Global Privacy Policy

Applicable to all entities within the Victory Conquest Group, including the Quest Transfer and Quest OTC platforms. Version 1.0 — effective 19 March 2025.

1. Introduction

Victory Conquest Holdings Pte. Ltd., a company incorporated in Singapore (UEN: 202408277H), together with its subsidiaries and affiliated entities (collectively referred to as the “Victory Conquest Group”, “Group”, “we”, “us” or “our”) is committed to protecting the privacy and personal data of all individuals who interact with our services, platforms, websites and applications.

This Global Privacy Policy (“Policy”) describes how the Victory Conquest Group collects, uses, stores, shares and protects personal data across all of its operating entities, platforms and jurisdictions. This Policy applies to all services offered by any entity within the Group, including but not limited to the Quest Transfer remittance services mobile application and platform, the Quest OTC over-the-counter trading platform, and all associated websites and client portals.

We process personal data in accordance with the applicable data protection and privacy laws of each jurisdiction in which we operate. Where there is a conflict between this Policy and applicable local law, the local law shall prevail to the extent of such conflict.

This Policy should be read together with any supplementary or entity-specific privacy notices that may be provided to you by the relevant Group entity at the time of data collection or during the course of our business relationship.

2. Group entities and applicable laws

The Victory Conquest Group operates through multiple entities across various jurisdictions. Each entity acts as an independent data controller for the personal data it collects and processes. The following table sets out the key Group entities, their jurisdictions and the primary data protection legislation applicable to each:

Each Group entity operates under the regulatory supervision of the relevant financial services and data protection authorities in its jurisdiction. Specific licensing and registration details are available upon request from the Data Protection Officer.

3. Data controller

Each Victory Conquest Group entity acts as the data controller in respect of the personal data it collects and processes in connection with the services it provides. Where services are delivered jointly by more than one Group entity, each participating entity shall be a joint controller, and appropriate arrangements will be in place to define their respective responsibilities.

The Group has appointed a Group Data Protection Officer who is responsible for overseeing data protection strategy and compliance across all entities:

Group Data Protection Officer: Mr. Kunal Sachdev
Email: pd@victoryconquest.com
Postal Address: C2-401, 4th Floor, Grand Bai La Croisette, Grand Baie, Mauritius

If you have any questions about this Policy, wish to exercise your data protection rights, or wish to make a complaint, please contact the Group Data Protection Officer using the details above. We will endeavour to respond to all legitimate requests within the timeframes mandated by the applicable law in your jurisdiction.

4. Services we provide

The Victory Conquest Group provides a range of financial services across its operating entities. Understanding the services we offer is essential to understanding the context in which we collect and process your personal data. The principal services provided by the Group include:

4.1 Payment intermediary and cross-border remittance services

Through our licensed entities, primarily Victory Conquest (Mauritius) Limited and Victory Conquest Payments (Canada) Limited, Victory Conquest (Australia) Pty Ltd. and Victory Conquest HK Limited we facilitate cross-border payment and remittance services for individuals, corporations and licensed financial institutions. These services are delivered via the Quest Transfer mobile application, our web-based client portal and direct institutional integrations.

4.2 Foreign exchange services

We provide foreign currency exchange and treasury services to corporate clients, financial institutions and individual customers, enabling them to convert currencies at competitive rates in connection with cross-border transactions and business operations.

4.3 Virtual currency and digital asset services

Through our licensed entities, including Victory Conquest Payments (Canada) Limited (registered with FINTRAC for dealing in virtual currency) and Quest OTC LLC (registered as a virtual currency exchange in Georgia), we offer services including stablecoin on-ramp and off-ramp, over-the-counter digital asset trading and fiat currency settlement for virtual asset service providers.

4.4 Business-to-business payment solutions

We provide payment intermediary services to licensed money transfer operators, banks, financial institutions, small-to-medium enterprises and large corporations, enabling them to utilize our settlement rails and payment infrastructure for their own business or on behalf of their customers.

5. Personal data we collect

We collect personal data that is necessary for the provision of our services, to comply with our legal and regulatory obligations and to pursue our legitimate business interests. The categories of personal data we collect may vary depending on the specific service, the entity providing the service and your relationship with us.

