SECURITY OF VERIFICATION CODE Policy
1. PURPOSE
This Security of Verification Code Policy (hereinafter referred to as the “Policy”) shall establish the functionality and operation in relevant with the verification code, Short Message Service (hereinafter the “SMS”), One-Time Password (hereinafter the “OTP”), and any relevant password submitted by All of the IUX Group Entities and its subsidiaries or branches (hereinafter referred to as the “Company”). By using the Company’s services, the Client shall be bound by the Client Agreement, the Policy, Privacy Policy, and other applicable documents published by the Company.
2. SCOPE
2.1 The Policy shall apply to all verification code, SMS, OTP, and any relevant password submitted by the Company, unless otherwise expressed by the Company in writing.
2.2 The “Company” shall refer to IUX Markets Limited and its subsidiaries or branches, including but not limited to:
- IUX Markets Limited is incorporated with the Financial Services Authority in Saint Vincent and the Grenadines under registered number 26183 BC 2021. At Euro House, Richmond Hill Road, Kingstown, VC0100, Saint Vincent & the Grenadines.
- IUX Markets (MU) Ltd. is authorized by the Financial Services Commission (FSC) in Mauritius, with the Investment Dealer license number GB22200605, at Silver Bank Tower, Ground Floor, 18 Bank Street, Cybercity, Ebene 72201.
- IUX Markets ZA (PTY) Ltd is authorized by the Financial Sector Conduct Authority (FSCA) in South Africa, with FSP No. 53103, registered at 18 Cavendish Road, Claremont, Cape Town, Western Cape, 7708.
3. SMS OR OTP TERMS OF USE
3.1 Subject to the Company’s Privacy Policy and other applicable documents published by the Company, the Company shall collect, process, and store the Client’s personal information, inter alia, phone number and other information specified by the applicable documents. The Company shall strictly adhere to the principle of data minimization, and shall collect only the information that is adequate, relevant, and necessary for the purposes of providing our functional services and adhering to regulatory requirements.
3.2 The Company may send the verification code, OTP, or other verification message by SMS to the Client’s registered phone number to verify the Client’s account, verifying deposit of funds, and/or carrying out such other verification processes determined by the Company.
3.3 The Company shall limit the submission of verification code, OTP, or other verification message by SMS to the Client’s registered phone number only. The Client must not use, provide, or submit any phone number belonging to another person or entity to the Company.
3.4 The Client may request to change the phone number to receive verification code, OTP, or other verification message by SMS at any time, subject to the Company’s Client Agreement and other applicable documents published by the Company. The Company may request additional verification, documentation, or other information necessary prior to approving the change of phone number.
4. AUTHENTICATOR APPLICATIONS
4.1 Subject to the Company’s Privacy Policy and other applicable documents published by the Company, the Company may require two-factor authentication (hereinafter the “2FA”) for the Client to exercise sensitive action, including but not limited to accessing and verifying accounts, funds withdrawals, changing an MT5 password, unlinking a third-party service, changing the applicable OTP or authentication method, or other actions designated by the Company.
4.2 The 2FA shall use a time-based one-time password (hereinafter the “TOTP”) generated by a third-party authenticator application. The TOTP shall be generated locally on the Client’s device by the third-party authenticator application. In this regard, the Company shall not have access, receive, and/or store the TOTP generated by a third-party authenticator application.
4.3 During the setup of TOTP authentication, the Company may display or provide the Client with a unique secret key, QR code, backup code, recovery code, or other authentication credentials required for the 2FA functionality (hereinafter the “Authentication Credentials”).
4.4 The Authentication Credentials shall be displayed or made available to the Client only during the setup process. The Client shall be solely responsible for maintaining the confidentiality and security of all Authentication Credentials and for securing the device, the authenticator application, and other authentication methods associated with the Client’s account.
4.5 Backup or recovery codes provided by the Company shall be one-time use only and shall become invalid upon successful use, expiry, replacement, or reset.
4.6 Upon successful identity verification, the Client may request to reset, replace, or change the ongoing authenticator application and/or OTP or authentication method. The Company may request additional verification, documentation, or other information necessary prior to processing the requests.
4.7 If the Client loses access to the authenticator application and does not have any valid backup or recovery codes, the Client may request recovery of access through the Company’s account recovery process. In this regard, the Company may request additional verification, documentation, or other information necessary for identity verification.
4.8 Upon successful identity verification, the Company may reset the Client’s existing TOTP configuration and restore OTP authentication through the Client’s registered email address or another authentication method designated by the Company.
4.9 The Client shall not disclose, transfer, share, or otherwise permit any third party to access or use such Authentication Credentials. The Company shall not be responsible for unauthorized access, transactions, or other losses arising from the Client’s failure to secure the device, authenticator application, and/or Authentication Credentials.
5. POLICY REVISION
The Company reserves the right to amend, revise, modify, change, or terminate the Policy at its sole discretion. Any changes or updates of the Policy shall be effective immediately upon posting on the Company’s official communications without prior notice provided that the Company shall inform the Client at the earliest opportunity.
