PayOwl ("we," "us," or "our") is committed to protecting the privacy and security of Clients (“you”, “your”) personal information. This Privacy Policy describes how we collect, use, maintain, and disclose information collected from users (each, a "User") of the PayOwl platform ("Platform") and any related services provided by us. By using our Platform, you agree to the collection and use of information in accordance with this policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalised have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Controller refers to any holding company, subsidiary, or entity belonging to the PayOwl group of companies, which may act as a personal data controller for the purposes outlined herein.

• PayOwl Platform means any PayOwl website, mobile application(s), and other official communication channels, including the content and services offered on or through these channels, as well as any updates, upgrades, and versions thereof.

• Personal Data refers to any information relating to an identified or identifiable natural person ("Data Subject"). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier or to one or more factors specific to that natural person.

• Privacy Laws means any applicable legislation related to the protection of personal data.

• Processing refers to any operation or set of operations performed on Personal Data or sets of Personal Data, whether by automated means or not. Such operations may include collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction of Personal Data.

Data Controller

The "controller" of data processing as described in this privacy policy (i.e. the responsible person) is:

PayOwl Exchange UAB,
Lithuania, A. Goštauto g. 8-328,
postal code LT-01108, Vilnius
info@payowl.com

Services are provided in cooperation with Our third-party provider(s). Your use of the Services is hence additionally subject to the terms of our third-party provider(s) which you must accept before using the Services.

Virtual Asset services are provided, and Virtual IBAN issuing and transacting is made available by Striga Technology OÜ (registry code: 16298772), address: Sepapaja 6, Tallinn, Estonia, in accordance with its terms and conditions.

The Payment Card is issued, and related payment services are provided by Wallester AS (registry code: 11812881), address F.R. Kreutzwaldi 4, 10120 Tallinn, Estonia, in accordance with its terms and conditions.

Collecting and Using Your Personal Data

While using our service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• Contact information (such as name, email address, phone number, physical address)

• Bank account information in order to pay for products and/or services within the service.

• Transaction data (such as purchase history, transaction amounts)

• Usage Data (such as IP address)

Usage Data

Usage Data is collected automatically when using the service.

Usage Data may include information such as your device's internet protocol address (e.g. IP address), browser type, browser version, the pages of our service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

When you access the service by or through a mobile device, we may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile internet browser you use, unique device identifiers and other diagnostic data.

We may also collect information that your browser sends whenever you visit our service or when you access the service by or through a mobile device.

Tracking Technologies and Cookies

We use cookies and similar tracking technologies to track the activity on our service and store certain information. For more information, please see our Cookie Policy.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our service, including to monitor the usage of our service.

• Managing your account: to manage your registration as a user of the service. The personal data you provide can give you access to different functionalities of the service that are available to you as a registered user.

• Performance of a Contract: the development, compliance and undertaking of the purchase contract for the products, items or services you have purchased or of any other contract with us through the service.

• Contact & Communication: To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.

• Marketing & Advertisement: To provide you with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information.

• Managing Requests: To attend and manage your requests to us.

• Corporate Transferring: We may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganisation, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by us about our service users is among the assets transferred.

• Additional Purposes: We may use your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our service, products, marketing and client experience.

We may share your personal information in the following situations:

• Service Providers: We may share your personal information with service providers to monitor and analyse the use of our service, for payment processing, and to contact you.

• Corporate Transferring: We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

• Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honour this Privacy Policy. Affiliates include parent companies and any other subsidiaries, joint venture partners or other companies that we control or that are under common control with us.

• Business Partners: We may share your information with our business partners to offer you certain products, services or promotions.

• Clients: When you share personal information or otherwise interact in the public areas with other users, such information may be viewed by all users and may be publicly distributed outside.

• With the Clients Consent: We may disclose your personal information for any other purpose with your consent.

Retention of Your Personal Data

The Company will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Specific data retention periods for Personal Data and Usage Data may vary depending on the nature of the data and legal requirements. However, as a general guideline:

• Personal Data will be retained for a period of no longer than 5 years after the termination of your account or the end of our business relationship.

• Usage Data will be retained for a period of no longer than 12 months after collection, unless a longer retention period is required by law or for security purposes.

After the expiry of the applicable retention periods, your Personal Data will be securely deleted or anonymised in accordance with our data retention policies, unless we are required by law to retain such data for a longer period.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to and maintained on computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organisation or a country unless there are adequate controls in place including the security of your data and other personal information.

All transfers of personal data belonging to citizens of the European Union (EU) outside the EU or European Economic Area (EEA) shall adhere to the 2021 European Commission Standard Contractual Clauses, unless the European Commission has issued an Art. 45 GDPR adequacy decision for the recipient country. For further details regarding transfers within the EU/EEA, please consult the European Commission’s website – Rules on International Data Transfers.

