General
Legal and Privacy
Providers List
Privacy Notice – Lumx US OP LLC
Last Updated: November 1, 2026
Effective Date: November 1, 2026
IMPORTANT NOTICE: PLEASE READ THIS PRIVACY NOTICE CAREFULLY. IF YOU ARE A CLIENT, ANY DISPUTE ARISING OUT OF OR RELATING TO THIS NOTICE OR TO THE PROCESSING OF YOUR PERSONAL DATA IS SUBJECT TO THE BINDING INDIVIDUAL ARBITRATION AGREEMENT AND CLASS ACTION WAIVER SET OUT IN CLAUSE 21 OF THE TERMS, AS DESCRIBED IN SECTION 15 OF THIS NOTICE. UNLESS YOU OPT OUT AS PROVIDED IN CLAUSE 21.6 OF THE TERMS, YOU WAIVE YOUR RIGHT TO A JURY TRIAL AND TO PARTICIPATE IN A CLASS ACTION.
BIOMETRIC DATA NOTICE: LUMX US AND ITS IDENTITY VERIFICATION PROVIDER MAY COLLECT BIOMETRIC DATA, SUCH AS A SCAN OF FACE GEOMETRY DERIVED FROM A SELFIE OR LIVENESS VIDEO, FOR IDENTITY VERIFICATION AND FRAUD PREVENTION. WHERE REQUIRED BY APPLICABLE LAW, WE WILL OBTAIN YOUR SEPARATE WRITTEN CONSENT BEFORE ANY SUCH COLLECTION. SEE SECTIONS 6.1 AND 10.
LUMX US DOES NOT SELL YOUR PERSONAL DATA.
1. Who We Are
Lumx US OP LLC (“Lumx US”), a limited liability company organized under the laws of the State of Wyoming, United States of America, with Employer Identification Number (EIN) 39-4963473 and registered address at 30 N Gould St, Ste R, Sheridan, WY 82801, USA, is a financial technology and payments infrastructure company that provides technology services for stablecoin-integrated payments through its platform, dashboard, and Application Programming Interfaces (“APIs”) (“Lumx’s Platform”). Lumx US is registered with the Financial Crimes Enforcement Network (FinCEN) as a money services business. Such registration is not a license and does not alter the technology nature of the Services.
Through Lumx’s Platform, Lumx US provides technology services to Clients, including the technical and operational connection between Clients and Payment Providers, support for the Client’s onboarding with Payment Providers, the routing, orchestration, and status tracking of instructions, and the enablement of individualized U.S. Virtual Accounts (the “Services”). Lumx US does not provide custody of virtual assets or fiat funds, does not hold or control private keys, and does not itself perform money transmission, currency conversion, foreign exchange, or settlement. All regulated activities underlying the Services are performed by duly licensed or authorized Payment Providers, in their own name and under their own licenses, registrations, or authorizations, as listed in the Provider List. Clients contract directly with Lumx US under the Lumx US Terms of Use, also referred to as the Lumx User Terms (the “Terms”), whether they access the Services directly or through a Platform. The Services are provided exclusively outside Brazil and in foreign currency, as set out in the Terms.
2. Scope and Our Role
Lumx US acts as the Controller of the Personal Data processed under this Notice in connection with the technology Services it provides and with the operation of its website and contact channels. This Notice describes how we collect, use, share, store, and protect such data.
The processing of Personal Data described in this Notice is carried out in accordance with the data protection laws applicable to each Data Subject, which may vary depending on the jurisdiction in which the Data Subject is located. These laws may include, by way of example and without limitation: U.S. federal and state laws, such as the Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulations and state privacy, biometric privacy, and data security laws; Brazilian Law No. 13,709/2018, the General Data Protection Law (“LGPD”), where applicable under its own territorial scope (Article 3); and the European Union and United Kingdom General Data Protection Regulations (“GDPR”), where applicable.
Payment Providers and Platforms act as independent controllers with respect to the Personal Data they process for their own purposes, subject to their own privacy notices. When a Client accesses the services of a Payment Provider through Lumx’s Platform, the Client establishes a direct relationship with that Payment Provider, whose privacy notice and Pass-Through Terms (as defined in the Terms) govern its own processing of Personal Data. Lumx US does not control and is not responsible for the privacy practices of Payment Providers, Platforms, blockchain networks, or other third parties.
