PRIVACY POLICY

Dated: 10 May 2025

PURPOSE OF PRIVACY POLICY

This Privacy Policy (hereinafter referred to as the “Policy”) describes how Pallapay LTD. processes User’s Personal data via https://www.pallapay.com/ (hereinafter referred to as the “Website”)

This Privacy Policy explains what kind of personal data we use, how exactly we use it, for what reasons do we need your personal data and what rights do you have concerning your personal data. Personal information is any of your data that can be used to identify you directly or indirectly, or to contact you. Our Privacy Policy covers all personal information that you submit to us or that we obtain from our partners and does not apply to anonymised data, as it cannot be used to identify you.

DISCLAIMER

WHO PROCESSES PERSONAL DATA?

Pallapay LTD. is a legal entity, incorporated under the laws of Canada, registration number: M23088601, 18 Strathearn Ave, Unit 29A, Brampton, ON, CANADA, L6T4X7 (hereinafter referred to as the “Pallapay” or “We”, “Us”). For any question please contact us via e-mail: [email protected].

WHEN IS PERSONAL DATA PROCESSED?

Personal data may be processed when Users use the Website and/or any of our API or third party services, listed on the Website, and/or interact with our payment processing services and/or marketing emails (collectively referred to as the "Services").

WHAT GUARANTEES WE PROVIDE?

Throughout this Privacy Policy, we use the term "personal information" to describe information that can be associated with a specific person and can be used to identify that person. We do not consider personal information to include information that has been made anonymous so that it does not identify a specific user.

We offer the appropriate security level to Personal data processing. Pallapay takes all the reasonable measures to protect Users Personal data from unauthorized access by third parties, as well as against loss, misuse, alteration, or destruction of Personal data.

We do not and will not process any special categories of Personal data such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs etc.

Automated decision making process (ADM) may be used as part of our Services in order to fasten the process. For example, ADM may check the accuracy of provided information. Please, note that ADM does not affect you in a legal sense, and you may always contest any decision that is based on ADM results by contacting us.

We guarantee that we do not sell Users' Data for a monetary reward.

WHAT DATA DO WE PROCESSED?

We collect the following types of personal information in order to provide you with the use of Pallapay Services, and to help us personalize and improve your experience.

1. Information needed to sign up - name, e-mail;
2. Information needed to carry out the transaction - wallet address to carry the transaction, full bank account numbers and/or credit card numbers that you link to your Pallapay account or give us when you use Pallapay Services, address, age;
3. Information needed for identification - passport, phone number, photo, additional requested documents;
4. Information needed to receive messages from us (if you directly agree) - name, e-mail or phone number;
5. Technical data: IP address, language, country, browser type, and version, browser plug-in types, location information, operating system and version;
6. Usage data: URL clickstreams, page response times, download errors, time spent on web pages, actions on pages;
7. Cookies.

Information we collect automatically: When you use Pallapay Services, we collect information sent to us by your computer, mobile phone or other access device. The information sent to us includes, but is not limited to, the following: data about the pages you access, computer IP address, device ID or unique identifier, device type, geo-location information, computer and connection information, mobile network information, statistics on page views, traffic to and from the sites, referral URL, ad data, and standard web log data and other information. We also collect anonymous information through our use of cookies and web beacons .

Information you provide to us: We may collect and store any information you provide us when you use Pallapay Services, including when you add information on a web form, add or update your account

information, participate in community discussions, chats, or dispute resolutions, or when you otherwise correspond with us regarding Pallapay Services.

When you use Pallapay Services, we also collect information about your transactions and your activities. In addition, if you open a Pallapay account or use Pallapay Services, we may collect the following types of information:

We may also collect information from or about you from other sources, such as through your contact with us, including our customer support team, your results when you respond to a survey, your interactions with members of the Pallapay corporate family or other companies (subject to their privacy policies and applicable law), and from other accounts we have reason to believe you control (whether in part or in whole). Additionally, for quality and training purposes or for its own protection, Pallapay may monitor or record its telephone conversations with you or anyone acting on your behalf. By communicating with Pallapay, you acknowledge that your communication may be overheard, monitored, or recorded without further notice or warning.

