Privacy Policy

Effective Date: June 2026

ONE INVESTMENT — Privacy & Data Protection Policy

1. Introduction & Core Commitment

At ONE INVESTMENT, we recognize that as a multi-project capital staging and digital wallet platform, we are entrusted with highly sensitive financial and personal data. This Privacy & Data Protection Policy ("Policy") governs how the ONE INVESTMENT mobile application, website, and internal backend systems collect, encrypt, store, share, and retain your data.

This Policy is fully integrated with the ONE INVESTMENT Master Terms & Conditions, the Asset Participation & Risk Disclosure, and the Payment, Refund & Wallet Policy. By registering an account, completing KYC verification, or initiating a digital wallet transaction, you explicitly consent to the data practices outlined in this document.

2. Mandatory Data Collection (KYC & AML Directives)

To operate legally within the financial frameworks of Bangladesh and accommodate authorized international participants, ONE INVESTMENT collects data across four primary categories:

2.1 Personal Identifiable Information (PII) & KYC Data

In strict compliance with the Bangladesh Financial Intelligence Unit (BFIU) regarding Anti-Money Laundering (AML) and Counter-Terrorism Financing (CFT), as well as international regulatory frameworks for our cross-border users (such as FATCA for the USA and FINTRAC for Canada), we are legally mandated to collect:

• Full legal name, date of birth, and residential address (including verified overseas proof of address for international users).
• Government-issued identification (Bangladesh National ID/Smart Card, or valid Foreign Passports for Non-Resident Bangladeshis and international participants).
• International tax identification numbers (e.g., SSN, SIN, or overseas TIN) where legally required to process cross-border compliance and repatriation.
• Facial recognition data or biometric selfies utilized exclusively for identity verification.
• Legally designated Nominee details (including Nominee NID/Passport and relationship) for inheritance protocols. By providing Nominee details, you legally confirm you have obtained their explicit, informed consent to share their personal data with our platform.

2.2 Financial & Transactional Data

To facilitate closed-loop wallet staging and project distributions, we collect:

• Linked bank account details (Routing numbers, SWIFT codes, Account names) for local BEFTN/BACH clearing or international wire transfers.
• Mobile Financial Service (MFS) numbers (e.g., bKash, Nagad) used for local deposits and withdrawals.
• Complete internal ledger history, including timestamped records of wallet top-ups, international gateway deposits, project allocations, capital deployments, and NBR tax withholdings (TDS/AIT).

2.3 Device Telemetry & Cybersecurity Data

To protect the platform against cyber threats, automated bot attacks, and unauthorized access, we automatically log:

• Device identifiers (IMEI, MAC address, operating system).
• IP addresses and network connection types.
• App session durations, interaction heatmaps, and crash diagnostics.

2.4 Hardware & App Store Permissions

To ensure seamless functionality and comply with Apple App Store and Google Play Store privacy mandates, the app requires explicit, user-granted permissions to access:

• Camera: Strictly for capturing live KYC documents and verification selfies. We do not access your background photo gallery.
• Biometrics: Utilizing device-native FaceID or TouchID exclusively for secure session logins and transaction signing.
• Push Notifications: Strictly for critical operational alerts (e.g., withdrawal approvals, security warnings).

3. How We Utilize Your Data

ONE INVESTMENT strictly silos your data. We do not and will never sell your Personal Identifiable Information (PII) or financial ledgers to third-party marketing agencies or data brokers. Your data is used exclusively to:

1. Verify your identity and maintain a legally compliant domestic and international user account.
2. Process MFS, inter-bank, and international gateway transactions securely.
3. Allocate your capital into specific active projects and accurately track performance distributions.
4. Prevent, detect, and investigate fraudulent chargebacks, duplicate accounts, or cross-border money laundering attempts.
5. Provide dedicated customer support and resolve ledger disputes.

4. Third-Party Gateway Sharing & Regulatory Disclosure

While your data is heavily guarded, platform operations require secure, encrypted data handoffs to authorized third parties.