5.1 Identity information

• Full legal name, former names and aliases
• Date of birth, age, gender and marital status
• Nationality and citizenship
• Government-issued identification documents (passport, national identity card, driver’s licence)
• Photographs for identity verification purposes
• Tax residency and tax identification numbers

5.2 Contact information

• Residential or business address
• Telephone numbers (mobile and landline)
• Email address
• Emergency contact details

5.3 Financial information

• Bank account details and banking relationships
• Transaction history and bank statements
• Source of wealth and source of funds information and supporting documentation
• Investment and financial protection plan details
• Payment method information
• Virtual currency wallet addresses

5.4 Transaction data

• Remittance and payment details including amounts, currencies and purposes
• Beneficiary details (name, address, account information, relationship to sender)
• Transaction timestamps, locations and reference numbers
• Payout methods and destination countries
• Foreign exchange conversion details

5.5 Business and corporate data

• Company registration and incorporation details
• Corporate structure and beneficial ownership information
• Business licensing and regulatory status
• Financial statements and business activity details
• Details of directors, officers, authorised signatories and key personnel

5.6 Device and technical information

• Device identifiers (IMEI, device ID, advertising ID)
• Operating system, browser type and application version
• IP address and geographic location data
• Biometric data (where enabled for device-level authentication)
• Session data, cookies, browsing actions and usage patterns
• Network connection and connectivity information

5.7 Communication data

• Records of correspondence with us via email, telephone, chat or other channels
• Customer support interactions and feedback
• Marketing and communication preferences

We do not collect Special Categories of Personal Data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying purposes, health data, or data concerning sexual life or orientation) unless it is strictly required by applicable law or regulation.

6. How we collect personal data

6.1 Direct collection

You may provide personal data directly to us when you:

• Register for an account on any of our platforms (Quest Transfer, Quest OTC, client portal)
• Apply for or use any of our products or services
• Complete our electronic or paper-based KYC/KYB forms and onboarding documentation
• Upload identification documents and supporting materials
• Enter into a contract with us for the provision of services
• Communicate with us by post, phone, email, chat or through our applications
• Subscribe to our publications or request marketing communications
• Provide feedback, complete surveys or participate in promotions

6.2 Automatic collection

When you interact with our websites, applications and platforms, we may automatically collect technical and usage data through cookies, server logs and similar technologies, including:

• App usage patterns, navigation paths, session duration and frequency of use
• Error logs, crash reports and application performance data
• Network connection information and push notification interaction data
• Location data (with your permission, where applicable)

6.3 Third-party sources

We may receive personal data about you from external sources, including:

• Identity verification and electronic KYC service providers
• Credit reference and credit-reporting agencies (where applicable)
• Sanctions, watchlist and politically exposed persons (PEP) screening databases
• Publicly available sources such as company registries, electoral registers and open-source intelligence
• Banking partners, payment processors and correspondent financial institutions
• Analytics providers
• Other members of the Victory Conquest Group for cross-referencing or reliance-on-third-party mechanisms

7. Legal basis for processing

We process your personal data only where we have a lawful basis to do so under applicable data protection law. The specific legal basis depends on the jurisdiction, the nature of the data and the purpose of processing. The principal legal bases upon which we rely include:

7.1 Performance of a contract

Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract. This applies to all services we provide, including the execution of remittance transactions, foreign exchange trades, virtual currency conversions and the management of your account.

7.2 Compliance with legal and regulatory obligations

Processing is necessary for compliance with legal obligations to which the relevant Group entity is subject. This includes obligations arising under anti-money laundering and counter-terrorist financing legislation (including the Financial Intelligence and Anti-Money Laundering Act 2002 of Mauritius, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act of Canada, EU Anti-Money Laundering Directives and equivalent legislation in each jurisdiction), sanctions regulations, tax reporting obligations and financial services regulatory requirements.

7.3 Legitimate interests

Processing is necessary for the purposes of legitimate interests pursued by us or a third party, provided that such interests are not overridden by your rights and freedoms. Our legitimate interests include fraud prevention, risk management, maintaining the security and integrity of our systems, improving our services, internal group administration and business development.

7.4 Consent

Where required by applicable law, we will obtain your explicit consent before processing your personal data for specific purposes, such as direct marketing communications or the use of non-essential cookies. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

7.5 Vital interests and public interest

In limited circumstances, processing may be necessary to protect the vital interests of you or another person, or for the performance of a task carried out in the public interest. These bases are relied upon only in exceptional cases.

