Privacy Policy

1. Introduction

This Privacy Policy describes how Blockdaemon, Inc. and our subsidiaries and affiliates ("Blockdaemon," "we," "us," or "our") process personal information that we collect through our digital or online properties or services that link to this Privacy Policy — including, as applicable, our website, mobile application, social media pages, marketing activities, live events, and other activities described in this Privacy Policy (collectively, the "Service").

Blockdaemon may provide additional or supplemental privacy policies to individuals for specific products or services that we offer where we collect personal information.

This Privacy Policy does not apply to information that we process on behalf of our business customers (such as businesses and other organizations) while providing the Blockdaemon platform or services to them. Our use of information that we process on behalf of our business customers is governed by our agreements with such customers. If you have concerns regarding your personal information that we process on behalf of an enterprise customer, please direct your concerns to that enterprise customer.

NOTICE TO EUROPEAN USERS  Individuals located in the European Economic Area or United Kingdom ("Europe") should also read the Notice to European Users section below.

2. Personal Information We Collect

Information You Provide to Us

Personal information you may provide to us through the Service or otherwise includes:

• Contact data — first and last name, salutation, email address, billing and mailing addresses, professional title and phone number, and other contact information such as social media identifiers/handles.
• Demographic data — city, state, country of residence, postal code, and date of birth.
• Profile data — username and password or PIN code used to establish an online account, other access protocols, information related to wallets, biographical details, avatar photo, links to social networks, interests, preferences, and any other information added to an account profile.
• Communications data — based on our exchanges with you, including when you contact us through the Service, social media, or otherwise.
• Transactional data — information relating to or needed to complete your orders on or through the Service, including order history and transaction history.
• Marketing data — your preferences for receiving our marketing communications and details about your engagement with them.
• Wallet data — information relating to or needed to complete your cryptocurrency transactions on or through the Service (e.g., wallet address, transaction number, sender and recipient, amount, and history), as well as information relating to other on-chain activity associated with your account or wallet.
• User-generated content data — comments, questions, messages, works of authorship, and other content generated, transmitted, or made available on the Service, plus associated metadata (e.g., where and by whom content was created, keywords, and location tags).
• Job application data — professional credentials, educational and professional history, institutional affiliations, and background/résumé-type information (e.g., work experience, education, salary, languages).
• Government-issued identification documentation — national ID number (e.g., SSN, tax ID, passport number), state or local ID number (e.g., driver's license), an image of the ID card, and/or other information needed to comply with financial or anti-money-laundering laws.
• Payment data — needed to complete transactions, including payment card information or bank account number.
• Other data — not specifically listed here, used as described in this Privacy Policy or as otherwise disclosed at the time of collection.

NOTE  When biometric authentication is enabled, the application sends a request to the device's operating system to perform the authentication. Blockdaemon receives only a success or failure notification and does not have access to the actual biometric data or template. Consult the device's own privacy policy for more information.

Third-Party Sources

We may combine personal information we receive from you with personal information we obtain from other sources, such as:

• Public sources — government agencies, public records, social media platforms, and other publicly available sources.
• Private sources — data providers, social media platforms, and data licensors.
• Our affiliate partners — our affiliate network provider and publishers, influencers, and promoters who participate in our affiliate programs.
• Marketing partners — joint marketing partners and event co-sponsors.
• Third-party services — social media services used to log into, or link to, a Service account, which may share username, profile picture, and other associated information based on your account settings on that service.

Automatic Data Collection

We, our service providers, and our business partners may automatically log information about you, your device, and your interaction over time with the Service, our communications, and other online services, such as:

• Device data — operating system type/version, manufacturer/model, browser type/version, screen resolution, RAM and disk size, CPU usage, device type, IP address, unique/advertising identifiers, language settings, mobile carrier, network information, and general location (city/state/geographic area).
• Online activity data — pages/screens viewed, time spent, referring website, navigation paths, activity on a page, access times and duration, and whether emails were opened or links clicked.
• Communication interaction data — interactions with our email, text, or other communications (e.g., whether an email was opened or forwarded), often tracked through pixel tags (clear GIFs) embedded invisibly in emails.

Cookies

Some of our automatic data collection is facilitated by cookies and similar technologies. See our Cookie Policy for more information, which also stores a record of your preferences regarding the use of these technologies in connection with the Service.

3. How We Use Your Personal Information

We may use your personal information for the following purposes, or as otherwise described at the time of collection:

Service Delivery and Operations

• Provide, operate, and improve the Service and our business.
• Personalize the Service, including remembering devices you've logged in from and your preferences as you navigate the Service.
• Establish and maintain your user profile on the Service.
• Enable security features, such as sending security codes via email or SMS, and remembering previously logged-in devices.
• Communicate with you about the Service, including announcements, updates, security alerts, and administrative messages.
• Communicate with you about events or contests in which you participate.
• Understand your needs and interests, and personalize your experience with the Service and our communications.
• Provide support for the Service, and respond to your requests, questions, and feedback.

