require the recipient to process personal data only for the agreed purpose, keep it secure, limit retention and onward disclosure and delete or return it when it is no longer required.

3. Where another applicable data protection law requires a recognised transfer mechanism, Lustum will use an appropriate contractual clause, adequacy mechanism or other lawful safeguard before making the transfer.

4. A provider may independently transfer personal data in connection with its own service. The provider's privacy notice explains the safeguards that apply to those transfers. 

5. DATA RETENTION

1. How long Lustum keeps personal data

1. Lustum retains personal data only for as long as it is reasonably necessary to provide and support the App and the requested services, maintain accurate account and transaction records, comply with applicable law and provider requirements, resolve disputes and protect the security and integrity of the App.

2. The retention period may differ according to the type of data, the status of the account or service and any legal, regulatory, accounting, security or dispute-related requirement that applies.

3. When personal data is no longer required, Lustum will delete it, anonymise it or place it beyond ordinary use pending secure deletion from backup systems.

4. Lustum does not retain the identity documents or biometric data submitted directly to the identity verification service provider. Deletion by Lustum does not delete personal data independently retained by a third-party service provider under its own legal obligations and privacy notice.

11. SECURITY

1. Lustum takes reasonable and practicable administrative, technical and organisational measures designed to protect personal data against unauthorised or accidental access, use, alteration, loss, erasure or disclosure.

2. These measures include restricting access to persons who need the data to perform their duties, using appropriate authentication and encryption, maintaining security logs and requiring relevant service providers to protect the data they process.

3. No method of transmission or storage is completely secure. If Lustum becomes aware of a personal data incident, it will investigate and take the notification and remedial steps required by applicable law.

12. USER RIGHTS

1. A user may request access to personal data held by Lustum and correction of personal data that is inaccurate. These rights are available under the Personal Data (Privacy) Ordinance of Hong Kong.

2. Where another applicable law provides additional rights, the user may also have the right to request deletion, restriction, objection or portability, or to withdraw consent for processing based on consent.

3. Privacy rights are subject to the conditions and exceptions in applicable law. Lustum may retain personal data where retention is required or permitted by law or remains necessary for security, fraud prevention, dispute resolution or the provision of a requested service.

1. A request may be sent to [email protected] with the subject “Privacy Request”. The user should identify the account and explain the request. The user should not send an identity document by email unless Lustum first provides a secure method.

2. Lustum may request information reasonably necessary to verify the identity and authority of the person making the request.

3. Where the relevant personal data is controlled only by a third-party service provider, Lustum may direct the user to that provider or assist in routing the request where appropriate. 

4. CHANGES TO THIS PRIVACY POLICY

1. Lustum may update this Privacy Policy when the App, the providers, the data flow or applicable law changes. The date at the beginning of the Privacy Policy identifies the latest version.

2. Where a change materially affects how Lustum uses personal data, Lustum will provide notice through the App, by email or through another appropriate channel before the change takes effect where required by law. 

3. CONTACT AND COMPLAINTS

1. Privacy questions, requests and complaints may be sent to LUSTUM HOLDINGS LIMITED at [email protected].

2. A user may make a complaint to the Office of the Privacy Commissioner for Personal Data in Hong Kong. Further information is available from the Office of the Privacy Commissioner for Personal Data.

3. Where another data protection law applies, the user may also have the right to complain to the competent supervisory authority.