Information from other sources: We may also obtain information about you from third parties such as credit bureaus and identity verification services.

You may choose to provide us with access to certain personal information stored by third parties such as social media sites (e.g., Facebook and Twitter). The information we may receive varies by site and is controlled by that site. By associating an account managed by a third party with your Pallapay account and authorizing Pallapay to have access to this information, you agree that Pallapay may collect, store and use this information in accordance with this Privacy Policy.

Authentication and Fraud Detection: In order to help protect you from fraud and misuse of your personal information, we may collect information about you and your interactions with Pallapay Services. We may also evaluate your computer, mobile phone or other access device to identify any malicious software or activity.

Using Your Mobile Device: We may offer you the ability to connect with Pallapay Services using a mobile device, either through a mobile application or via a mobile optimized website. The provisions of this Privacy Policy apply to all such mobile access and use of mobile devices.

When you download or use our mobile applications, or access one of our mobile optimized sites, we may receive information about your location and your mobile device, including a unique identifier for your device. We may use this information to provide you with location-based services, such as advertising, search results, and other personalized content. Most mobile devices allow you to control or disable location services in the device's setting's menu. If you have questions about how to disable your device's location services, we recommend you contact your mobile service carrier or the manufacture of your particular device.

WHY DO WE NEED TO COLLECT AND PROCESS YOUR PERSONAL DATA?

Our primary purpose in collecting personal information is to provide you with a secure, smooth, efficient, and customized experience. We may use your personal information to:

1. provide Pallapay Services and customer support;
2. process transactions and send notices about your transactions;
3. verify your identity, including during account creation and password reset processes;
4. resolve disputes, collect fees, and troubleshoot problems;
5. manage risk, or to detect, prevent, and/or remediate fraud or other potentially prohibited or illegal activities;
6. detect, prevent or remediate violations of policies or applicable user agreements;
7. improve the Pallapay Services by customizing your user experience;
8. measure the performance of the Pallapay Services and improve their content and layout;
9. manage and protect our information technology infrastructure;
10. provide targeted marketing and advertising, provide service update notices, and deliver promotional offers based on your communication preferences;
11. contact you at any telephone number, by placing a voice call or through text (SMS) or email messaging, as authorized by our User Agreement;
12. perform creditworthiness and solvency checks, and compare information for accuracy and verify it with third parties.
13. process your Personal data for statistical and analytical purposes, user support, improvement of the work of the Website, analysis of the interaction of Users with the Website when you visit any page of our Website, regardless of where you visit or use them from;
14. process your Personal data for User’s authorization on the Website when you use our Website and create an account, communicate with us or leave a query, subscribe to our newsletters/updates;
15. process your Personal data when we perform the transactions and perform our Services;
16. process your Personal data for KYC procedure when you conclude Service agreement with Us, receive, pay and/or use any of our Services.

We may contact you via electronic means or postal mail to notify you regarding your account, to troubleshoot problems with your account, to resolve a dispute, to collect fees or monies owed, to poll your opinions through surveys or questionnaires, or as otherwise necessary to service your account. Additionally, we may contact you to offer coupons, discounts and promotions, and inform you about Pallapay Services and the services of our corporate family. Finally, we may contact you as necessary to enforce our policies, applicable law, or any agreement we may have with you. When contacting you via phone, to reach you as efficiently as possible we may use, and you consent to receive, autodialed or prerecorded calls and text messages. Where applicable and permitted by law, you may decline to receive certain communications.

WHAT LEGAL GROUNDS DO WE HAVE IN ORDER TO COLLECT AND PROCESS YOUR PERSONAL DATA?

We rely on the following legal grounds:

Your explicit consent with the Policy: We obtain Your consent to processing of personal data in accordance with the Policy through consent forms within the Services.

Our contractual obligations with Users: We need to collect data in order for Us to fulfill Our obligations under the contract concluded between You and Us.

Our legitimate interest: We need to provide the best and comfortable Services to You and it includes the following: market research, exercise and protection of Our rights, marketing and promotion of Our Services; ensuring security and fraud prevention.

MARKETING

We do not sell or rent your personal information to third parties for their marketing purposes without your explicit consent. We may combine your information with information we collect from other companies and use it to improve and personalize Pallapay Services, content, and advertising. If you do not wish to receive marketing communications from us or participate in our ad-customization programs, simply indicate your preference by logging into your account and going to the Notifications section and updating your preferences, or by following the directions that may be provided within the communication or advertisement.

We respect your communication preferences. If you no longer wish to receive notifications via our application, you can adjust your preferences by visiting the settings page of the application.

COOKIES

Cookies are used when users are logged in, so that the service provider can remember and identify you as users. This prevents you from having to log in every single time you visit a new page. These cookies are typically removed or cleared when you log out to ensure that you can only access restricted features and areas when logged in.

When you access our website or use Pallapay Services, we (including companies we work with) may place small data files on your computer or other device. These data files may be cookies, pixel tags, "Flash cookies," or other local storage provided by your browser or associated applications (collectively "Cookies"). We use these technologies to recognize you as a customer; customize Pallapay Services, content, and advertising; measure promotional effectiveness; help ensure that your account security is not compromised; mitigate risk and prevent fraud; and to promote trust and safety across our sites and Pallapay Services.

Some of the cookies used are persistent, which means that they remain stored on your device for one year.

In some cases, service providers may provide you with custom content based on what you tell them about yourself, either directly or indirectly if you link a social media account. These types of cookies simply allow these service providers to provide you with content that they feel may be of interest to you.

Pallapay uses the following types of cookies:

1. Necessary cookies: help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies. These cookies may detect if the visitor has accepted the marketing category in the cookie banner. This cookie is necessary for GDPR-compliance of the website.
2. Statistics cookies: help website owners to understand how visitors interact with websites by collecting and reporting information anonymously. These cookies may register data on visitors' website-behaviour, collect statistics on the user’s interaction with the real-time price- and stock bar on the website.
3. Marketing: are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third-party advertisers.

In some special cases service providers also use cookies provided by trusted third parties. Third-party analytics are used to track and measure usage of website so that service providers can continue to produce engaging content. These cookies may track things such as how long users spend on the site or pages they visit, which helps them to understand how they can improve the site for you as users.

Regularly, service providers may test new features and make subtle changes to the way the site is delivered, during this period, these cookies may be used to ensure that users receive a consistent experience on the site.

You are free to decline our Cookies if your browser or browser add-on permits, unless our Cookies are required to prevent fraud or ensure the security of websites we control. However, declining our Cookies may interfere with your use of our website and Pallapay Services.

PROCESSING OF MERCHANT’S CUSTOMERS’ DATA

The User (as a Merchant) is obliged to determine the personal data legislation for each its customer and comply with its requirements for each such customer separately. In the cases and in the form stipulated by the personal data legislation, the User (as a Merchant) shall obtain the voluntary consent of its customers or has any other legal basis (legal ground) to collect, store and process customers’ personal data (including by Pallapay) for the purposes, including but not limited to, of using the Services. The User (as a Merchant) acts as a representative of Pallapay in relations with the User’s customers on the use of personal data, and also bears full responsibility to its customers for their personal data. The User (as a Merchant) is obliged to inform and in a cases stipulated by the personal data legislation obtain the consent of the User’s customers for the transfer of their personal data to Pallapay and bring to the User’s customers all required information in accordance with the personal data legislation, about Pallapay as the person to whom the personal data of the User’s customers are transmitted. The User (as a Merchant) undertakes to take and ensures that it has taken all the necessary and sufficient organizational and technical measures to protect the User’s customers’ personal data. In the event that the User violates any personal data legislation and causes losses to Pallapay as a result of such a violation, the User shall indemnify all losses to Pallapay.

THIRD PARTY SERVICE PROVIDERS

Sometimes we may need to share your data with a third party. We may share your data with our contractors provided these third parties assume confidentiality obligations regarding your personal data. Please, be informed that we may disclose your personal data to the following third parties:

• our group entities or subsidiaries;
• government or law enforcement officials, enforcement, exchange body, central or local government department and other statutory or public bodies or court;
• business partners, suppliers, contractors, sponsors, analytics, search engine providers.

