Case 1:23-cv-01599-ABJ-ZMF Document 114-15 Filed 09/15/23 Page 1 of 10
EXHIBIT 13
PDF Page 3
Case 1:23-cv-01599-ABJ-ZMF Document 114-15 Filed 09/15/23 Page 2 of 10
Company
Platform
Clients
Resources
Log
in
Get Started
FAQ
Are Ceffu assets insured?
Yes, Ceffu maintains specie insurance coverage provided by a third-party insurer. Bespoke insurance coverage
Where
is
also available upon request based on various user requirements.
Ceffu registered?
is
Ceffu is registered under Bifinity UAB with the Registry of Legal Entities of the Republic of Lithuania and local FIU as a crypto wallet service provider, which allows
and trading services for virtual assets.
it
to provide custody
How do I sign up for a Ceffu account?
Please contact sales@ceffu.com to start your onboarding process with a designated Account Manager.
Which digital assets and networks does Ceffu support?
Ceffu supports a variety of digital assets, including BTC, ETH, BNB, LTC, XRP, and a host of other tokens and blockchains. Please refer to https://www.ceffu.com/supported-assets for the
full list.
Is
there
a
minimum deposit requirement?
Yes, clients must deposit a minimum of USD 1,000,000 worth of digital assets under custody.
Do you onboard both corporate and retail users?
We do not currently onboard non-corporate users. The Ceffu platform
is
an institutional virtual asset custody service specially built to cater to the needs of corporate users.
How can I be sure that my assets won’t be commingled with other client assets?
Using our Qualified Wallet service, each client has a fully segregated on-chain wallet which contains only their own digital assets. This proof can be verified directly on the blockchain, as
clients have full visibility that the only movements coming in and out of their wallet belong to them.
How long does the onboarding process take?
This process can take between 2 days to 2 weeks depending on how soon you can provide all the relevant information required for onboarding and KYC/KYB.
Case 1:23-cv-01599-ABJ-ZMF Document 114-15 Filed 09/15/23 Page 4 of 10
Company
Platform
Clients
Resources
Log
in
Get Started
Facilitating institutional crypto
adoption
Ceffu
is a
compliant, insured institutional custodian offering integrated custody and liquidity solutions.
Request Demo
Since launching our institutional services in December 2021, Ceffu has devoted its operational and technological resources to growing a compliant and
audited institutional-grade infrastructure that addresses the ever-growing needs of global clients, the likes of large financial services firms,
institutional investors, and crypto-native firms.
Ceffu is operated by a dedicated team of experts from traditional finance, cryptocurrency exchanges, blockchain and customer asset security, working
together to ensure the necessary governance controls and security measures are implemented to safeguard our clients and their digital assets.
Our goal is to reinforce the security of the blockchain ecosystem to help every institution be a part of an open financial system. Together with Binance’s
unique ecosystem, Ceffu provides core infrastructure services for institutions to manage crypto with world-class security standards.
Ceffu is the only institutional
custody partner of the Binance
Exchange
Our unique integration with the Binance ecosystem enables unparalleled access
benefiting from some of the deepest liquidity in the market:
Execution & OTC Services
Liquidity Program
Exclusive VIP Programs
Competitive Fees
More Tailored Institutional Solutions
to
institutional services
Case 1:23-cv-01599-ABJ-ZMF Document 114-15 Filed 09/15/23 Page 6 of 10
Company
Platform
Clients
Resources
Ceffu by Bifinity UAB
-
Log
Get Started
in
Privacy Policy
Last updated: 8th February, 2023
Ceffu (“Ceffu”, “we”,
or
“us”)
is
committed
to
protecting the privacy
of
our customers, and we take our data protection responsibilities seriously.
This Privacy Notice describes the Personal Data that we collect, use, and share about you when you explore, sign up or access Ceffu websites and applications (“Services”), how it is used, when and how it is shared,
the rights and choices that you have, and how you can contact us about our privacy practices. This Privacy Notice also outlines your data subject rights, including the right that you have to object to certain uses of your
Personal Data.
“Personal Data” means any information that relates
websites (e.g. device information, IP address).
