Legal & Privacy

Last updated: [TO BE PROVIDED: date of publication]

Privacy notice

This notice explains how personal data is handled when you visit this website, send us a message through the contact form, or write to us by email.

1. Who is responsible

The controller is [TO BE PROVIDED: legal name and address of the SBG company acting as data controller for this website].

Privacy contact: [TO BE PROVIDED: email address for privacy requests, and the name and contact details of the data protection officer if one has been appointed]

[TO BE PROVIDED: name and address of the EU representative under Article 27 GDPR — required only if the controller has no establishment in the EU/EEA; delete this line otherwise]

2. What this website does not do

This website sets no cookies and does not store or read information on your device. It runs no analytics, shows no advertising, loads no fonts, scripts, or other content from third-party servers, and does not build visitor profiles. There is therefore no cookie banner. We do not sell personal data, and we do not share it for advertising.

3. When you visit the website

The website is hosted by Cloudflare, Inc. To deliver the pages to your browser and to protect the website against attacks, Cloudflare processes technical data on our behalf: your IP address, the date and time of the request, the page requested, the referring page, and your browser and operating system type. We do not keep visitor logs of our own and do not use this data to identify you. Cloudflare retains it only for a short period under its own retention schedule. Legal basis under the GDPR: our legitimate interest in operating a secure and stable website (Article 6(1)(f)).

4. When you use the contact form

What we collect. What you enter: first name, last name, business email address, company name, country, your organization's primary place of business, the topics you are interested in, and your message. We also record the date and time of submission, whether you checked the box for updates, and the country your request came from, which our hosting provider derives from your IP address. Your IP address itself is not included in the message we receive.

What we use it for. To answer your inquiry, to assess whether and where we can work with your organization, and to follow up on that conversation. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business inquiries (Article 6(1)(f) GDPR).

Business email addresses only. SBG works exclusively with institutions. Addresses from free or temporary email providers are therefore declined when you enter them, and you are told why. When you move to the second step of the form, and again when you submit it, your email address is checked on our server; to confirm that the address can receive email, the domain part of the address (the part after the @ sign) is looked up through public DNS services operated by Cloudflare and, as a fallback, Google. No other automated decision is taken about you.

Protection against misuse. To tell people from automated submissions and to limit the number of messages from one source, the form uses a signed time stamp that exists only in the open page, and our server stores a salted hash of your IP address for one hour. To recognize a message that is sent twice, it also keeps a technical fingerprint of the submission for up to 24 hours. None of this is stored on your device. Legal basis: our legitimate interest in protecting the form against abuse (Article 6(1)(f) GDPR).

How your message reaches us. The form is processed on Cloudflare's servers and sent to our mailbox by the email delivery service Resend (Resend, Inc.). Resend stores the message, including its content, on servers in the United States and keeps it in its log for 30 days. If the message cannot be delivered right away, it is held in encrypted storage at Cloudflare until it has been delivered, and for no longer than 30 days; you are told on screen when this happens. Technical logs of the form contain a reference number, an error code, and the domain of your email address — not your name, your full address, or your message.

The fields marked as required are needed to handle your inquiry. Please do not put confidential information or personal data about other people in the message field.

5. Updates by email

If you check the box for updates, we will use your email address to send you occasional information about SBG's products and company news. The legal basis is your consent (Article 6(1)(a) GDPR). Before we send anything, we ask you to confirm your address. You can withdraw your consent at any time, with effect for the future, through the unsubscribe link in each message or by writing to the privacy contact above. Checking the box is optional and has no effect on how we handle your inquiry.

6. When you write to us by email

If you write to an SBG email address, we process your address, your message, and any attachments in order to answer you. Legal basis: our legitimate interest in handling correspondence (Article 6(1)(f) GDPR) or, where your message concerns a contract, Article 6(1)(b) GDPR.

Job applications. If you send an application, we use what you send only to assess it. We delete it six months after the process ends, unless you are hired or you ask us to keep it longer. Please send applications by email, not through the contact form.

7. Who receives your data

Your message is delivered to SBG by email and read by the SBG staff responsible for partner inquiries. We use service providers that process data on our instructions and under contract:

  • Cloudflare, Inc. — hosting of this website, processing of the contact form, and temporary storage of undelivered messages;
  • Resend, Inc. — delivery of form messages to our mailbox;
  • Microsoft — the Microsoft 365 service that operates our email, which we obtain through GoDaddy.

Where it is needed to answer your inquiry, we may pass it to another company in the SBG group. We do not pass your data to anyone else unless the law requires it.