Certain information we collect may constitute “nonpublic personal information” under the GLBA. Where Lumx US provides the Services to an individual who obtains them primarily for personal, family, or household purposes, we will provide the privacy notices required by the GLBA, including any applicable initial and annual notices, and will honor the choices required by applicable law. Lumx US does not disclose nonpublic personal information to nonaffiliated third parties except as permitted by the GLBA, such as to process and service the transactions requested by the Client, to protect against fraud, and to comply with legal requirements; accordingly, no opt-out right currently applies to such disclosures.
3. Contact and Data Protection Officer (DPO)
To exercise your rights or to send questions, complaints, or suggestions about this Notice, contact us at dpo@lumx.io.
You may also contact us by mail at: Lumx US OP LLC, Attn: Privacy / Data Protection Officer, 30 N Gould St, Ste R, Sheridan, WY 82801, USA.
Data Protection Officer (DPO): Débora Leal Soares de Castro.
4. Definitions
Client: an individual or legal entity that engages the Services of Lumx US, directly or through a Platform, and accepts the Terms.
Controller: the party that makes decisions regarding the processing of Personal Data.
Personal Data: information relating to an identified or identifiable natural person.
Sensitive Personal Data: data such as biometrics, health, and racial or ethnic origin, among others defined under applicable law.
Processor: the party that processes Personal Data on behalf of the Controller.
Platform: a third party that has entered into an agreement with Lumx US and integrates the Services into its own products, applications, or interfaces, and through whose channel a Client may have been onboarded, referred, or introduced. A Platform does not act on behalf of Lumx US.
Lumx’s Platform: the platform, dashboard, APIs, interfaces, software, and technology infrastructure made available by Lumx US through which the Services are provided.
Payment Provider or Provider: a financial institution, bank, licensed or authorized money transmitter, payment institution, custodian, or other provider integrated with or connected to Lumx’s Platform that performs, in its own name and under its own licenses, registrations, or authorizations, the regulated activities underlying the Services, such as custody of virtual assets, conversion between virtual assets and fiat currency, money transmission, and the maintenance of U.S. Virtual Accounts, as listed in the Provider List.
Data Subject: the natural person to whom the Personal Data relates.
Terms: the Lumx US Terms of Use, also referred to as the Lumx User Terms, available at lumx.io/legal/legal-and-privacy/terms-of-service.
U.S. Virtual Account: an individualized virtual account in the Client’s own name, with its own account and routing numbers, made available through a banking Payment Provider, as described in the Terms.
Processing: any operation performed on Personal Data, such as collection, use, storage, sharing, and deletion.
International Transfer: the transfer of Personal Data to a foreign country or international organization.
5. Who This Notice Applies To
This Notice applies to the following Data Subjects:
Clients who are individuals, whether they engage Lumx US directly or through a Platform;
shareholders or members, ultimate beneficial owners, officers, and legal representatives of Clients that are legal entities;
beneficiaries, counterparties, and other individuals whose data is included in instructions submitted by Clients through Lumx’s Platform or in supporting documentation provided by Clients;
individuals who interact with the lumx.io website, our social media profiles, or our contact channels, including job applicants.
This Notice does not apply to anonymized or aggregated data that does not allow the Data Subject to be identified.
Lumx US currently directs the Services primarily to Clients located outside the United States. However, Lumx US may process Personal Data of individuals located or residing in the U.S. in connection with the Services, including where a Client is incorporated or established in the U.S., or where a shareholder, member, ultimate beneficial owner, officer, legal representative, beneficiary, or counterparty of a Client is located or resides in the U.S. In such cases, the provisions of this Notice applicable to Data Subjects in the U.S., including Sections 6.1, 11, and 12.2, will apply to the extent required by applicable law.
6. Personal Data, Sources, Purposes, and Legal Bases
We collect Personal Data from the following sources: (i) the Data Subject or the Client they represent; (ii) Platforms through which the Client was onboarded, referred, or introduced to Lumx US; (iii) identity verification services, public databases, and domestic and international restricted-party lists; (iv) public blockchain records; and (v) Payment Providers, regarding the Client’s onboarding status, the execution, rejection, or status of transactions, and related compliance information.