This Privacy Notice applies
to all
To the extent that you are
have with you.
a
To the extent that you are not
an identified
or
identifiable individual, and can include information that you provide
to
us and that we collect about you, such as when you engage with our
Personal Data processing activities carried out by us, across our platform websites and departments.
customer
a
to
or
user
of
our services, this Privacy Notice applies together with any terms
relevant stakeholder, customer
or
user
of
of
business and other contractual documents, including but not limited
our services, but are using our website, this Privacy Notice also applies
This Notice should therefore be read together with our Cookie Notice, which provides further details on our use
of
to
you together with our Cookie Notice
cookies on the website. Our Cookie Notice can be accessed here
to
any agreements we may
.
.
What Personal Data does Ceffu Collect and Process
What personal data does Ceffu collect and process?
Personal Data related
persons, including:
-
Why does Ceffu process my personal data?
Legal Basis for our use
to
company Directors, UBOs and Authorised
Managing our contractual relationship with you, to create and
maintain your account.
This includes when we use your Personal Data to take and handle
orders and process payments.
Performance of a contract when we provide you with products or
services or communicate with you about them. This includes when
we use your Personal Data to take and handle orders, and process
payments. The consequences of not processing your Personal Data
for such purposes is the inability to open an account with us or the
termination of your account where one is already open.
to
company Directors, UBOs and Authorised
To maintain legal and regulatory compliance. We collect and
process your Personal Data to comply with our Know Your Customer
(“KYC”)/ Due Diligence obligations imposed under applicable laws
and regulations. This helps us identify and verify our customers.
If you do not provide Personal Data required by law, you may be
unable to open an account, or we may have to close your account,
or we may have to close your account where it is already opened.
Legal obligation processing is necessary to comply with our legal
obligations under applicable laws and regulations, such as AntiMoney Laundering laws and regulations.
Email address
First Name
Last Name
To communicate with you on services and transaction related
matters. We use your Personal Data to communicate with you in
relation to our services on administrative or account related
information. We will communicate with you to keep you updated
about our Services, for example, to inform you of relevant security
issues, updates, or provide other transaction-related information.
Without such communications, you may not be aware of important
developments relating to your account that may affect how you can
use our Services. You may not opt-out of receiving critical service
communications, such as emails or mobile notifications sent for
legal, compliance or security purposes.
Performance of a contract when we provide you with products or
services, or communicate with you about them. This includes when
we use your Personal Data to take and handle orders, and process
payments.
Email address
First Name
Last Name
Home address
Region
Nationality
The Internet protocol (IP) address used
To provide customer services. We process your personal data when
you contact us in order to provide support with respect to
questions, disputes, complaints, troubleshoot problems, etc.
Without processing this Personal Data for this purpose, we can’t
respond to your requests.
Performance
performance
Email address
First Name
Last Name
Gender
Age
Date of birth
Nationality
Personal Data related
persons, including:
-
-
-
Email address
First Name
Last Name
Gender
Age
Date of birth
Nationality
Moving images used
Facial Recognition
to
identify
a
of
Personal Data
living individual.
to
connect your computer
of a contract. Processing is necessary
of a contract to which you are a party.
for
the
PDF Page 8
Case 1:23-cv-01599-ABJ-ZMF Document 114-15 Filed 09/15/23 Page 7 of 10
the Internet (“IP address”)
Device ID
- Bank account information, payment card information
- Information about the transaction you make on our services, such
as name of the recipient, your name and e-mail.
to
-
IP address
Login, e-mail address, password and location of your device or
computer
- Ceffu metrics (e.g., the occurrences of technical errors, your
interactions with service features and content, and your settings
preferences)
- Version and time zone settings
- To promote the safety, security and integrity of our platform. We
process your Personal Data in order to enhance security, monitor
and verify identity or service access, combat malware or security
risks and to comply with applicable security laws and regulations.
We process your Personal Data to verify accounts and related
activity, find and address violations of our Terms and Conditions,
investigate suspicious activity, detect, present and combat unlawful
behavior, detect fraud and maintain the integrity of our Services.