8. Transfers to other countries

SBG Inc. is a company in the United States, and our service providers operate internationally. Your data may therefore be processed outside the country you are in, including in the United States. Where personal data from the European Economic Area, the United Kingdom, or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's standard contractual clauses or an equivalent recognized safeguard; transfers to U.S. recipients certified under the EU–U.S. Data Privacy Framework rely on that framework. You can ask the privacy contact for a copy of the safeguards.

9. How long we keep it

  • Inquiries that do not lead to a business relationship: deleted 12 months after our last correspondence with you.
  • Inquiries that lead to a business relationship: kept with our business records for as long as the law requires.
  • The delivery log at Resend: 30 days.
  • Undelivered messages held at Cloudflare: until delivered, at most 30 days.
  • The salted hash of your IP address: one hour.
  • Job applications: six months after the process ends.
  • Records of a marketing consent: for as long as the consent is in use and for three years after it is withdrawn, so that we can show it was given.

10. Your rights

You may ask us for access to your personal data, for its correction or deletion, for restriction of its processing, and for a copy in a portable format. You may object at any time to processing based on our legitimate interests, and to any use of your data for direct marketing. You may withdraw a consent at any time. To exercise any of these rights, write to the privacy contact above; we will answer within one month.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to complain to the data protection authority in the country where you live or work.

If you are a resident of a U.S. state with a privacy law that gives you comparable rights, you may exercise them in the same way. We do not sell personal information and do not share it for cross-context behavioral advertising.

11. Security

The website is delivered over an encrypted connection. Email is not a secure channel for confidential information; please do not send any through the contact form.

12. Links to other websites

This website links to alphalox.com. Once you follow that link, the privacy policy of the operator of that platform applies, not this notice.

13. Changes

We will update this notice when the website or the way we handle data changes. The date at the top of this page shows the current version.

Disclaimer

Information only. This website describes the technology and the plans of SBG Inc. and its group companies. It is not an offer, a solicitation, or a recommendation to buy or sell any security, financial instrument, crypto-asset, e-money token, or service, in any jurisdiction. It is not investment, legal, tax, or regulatory advice.

Institutional audience. The website is addressed to banks, asset managers, broker-dealers, investment advisers, large enterprises, and other professional counterparties. It is not addressed to retail clients or consumers and is not intended for distribution in any jurisdiction where that would be unlawful.

Availability by jurisdiction. The capabilities described are those of a technology platform. Whether a given service can be provided to a given client depends on the authorizations held by the entity that provides it, on the client's own regulatory status, and on the law of the jurisdictions involved. Not every capability is available in every jurisdiction. A partner that uses SBG's infrastructure remains responsible for its own licenses and regulatory obligations.

Regulatory status. SBG Inc. is not a bank. The U.S. charters, registrations, and licenses described on this website have not been granted; an application or a plan to apply is not an approval, and no approval can be assured. For each market, the status shown on this website — "Live," "In application," "Live / in progress," or "Staged" — is the status on the date shown at the top of this page. No regulator has reviewed or approved this website.

Forward-looking statements. Statements about plans, applications, timelines, future products, markets, and capabilities are forward-looking. They reflect current intentions and assumptions and are subject to regulatory decisions, market conditions, and other factors outside SBG's control. Actual outcomes may differ, and SBG does not undertake to update these statements.

Technology descriptions. Descriptions of the platform's architecture, security, and performance describe design objectives unless a statement is expressly presented as a measured result. They are not warranties or service-level commitments; those are set out only in a written agreement with SBG.

Digital assets. Digital assets involve risk, including the risk of total loss, and their regulatory treatment differs between jurisdictions and may change.

Third parties. Names of third parties, standards, laws, and authorities appear for description only and do not imply partnership, endorsement, or approval. SBG is not responsible for the content of external websites.

No reliance. SBG takes care that the information on this website is accurate on the date shown, but gives no warranty as to its completeness or accuracy and accepts no liability for decisions taken in reliance on it, to the extent the law allows.

Third-party platform (Alphalox)

The "Sign in" and "Create an Alphalox account" links on this website lead to alphalox.com. Alphalox is a separate trading platform operated by [TO BE PROVIDED: full legal name, registered office, and register number of the company that operates alphalox.com, and its relationship to SBG — e.g. "a company of the SBG group" or "an independent company"].

Trading, account, and custody services on Alphalox are provided by the operator of that platform, not by SBG Inc. through this website. Anyone who registers or signs in there enters into a relationship with the operator of Alphalox and must accept Alphalox's own terms and conditions, privacy policy, and risk disclosures; those documents, and the regulatory status stated in them, apply to the services provided there.

Alphalox decides who may open an account and in which countries its services are available. This website does not open accounts, does not accept orders, and does not hold client assets or funds. Data you enter on alphalox.com is not collected by this website.

[TO BE PROVIDED: the authorization under which the operator of Alphalox provides its services — competent authority, type of authorization, and reference number]