数据保护政策

I、执行摘要

Quantum Star Co., Ltd. 的数据保护政策是一份包含规章制度和操作流程的文件,旨在用于保护和保障公司所收集、管理与储存的所有数据的隐私与安全。该政策适用于 Quantum Star 所持有的所有过去、现在或未来客户的信息,无论是电子形式还是纸质形式,自数据创建起直至销毁或永久保存。

政策涵盖了个人数据保护的相关规则,包括员工、客户、供应商及其他第三方在确保负责任地处理个人数据方面的义务。本政策体现了公司致力于充分保护个人数据及其隐私的承诺。

II、政策目的

本政策的目的是为公司如何处理员工、客户、供应商及第三方的个人数据提供指导,确保其符合数据保护法律要求,并保障客户的权利。此政策适用于公司所处理的所有个人数据,无论数据的格式或存储媒介如何。

Quantum Star 最重视的是客户对信息处理的信任与信心,确保潜在与现有客户在提供信息时能够相信公司将准确、合理地使用这些信息,防止其被篡改或误用。我们致力于保障客户数据的安全,严格遵守保密标准。

III、政策适用范围

本政策适用于公司员工及客户的所有个人数据处理行为。出于良好行业惯例,公司授权访问个人数据的外部代理或服务商亦需遵循本政策。相关服务单位须以书面形式确认遵守本政策,并由公司数据保护团队提供指导。

IV、术语定义

• 个人(Person):指自然人或法人。

•  个人数据(Personal Data):与已识别或可识别的自然人有关的任何信息。

•  处理(Processing):对个人数据执行的任何操作或一组操作(包括但不限于收集、记录、组织、存储、修改、检索、传输、披露、删除等),不论是否通过自动化方式。

•  加密(Encryption):将信息或数据转化为无法理解或读取的特殊代码的过程。

•  数据泄露(Data Breach):未经授权,个人数据被访问、披露或窃取的事件。

V、目标与原则

5.1 目标

• 确保客户数据的保密性、完整性和可用性;

• 防止未经授权访问、泄露或篡改;

• 明确员工对数据保护的责任与义务;

• 提高客户对公司数据处理方式的透明认知;

• 遵守所有适用的数据保护法规。

5.2 原则

合法、公正、透明:数据收集与处理须合法,并向数据主体说明用途;

• 目的明确:数据只为特定、合法目的而收集;

• 数据最小化:仅收集业务运行所需的最少数据量;

• 准确性:确保数据的更新与准确;

• 存储限制:数据只保留至达成目的所需时间;

• 完整性与保密性:保障数据在存储和传输过程中的安全性;

• 问责机制:公司对数据保护承担全面责任。

VI、数据收集与使用标准

公司仅收集为运营所需的数据类型,包括客户身份信息、联系方式、交易历史等。所有数据收集前须明确用途,并征得客户同意。

VII、数据存储与加密

所有客户数据必须加密存储,包括存储在数据库、备份介质及移动设备上的数据。加密算法应符合行业标准(如 AES-256)。访问加密密钥的权限仅限授权人员。

VIII、访问控制与权限管理

公司采用基于角色的访问控制(RBAC),确保员工只能访问其职责所需的数据。所有访问记录应保留审计日志,不得随意共享账户或越权操作。

IX、数据备份与灾难恢复

公司须定期执行数据备份(每日或每周),备份数据应安全存储并加密。灾难恢复计划(DRP)必须每年测试一次,确保在系统故障、黑客攻击或自然灾害下能迅速恢复业务。

X、数据生命周期管理

数据在不再需要时应及时删除或匿名化处理。删除须采用不可恢复的技术手段(如数据擦除软件、物理销毁)。公司设定数据保留期限,并定期审查不再必要的记录。

XI、安全监控与审计

信息安全团队应部署系统日志审计、异常行为检测(UEBA)及入侵检测系统(IDS)。所有数据访问和修改操作须记录并定期审核。关键系统应启用多因素认证(MFA)。

XII、合规性与用户透明度

公司应遵守本地及国际数据保护法规,如柬埔寨《数据隐私法》草案、GDPR 等。公司须:

• 明确告知客户数据用途、存储周期及第三方共享情况;

• 提供数据访问、更正、删除、限制处理等权利;

•  建立数据保护联系人或数据保护官(DPO),接收客户咨询与投诉。

XIII、安全培训与应急响应

公司应定期对员工开展数据保护与信息安全培训,内容包括:

• 如何识别钓鱼邮件

• 如何安全传输数据

• 数据泄露报告流程

如发生数据泄露事件,公司应:

• 在72小时内向监管机构报告;

• 及时通知受影响客户;

• 启动调查与补救机制;