Without processing your Personal Data, we may not be able to
ensure the security of our Services. We use your Personal Data to
provide functionality, analyze performance, fix errors, and improve
the usability and effectiveness of Ceffu Services
Performance
performance
IP address
Login, e-mail address, password and location of your device or
computer
- Ceffu metrics (e.g., the occurrences of technical errors, your
interactions with service features and content, and your settings
preferences)
- Version and time zone settings
To promote safety, security, and integrity of our Services. Fraud
prevention and detection and credit risks. We process your Personal
Data to prevent and detect, prevent and mitigate fraud and abuse of
our Services and in order to protect you against account
compromise or funds loss and in order to ensure the security of our
users, our Services and others. We may also use scoring methods to
assess and manage credit risks.
Our Legitimate Interests. Processing is necessary for the purpose
of the legitimate interests pursued by us and the interests of our
users when, for example, we detect and prevent fraud and abuse in
order to protect the security of our users, ourselves, or others.
Email address
First Name
- Last Name
- Age
- Home address
- Region
- Nationality
- The Internet protocol (IP) address used to connect your computer
to the Internet (“IP address”)
- Bank account information, payment card information
- Information about the transactions you make on our services,
such as the name of the recipient, your name and e-mail address.
- Version and time zone.
- Transaction history
To provide and improve our Services. We process your Personal
Data to provide the services to you and process your orders. For
example, when you want to use the exchange service on our
platform, we ask for certain information such as your identification,
contact information and payment information.
Performance
performance
E-mail address
Transaction Information
Complete name
To provide you with promotions. We use your Personal Data to
provide you with promotions, including offers, rewards and other
incentives to use our Services.
Our legitimate interests and the interests of our users when, for
example, we would like to provide promotions and offers and
reward your customer loyalty.
E-mail address
Complete name
To provide you with promotions. We use your Personal Data to
provide you with promotions, including offers, rewards and other
incentives to use our Service
Your Consent. We ask for your consent to process your Personal
Data for a specific purpose that we communicate to you. When you
consent to processing your Personal Data for a specified purpose,
you may withdraw your consent at any time and we will stop
processing your Personal Data for that purpose. The withdrawal of
consent does not affect the lawfulness of processing based on
consent before its withdrawal.
-
-
-
-
-
-
-
-
E-mail address.
Information about the transaction you make on our services, such
as name of the recipient, your name and e-mail.
- The Internet protocol (IP) address used to connect your computer
to the Internet (“IP address”)
- Device ID
- Any information requested at the point of the survey/ action.
-
Can children use Ceffu Services?
Ceffu does not allow anyone under the age
of
18
to
of a contract. Processing is necessary
of a contract of which you are a party.
of a Contract. Processing is necessary
of a contract to which you are a party.
for
for
the
the
Our legitimate interests. Processing is necessary for the purpose of
our legitimate interes to improve and run our Services throught the
information obtained from these surveys.
use our Services and does not knowingly collect personal data from children under 18.
What About Cookies and Other Identifiers?
We use cookies and similar tools to enhance your user experience, provide our services, and enhance our efforts and understand how customers use our services so we can make improvements. Depending on
applicable laws in the region you are located in, the cookie banner on your browser will tell you how to accept or refuse cookies. A copy of our cookie policy is available here
.
How and Why does Ceffu share your Personal Data ?
We may share your Personal Data with third parties (including other Ceffu entities) if we believe that sharing your Personal Data is in accordance with, or required by, any contractual relationship with you or us,
applicable law, regulation or legal process. When sharing your Personal Data with other Ceffu entities, we will use our best endeavors to ensure that such entities are either subject to this Privacy Notice, or follow
practices at least as protective as those described in this Privacy Notice.
We may also share personal data with the following persons
or in
the following circumstances:
Affiliates
Personal Data that we process and collect may be transferred between companies, Services, and employees affiliates with us as a normal part of conducting business and offering our Services to you.
Third party service providers
We employ other companies and individuals to perform functions on our behalf. Examples include analysing data, providing marketing assistance, processing payments, transmitting content, and assessing
and managing credit risk. These third-party service providers only have access to personal data needed to perform their functions, but may not use it for other purposes. Further, they must process the
personal data in accordance with our contractual agreements and only as permitted by applicable data protection laws.