8. Purposes of processing

8.1 Service provision and account management

• Processing and executing remittance, payment, foreign exchange and virtual currency transactions
• Verifying your identity and conducting KYC/KYB checks
• Managing your account, profile and beneficiary information
• Providing customer support and responding to enquiries
• Sending transaction confirmations, status updates and service notifications

8.2 Compliance, legal and regulatory

• Complying with anti-money laundering (AML) and counter-terrorist financing (CFT) requirements across all operating jurisdictions
• Conducting sanctions and watchlist screening using our compliance platforms (including FlexComply)
• Screening virtual currency wallets for compliance purposes
• Filing suspicious transaction reports (STRs) and other mandatory regulatory reports with Financial Intelligence Units and relevant authorities
• Maintaining records as required by applicable law and regulation
• Responding to requests and enquiries from regulators, law enforcement and judicial authorities

8.3 Risk management and fraud prevention

• Assessing and monitoring customer, transaction and jurisdictional risk
• Detecting and preventing fraudulent, unauthorised or suspicious activities
• Implementing enhanced due diligence measures for higher-risk relationships
• Monitoring for unusual transaction patterns or behaviours
• Maintaining the security, integrity and availability of our systems and infrastructure

8.4 Service improvement and analytics

• Analysing usage data to improve the functionality and user experience of our platforms
• Developing new features, products and services
• Conducting market research and business analytics
• Optimising transaction processing efficiency and settlement times

8.5 Marketing and communications

• Providing you with information about our services and products that may be of interest to you (with your consent where required)
• Managing your marketing preferences and opt-out requests

We will only use your personal data for the purposes for which it was collected, unless we reasonably determine that we need to use it for another compatible purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis for doing so.

9. Intra-group data sharing

As a global financial services group, we may share personal data between entities within the Victory Conquest Group for the following purposes:

• Facilitating the delivery of cross-border payment, remittance, foreign exchange and virtual currency services where multiple Group entities are involved in the transaction chain
• Enabling centralised or coordinated compliance functions, including group-wide sanctions screening, risk assessment and AML/CFT monitoring
• Supporting the “Reliance on Third Parties” mechanism, whereby one Group entity may rely on the customer due diligence performed by another Group entity in accordance with applicable AML/CFT legislation
• Internal audit, governance and quality assurance activities
• Centralised IT and system administration, including security monitoring and incident response
• Group-level financial reporting, consolidation and strategic planning

Where you have opted in to receive services from multiple Group entities, your personal data will be shared with each relevant entity to enable the delivery of those services. For example, if you use the Quest Transfer application (operated by Victory Conquest (Mauritius) Limited) and also engage Quest OTC (operated by Quest OTC LLC) for digital asset services, your data may be shared between these entities to provide you with an integrated service experience.

All intra-group data sharing is subject to appropriate data protection agreements, standard contractual clauses or equivalent safeguards as required by applicable law.

10. Disclosure to third parties

We may disclose your personal data to the following categories of third-party recipients, in each case only to the extent necessary and on appropriate legal grounds:

10.1 Service providers and business partners

• Licensed payout partners, banking partners and correspondent financial institutions for transaction completion and fund settlement
• Payment processors and payment network operators for transaction execution
• Identity verification, electronic KYC and compliance technology service providers (including FlexComply for sanctions screening and AMLBOT for virtual currency wallet screening)
• Cloud infrastructure and hosting providers (including Google Cloud Platform)
• IT service providers, software developers and system administrators
• Professional advisers including lawyers, auditors, accountants, compliance consultants and insurers

10.2 Regulatory and law enforcement authorities

• Financial Intelligence Units (FIUs) in each operating jurisdiction for suspicious transaction reporting
• Financial regulators and supervisory authorities, including the Financial Services Commission (Mauritius), FINTRAC (Canada), Customs and Excise Department (Hong Kong), the Office of the Data Protection Commissioner (Mauritius), the Office of the Privacy Commissioner of Canada and equivalent authorities in each jurisdiction
• Tax authorities as required by applicable tax laws and international tax information exchange agreements
• Law enforcement agencies where required by law or where necessary for the prevention or detection of crime
• Courts, tribunals and other judicial authorities pursuant to legal orders or proceedings

10.3 Other disclosures

• Any registrar of a public register where data is required to be included
• Potential parties in connection with a merger, acquisition, reorganisation, sale of assets or business transfer, subject to appropriate confidentiality obligations
• Any other third party with your explicit consent

We will not sell, rent or trade your personal data to any third party for their own marketing purposes without your explicit consent.

We require all third-party recipients to respect the security of your personal data and to process it in accordance with applicable law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process it for specified purposes and in accordance with our instructions.

11. International data transfers

Given the global nature of our operations, your personal data may be transferred to and processed in countries other than the country in which it was originally collected. This includes transfers between Group entities and to third-party service providers located in different jurisdictions.

Our Group entities, service providers and partners are located in jurisdictions including, but not limited to: Singapore, Mauritius, Canada, Poland, Hong Kong, Australia, Georgia, Kenya, India, Malaysia, the United Kingdom, the Republic of Ireland, the European Union, the United States, Vietnam and Thailand.

Whenever we transfer personal data internationally, we ensure that appropriate safeguards are in place to provide an adequate level of protection, including:

• Transfers to countries that have been recognised as providing an adequate level of data protection by the relevant authority (for example, European Commission adequacy decisions for GDPR purposes)
• Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent instruments approved by the relevant data protection authority
• Intra-group data transfer agreements incorporating appropriate data protection commitments
• Other recognised transfer mechanisms as permitted under applicable law, such as binding corporate rules, certification schemes or codes of conduct

For data subjects located in the European Economic Area, transfers to countries outside the EEA that have not received an adequacy decision will be made pursuant to the EU Standard Contractual Clauses or other approved mechanisms under the GDPR.

For data subjects in other jurisdictions, we apply equivalent safeguards as required by the applicable local data protection law. You may contact the Data Protection Officer for further information on the specific transfer mechanisms used.

12. Data security

We take the security of your personal data seriously and have implemented comprehensive technical and organisational measures to protect it from unauthorised access, alteration, disclosure, destruction or accidental loss. These measures include:

12.1 Technical measures

• End-to-end encryption for all data in transit using TLS 1.3 protocols
• AES-256 encryption for data at rest, including on mobile devices and in cloud storage
• Multi-factor authentication and role-based access controls for all systems
• Secure API communications with robust authentication protocols
• Real-time fraud detection and monitoring systems
• Regular security audits, vulnerability assessments and penetration testing
• Comprehensive activity logging and audit trails
• Regular backup procedures and disaster recovery planning
• SOC 2 Type II certified cloud infrastructure (Google Cloud Platform)

12.2 Organisational measures

• Documented data security policies and procedures
• Clearly defined roles and responsibilities for data protection
• Access to personal data limited to authorised personnel with a legitimate business need
• All personnel subject to contractual confidentiality obligations
• Regular data protection and information security training for all staff
• Incident response procedures for suspected or confirmed data breaches
• Due diligence and contractual safeguards for all third-party data processors

12.3 Mobile application security (Quest Transfer)

• Minimal data storage on mobile devices; only essential authentication tokens stored locally
• No transactional or sensitive personal data permanently stored on devices
• Local data limited to user preferences and session management
• All substantive data securely stored on cloud infrastructure

We have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulatory authority of a breach where we are legally required to do so, within the timeframes prescribed by applicable law.

13. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy our legal, regulatory, accounting and reporting obligations. The retention periods we apply are determined by reference to the following factors:

• Applicable AML/CFT regulatory requirements across our operating jurisdictions
• The nature and sensitivity of the personal data
• The potential risk of harm from unauthorised use or disclosure
• The purposes for which we process the data and whether we can achieve those purposes through other means
• Applicable legal, tax, accounting and regulatory requirements

The following general retention periods apply across the Group, subject to any longer periods required by specific local laws:

At the end of the applicable retention period, personal data will be securely deleted or irreversibly anonymised. Where deletion or anonymisation is not immediately practicable (for example, because data is stored in backup archives), we will securely isolate the data until deletion is possible.

14. Your data protection rights

You have rights in relation to your personal data under applicable data protection law. The specific rights available to you may vary depending on the jurisdiction in which you are located and the applicable law. The following is a comprehensive summary of rights that may apply to you:

14.1 Right of access

You have the right to request a copy of the personal data we hold about you and to receive information about how we process it. This is commonly known as a “data subject access request” or “access request.”

14.2 Right to rectification

You have the right to request the correction of inaccurate or incomplete personal data that we hold about you. We may need to verify the accuracy of any new data you provide.

14.3 Right to erasure

You have the right to request the deletion of your personal data in certain circumstances, such as where the data is no longer necessary for the purpose for which it was collected, where you withdraw your consent (and there is no other legal basis for processing), or where the data has been unlawfully processed. Please note that we may not always be able to comply with your request, for example where retention is required for legal, regulatory or compliance purposes.

14.4 Right to restriction of processing

You have the right to request that we suspend or restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data, where processing is unlawful but you oppose erasure, or where you have objected to processing pending verification of our legitimate grounds.

14.5 Right to data portability

Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

14.6 Right to object

You have the right to object to processing of your personal data that is based on our legitimate interests or a public interest ground. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

14.7 Rights relating to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such processing is necessary for the performance of a contract, is authorised by law or is based on your explicit consent.

