Privacy Policy

Ultra Multipurpose Technology Limited ("Ultra", "Company", "we", "us" or "our") is committed to maintaining the accuracy, confidentiality, and security of your personally identifiable information ("Personal Information"). As part of this commitment, our Privacy Policy ("Policy") governs our actions as they relate to the collection, use and disclosure of Personal Information.

This Privacy Policy governs your access to, and use of our Services, and your access to all forms of systems, operations and processes within the jurisdiction within which we operate that involve the collection, storage, use, transmission, and disposal of personal information. Before you use or submit any information through or in connection with our Services, please review this Policy carefully. By using our Services, you authorize the collection, use, storage, and disclosure of your data and information as outlined in this Policy and how they are collected and used by us.

This Privacy Policy is strictly restricted to our Services; thus, it does not apply to Services that are not owned or controlled by us, including third-party websites, products and services. You are advised to read the terms of use, privacy policy and other policies of such third-parties.

To ensure that you understand the terms used in this Privacy Policy, the following terms are referenced and defined below:

• "Cookies": means a small amount of data generated by the website and saved by your browser application. It is used to identify your browser, provide analytics and remember information about you.
• "Ultra"/ "Company"/ "we"/ "us" or "our": means Ultra Multipurpose Technology Limited and its subsidiaries including any person or legal entity to whom the rights and/or obligations of the Company have been assigned.
• "Content": means the service and any materials, graphics, audiovisual files, processes and code, features, and functionality available on our website.
• "Device": means any electronic device connected to the internet which a person (natural or legal) uses to access our Site. It could be a phone, tablet, computer, or any other device capable of connecting to the internet and accessing our Services.
• "PIN": means Personal Identification Number.
• "Account": means a unique account created by you on our Website to access our Services or part of our Services.
• "Personal Information": means any information that belongs to a customer. Such information includes but is not limited to name, telephone numbers, email address, location, Gender, Product interest, bank account details, etc., of customers which makes them easily identifiable.
• "Policy": means this Privacy Policy.
• "Services": means the services offered by Ultra via the Website which includes streamlining international money transactions seamlessly.
• "User" or "You" or "Customer"/ "Your": means individuals, corporate organisations, tech brands, tech enthusiasts and all other persons that in one way or the other access our Services.

By accessing our website, creating an Ultra account, or utilizing any feature of our Services, you confirm that you have read, understood, and provided explicit, informed consent to the collection, processing, storage, and lawful disclosure of your Personal Information in full alignment with this Privacy Policy.

Where processing is predicated upon your consent, you preserve the legal right to withdraw your consent at any time by issuing formal written notice to [email protected] or adjusting your privacy preferences inside the Ultra application. However, withdrawal of consent does not invalidate prior lawful processing, nor does it impair processing obligations imposed by anti-money laundering (AML), counter-terrorist financing (CTF), or financial regulatory compliance statutes.

If you submit Personal Information regarding any third party (e.g., directors, authorized signatories, ultimate beneficial owners, or recipients of your payments), you warrant and represent that you have obtained full lawful consent and authority from such individuals prior to furnishing their details to Ultra.

We gather Personal Information directly from your inputs when opening an account, verifying your credentials, interacting with our customer support teams, or executing digital asset and fiat transactions. The categories of information collected encompass:

• Personal & Identity Information: Full legal name, date of birth, gender, nationality, residential address, government identification credentials (passport, national ID, or driver’s license), and tax identification numbers.
• Contact Details: Verified email addresses, mobile telephone numbers, and official mailing addresses.
• Financial & Transactional Records: Linked commercial bank account numbers, digital wallet addresses, transaction counterparties, transfer dates, amounts, currency settlement choices, and payment memos.
• Corporate & KYB Records (Businesses): Certificate of incorporation, memorandum of association, commercial registry extracts, operating licenses, proof of registered office, and identity records of beneficial owners holding 10% or more equity.
• Technical & Device Telemetry: IP address, unique device identifiers, operating system version, browser telemetry, app session logs, and diagnostic event metrics.

To adhere rigorously to Know-Your-Customer (KYC) directives and provide industry-leading defense against identity fraud and synthetic impersonation, Ultra may collect and process biometric facial geometry and liveness validation video recordings during user onboarding and high-value authentication challenges.

Facial data is strictly evaluated to authenticate that the live person submitting the application corresponds directly to the identity document presented.

Ultra does not commercialize, sell, or disclose biometric records to advertisers or unaffiliated third parties. Biometric templates are stored within encrypted, isolated vaults with strict access segregation and are retained only for the period necessary to fulfill regulatory fraud-prevention requirements, following which they are permanently deleted.