Your Rights

Your access to data subject rights may vary based on the jurisdiction you access the PayOwl platform from, your residency, or citizenship. Upon receiving your requests through the provided contact details, PayOwl will respond promptly and within the applicable statutory deadlines. As a general rule, this timeframe is set at thirty (30) days, extendable by two additional months in accordance with Article 12 of the GDPR, unless otherwise specified by other relevant Privacy Laws.

• Access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed. If such processing is taking place, you have the right to access information about the processing, including the purposes of the processing, the categories of personal data being processed, the recipients of the personal data, and its retention period.

• Rectification: You have the right to correct any inaccurate personal data and to complete any incomplete personal data we may hold about you.

• Erasure: You have the right to request the deletion or erasure of your personal data ("the right to be forgotten"). While we will make reasonable efforts to inform any other controllers also processing your data of your request for deletion, please note that we may not always be able to comply with such requests for specific legal reasons, which will be outlined in this Privacy Policy.

• Restriction: Under certain circumstances, you have the right to request the restriction of the processing of your personal data.

• Portability: If you have provided us with your personal information either by consenting to its processing or for the purpose of entering into a contract with us, you have the right to receive that information in a portable format. This means you can request to receive your data in a format that allows for easy transfer to another data controller. Additionally, where technically feasible, you may request us to directly transmit your personal information to a third party of your choice. Please note that while we assist in facilitating the transfer of your data to a third party at your request, we want to make it clear that we are not responsible for how that third party utilises your account information. Any use of your information by such third parties will be governed by the agreement between you and them, as well as any privacy statement they provide to you.

• Objection: You have the right to object to the processing of your personal data, including profiling, for direct marketing, statistical, scientific, or historical research purposes. Additionally, you have the right not to be subject to automated decision-making, including profiling, that has legal or other significant effects on you.

• Withdrawal: When we depend on your consent to process your personal information, you have the right to withdraw your consent at any time. We will always provide clear information whenever we require your permission for specific processing activities.

You may exercise your rights of access, rectification, erasure and restriction by contacting us. Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we will try our best to respond to you as soon as possible.

You have the right to complain to a data protection authority about our collection and use of your Personal Data. For more information, if you are in the European Economic Area (EEA), please contact your local data protection authority in the EEA.

Disclosure of Your Personal Data

Business Transactions: If the Company is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement: Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements: The Company may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation

• Protect and defend the rights or property of the Company

• Prevent or investigate possible wrongdoing in connection with the service

• Protect the personal safety of users of the service or the public

• Protect against legal liability

Security of Your Personal Data: The security of your Personal Data is important to us, however no method of transmission over the internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Detailed Information on the Processing of Your Personal Data

The Service Providers we use may have access to your Personal Data. These third-party vendors collect, store, use, process and transfer information about your activity on our service in accordance with their Privacy Policies.

Analytics

We may use third-party service providers to monitor and analyse the use of our service.

• Google Analytics – Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualise and personalise the ads of its own advertising network. You can opt-out of having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga js, analytics.js and dc.js) from sharing information with Google Analytics about visits activity. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy

Email Marketing

We may use your Personal Data to contact you with newsletters, marketing or promotional materials and other information that may be of interest to you. You may opt-out of receiving any, or all, of these communications from us by following the unsubscribe link or instructions provided in any email we send or by contacting us.

• PostGrid – Their Privacy Policy can be viewed at https://www.postgrid.com/legal/

Payments

We may provide paid products and/or services within the service. In that case, we may use third-party services for payment processing (e.g. payment processors).

We will not store or collect your payment card details. That information is provided directly to our third- party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

• Apple Store In-App Payments – Their Privacy Policy can be viewed at https://www.apple.com/legal/privacy/en-ww/

• Google Play In-App Payments – Their Privacy Policy can be viewed at https://www.google.com/policies /privacy/

When you use our service to pay for a product and/or service via bank transfer, we may ask you to provide information to facilitate this transaction and to verify your identity.

GDPR Privacy

Legal Basis for Processing Personal Data under GDPR

We may process Personal Data under the following conditions:

• Consent: You have given your consent for processing Personal Data for one or more specific purposes.

• Performance of a Contract: Provision of Personal Data is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof.

• Legal Obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.

• Vital Interests: Processing Personal Data is necessary in order to protect your vital interests or of another natural person.

• Public Interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Company.

• Legitimate Interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by the Company.

In any case, the Company will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Children's Privacy

Our Service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under the age of 18, we take steps to remove that information from our servers.

Links to Other Websites

Our service may contain links to other websites that are not operated by us. If you click on a third- party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to This Privacy Policy

We may update or change our Privacy Policy from time to time. Any changes will be posted on this page with an updated date.

We will let you know via email and/or a prominent notice on our service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about our Privacy Policy or data processing practices, you can contact us by email: info@payowl.com