Legal Authorities
We may be required by law or by Court to disclose certain information about you or any engagement we may have with you to relevant regulatory, law enforcement and/or other competent authorities. We will
PDF Page 9
Case 1:23-cv-01599-ABJ-ZMF Document 114-15 Filed 09/15/23 Page 8 of 10
disclose information about you to legal authorities to the extent we are obliged to do so according to the law. We may also need to share your information in order to enforce or apply our legal rights or to
prevent fraud.
Business transfers
As we continue to develop our business, we might sell or buy other businesses or services. In such transactions, user information generally is one of the transferred business assets but remains subject to the
promises made in any pre-existing Privacy Notice (unless, of course, the user consents otherwise). Also, in the unlikely event that Ceffu or substantially all of its assets are acquired by a third party, user
information will be one of the transferred assets.
Protection of Ceffu and others
We release accounts and other personal data when we believe release is appropriate to comply with the law or with our regulatory obligations; enforce or apply our Terms of Use and other agreements; or
protect the rights, property or safety of Ceffu, our users or others. This includes exchanging information with other companies and organisations for fraud protection and credit risk reduction.
International transfers of Personal Information
To facilitate our global operations, we may transfer, store and process within our Affiliates, third-party partners, and service providers based throughout the world. The EEA includes the European Union countries
as well as Iceland, Liechtenstein, and Norway. Transfers outside of the EEA are sometimes referred to as “third country transfers”.
cases where we intend to transfer personal data to third countries or international organisations outside of the EEA, we put in place suitable technical, organizational and contractual safeguards (including
Standard Contractual Clauses), to ensure that such transfer is carried out in compliance with applicable data protection rules, except where the country to which the personal data is transferred has already been
determined by the European Commission to provide an adequate level of protection.
In
We also rely on decisions from the European Commission where they recognise that certain countries and territories outside
data. These decisions are referred to as “adequacy decisions”.
of
the European Economic Area ensure an adequate level
of
protection for personal
How Secure is My Information?
We design our systems with your security and privacy in mind. We have appropriate security measures in place to prevent your information being accidentally lost, used or accessed in an unauthorised way, altered
or disclosed. We work to protect the security of your personal data during transmission and while stored by using encryption protocols and softwares. We maintain physical, electronic and procedural safeguards in
connection with the collection, storage and disclosure of your personal data. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business
need to know.
Our security procedures mean that we may ask you to verify your identity to protect you against unauthorised access
utilized for other online accounts and to sign off when you finish using a shared computer.
to
your account. We recommend using
a
unique password for your Ceffu account that
is
not
What About Advertising?
In order for us to provide you with the best user experience, we may share your Personal Data with our marketing partners for the purposes of targeting, modeling, and/or analytics as well as marketing and
advertising. You have a right to object at any time to processing of your personal data for direct marketing purposes (see Section 8 “What Rights Do I Have”? below).
What Rights Do I Have?
Subject to applicable law, as outlined below, you have a number of rights in relation to your privacy and the
Personal Data, and to ask for data portability. You may also object to our processing of your personal data or
consent to our processing of your personal data for a specified purpose, you may withdraw your consent at any
be limited in some situations - for example, where we can demonstrate we have a legal requirement to process
protection of your Personal Data. You have the right to request access to, correct, and delete your
ask that we restrict the processing of your personal data in certain instances. In addition, when you
time. If you want to exercise any of your rights please contact us at dpo@ceffu.com. These rights may
your Personal Data.
Right to access: you have the right to obtain confirmation that your Personal Data are processed and to obtain a copy of it as well as certain information related to its processing;
Right to rectify: you can request the rectification of your Personal Data which are inaccurate, and also add to it. You can also change your Personal Aata in your account at any time.