14.8 Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

14.9 Right to lodge a complaint

You have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. The principal supervisory authorities for our Group entities include:

• Mauritius: Data Protection Commissioner’s Office (www.dataprotection.govmu.org)
• Canada: Office of the Privacy Commissioner of Canada (www.priv.gc.ca)
• Poland / EU: President of the Office for Personal Data Protection (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw; kancelaria@uodo.gov.pl)
• Hong Kong: Office of the Privacy Commissioner for Personal Data (www.pcpd.org.hk)
• Australia: Office of the Australian Information Commissioner (www.oaic.gov.au)
• Kenya: Office of the Data Protection Commissioner (www.odpc.go.ke)
• India: Data Protection Board of India (as established under the DPDPA 2023)
• Singapore: Personal Data Protection Commission (www.pdpc.gov.sg)
• Malaysia: Department of Personal Data Protection (www.pdp.gov.my)
• Georgia: State Inspector’s Service / Personal Data Protection Service

We encourage you to contact us before approaching a supervisory authority so that we may have the opportunity to address your concerns directly.

14.10 How to exercise your rights

To exercise any of the rights described above, please contact our Data Protection Officer:

Email: pd@victoryconquest.com
Post: Data Protection Officer, Victory Conquest Group, C2-401, 4th Floor, Grand Bai La Croisette, Grand Baie, Mauritius

We may need to verify your identity before processing your request. This is a security measure to ensure that personal data is not disclosed to any unauthorized person.

We will respond to all legitimate requests within one month (or 30 calendar days, where applicable). If your request is particularly complex or if you have made multiple requests, we may extend this period by up to two additional months, and we will notify you of any such extension.

There is generally no fee for exercising your data protection rights. However, we may charge a reasonable administrative fee if your request is manifestly unfounded, repetitive or excessive, or we may decline to act on the request in such circumstances.

15. Cookies and tracking technologies

15.1 Website cookies

Our websites use cookies and similar tracking technologies to enhance your browsing experience, analyse site traffic and understand where our audiences come from. A cookie is a small data file placed on your device when you visit a website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of our websites and cannot be disabled. They enable core functionality such as security, session management and accessibility.
• Performance and Analytics Cookies: Help us understand how visitors interact with our websites by collecting information about pages visited, time spent and errors encountered. This data is aggregated and anonymised.
• Functionality Cookies: Enable enhanced features and personalisation, such as remembering your preferences and settings.
• Marketing and Advertising Cookies: Used (with your consent where required) to deliver relevant marketing communications and to measure the effectiveness of our advertising campaigns.

You may manage your cookie preferences through your browser settings or through cookie consent mechanisms on our websites. Disabling certain cookies may affect the functionality of our websites.

15.2 Mobile application analytics

Our mobile applications (including Quest Transfer) use analytics tools to monitor app performance and stability, understand user behaviour and preferences, identify and resolve technical issues and improve functionality. These tools may use session identifiers, crash reporting mechanisms and performance monitoring technologies.

16. Children’s privacy

Our services are not intended for, and we do not knowingly collect personal data from, individuals under the age of 18 (or such higher age as may be prescribed by local law). If we become aware that we have collected personal data from a minor without appropriate parental or guardian consent, we will take prompt steps to delete such data. If you believe that a child has provided us with personal data, please contact our Data Protection Officer immediately.

17. Third-party websites and links

Our websites and applications may contain links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. When you leave our platforms, we encourage you to read the privacy notice of every website you visit.

18. Changes to this Policy

We may update this Global Privacy Policy from time to time to reflect changes in our practices, services, legal requirements or regulatory guidance. Material changes will be communicated to you through one or more of the following methods:

• Publication on our website (www.victoryconquest.com) with the effective date clearly indicated
• In-app notifications within the Quest Transfer and Quest OTC platforms
• Email notifications to registered users
• Push notifications for significant changes affecting mobile application users

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Your continued use of our services following any changes to this Policy constitutes your acceptance of such changes, to the extent permitted by applicable law.

19. Governing law

This Policy is governed by and construed in accordance with the laws of the jurisdiction of the Group entity with which you have a contractual relationship. Where you interact with multiple Group entities, the data protection laws applicable to each respective entity shall apply to the processing activities of that entity.

In the event of any conflict between this Policy and mandatory provisions of applicable local data protection law, the local law shall prevail.

20. Contact us

If you have any questions, concerns or requests regarding this Policy or how we process your personal data, please contact us:

Data Protection Officer: Mr. Kunal Sachdev
Email: pd@victoryconquest.com
Postal Address: Data Protection Officer, Victory Conquest Group, C2-401, 4th Floor, Grand Bai La Croisette, Grand Baie, Mauritius

For entity-specific enquiries, you may also contact the relevant Group entity directly. Contact details for each entity are available on our website at www.victoryconquest.com.