Ultra maintains strict purpose limitation standards. We collect, store, and process Personal Information exclusively for predetermined, transparent, and legitimate purposes communicated to you in this Policy or at the point of data capture.

Your information will under no circumstances be used, altered, or transferred for secondary objectives that are incompatible with those initial purposes, except where permitted or mandated by applicable law or supported by your fresh, affirmative consent.

We practice disciplined data minimalization. Ultra restricts the collection of Personal Information to only what is adequate, relevant, and strictly necessary to render our Web3 banking, payments, and multi-currency exchange services.

We continuously audit our account registration and operational workflows to ensure that unnecessary, excessive, or irrelevant data points are excluded from collection.

We process your personal information for essential business purposes:

• To open, operate, and maintain your Ultra multi-currency wallet account.
• To process deposits, transfers, counter QR payments, and fiat/crypto settlements.
• To verify your identity and satisfy regulatory KYC, KYB, and AML compliance statutes.
• To detect and counteract financial crimes, unauthorized intrusions, and security vulnerabilities.
• To transmit critical transaction confirmations, security notices, and legal updates.
• To deliver 24/7 client support and resolve chargebacks or transaction disputes.

In compliance with prevailing data privacy frameworks (including NDPA and global standards), our processing activities are grounded in recognized lawful bases:

Ultra does not sell or lease your Personal Information to data brokers. We share data solely with vetted entities under strict confidentiality and security obligations:

• Regulated Banking Partners: Licensed partner banks and payment processors that facilitate local fiat clearing, debit card provisioning, and regulatory settlement accounts.
• Identity & Fraud Providers: Accredited verification services that execute automated KYC checks, sanction list screenings, and transaction fraud analytics.
• Infrastructure Providers: Secure cloud hosting, enterprise database systems, and customer ticketing platforms adhering to SOC 2 and ISO 27001 certifications.
• Regulators & Law Enforcement: Supervisory authorities, financial intelligence agencies, and judicial courts when legally mandated by court order or statutory obligation.

We retain Personal Information only for as long as necessary to fulfill the purposes for which it was acquired and to comply with statutory legal, accounting, and supervisory requirements.

Pursuant to global anti-money laundering (AML) and financial recordkeeping mandates, customer identification credentials, account statements, and transfer records are retained for a minimum period of five (5) to seven (7) years following the termination of your account relationship.

Following the expiration of mandatory retention periods, your data is permanently erased from our systems or irreversibly aggregated for anonymized reporting.

Ultra maintains bank-grade cybersecurity protocols designed to protect your data against unauthorized access, theft, alteration, and compromise:

• Encryption in Transit & Rest: TLS 1.3 protocol encryption for all network transmissions and AES-256 encryption across all data storage volumes.
• Zero-Trust Architecture: Granular role-based access control, mandatory multi-factor authentication (MFA), and audit logging across all internal environments.
• Vulnerability Assessments: Automated intrusion detection, regular code audits, and continuous third-party penetration testing.

Note: While we apply advanced security defenses, you remain responsible for keeping your PIN, passwords, and two-factor recovery codes confidential.

Subject to jurisdictional laws, you possess enforceable privacy entitlements regarding your Personal Information:

To submit a privacy rights request, email [email protected]. We will process your verified request within 30 calendar days.

Our Services are strictly reserved for individuals aged eighteen (18) years or older, or the statutory age of financial majority in your legal domicile.

Ultra does not knowingly collect, retain, or solicit data from minors under eighteen. If we discover that an account has been registered by a minor, we will promptly deactivate the account and purge all associated personal records.

In the event that Ultra Multipurpose Technology Limited is involved in a corporate merger, asset acquisition, restructuring, or corporate dissolution, customer Personal Information may be transferred as an operating business asset.

We will issue clear notification via our website and electronic communication prior to any transfer of controlling interest, ensuring the acquiring party remains bound by the data protection principles defined herein.

Ultra reserves the prerogative to revise this Privacy Policy periodically to reflect technological enhancements, product releases, or amendments in statutory regulatory statutes.

Whenever updates occur, the "Effective Date" at the top of this document will be refreshed. For substantial modifications, we will provide conspicuous alerts via app push notifications, website announcements, or direct email.

Your continued interaction with our Services following any modifications confirms your informed acceptance of the updated terms.

For any questions, requests, or privacy compliance inquiries, please reach out to our dedicated Data Protection team: