Privacy Policy Statement

About the Platform

Riverchain, through its operating company Riverchain International Limited (“RIL”) and its affiliated or related companies from time to time (“Riverchain Group Companies”), operates a corporate website and platform that facilitates the provision of supply chain financing opportunities (the “Platform”) and other features and services through the Platform (“Platform Services”) to users of the Platform including clients, investors and financiers (“Users”).

About this Statement

This Statement sets out the ways upon which we collect, process and use your personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) of the Laws of the Hong Kong Special Administrative Region of the People’s Republic of China (“Hong Kong”). The broad categories of personal data we collect from you are:

Account Information: We collect personal data from you when you register for an account on the Platform, and operate and use your account on the Platform, such as your: name, email address, telephone number, job title, entity which you represent when you use the Platform and details of transactions entered into using the Platform, username and password (“Account Information”).

Onboarding and KYC Information: We collect various onboarding documents and know-your-client (“KYC”) documents from you (or from the entity which you represent), which may contain personal data within (“KYC Information”), such as:
- annual returns;
- historical financial statements;
- commercial and financing contracts;
- trade documents (i.e. invoice, payment application or payment certificate);
- list of associated companies;
- list of ongoing trade disputes and litigation;
- bank account details and statements;
- company information, such as constitutional documents, resolutions and other internal information; and
- where required, identification information of business owners or key individual stakeholders, such as their identity card and proof of address.

Assessment-related reference information: In addition to KYC Information, we also collect personal data from third parties, such as public and research databases (where permitted by law), information on corporate websites, your business associates (as may be suggested from your KYC and due diligence information) and additional due diligence materials provided by Users (“Assessment Reference Information”).

Cookies and tracking technologies: See “Use of cookies and other tracking technologies” below.

Other information: We will collect personal data that you voluntarily submit to us when you use our Platform, Platform Services or any our other services or otherwise interact with us by email, social media, surveys, our website, chat or other correspondence, on our website and physical events or in the course of our business activities.

If you do not provide your personal data to us as required, you may not be able to utilise certain functionality of our Platform or access our Platform Services.

Uses of personal data

We will use (or disclose, where applicable) the personal data collected from you for the following purposes:

Account management: We will use your Account Information to manage and maintain your account with us, authenticate your identity, operate our Platform and provide our Platform Services to you.

Onboarding and KYC information: We will use KYC Information to conduct KYC and due diligence checks to ensure that the Users participating in the Platform and using our Platform Services are adequately verified and that we comply with our legal and regulatory obligations including under the Terms of Use.

Assessment-related reference information: Using Assessment Reference Information and historic information we have in relation to prior transactions made through the Platform, we will engage in an assessment of and provide a reference score to certain Users with respect to the quality of the transactions to be undertaken in connection with the Platform or Platform Services.

Assessment data modelling: We will also combine outputs from the assessment and analyse it to look for patterns, trends and characteristics that help better inform the risk profiles of Users. This information will be used to develop and improve our proprietary assessment models so that we can improve the quality and accuracy of our assessments over time.

Preparation and execution of legal and finance documents: We may use data to prepare documentation in relation to the provision of Platform Services to Users.

Other Platform Services: Certain Platform Services such as those listed below may involve the incidental processing of personal data:
- Deal structuring and negotiation: We may in certain instances facilitate and negotiate deal terms on the Platform.
- Matching of Users: As a marketplace, we will help to match Users who may require certain services through our Platform. That means we will use the characteristics and financing preferences provided by a party to assess whether it is suited to another.
- Payment agency: We may act as a payment or collection agent to collect payment and payment information on behalf of a User and/or make payments on behalf of the User, as the case may be.
- Payment collection support: We may send automatic reminders for payments to Users or on behalf of Users (as the case may be) to remind them of their payment obligations.
- Feedback and complaints: We may use personal data to for research, development, and analysis, in relation to your/customer behaviour including carrying out data sorting and analysis to enable us to better understand your characteristics and transaction behaviour to improve the Platform and Platform Services. In addition, we may seek your feedback, including through surveys, in relation to the Platform and Platform Services. We will also use your personal data for the purposes of responding to queries and addressing or investigating any complaints, claims or disputes.
- Deterrence: Deterring, detection, investigation and/or prevention of activities that may violate, or may be suspected to violate, our policies or may be abusive, illegal, and/or criminal.
- Collections: Collection or recovery of any debt owed by you to us or in relation to the Platform Services.

Cookies and tracking technologies: See “Use of cookies and other tracking technologies” below.

Direct marketing: See “Direct marketing” below.

Analytics and improvement: We may use personal data that we collect about you for purposes that include testing our IT systems, data analysis, improving our websites and developing new functionalities and features and new services and products to be used on the Platform. Where appropriate, we will anonymise your personal data for these purposes.

Transaction-related disclosure: In the event of any actual or proposed transfer of business, transfer of shares, restructuring, amalgamation, or purchase of us or our business, we may transfer your personal data to the new entity as part of the transaction.

Compliance with legal or regulatory obligations: Where we are required by applicable law or requested by any competent court, regulatory body or governmental body, we may also disclose your personal data as required. We may also disclose your personal data to third parties under a duty of confidentiality to us and our affiliates such as accountants, legal professionals and other advisers. We may also use your personal data for establishing, exercising and/or defending our legal rights.

Other purposes: Any other purposes ancillary to or related to the above.

Use of cookies and other tracking technologies

When you browse our Platform, cookies may be stored for internal navigation and programming purposes. We may use cookies and other tracking mechanisms described below to track information about your use of our Platform (“Tracking Data”) for analytics purposes and improving our services provided to you on the Platform. We may combine this Tracking Data with other personal data we collect from you, in which case such Tracking Data shall be considered your personal data for the purpose of, and will be used in accordance with, this Statement.

Cookies are alphanumeric identifiers that we transfer to your computers, mobile phones or other devices through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Platform while others are used to enable a faster log-in process, or to allow us to store and track information about your interests and preferences while using our Platform.

We may also engage third parties to track and analyse non-personally identifiable data from the website(s) of the Platform. We use the data collected by such third parties to help us administer and improve the quality of our Platform and to analyse usage of the same. This is unrelated to and separate from your personal data. Such third parties may combine the non-personally identifiable data that we provide about you with other information that they have collected. The service providers who administer these services use technologies such as cookies, web server logs and web beacons to help Riverchain analyse how visitors use the website. The information collected through these means (including IP address) is disclosed to these service providers, who use the information to evaluate use of the Platform. These service providers may use the personal data collected to contextualise and personalise the marketing materials of their own advertising network. You can edit your browser settings to disable cookies but to do so you may not be able to utilise certain functionality of our Platform or access our Platform Services.

If you interact with us on social media platforms, we can interact with you according to the platform rules. However, we have no control over these other third-party websites and/or mobile applications which are independent from us. You are responsible for reading and understanding these privacy policies of third parties.

Direct marketing

From time to time. we will proactively recruit potential Users to sign up to the Platform. That means that we will use your personal data to offer or advertise the availability of the Platform and Platform Services (commonly referred to as “direct marketing”).

Pursuant to your indicated preferences we will use your personal data such as your email address, your company’s address and/or phone number to market the Platform and Platform Services as well as similar financing opportunities (including those offered by us and our affiliates) as those offered on the Platform that may of interest to you to you and your affiliated business from time to time.

Subject to your consent, we may use your personal data to send you direct marketing (including, but not limited to, special offers, news, information and marketing) about us, our Platform or Platform Services, whether by in-app messages and/or notifications and/or push notifications to your mobile device, email, telephone, text message, or other media whether now known or available in the future. Subject to your consent, we may also use your personal data for, or provide your personal data to, our affiliates and/or our marketing partners so that they may send you direct marketing (including, but not limited to, special offers, news, information and marketing) about us and/or our marketing partners in relation to the Platform and Platform Services whether by in-app messages and/or notifications and/or push notifications to your mobile device, post, email, telephone, text message, and/or other media whether now known or available in the future.

At any time, you can object to receiving any or all of our marketing-related communications. You can do so by updating your marketing preferences where such settings are available on the Platform, or by contacting us by email to info@riverchain.com.

Service providers

We may provide your personal data to the people and/or companies providing services (whether within or outside Hong Kong) to us (“Riverchain Service Providers”) to facilitate the provision of our Platform and Platform Services to you. This includes:

Riverchain’s Group Companies, officers, directors, employees, professional advisors, partners and other representatives of Riverchain and Riverchain’s Group Companies;

any agent, contractor or third-party service provider which provides services of any kind to Riverchain in connection with the operation of its business (including Riverchain’s auditors and legal advisors, insurance companies, credit reference agencies);

any party who executes any financing transaction or other security documents for the purpose of receiving products and/or services provided by Riverchain (“Transaction Documents”);

any insurer, valuer and auditor;

any actual or proposed participant or sub-participant in, or assignee, transferee or novatee of Riverchain’s rights in relation to the Transaction Documents;

any person with (or through) whom Riverchain may enter into (or may potentially enter into) any transaction in connection with the purchase or sale of any credit insurance or any other contractual protection or hedging with respect to Riverchain’s rights and obligations;

any intermediary institution and/or agent or sub-agent thereof upon their request for the purpose of completing any transaction under the Transaction Documents;

any local or overseas governmental or regulatory authorities upon their request or for the purpose of ensuring compliance with applicable laws and regulations;

any person if such disclosure is necessary or desirable for Riverchain’s performance of its duties or exercise or enforcement of its rights and powers under or in connection with any agreement or document with the Users such as debt collection agencies; and

any other third party in connection with such purposes as Riverchain may consider necessary or desirable.

Riverchain Service Providers may use cloud service providers to facilitate the provision of the Platform and Platform Services to you. Your personal data may be transferred outside Hong Kong. Riverchain Service Providers are required to use your personal data consistent with the agreements we enter with them, to keep our (and your) information confidential, not to keep our (and your information) for longer than is necessary and have adequate security measures in place to protect against unauthorised access, use and retention.

Third party websites and mobile applications

Our Platform may from time to time contain linkages to other third-party websites and/or mobile applications. These other third-party websites and/or mobile applications are independent from us. We have no control or management over the contents of such other websites, mobile applications or their privacy policies or compliance with law. You should read the respective privacy policies of other websites or mobile applications.

Security

We take appropriate steps to protect the personal data we hold against unauthorised or accidental access, processing, erasure, loss or use (which includes disclosure or transfer).

Retention

As you may expect, different retention periods apply to the various kinds of personal data collected and held by us. We take all reasonably practicable steps to ensure that personal data will not be kept longer than is necessary for the fulfilment of the purposes (or any related purpose) for which the data is or is to be used, unless the retention is otherwise permitted or required by law.

Access and correction

If you have any questions or wish to access or correct your personal data, please contact our Personal Data Privacy Officer by email to info@riverchain.com.

All such requests will be handled promptly in accordance with the requirements of the PDPO. We may charge you a reasonable fee for processing your personal data access request.

Changes to this Statement

We may update this Statement from time to time and so you should review this page periodically. When we change this Statement in a material way, we will update the “last modified” date at the end of this Statement. Changes to this Statement are effective when they are posted on this page.

Last updated: April 2025

Privacy Policy Statement

Riverchain Platform (the “Platform”)

Last updated: February 2026

About the Platform

Riverchain, through its operating company Riverchain International Limited (“RIL”) and its affiliated or related companies from time to time (together, “Riverchain Group Companies”, “Riverchain”, “we”, “us”, “our”), operates a corporate website and the Platform that facilitates supply chain, working capital financing opportunities and related services (the “Platform Services”) for users including clients, investors, financiers and their authorized representatives (the “Users”).

About this Statement

This Privacy Policy Statement (the “Statement”) explains how we collect, process and use personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of the Hong Kong Special Administrative Region (the “PDPO”) and, where applicable, corresponding data privacy requirements in other jurisdictions. We are committed to protecting the privacy, confidentiality and security of the personal information we hold by complying with the PDPO. We are equally committed to ensuring all Riverchain Service Providers (as defined below) uphold these obligations.

If you choose not to provide the personal data we request when it is required for specific functions, certain features of the Platform or the Platform Services may not be available to you.

This Statement forms part of, and should be read together with, the Platform Terms of Use and the applicable any financing arrangement, agreement or relevant document thereof entered into between you (or the entity you represent) and Riverchain or any member of the Riverchain (collectively, the “Financing Documents”).

By using the Platform or the Platform Services, you acknowledge and agree that such use constitutes acceptance of the Platform Terms of Use and that any personal data provided in connection with or arising from any such use of the Platform or the Platform Services and the Financing Documents will be processed in accordance with this Statement.

In the event of any conflict or inconsistency between this Statement and the Financing Documents, the provisions of the relevant Financing Documents shall prevail to the extent of such conflict or inconsistency.

Categories of Personal Data We Collect

1) Account Information

We collect personal data from you when you register for an account on the Platform, and operate and use your account on the Platform, such as name, work email address, phone number, job title, the organization you represent, username, password, multi-factor authentication or one-time password (OTP) verification details, as well as records of transactions and activity logs associated with your account (the “Account Information”).

2) Onboarding and KYC Information

We collect various onboarding documents and know-your-client (“KYC”) documents from you (or from the entity which you represent), which may contain personal data within (“KYC Information”), such as:

annual returns and business registration certificates

constitutional documents

registers of directors, officers and members

corporate resolutions

authorised signatory lists with specimen signatures and corresponding director(s) resolutions

historical financial statements

commercial and financing contracts

trade documents (e.g. invoices, payment applications, payment certificates)

lists of associated companies and organisational structure charts, including beneficial ownership and control information

information and documentation concerning disputes/litigation

bank account details and statements

where required, identification information of directors, officers, shareholders and key individual stakeholders (e.g., identification documents and proof of address)

any regulatory licenses or approvals relevant to business sector or activities

source of funds and source of wealth documentation (e.g., declarations, supporting evidence)

3) AssessmentRelated Reference Information

In addition to KYC Information, we also collect personal data from thirdparty sources, such as public registers and databases (where permitted by law), thirdparty risk and compliance agencies, information on corporate websites, counterparties and business associates (as may be referenced in the KYC Information and corresponding due diligence procedures), and, together with supplementary due diligence materials you or your representatives provide during onboarding or ongoing monitoring (the “Assessment Reference Information”).

4) Platform Usage, Cookies and Tracking Technologies

We also collect tracking technical data to enhance the Platform, such as device and browser information, IP addresses and geographic locations, session identifiers, pages viewed, actions taken, timestamps, preferences and settings, cookies and SDK identifiers. See “Use of cookies and other tracking technologies”.

5) Other Information You Provide

We collect information that you voluntarily provide to us through various channels, including online forms, file uploads, surveys, correspondence, social media physical events, and other communications with our team. This also includes any content or materials you generate and submit through the Platform or through your use of our services.

How We Use Personal Data

We will use (or disclose, where applicable) the Account Information, the KYC Information, the Assessment Reference Information and other personal data collected from you for the following purposes:

Account management and authentication: to register, verify and authenticate identity, operate and secure the Platform, and provide Platform Services.
Onboarding, KYC/AML and due diligence: to conduct KYC due diligence checks, verify entities and individuals, perform risk assessment and sanctions screening, to ensure that the Users using our Platform and the Platform Services are adequately verified and that we comply with our legal and regulatory obligations, as well as under our Terms of Use.
Assessment and scoring: to assess and generate reference scores with respect to the quality of the transactions to be undertaken in connection with the Platform or Platform Services.
Model development and analytics:  to combine outputs from assessments and analyse them for patterns, trends and characteristics to inform the risk profiles of Users and improve our proprietary assessment models and performance of the Platform and corresponding Platform Services with a view to improving the quality and accuracy of our assessments. Where appropriate, we will anonymise your personal data for these purposes.
Documentation: to prepare documentation related to the provision of the Platform Services to Users and handle associated workflows within the integrated systems with the Platform.
Platform Services facilitation: to facilitate the provision of the Platform Services, including but not limited to deal negotiation and structuring of deals, matching Users based on relevant characteristics or preferences, acting as a collection or payment agent and issuing payment or collection reminders.
Support, feedback and complaints: for research, development and analysis to improve the Platform and the Platform Services while also using your personal data to respond to queries, address or investigate any complaints, claims or disputes. We may seek your additional feedback for continuous improvement of the Platform or Platform Services through surveys.
Deterrence and protection: to deter, detect, investigate, and prevent any activities that may, or are suspected to, violate our policies, threaten Platform security, breach legal or regulatory requirements, or constitute, or may constitute, abusive, illegal, or criminal conduct.
Collections: to pursue recovery of sums pursuant to any enforcement of our rights arising from the use of our Platform or Platform Services, including but not limited to taking legal action to protect interests and ensure compliance with agreements and relevant legal or regulatory requirements.
Platform Usage, Cookies and Tracking Technologies: see “Use of cookies and other tracking technologies”.
Direct marketing: see “Direct marketing” below.
Service improvement and R&D: to test systems, conduct data analysis, improve and develop websites, the Platform, Platform Services and products. Where appropriate, we will anonymise your personal data for these purposes.
Corporate transactions: to transfer as a result of or support any actual or proposed business, share or asset transfer or purchase, restructuring, amalgamation.
Legal and regulatory compliance: to disclose, where appropriate, to third parties under a duty of confidentiality to us and/or our affiliates or, where required by law or upon request from any competent court, regulator, or government body competent regulatory, governmental, or law enforcement authorities to meet our legal obligations and comply with applicable laws and regulations, and to establish, exercise or defend our rights.
Other purposes: Any purposes ancillary to or reasonably related to the above.

You have the right to request erasure of your personal data held by us and to object to the sharing or transfer of your Personal Data, subject to applicable legal and regulatory requirements. Please contact us at personaldata@riverchain.com to exercise these rights.

Use of cookies and other tracking technologies

We use cookies and similar technologies (e.g., web beacons, SDKs, pixels, server logs etc.) to track information concerning use of our Platform and Platform Services (the “Tracking Data”), which may be stored, for the purposes of internal navigation, programming and delivering the Platform Services. We may combine the Tracking Data with other information mentioned in this Statement and such data will be used in accordance with this Statement.

Cookies are alphanumeric identifiers we transfer to your device via your browser or app, which correspondingly stores the same. Some cookies permit the Platform to enhance Users’ Platform navigation and experience while some enable core functionality (e.g., sign in and session management etc.), store and track preferences and perform analytics to improve the Platform.

We may also engage third parties to track and analyse non-personally identifiable data from the Platform. We use the data collected by such third parties to help us administer and improve the quality of our Platform and the Platform Services while analysing usage of the same. This is unrelated to and separate from your personal data. Such third parties may combine the non-personally identifiable data that we provide about you with other information that they have collected. The service providers who administer these services use technologies such as cookies, web server logs and web beacons to help us analyse how visitors use the Platform. The information collected through these means, such as IP addresses, is disclosed to these service providers, who use the information to evaluate the use of the Platform. These service providers may use the personal data collected to contextualise and personalise the marketing materials of their own advertising network.

You can edit your browser to disable, block or alert you about cookies; some Platform features may not function without them.

If you interact with us on social media, your use is subject to those platforms’ privacy policies, which we do not control. We have no control over these other third-party websites and/or mobile applications which are independent from us. You are responsible for reading and understanding these privacy policies of third parties.

Direct marketing

Subject to your consent or indication of no objection, we may use your personal data to offer or advertise the availability of the Platform and Platform Services (i.e. direct marketing).

Pursuant to your indicated preferences we will use your personal data such as your email address, your company’s address and/or phone number to market the Platform and Platform Services as well as similar financing opportunities offered on the Platform, including those offered by us and our affiliates, that may be of interest to you to you and your affiliated business from time to time.

Subject to your consent or indication of no objection, we may use your personal data to send you direct marketing (including, but not limited to, special offers, news, information and marketing) about us, our Platform or Platform Services, whether by in-app messages and/or notifications and/or push notifications to your mobile device, email, telephone, text message, or other media whether now known or available in the future.