Research and Development

We may use your personal information for research and development, including to analyze and improve the Service and our business and to develop new products and services. As part of these activities, we may create aggregated, de-identified, or anonymized data by removing information that makes the data personally identifiable, and may use and share that data with third parties for our lawful business purposes.

Marketing

• Direct marketing — we may send you direct marketing communications, personalized based on your needs and interests. You may opt out as described in Your Choices below.
• Interest-based advertising — our third-party advertising partners may use cookies and similar technologies to collect information about your interaction with the Service, our communications, and other online services over time to serve interest-based ads, and we may share user information with these companies to facilitate similar advertising on other platforms.

Recruiting and Job Applications

We may use personal information submitted in a job application to facilitate recruitment activities and process applications, such as evaluating a candidate and monitoring recruitment metrics.

Compliance and Protection

• Comply with applicable laws, lawful requests, and legal process, such as responding to subpoenas, investigations, or government requests.
• Protect our, your, or others' rights, privacy, safety, or property, including by making and defending legal claims.
• Audit internal processes for compliance with legal, contractual, or internal-policy requirements.
• Enforce the terms and conditions that govern the Service.
• Prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and identity theft.

Business Interactions

If you communicate with us as an employee or representative of a service provider, business partner, or other organization we do business with, we may use personal information about you to administer and operate that relationship.

Cookies and Similar Technologies

In addition to the other uses in this section, we may use cookies and similar technologies for the purposes described in our Cookie Policy.

Use for New Purposes

We may use your personal information for reasons not described in this Privacy Policy where permitted by law and where the use is compatible with the purpose for which we collected it.

Retention

We generally retain personal information to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements, establishing or defending legal claims, or fraud prevention. To determine the appropriate retention period, we consider factors such as the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether they can be achieved by other means, and applicable legal requirements. When information is no longer required, we delete it, anonymize it, or isolate it from further processing.

4. How We Share Your Personal Information

We may share your personal information with the following parties, and as otherwise described in this Privacy Policy, other applicable notices, or at the time of collection:

• Affiliates — our corporate parent, subsidiaries, and affiliates.
• Service providers — third parties that provide services on our behalf or help operate the Service or our business (e.g., hosting, technology, customer support, email delivery, marketing, consumer research, and website analytics).
• Payment processors — payment card information is collected and processed directly by our payment processors.
• Advertising partners — third-party advertising companies, for the interest-based advertising purposes described above.
• Third parties designated by you — where you have instructed us or provided consent, such as third-party advertisers collaborating to offer you services.
• Partners — business and marketing partners with whom we co-sponsor events or promotions, jointly offer products and services, or whose products/services may interest you.
• Linked third-party services — if you log into, or link your account to, a social media or other third-party service, that service's use of shared information is governed by its own privacy policy and your account settings.
• Professional advisors — lawyers, auditors, bankers, and insurers, where necessary in the course of the services they render to us.
• Authorities and others — law enforcement, government authorities, and private parties, where we believe in good faith it is necessary for the compliance and protection purposes described above.
• Business transferees — in the context of actual or prospective business transactions (e.g., investment, financing, public stock offerings, or the sale, transfer, or merger of all or part of our business, assets, or shares), including to an acquirer, successor, or assignee as part of a merger, acquisition, or similar transaction, or an insolvency, bankruptcy, or receivership.

5. Your Choices

This section describes the rights and choices available to all users. Users located in Europe can find additional information about their rights in the Notice to European Users section below.

• Opt-out of communications — you may opt out of marketing-related emails via the unsubscribe instructions at the bottom of the email, or by contacting us. You may continue to receive service-related and other non-marketing emails.
• Do Not Track — Blockdaemon does not currently respond to browser "Do Not Track" signals.
• Declining to provide information — where personal information is required or mandatory to provide a service, we may not be able to provide that service without it.

6. Other Sites & Services

The Service may contain links to websites, mobile applications, and other online services operated by third parties, or our content may be integrated into third-party pages or services. These links and integrations are not an endorsement of, or a representation of affiliation with, any third party. We do not control, and are not responsible for, third-party websites, applications, or services — we encourage reviewing their own privacy policies.

7. Security

We employ technical, organizational, and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information.

8. International Data Transfer

We are headquartered in the United States and may use service providers operating in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your home state, province, or country. Users in Europe should also read the Data Processing outside Europe section below.

9. Children

The Service is not intended for use by anyone under 18 years of age. If you are a parent or guardian and believe we have collected personal information from a child in a manner prohibited by law, please contact us. If we learn that we collected a child's personal information through the Service without the required parental or guardian consent, we will comply with applicable legal requirements to delete that information.

10. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you by revising the date at the top of the Policy and posting it on the Service or through other appropriate means. Modifications become effective upon posting the revised version (or as otherwise indicated). Continued use of the Service after the effective date of a modified Privacy Policy constitutes acknowledgment that the modified Policy applies to your interactions with the Service.

11. How to Contact Us

Blockdaemon Inc.

11400 West Olympic Blvd., Suite 200, PMB 215, Los Angeles, CA 90064

support@blockdaemon.com — please include "Privacy Policy" in the subject line.

12. Notice to European Users

General

Where this Notice applies. This Notice to European Users section applies only to individuals in the United Kingdom, Switzerland, and the European Economic Area ("Europe," as defined at the top of this Privacy Policy).

Personal information. References to "personal information" in this Privacy Policy include "personal data" as defined in the GDPR and the FADP — i.e., information about individuals who are directly identified or identifiable.

Controller. Blockdaemon is the controller of your personal information for purposes of European data protection legislation (the EU GDPR, the "UK GDPR" as applicable (together, the "GDPR"), and the Swiss Federal Act on Data Protection (the "FADP")). See How to Contact Us above for our contact details.

Our GDPR Representatives

• Blockdaemon Ltd — 5th Floor, Rear Connaught House, 1 Burlington Road, Dublin, Dublin 4, D04 C5Y6, Ireland. Email: support@blockdaemon.com (subject line "Privacy Policy").
• Blockdaemon UK Limited — 30th Floor, Leadenhall Building, 122 Leadenhall St, EC3V 4AB, London. Email: support@blockdaemon.com (subject line "Privacy Policy").

Our Representative in Switzerland

EDPO Switzerland Sàrl, appointed under the FADP. Contact via EDPO Switzerland's online request form (edpo.com/swiss-data-request) or by writing to Rue de Lausanne 37, 1201 Geneva, Switzerland.

Our Data Protection Officer

Our Data Protection Officer independently oversees and advises on our compliance with the GDPR and the FADP, including the practices described in this Privacy Policy: heyData GmbH, Schützenstraße 5, 10117 Berlin — www.heydata.eu, datenschutz@heydata.eu.

Our Legal Bases for Processing

For each purpose for which we use your personal information, the GDPR requires a valid legal basis. Our legal bases are:

• Contractual Necessity — where we need to perform a contract we are about to enter into or have entered into with you.
• Legitimate Interests — where processing is necessary for our legitimate interests and your interests and fundamental rights do not override those interests. Detail on specific legitimate interests appears in the table below.
• Compliance with Law — where we need to comply with a legal or regulatory obligation.
• Consent — where we have your specific consent to carry out the processing in question.

No Automated Decision-Making and Profiling. We do not engage in automated decision-making and/or profiling that produces legal or similarly significant effects.

Your Rights

European data protection law gives individuals in Europe certain rights regarding their personal information. You may ask us to:

• Access — provide information about our processing of your personal information and give you access to it.
• Correct — update or correct inaccuracies in your personal information.
• Delete — delete your personal information where there is no good reason for us to continue processing it, or where you have exercised your right to object (see below).
• Transfer — receive a machine-readable copy of your personal information, for yourself or a third party of your choice.
• Restrict — restrict processing, for example while we establish the data's accuracy or the reason for processing it.
• Object — object to processing that relies on Legitimate Interests, or to processing for direct marketing purposes.
• Withdraw Consent — withdraw consent at any time where processing is based on consent.

Exercising these rights. Submit requests by email to privacy@blockdaemon.com or to our postal address above. We may request information to confirm your identity and process your request. If we reject a request in whole or in part, we will explain our grounds for doing so, subject to any legal restrictions.

Right to Lodge a Complaint

If you are not satisfied with our response, or with how we process your personal information, you may complain to the data protection regulator in your place of residence:

• European Economic Area — find your local regulator at edpb.europa.eu/about-edpb/board/members_en.
• Switzerland — Federal Data Protection and Information Commissioner, Feldeggweg 1, CH-3003 Bern.
• United Kingdom — The Information Commissioner's Office, Water Lane, Wycliffe House, Wilmslow, Cheshire SK9 5AF.

Data Processing outside Europe

We are a U.S.-based company, and many of our service providers, advisers, partners, and other data recipients are also based in the U.S. This means your personal information will necessarily be accessed and processed in the U.S., and may also be provided to recipients in other countries outside Europe. Where we share personal information with third parties based outside Europe, we try to ensure a similar degree of protection is afforded to it as in Europe.

Personal information subject to the FADP is transferred to the following countries:

• UK and EU Member States — transfer mechanism: adequacy decision.
• U.S., Singapore, and United Arab Emirates — transfer mechanism: EU standard contractual clauses (including the Swiss Annex).

Contact us for further information on the specific mechanism used when transferring your personal information. You may have the right to receive a copy of the appropriate safeguards under which it is transferred.