A Client that provides us with data about its shareholders or members, ultimate beneficial owners, representatives, beneficiaries, or counterparties must have a lawful basis to do so and must ensure that such individuals are made aware of this Notice.
The legal bases indicated in the tables below are those relied upon under the LGPD and under other laws that require a legal basis for processing, such as the GDPR, where applicable. For Data Subjects in the U.S. and in other jurisdictions that do not adopt a legal-basis model, the processing is carried out on the grounds permitted by applicable law, as described in Section 6.7.
6.1. Due diligence of Clients who are individuals
For Data Subjects in the U.S., the collection of biometric data will comply with the requirements of applicable state laws, including specific notice and written consent, where required.
NOTICE TO RESIDENTS OF ILLINOIS, TEXAS, WASHINGTON, COLORADO, AND OTHER STATES WITH BIOMETRIC PRIVACY LAWS: THIS SECTION 6.1, TOGETHER WITH SECTION 10, CONSTITUTES THE PUBLICLY AVAILABLE WRITTEN POLICY OF LUMX US ESTABLISHING A RETENTION SCHEDULE AND GUIDELINES FOR THE PERMANENT DESTRUCTION OF BIOMETRIC DATA.
Biometric data is collected and processed by Lumx US and its identity verification Processor exclusively for identity verification, liveness detection, fraud prevention, account security, and compliance with applicable law. Lumx US does not sell, lease, trade, or otherwise profit from biometric data, and discloses it only to Processors that assist with these purposes, to Payment Providers where necessary to complete an onboarding or transaction requested or authorized by the Data Subject, or as required by law or valid legal process.
Where required by applicable law, including the Illinois Biometric Information Privacy Act and similar laws in Texas, Washington, and Colorado, Lumx US will inform the Data Subject in writing of the collection, purpose, and retention period and will obtain the Data Subject’s informed written consent, which may be given electronically, before any biometric data is collected. Biometric data is protected with a standard of care at least as protective as that applied to other confidential and sensitive information, and is permanently destroyed in accordance with the retention schedule in Section 10.
6.2. Due diligence of Clients that are legal entities
Depending on the risk identified, we may request additional information, such as bank statements, income tax returns, and documents that evidence the source of funds or support the transaction, such as purchase orders or contracts.
6.3. Transaction analysis
6.4. Provision of the Services
6.5. Contact, website, and social media
6.6. Access to Lumx’s Platform, the APIs, and the website
6.7. Secondary purposes
The data above may also be processed for the regular exercise of rights in judicial, administrative, or arbitral proceedings and to respond to requests from competent authorities.
For Data Subjects located outside Brazil, processing is carried out on the grounds permitted by applicable local law, including the performance of a contract, compliance with legal and regulatory obligations, and the legitimate business interests of Lumx US.
7. Automated Decisions and Artificial Intelligence
Due diligence involves automated analysis of document authenticity, liveness checks, and screening against restricted-party lists. This analysis may generate recommendations to approve or reject an onboarding. By default, every decision is reviewed by a human professional. Data Subjects may request review of automated decisions at dpo@lumx.io. Where an adverse decision is based in whole or in part on information obtained from a consumer reporting agency, Lumx US will provide the notices required by the Fair Credit Reporting Act. Decisions on onboarding, execution of transactions, and holds or blocks taken by Payment Providers are made by them under their own policies.
We may use artificial intelligence tools in operational activities, such as due diligence, transaction monitoring, and communications management, always limited to the purposes of this Notice. Personal Data is not shared with AI providers for model training.
8. Sharing of Personal Data
Lumx US does not sell Personal Data. We share data only in the cases below, which apply equally to current and former Clients.
8.1. Payment Providers (independent controllers)
To provide the Services, including connecting the Client to Payment Providers, supporting the Client’s onboarding with them, and transmitting the Client’s instructions for execution, we share with the Payment Providers listed in the Provider List the necessary registration data, due diligence information (KYC/KYB), and transaction data. Providers process such data as independent controllers, including to comply with their own legal and regulatory obligations, in accordance with their privacy notices. Payment Providers may also share with Lumx US information about the Client’s onboarding status, the execution, rejection, holding, or blocking of transactions, and other compliance-related information, which Lumx US processes for the purposes described in this Notice. Lumx US does not control and is not responsible for the processing carried out by Payment Providers, including their own due diligence, transaction monitoring, and regulatory reporting.