• 更新防护措施,避免重复事件。

XIV、总结

Quantum Star Co., Ltd. 承诺采取所有必要措施保障客户数据的安全与隐私。本政策为公司内部员工、系统及流程提供行为指引,是全体员工必须遵守的合规框架。

XV、政策批准

本政策经管理层批准生效,并在全公司范围内执行。如员工违反本政策,公司有权采取纪律处分直至终止雇佣关系。

XVI、政策披露

本政策公开透明,将通过官网、App、邮件等方式向客户提供。客户可随时查阅其内容并提出意见或投诉。

XVII、政策审查

本政策将至少每12个月审查一次,或根据法律法规变动、业务需求调整进行修订。所有更新须经管理层审批后实施,并通过公告方式告知相关方。


PRIVACY AND SECURITY PROTECTION MANAGEMENT MEASURES FOR VIRTUAL CURRENCY EXCHANGE DAТА

I. EXECUTIVE SUMMARY

Quantum Star's Data Protection Policy is a document with regulations and procedures that shall be adopted to protect and secure all data consumed, managed, and stored by the company. The policy covers all data that Quantum Star holds for either past, current, or prospective persons in either electronic or paper format, from when it is created to when it is either destroyed or permanently preserved. It provides the rules of personal data protection, including related obligations of staff, Customers, suppliers, and other third parties in ensuring responsible processing of personal data.
This policy demonstrates the company's commitment to ensuring adequate protection and privacy of personal data.

II. POLICY PURPOSE

The purpose of this policy is to provide guidelines on how the company shall process the personal data of its staff, customers, suppliers, and other third parties in compliance with data protection law and to protect the customer's rights. The policy shall apply to all personal data the company processes regardless of the format or media on which the data is stored or to whom it relates.
Quantum Star's most important assets are the trust and confidence required to handle information properly. Customers and potential customers expect us to maintain their information accurately, protect it against manipulation and errors, secure it from theft, and free it from unwarranted disclosure. We protect the data security of our customers and potential customers by complying with all relevant data protection laws and regulations and ensuring our staff complies with strict standards of security and confidentiality.

III. РОLICY SCOPE

This policy encompasses all Processing of Personal Data by staff, and customers, each of whom is subject to this policy. Asa matter of good practice, other organizations or agents who have access to and process personal data on behalf ofthe company will be expected to read and comply with this policy. The relevant service that deals with such external third parties is responsible for ensuring that such third parties agree in writing to abide by this policy, with support from published procedures and guidance, and from the Company Data Protection Team.

IV. DEFINITION OF TERMS

This policy tries as far as possible to avoid using technical terms. However, there are some terms used in the Data Protection Policy that it is helpful to have an understanding of in the context of data protection compliance. To assist such understanding, we have set out a list of key terms and their meanings below. Where these terms are used in this policy, they should be read and applied in this context.

IV. DEFINITION OF TERMS

Person: Refers to a natural person or legal person.

Personal data: Refers to any information relating to an identified or identifiable natural person.

Processing: Refers to any operation or set of operations which may be performed on personal data, whether or not by automated means or non-automated means, including but not limited to collection, recording, organization, storage, alteration, retrieval, use, disclosure by transmission, dissemination, erasure, and destruction.

Encryption: Transformation of information or data into any special code that cannot be understood or used.

Data breach: Refers to an incident in which personal data was accessed, disclosed, or stolen without an authorization.

V. OBJECTIVE AND PRINCIPLES

5.1 Objectives

a. Ensure the confidentiality, integrity, and availability of customer data to prevent unauthorized access, leakage, or tampering.
b. Comply with international and local privacy protection laws and regulations (such as GDPR, CCPA, etc.).
c. Establish trust and ensure customer transparency regarding data usage.

5.2 Basic Principles

a. Data Minimization Principle: Only collect data necessary to complete business needs, avoiding unnecessary information storage.
b. Security-First Principle: Design data protection solutions centered around security technologies and policies.
c. Transparency Principle: Ensure that customers are aware of how their data is collected, used, stored, and shared.

VI. DATA COLLECTION AND USAGE STANDARDS

6.1 Data Collection

a.Collect only essential customer information, such as identity verification data (KYC), transaction data, and contact information.
b.Ensure data sources are legal and obtain explicit consent from customers.

When we collect the information from customers, staff, and other third party we will usually identify any information that is mandatory (i.e., information required for creating an account and enabling you to access the features of the website and receive any services). You may choose not to provide us with the requested data, but failure to do so may inhibit our ability to do business with you or to respond to your inquiries

6.2 Data Usage

a. Collected data is strictly limited to the following purposes:
  • Identity verification and account management.
  • Transaction records and risk control analysis.
  • Compliance with legal and regulatory requirements (e.g., anti-money laundering, tax reporting).
b.Do not use data for advertising or other commercial purposes without customer consent.