4.1 Financial Gateways: We securely share necessary transactional data (e.g., transaction IDs, user phone numbers, payout amounts) with our authorized Mobile Financial Services (MFS) partners, scheduled commercial banks in Bangladesh, and international payment gateways solely to execute your requested deposits and withdrawals.

4.2 Law Enforcement & Regulatory Bodies: ONE INVESTMENT cooperates fully with the Government of Bangladesh and applicable international financial authorities. We reserve the absolute right to disclose your KYC profile, wallet balances, and transaction history without prior notice if formally requested by:

• The Bangladesh Financial Intelligence Unit (BFIU).
• The National Board of Revenue (NBR) for tax auditing purposes.
• International financial intelligence agencies (e.g., FINTRAC in Canada) when legally compelled regarding specific cross-border transactions or AML audits.
• Law enforcement agencies acting under the Cyber Security Act, 2023, or via a binding court order from a competent jurisdiction in Dhaka.

4.3 Corporate Infrastructure: Your data may be processed by enterprise-grade cloud hosting providers (e.g., AWS, Google Cloud) that maintain the platform's backend architecture. These providers are bound by strict corporate confidentiality agreements.

5. Cross-Border Data Processing

ONE INVESTMENT maintains corporate and operational offices in both Dhaka, Bangladesh, and Montreal, Canada. By using the app, you acknowledge and consent that your data may be securely transferred, stored, or processed on encrypted servers located outside of Bangladesh. Regardless of server location, ONE INVESTMENT enforces enterprise-grade security protocols to ensure your data remains protected under the operational standards defined in this Policy.

6. Statutory Data Retention & Archiving

6.1 Active Accounts: We retain your PII, KYC, and financial data for as long as your ONE INVESTMENT digital wallet remains active and holds a balance or active project allocation.

6.2 Post-Termination (The Audit Lock): If you delete the ONE INVESTMENT app or explicitly request account termination, we cannot immediately erase your financial footprint. In compliance with standard domestic and international financial auditing and AML statutory requirements, ONE INVESTMENT will securely archive your KYC documents, wallet ledger, and transaction history for a mandatory period of 5 to 7 years following account closure.

• During this retention period, your data is isolated, frozen, and inaccessible for daily operations, retained solely for potential regulatory audits or legal disputes.

7. Cryptographic Safeguards & Account Security

7.1 Platform Defense: ONE INVESTMENT utilizes bank-grade encryption protocols (such as 256-bit AES and TLS/SSL transit layers) to protect data moving between your mobile device and our servers.

7.2 User Liability: While we heavily fortify our infrastructure, the security of your account also depends on you. You are entirely responsible for keeping your OTPs, PINs, and login credentials strictly confidential. ONE INVESTMENT accepts no liability for data breaches or unauthorized wallet transfers resulting from your device being compromised, "jailbroken," or infected with malware.

7.3 Breach Notification Protocol: In the highly unlikely event of a confirmed systemic breach affecting your PII or financial ledgers, ONE INVESTMENT commits to notifying affected users and relevant regulatory authorities within 72 hours of verified detection, detailing the scope of the incident and immediate mitigation steps taken.

8. User Rights & Account Management

Subject to the statutory retention laws mentioned in Section 6, you maintain the right to:

• Access & Review: View your active wallet balances, historical project participation, and KYC profile directly within the app dashboard.
• Correction: Contact Support to update your contact information or correct inaccurate NID/Passport/Bank details (requires mandatory re-verification).
• Communication Opt-Out: You may opt out of promotional emails or push notifications regarding new project launches; however, you cannot opt out of critical operational notices (e.g., withdrawal approvals, tax deduction notices, security alerts).

9. Policy Modifications

ONE INVESTMENT reserves the absolute right to update, modify, or amend this Privacy & Data Protection Policy at any time to reflect new digital privacy frameworks, BFIU/international regulatory shifts, App Store compliance mandates, or upgraded cybersecurity architectures. Any material changes will be communicated via an in-app notice. Continued use of the platform after updates are published constitutes your legally binding acceptance of the revised Policy.

10. Privacy Contact & Data Officer

For inquiries regarding your KYC data, account deletion procedures, or privacy concerns, please contact our administrative team: