1. Who we are
This policy is issued by 9Y9 PTY LTD (ABN 19 600 445 118), trading as SCDO Laboratory, Melbourne, Victoria, Australia. AUSTRAC digital currency exchange registration DCE100714503-001. Contact: admin@apeccapital.org. It covers scdoscan.io, scdo.com.au, apeccapital.org and related SCDO websites, the public RPC, the web wallet pages, the thank-you wheel and KYC / withdrawal forms.
2. What we collect
- Server logs: IP address, time, URL, status, referrer, user agent — for security and rate limiting.
- Wallet addresses you enter or use on our sites (public blockchain data).
- Telegram handle when you message our help bot or give it on a form.
- KYC / declaration data when you apply to withdraw a wheel prize or use another KYC-gated service: full legal name (and Chinese name if given), date of birth or 18+ confirmation, country, phone or Telegram, PEP answer, receiving wallet address(es), drawn signature, typed name, consents, and technical data of the submission (IP, user agent, time). For future fiat / OTC flows we may also collect residential address and identity-document images.
We do not collect private keys or recovery phrases. Browsing the explorer, holding SCDO and receiving SCDO need no KYC.
3. Why we collect it
To run the websites and RPCs safely; to identify customers under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the AML/CTF Rules; to screen against sanctions lists; to prevent fraud and duplicate claims; and to pay promotional wheel prizes and bounties.
4. Storage, encryption and retention
KYC records (form data, signed PDF, signature image) are stored encrypted at rest (AES-256-GCM) on our own server, with the master key kept outside the web root and the database. They are not publicly readable. We keep them for 7 years as the AML/CTF Act requires, then destroy or de-identify them. Revoking reuse permission stops reuse for future withdrawals but does not delete the record during the legal retention period.
5. Retrieval and consent
Decrypting a KYC record for a later withdrawal requires your fresh authorisation (wallet signature or one-tap consent via your personal link). Every decrypt is logged (who, when, purpose, consent proof). The only exception is a lawful request from AUSTRAC or law enforcement, which is also logged with the reason.
6. On-chain KYC registry
If you authorise reuse, we may write to a public SCDO Shard0 registry contract only: the SHA-256 of your signed PDF, KYC tier / business type, document number, timestamp, expiry and a revoked flag. No name, phone, Telegram or other personal data is written on-chain.
7. Disclosure
We do not sell personal information. We disclose it only to AUSTRAC or law enforcement when the law requires, and to hosting providers who run our servers (Spain and the United States) under encryption and confidentiality.
8. Overseas users
Our sites are used from many countries. Our KYC records are stored in Spain; websites are also served from the United States. By using the service you acknowledge this transfer.
9. Access, correction and complaints
Email admin@apeccapital.org to ask for access to or correction of personal information we hold about you, or to complain. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC).
10. Changes
We may update this policy when our services change. The date at the top shows the latest version.
1. 我們是誰
本政策由 9Y9 PTY LTD（ABN 19 600 445 118，以 SCDO Laboratory 名義經營，澳大利亞維多利亞州墨爾本）發布。AUSTRAC 數字貨幣兌換登記號 DCE100714503-001。聯絡：admin@apeccapital.org。涵蓋 scdoscan.io、scdo.com.au、apeccapital.org 及相關 SCDO 網站、公共 RPC、網頁錢包、感謝轉盤及 KYC／提現表格。
2. 我們收集甚麼
- 伺服器日誌：IP 地址、時間、網址、狀態、來源頁、瀏覽器標識 — 用於安全及頻率限制。
- 錢包地址（您輸入或使用的，屬公開鏈上資料）。
- Telegram 帳號（您聯絡幫助機器人或在表格上提供時）。
- KYC／聲明資料（申請轉盤獎金提現或其他需 KYC 服務時）：法定全名（及所填中文姓名）、出生日期或年滿 18 歲確認、國家、電話或 Telegram、PEP 回答、收款錢包地址、手寫簽名、輸入姓名、同意記錄，以及提交的技術資料（IP、瀏覽器標識、時間）。日後法幣／OTC 流程或會另收集居住地址及身份證件影像。
我們不收集私鑰或助記詞。瀏覽瀏覽器、持有及接收 SCDO 無需 KYC。
3. 為何收集
為安全營運網站及 RPC；依《2006 年反洗錢和反恐怖融資法》（聯邦）及 AML/CTF 規則識別客戶；進行制裁名單篩查；防止欺詐及重複領取；以及支付推廣轉盤獎金與賞金。
4. 存放、加密及保存期
KYC 記錄（表格資料、已簽署 PDF、簽名圖）以 AES-256-GCM 加密存放於我們自有伺服器，主密鑰置於網站根目錄及資料庫之外，不可公開讀取。依 AML/CTF 法要求保存 7 年，之後銷毀或去識別化。撤銷重用授權會停止日後提現重用，但在法定保存期內不會刪除記錄。
5. 取回及同意
日後提現若需解密 KYC 記錄，須經您重新授權（錢包簽名或個人連結一鍵同意）。每次解密均記入日誌（何人、何時、用途、同意證明）。唯一例外是 AUSTRAC 或執法機關依法提出的合法要求，亦會連同理由記入日誌。
6. 鏈上 KYC 登記
如您授權重用，我們可能在 Shard0 公開登記合約中僅寫入：已簽署 PDF 的 SHA-256、KYC 等級／業務類型、文件編號、時間戳、有效期及撤銷標記。絕不會把姓名、電話、Telegram 或其他個人資料寫上鏈。
7. 披露
我們不出售個人資料。只在法律要求時向 AUSTRAC 或執法機關披露，以及在加密及保密條件下提供給託管服務商（伺服器位於西班牙及美國）。
8. 境外使用者
我們的網站服務多國使用者。KYC 記錄存放於西班牙；網站亦由美國伺服器提供。使用本服務即表示您知悉此等傳輸。
9. 查閱、更正及投訴
請電郵 admin@apeccapital.org 查閱或更正我們持有的您的個人資料，或提出投訴。如不滿意，可聯絡澳大利亞資訊專員辦公室（OAIC）。
10. 政策更新
服務變化時我們可能更新本政策。頁頂日期為最新版本。