Right to delete: you can, in some cases, have your Personal Data deleted;
Right to object: you can object, for reasons relating to your particular situation, to the processing of your Personal Data. For instance, you have the right to object where we rely on legitimate interest or where
we process your data for direct marketing purposes;
Right to restrict processing: You have the right, in certain cases, to temporarily restrict the processing of your Personal Data by us, provided there are valid grounds for doing so. We may continue to process
your personal data if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law;
Right to portability: in some cases, you can ask to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format, or, when this is possible, that we
communicate your Personal Data on your behalf directly to another data controller;
Right to withdraw your consent: for processing requiring your consent, you have the right to withdraw your consent at any time. Exercising this right does not affect the lawfulness of the processing based on
the consent given before the withdrawal of the latter;
Right to lodge a complaint with the relevant data protection authority: We hope that we can satisfy any queries you may have about the way in which we process your personal data. However, if you have
unresolved concerns, you also have the right to complain to the Irish Data Protection Commission or the data protection authority in the location in which you live, work or believe a data protection breach has
occurred.
If
you have any questions
or
objections as
to
how we collect and process your personal data, please contact dpo@ceffu.com
.
For How Long is My Personal Data Kept?
We keep your Personal Data to enable your continued use of Ceffu Services, for as long as it is required in order to fulfill the relevant purposes described
as for tax and accounting purposes, compliance with Anti-Money Laundering laws, or as otherwise communicated to you.
Contact Information
Our data protection officer can be contacted
at
dpo@ceffu.com and
,
will
work
to
address any questions
or
issues that you have with respect
to
in
this Privacy Notice, and as may be required by law such
the collection and processing
of
your Personal Data.
Ceffu relationship to you
Ceffu is a registered trademark Binance Institutional Holdings Limited (BIH), (company number: 724668, registered office address :6th Floor, South Bank House, Barrow Street, Dublin
Ireland) is the Data Controller for the personal data collected and processed in connection with the provision of Ceffu Services.
However, depending on your place of legal residence certain Ceffu entities could be involved in your processing activities. Below you
the means and purposes of processing your personal data in relation to the services provided to you.
What country
D04 TR29, the Republic
Registered office
Singapore
Binance Institutional SG Pte. Ltd.
317 Outram Road, #B1-03, Concorde Shopping Centre, Singapore
169075
Lithuania
Bifinity UAB
J.
Ceffu companies may share your Personal Data with each other and
will
use that data
in a
way which
is
of
find a table for your reference, the Ceffu entity you contract with determines
Your operating entity
is
the company providing the service from?
will
4,
consistent with this Privacy Notice.
Balcikonio
str 3.,
Vilnius, the Republic
of
Lithuania
Case 1:23-cv-01599-ABJ-ZMF Document 114-15 Filed 09/15/23 Page 10 of 10
U. S. SECURITIES AND EXCHANGE COMMISSION
Investigation #HO-14376
DECLARATION OF JOSEPH MORGAN
Pursuant to 28 U.S.C. Section 1746, the undersigned states as follows:
1.
My name is Joseph Morgan I am over twenty-one years of age and have personal knowledge of the matters
set forth herein.
2.
I am assigned as an IT Specialist to the U.S. Securities and Exchange Commission’s Division of
Enforcement in Washington, D.C. As part of my duties I have been trained to preserve various forms of
online content. For investigation #HO-14376 I have been tasked to conduct a Website Capture/Video
Capture/Social Media/Telegram/Live Stream/Blog.
3.
In support of investigation number HO-14376, and at the direction of my supervisor, I was tasked to
conduct an internet preservation of the following URL’s.
www.ceffu.com
4.
I completed the above mentioned internet preservation on, August 3, 2023, using the following tools:
Adobe Acrobat Pro / FireShot Pro / Google Chrome Browser / WebPreserver
The above listed tools are commonly used to preserve internet content.
5.
I saved the above-mentioned internet preservation using FTK Imager, which ensures that the internet
preservation will not be altered or modified during storage. Specifically, FTK Imager forensically seals the
internet preservation such that it can be opened only with FTK Imager. The sealed internet preservation
has been labeled HO-14376 and saved to the following location:
K:\Other_Projects\Webcaptures\imagefiles
6.
I also saved a copy of the above mentioned internet preservation along with this declaration to a network
share. The location for this network share is provided below:
\\ad.sec.gov\Projects\ENF2\Other_Projects\Webcaptures
I declare under penalty of perjury that the foregoing is true, correct, and made in good faith.
[Analyst Name]
Executed on this 3rd day of August 2023.
Back to 