Why do we collect your data and how it may be used?

Personal data is collected for the following purposes:

Unless permitted by applicable laws and regulations, we will obtain consent from customers ifwe wish to use personal data of customers for purposes other than those stated in this privacy statement.

Who may be provided with your personal data?

Personal data will be kept confidential but may, where permitted by law or where such disclosure is necessary to satisfy the purpose or a directly related purpose for which the personal data was collected, provide such personal data to the following parties:

6.3 Data Sharing

a. Share data only with necessary third-party service providers (e.g., payment gateways, identity verification platforms).
Sign strict data processing agreements to ensure third parties comply with privacy and security standards.
b. Prohibit cross-border data transfer unless required by local laws.

VII. DATA STORAGE AND ENCRYPTION

7.1 Data Storage

a. Store customer data in highly secure databases with access control measures to restrict permissions.
b. Conduct regular security checks on storage systems to prevent data leaks and unauthorized access.

7.2 Data Encryption

a. Static Data Encryption: Use AES-256 or equivalent encryption algorithms for stored data.
b. Data Transmission Encryption: Use HTTPS/TLS 1.2+ to protect data during transmission against man-inthe-middle attacks.
c. Sensitive information (e.g., passwords, private keys) must be encrypted using irreversible methods (e.g., bcrypt).

VIII. ACCESS CONTROL AND PERMISSION MANAGEMENT

8.1 User Access

a. User accounts must enable multi-factor authentication (MFA) to prevent unauthorized access.
b. Implement complex password rules and regularly remind users to update their passwords.

8.2 Internal Permissions

a. Assign minimum permissions to internal staff based on roles, requiring approval for access to sensitive data.
b. Regularly review permission allocations and revoke unnecessary permissions.

IX. DATA BACKUP AND DISATER RECOVERY

9.1 Data Backup

a. Regularly back up customer data and store encrypted backups offsite.
b. Retain backup files for at least 3 months to ensure recoverability.

9.2 Disaster Recovery

a. Develop a detailed disaster recovery plan (DRP) covering scenarios such as data loss and system failures.
b. Conduct regular drills on recovery processes to meet recovery time objectives (RTO) and recovery point objectives (RPO).

X. DATA LIFECYCLE MANAGEMENT

10.1 Data Retention

The retention period for customer data must comply with local legal requirements or contract agreements, with expired data securely destroyed.

10.2 Data Destruction

a. Use professional tools to thoroughly destroy expired or unnecessary data, ensuring it cannot be recovered.
b. Maintain records of destruction for auditing purposes.

XI. SECURITY MONITORING AND AUDIT

11.1 Real-Time Monitoring

a. Monitor all systems and networks related to customer data in real-time to detect abnormal activities.
b. Use Security Information and Event Management (SIEM) tools to generate and analyze security logs.

11.2 Security Audit

a. Conduct regular audits of data access records to ensure compliance with operational policies.
b. Engage third-party organizations for annual data security assessments.

ХII. СОMPLIANCE AND USER TRANSPARENCY

12.1 Legal Compliance

a. Regularly update data privacy policies to comply with the latest laws and regulations.
b. Ensure that any cross-border data transfers meet relevant international data protection standards.

12.2 User Right to Know

a. Provide customers with clear privacy policies explaining data collection, storage, and usage practices.
b. Offer channels for data access, correction, or deletion requests, responding promptly to customer needs.

XIII. TRAINING AND EMERGENCY RESPONSE

13.1 Security Training

a. Regularly train employees on data privacy and security to enhance awareness of preventive measures.
b. Ensure the development team understands the design requirements for privacy protection.

13.2 Emergency Response

a. Establish a data breach emergency response mechanism, clearly defining responsibilities and handling procedures.
b. In the event of a data breach, immediately notify affected customers and report to regulatory authorities.

XIV. SUMMARY

Through these measures, the virtual currency exchange will construct a comprehensive data privacy and security protection system, ensuring the security and compliance of customer data while enhancing customer trust and business stability.

XV. POLICY APPROVAL

This policy is approved by the Company's Board of Directors.

XVI. POLICY DISCLOSURE

This policy is authorized for full disclosure internally within the Company, but is designated as Confidential and should not be disclosed to third parties without the prior approval of the Company's director.

XVII.REVIEW OF THE POLICY

The Policy is responsible by IT Department and all propose for any changes, amend and revise shall propose by IT Department and then submit to the Board of director for approval.

IT Department shall regularly review of the Policy at least once in every one years or as and when there is an update to the regulatory requirements.