Privacy Policy

1. Data Controller

This Privacy Policy applies to services provided by: The One Exchange Co., Ltd., Thailand. Contact: info@the-one.exchange The One Exchange Co., Ltd. acts as the controller of personal data collected in connection with currency exchange services, customer verification, transaction processing and related services.

2. Legal Basis

We collect, use, disclose and store personal data in accordance with the following:

• Thailand’s Personal Data Protection Act B.E. 2562 (PDPA);
• applicable anti-money laundering and counter-terrorism financing (AML/CFT) requirements;
• KYC and customer due diligence requirements;
• accounting, tax and legal obligations;
• legitimate business and security interests where permitted by law.

3. Personal Data We May Collect

We may collect the following categories of personal data:

• full name;
• passport or national identity document details;
• nationality;
• date of birth;
• contact information;
• photographs or copies of identity documents;
• transaction details;
• payment and banking information;
• wallet addresses, where applicable;
• CCTV recordings;
• website usage and technical data.

4. Purposes of Processing

We may process personal data for the following purposes:

• customer identification and verification;
• KYC and AML/CFT compliance;
• transaction execution and verification;
• fraud prevention and risk management;
• customer support and communication;
• accounting, audit, tax and legal compliance;
• internal security and protection of customers, staff and property;
• responding to lawful requests from authorities.

5. Disclosure of Personal Data

Where necessary and on a lawful basis, personal data may be disclosed to the following parties. We do not sell personal data.

• Thai government authorities;
• regulatory bodies;
• law enforcement agencies;
• banks and financial institutions;
• payment service providers;
• compliance service providers;
• accounting, audit and legal advisors;
• IT and security service providers.

6. International Transfers

Some systems, service providers or technical infrastructure may process or store data outside Thailand. Where required by law, we apply appropriate safeguards for the international transfer of personal data.

7. Data Retention

We retain personal data only for as long as necessary. When data is no longer required, it will be deleted, destroyed or anonymised where legally and technically possible. Retention periods are determined by the following:

• the purposes for which data was collected;
• AML/CFT and KYC requirements;
• accounting, tax and audit requirements;
• legal and regulatory obligations;
• dispute resolution;
• fraud prevention and security.

8. Rights of Data Subjects

Subject to applicable law, you may have the following rights. Requests may be submitted to info@the-one.exchange. Note: some requests may not be fulfilled where we are required to retain or process data under AML/CFT, accounting, tax, legal or regulatory requirements.

• request access to your personal data;
• request a copy of your personal data;
• request correction of inaccurate data;
• request deletion or destruction of data, where legally permitted;
• object to certain processing;
• request restriction of processing;
• withdraw consent, where consent is the legal basis;
• lodge a complaint with the relevant authority.

9. Security Measures

We use reasonable technical and organisational measures to protect personal data from unauthorised access, disclosure, loss, alteration, destruction or misuse. Access to personal data is restricted to authorised staff and service providers who require it for legitimate business, compliance or legal purposes.

10. CCTV Surveillance

CCTV systems may be used inside and around our premises for the following purposes:

• security;
• fraud prevention;
• protection of customers, staff and property;
• AML/CFT support and transaction verification;
• dispute investigation.

11. Cookies and Website Data

Our website may use cookies, analytics tools, security measures and technical data for the following purposes:

• website operation;
• improving website functionality;
• protection against fraud, abuse and unauthorised access;
• general usage analysis.

12. Changes to This Policy

We may update this Privacy Policy periodically. The latest version will be available on our website. Last updated: May 2026.