8.2. Platforms (independent controllers)
Where the Client was onboarded, referred, or introduced through a Platform, we may share with that Platform the information necessary for the integration of the Services into the Platform’s products, such as the Client’s onboarding status, account identifiers, and the status of instructions and transactions. Platforms process such data as independent controllers, under their own privacy notices, and do not act on behalf of Lumx US. We do not share with Platforms any information whose disclosure is prohibited by law, including information related to suspicious activity reporting.
8.3. Processors
We engage service providers that process Personal Data on our behalf, solely in accordance with our instructions and subject to contractual confidentiality and security obligations.
8.4. Other cases
Data Subject authorization: when the Data Subject requests or authorizes the sharing.
Authorities: to comply with the law, a court order, or a request from a competent authority, including regulatory reporting obligations under the Bank Secrecy Act and applicable sanctions programs.
Professional advisers and auditors: to legal, compliance, accounting, and audit advisers, subject to confidentiality obligations.
Exercise of rights: to protect the rights, safety, and property of Lumx US, its Clients, or third parties.
Corporate transactions: in the event of a merger, acquisition, sale of assets, or reorganization, with the protections of this Notice maintained.
Third-party wallets: when the Data Subject connects third-party digital wallets, the terms and notices of the respective provider apply. Lumx US does not hold custody of virtual assets or funds, whether in third-party wallets or in custodial wallets made available by Payment Providers.
9. International Transfers
Lumx US is based in the U.S., where Personal Data is stored and processed. If you are located outside the U.S., your Personal Data will be transferred to, stored, and processed in the U.S. and in the other countries where our Payment Providers and Processors operate (Section 8.3). Personal Data collected by Lumx US directly from Data Subjects located in Brazil is processed in the U.S., subject to the LGPD where applicable under its Article 3; under ANPD Resolution CD/ANPD No. 19/2024, such direct collection by a controller located abroad does not constitute an International Transfer. Where Personal Data of Data Subjects located in Brazil is received from Platforms or other agents located in Brazil, the transfer to the U.S. relies on the standard contractual clauses approved by the Brazilian National Data Protection Authority (“ANPD”) (Article 33, II, “b”, of the LGPD and ANPD Resolution CD/ANPD No. 19/2024).
Onward transfers to Payment Providers and Processors, in the U.S. or in other countries, are carried out with contractual safeguards that ensure a level of protection consistent with the LGPD and the standard contractual clauses.
For Data Subjects located in the European Economic Area, the United Kingdom, or Switzerland, where applicable, transfers outside those jurisdictions rely on adequacy decisions or on standard contractual clauses approved by the competent authorities. For Data Subjects located in other jurisdictions, we comply with the applicable cross-border transfer rules, including by entering into contractual safeguards with recipients where required.
Data Subjects may request information about these safeguards, including the content of the applicable standard contractual clauses, at dpo@lumx.io.
10. Retention and Disposal
Retention periods may be extended to comply with a legal obligation, an order from an authority, an audit, or a judicial, administrative, or arbitral proceeding, or to preserve evidence of fraud and incidents.
Once the retention periods expire and there is no other basis for retention, the data is deleted or anonymized.
11. Security and Incidents
We maintain an information security program with administrative, technical, and physical safeguards, overseen by a designated qualified individual and reviewed periodically, which includes: encryption of data in transit and at rest; need-to-know access controls; multi-factor authentication (MFA); firewalls; a backup policy; risk assessments; and an incident response plan. Whenever possible, we apply data minimization, segregation, and pseudonymization. Where applicable, this program is designed to meet the Federal Trade Commission’s Standards for Safeguarding Customer Information (16 C.F.R. Part 314).