At any time, you may consent to or opt out of receiving any or all of our marketing-related communications at any time by updating your preferences in the Platform (where available) or by contacting us at personaldata@riverchain.com. We will accede to your request as soon as reasonably practicable.

Service Providers and Data Transfers

We may share the Account Information, the KYC Information, the Assessment Reference Information and other personal data collected from you with the individuals, any of the Riverchain Group Companies and third party service providers, whether within or outside Hong Kong, providing services to us (the “Riverchain Service Providers”) to facilitate the operation of the Platform and our Platform Services. The Riverchain Service Providers include:

Riverchain Group Companies, officers, directors, employees, professional advisors, partners and other representatives of Riverchain Group Companies;

any agent, contractor or third-party service provider which provides services of any kind to Riverchain in connection with the operation of its business, including but not limited to Riverchain’s auditors and legal advisors, insurance companies, credit reference agencies, information technology providers, cloud providers, data storage providers, cybersecurity consultants and service providers, KYC and Anti-money Laundering assessors, credit risk assessors, document generation, collation and execution platforms, financial institutions providing payments and/or collection services, debt collection agencies and partners;

any party who executes any financing transaction or other security documents for the purpose of receiving products and/or services provided by Riverchain (the “Transaction Documents”);

any insurer, valuer, financial institutions providing hedging services and auditor;

any actual or proposed participant or sub-participant in, or assignee, transferee or novatee of Riverchain’s rights in relation to the Transaction Documents;

any person with (or through) whom Riverchain may enter into (or may potentially enter into) any transaction in connection with the purchase or sale of any credit insurance or any other contractual protection or hedging with respect to Riverchain’s rights and obligations;

any intermediary institution and/or agent or sub-agent thereof upon their request for the purpose of completing any transaction under the Transaction Documents;

any local or overseas governmental or regulatory authorities upon their request or for the purpose of ensuring compliance with applicable laws and regulations;

any person if such disclosure is necessary or desirable for Riverchain’s performance of its duties or exercise or enforcement of its rights and powers under or in connection with any agreement or document with the Users such as debt collection agencies; and

any person or other third party who/which you have given instructions, authorisation and consent to us.

The personal data collected from you will not be disclosed by us to any other party without your prior consent. Riverchain Service Providers may use cloud service providers to facilitate the provision of the Platform and Platform Services to you. Such Riverchain Service Providers may be transferred and processed outside of Hong Kong. Riverchain Service Providers are required to use your personal data consistent with the agreements we enter with them, to keep our (and your) information confidential, not to keep our (and your information) for longer than is necessary and have adequate security measures in place to protect against unauthorised access, use and retention.

Thirdparty websites and applications

The Platform may contain links to or integrations with other thirdparty websites or applications that are independent from us. We do not and have no control or management over their content, data retention or data privacy policies and whether those are in compliance with relevant laws and/or regulations. You should review those policies of those thirdparty websites or applications.

Security

We implement reasonable and appropriate measures to protect the personal data we hold against unauthorised or accidental access, processing, erasure, loss or use (including disclosure or transfer).

Retention

We take reasonably practicable steps to ensure personal data is not kept longer than necessary for the purposes (or any related purposes) stated in this Statement (or related purposes), unless a longer period is required or permitted by law. If you wish to request deletion of your Personal Data or your account, please contact us at personaldata@riverchain.com. Upon verification of your identity and unless retention is required by law or regulation, your Personal Data and/or account will be permanently removed from our system as soon as reasonably practicable.

Access and Correction

You may request access to or correction of your personal data held by us by contacting our Personal Data Privacy Officer at personaldata@riverchain.com. We will handle requests promptly in accordance with the PDPO. We may charge a reasonable fee for processing a data access request as permitted by law.

Changes to this Statement

We may update this Statement from time to time. Where appropriate, Users will be notified of material changes to this Statement via the Platform or email where appropriate. Your continued use of the Platform and the Platform Services after the changes take effect signifies your acknowledgment to any update of this Statement. Changes to this Statement are effective when they are posted on this page.

Contact Us

Personal Data Privacy Officer
Riverchain International Limited
Email: personaldata@riverchain.com
Registered office: 4/F Hecny Centre, 111 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong SAR