Privacy Notice

• Identity Information — Full legal name, title, employer, government-issued identification for KYC/AML compliance
• Contact Information — Business email, phone number, mailing address for institutional correspondence
• Financial Information — Source-of-funds documentation, beneficial ownership disclosures, and banking details for settlement
• Technical Information — IP address, browser type, device identifiers, and access logs for security monitoring
• Transaction Data — Order history, trade executions, settlement records, and warrant transfers on the platform

• KYC/AML Compliance — Verifying identity, screening against OFAC SDN lists, and fulfilling Bank Secrecy Act obligations
• Platform Operations — Processing trades, managing settlements, issuing warehouse warrants, and maintaining your account
• Regulatory Reporting — Filing required reports with FinCEN, OFAC, and other regulatory authorities as mandated by law
• Security — Monitoring for unauthorized access, fraud detection, and maintaining the integrity of the origination platform
• Communications — Sending operational notices, regulatory updates, and material announcements related to your account

OCRE does not sell personal information. We share information only with: (1) regulatory authorities as required by law, (2) independent Tier-1 auditors for material certification processes, (3) U.S.-regulated trust institutions for fiat custody and settlement, and (4) legal counsel in connection with regulatory compliance or dispute resolution. All third-party service providers are bound by confidentiality agreements and data protection standards.

Personal information and transaction records are retained for a minimum of five (5) years following account closure, consistent with Bank Secrecy Act record-keeping requirements. OFAC screening records are maintained indefinitely. You may request deletion of non-regulatory data by contacting our Data Protection Officer, subject to applicable legal retention obligations.

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate or incomplete information
• Deletion — Request deletion of non-regulatory data (subject to legal retention requirements)
• Portability — Receive your data in a structured, machine-readable format
• Objection — Object to processing of your data for non-essential purposes

For privacy-related inquiries, contact our Data Protection Officer at our Miami headquarters. All requests are processed within 30 business days.