In the event of an incident that may result in significant risk or harm to Data Subjects covered by the LGPD, we will take containment measures and notify the ANPD and the affected Data Subjects, pursuant to Article 48 of the LGPD and ANPD Resolution CD/ANPD No. 15/2024. For Data Subjects covered by U.S. law, we will notify Data Subjects and authorities in accordance with applicable federal and state laws, including, where applicable, notification to the Federal Trade Commission under 16 C.F.R. Part 314. Where an incident affects Personal Data processed by a Payment Provider, we will cooperate with that Payment Provider, which is responsible for the notifications applicable to its own processing. For Data Subjects in other jurisdictions, we will notify the competent authorities and the affected Data Subjects where required by applicable law.
Data Subjects are responsible for the security of their credentials and wallets. If you identify any risk, please notify the DPO immediately.
12. Data Subject Rights
All requests must be submitted to dpo@lumx.io. We may request additional information to verify the requester’s identity and prevent fraud. The rights available to you, and the manner in which they may be exercised, depend on the law applicable to you; Sections 12.2 to 12.4 describe, by way of example, the rights available in certain jurisdictions.
12.1. Rights of all Data Subjects
Subject to applicable law and to the limitations in Section 12.5, all Data Subjects may request, by contacting us at dpo@lumx.io:
access to, or a copy of, the Personal Data we hold about them, and information about how it is processed;
correction of incomplete, inaccurate, or outdated Personal Data;
deletion of Personal Data, subject to our legal and regulatory retention obligations;
restriction of, or objection to, certain processing, including processing for direct marketing purposes;
portability of Personal Data, where technically feasible;
information about the third parties with which Personal Data has been shared;
withdrawal of consent, where consent is the basis for processing, without affecting processing carried out before the withdrawal; and
human review of decisions based solely on automated processing.
We will respond within the period required by applicable law or, where no period is set, within 45 days, which may be extended where reasonably necessary, in which case we will inform the Data Subject. You may unsubscribe from marketing communications at any time by using the link included in each communication; we may continue to send service-related messages necessary for the use of the Services.
12.2. Data Subjects in the U.S.
Depending on the laws of your state of residence, you may have the right to access, correct, delete, and obtain a portable copy of your data, as well as to opt out of certain uses. Lumx US does not discriminate against Data Subjects who exercise their rights. Data Subjects may designate an authorized agent, subject to written proof of authorization. We will respond within the timeframes set by applicable state law. If a request is denied, the Data Subject may appeal the decision by replying to our denial notice. Certain state privacy laws do not apply to information subject to the GLBA or processed to comply with anti-money laundering obligations; where such exemptions apply, we will inform the Data Subject. Lumx US does not sell Personal Data and does not use biometric data for targeted advertising. Where you interact with Lumx US solely in a business capacity, such as a representative, officer, or ultimate beneficial owner of a Client that is a legal entity, certain state privacy laws may not apply to your Personal Data or may grant more limited rights, since some of them exclude data processed in a commercial or employment context. In such cases, you may still exercise the rights described in Section 12.1.
12.3. Data Subjects in Brazil (LGPD)
Under Article 18 of the LGPD, Data Subjects may request:
confirmation of the existence of processing and access to the data;
correction of incomplete, inaccurate, or outdated data;
anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the law;
portability, in accordance with ANPD regulations;
information about the entities with which the data has been shared;
objection to processing carried out in non-compliance with the LGPD;
review of automated decisions (Article 20);
withdrawal of consent and deletion of data processed based on it, where consent is the legal basis.
Confirmation of processing is provided immediately, in simplified form, or within 15 days, by means of a complete statement (Article 19). Other requests are handled within a reasonable time, and we will inform the Data Subject of the estimated response time. Data Subjects may also file a petition with the ANPD and with consumer protection agencies.
12.4. Data Subjects in other jurisdictions
If you are located in the European Economic Area, the United Kingdom, or Switzerland and the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies to the processing of your Personal Data, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to withdraw consent and to lodge a complaint with the competent data protection authority.
If you are located in another jurisdiction, such as Mexico, Colombia, Argentina, or Chile, you may have similar rights under local data protection laws, including the rights of access, rectification, cancellation, and opposition, which we will honor as required by applicable law. You may also lodge a complaint with the competent local data protection authority.
12.5. Limitations
Some requests may not be fully fulfilled, for example where there is a legal retention obligation, a need to defend legal claims, or the need to protect trade secrets and the rights of third parties. In such cases, we will explain the reasons. Records on public blockchains cannot be altered or deleted by Lumx US. Requests concerning Personal Data processed by Payment Providers or Platforms as independent controllers must be directed to them, and Lumx US will assist where reasonably possible. We may also decline to disclose alerts, risk scores, models, or details of investigations whose disclosure is restricted by law, by an order of an authority, or by confidentiality obligations, including those relating to suspicious activity reporting, as provided in Clause 11.3 of the Terms.
13. Minors
The Services are intended exclusively for individuals aged 18 or older. We do not knowingly collect data from children or adolescents. If we identify such processing, the data will be deleted, unless otherwise required by law. In particular, we do not knowingly collect personal information from children under 13 within the meaning of the Children’s Online Privacy Protection Act (COPPA).
14. Cookies
We use cookies and similar technologies, such as web beacons and pixels, to collect information about your interaction with the lumx.io website and Lumx’s Platform. The types of cookies we use include:
Necessary cookies: essential for the core functionality of the website and Lumx’s Platform, such as authenticating users, maintaining sessions, and securing transactions. These cookies cannot be disabled without affecting the functioning of the website and Lumx’s Platform.
Analytical cookies: help us understand how users navigate and use the website and Lumx’s Platform, so that we can improve their performance.
Security cookies: protect against security threats by helping to detect and prevent fraudulent or malicious activity.
Marketing cookies: where used, help us understand how you interact with our website and communications in order to make future communications more relevant. These cookies are used only in accordance with applicable law, including any consent or opt-out requirements.
Web beacons. Pages of our website and our emails may contain small electronic files known as web beacons (also referred to as clear GIFs, pixel tags, or single-pixel GIFs) that allow us, for example, to count the users who have visited those pages or opened an email, and to compile related statistics, such as the popularity of certain content and the integrity of our systems and servers.
You can control or disable cookies through your browser settings. Please note, however, that disabling certain cookies may limit the functionality of the website or of Lumx’s Platform.
Because there is no uniform industry standard for “Do Not Track” browser signals, our website does not currently respond to them. Where required by applicable law, we treat Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of Personal Data for the browser or device from which the signal is sent.
15. Governing Law and Dispute Resolution
PLEASE READ THIS SECTION CAREFULLY. IT AFFECTS YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE A LAWSUIT IN COURT, TO HAVE A JURY TRIAL, AND TO PARTICIPATE IN A CLASS ACTION.
This Notice is governed by the laws of the State of Wyoming, without regard to its conflict of law rules, without prejudice to the mandatory data protection laws applicable to the Data Subject, such as the LGPD, where applicable.
For Data Subjects who are Clients, any dispute arising out of or relating to this Notice or to the processing of Personal Data under it will be resolved in accordance with Clause 21 (Governing Law and Dispute Resolution) of the Terms, including the prior amicable negotiation period, binding individual arbitration, the class action waiver, the small claims and interim relief carve-outs, and the right to opt out of arbitration set out therein, which are incorporated into this Notice by reference. For other Data Subjects, the state or federal courts located in the State of Wyoming will have jurisdiction, without prejudice to the following paragraph.
Nothing in this Section limits the right of the Data Subject to submit requests and complaints to dpo@lumx.io, to file a petition with the ANPD or with another competent data protection or consumer protection authority, or to rely on any mandatory provision of the law of the country of habitual residence from which no derogation is permitted by agreement, or on any right that cannot be waived under applicable law.
16. Changes to This Notice
We may update this Notice to reflect changes to the Services or to the law. The current version will always be published on our website, with the date of the last update. Material changes will be communicated by email or through Lumx’s Platform or the interface of the applicable Platform. Except where an immediate change is required by law, an order of an authority, or security reasons, material changes affecting Clients will be notified in advance in accordance with Clause 19 of the Terms. Your continued use of the Services after the effective date of an updated Notice constitutes acknowledgment of the updated Notice, except where your consent is required by applicable law.
This Notice is drafted in English. Any translation is provided for convenience only, and in the event of any discrepancy the English version will prevail, without prejudice to mandatory language requirements under applicable law.