We may share your personal information:

• In order to provide our Services to you or to administer them;
• In order to comply with any applicable laws or regulations. This includes exchanging information for the purposes of detecting and investigating fraudulent or unlawful activity and respond to claims and legal process;
• To prevent or stop activity we may consider to be, or to pose a risk of being, illegal, unethical or legally actionable or that poses a threat to the safety of you, another person or the public generally;
• In case of merger, acquisition or any other reorganizations of our company, transfer of control with transfer of all information to the relevant third party with your consent to do so if required by law.

Anonymous or aggregated information or other data that does not directly identify you is shared for the analysis. If you would like to get a full list of all third parties with whom we share your data, please, e-mail [email protected] as the list may vary depending on your specific use of our Services.

HOW WE SHARE PERSONAL INFORMATION WITH OTHER THIRD PARTIES

We may share your personal information with:

• Members of the Pallapay corporate family, such as Pallapay Credit, to provide joint content, products, and services (such as registration, transactions and customer support), to help detect and prevent potentially illegal acts and violations of our policies, and to guide decisions about their products, services, and communications. Members of our corporate family will use this information to send you marketing communications only if you have requested their services.
• Financial institutions that we partner with to jointly create and offer a product (including but not limited to, the Pallapay Extras credit card where we share information with GE Capital to determine whether you should receive pre-approved offers for the Pallapay Extras credit card). These financial institutions may only use this information to market Pallapay-related products, unless you have given consent for other uses.
• Credit bureaus and collection agencies to report account information, as permitted by law.
• Banking partners as required by credit card association rules for inclusion on their list of terminated merchants (in the event that you meet their criteria which includes having Pallapay close your Pallapay Account due to your breach of Pallapay’s User Agreement).
• Companies that we plan to merge with or are acquired by. (Should such a combination occur, we will require that the new combined entity follow this Privacy Policy with respect to your personal information. If your personal information could be used contrary to this policy, you will receive prior notice.)
• Law enforcement, regulators, government officials, or other third parties (in Singapore or elsewhere) in relation to a subpoena, court order, or other legal process or requirement under Singapore law or regulation, or the laws and regulations of other jurisdictions that are applicable to Pallapay or one of its Affiliates; when we need to do so to comply with such law or credit card rules; or when we believe, in our sole discretion, that the disclosure of personal information is necessary to prevent physical harm or financial loss; to report suspected illegal activity or investigate violations of our User Agreement
• Other unaffiliated third parties, for the following purposes:
  • Fraud Prevention and Risk Management: to help prevent fraud or assess and manage risk. For example, if you use the Pallapay Services to buy or sell goods, we may share account information in order to help protect your account from fraudulent activity, alert you if we detect such fraudulent activity on your accounts, or evaluate credit risk.
  • Customer Service: for customer service purposes, including to help service your accounts or resolve disputes (e.g., billing or transactional).
  • Shipping: in connection with shipping and related services for purchases made using Pallapay.
  • Legal Compliance: to help them comply with anti-money laundering and counter-terrorist financing verification requirements.
  • Service Providers: to enable service providers under contract with us to support our business operations, such as fraud prevention, bill collection, marketing, customer service and technology services. Our contracts dictate that these service providers only use your information in connection with the services they perform for us and not for their own benefit.
• Other third parties with your consent or direction to do so.

Please note that these third parties may be in other countries where the laws on processing personal information may be less stringent than in your country.

If you open a Pallapay account directly on a third party website or via a third party application, any information that you enter on that website or application (and not directly on a Pallapay website) will be shared with the owner of the third party website or application. These sites are governed by their own privacy policies and you are encouraged to review their privacy policies before providing them with personal information. Pallapay is not responsible for the content or information practices of such third parties.

YOUR RIGHTS UNDER THE POLICY

We would like you to know, that among other, you have the following rights in relation to your Personal data:

• To access: at any time, you can ask Us about what Personal data of yours We have, how We use it, why We process it etc.
• To correct: you can request that we update, block or delete your Personal data, if the data is incomplete, outdated, incorrect, unlawfully received or there is no need to proceed it anymore;
• To delete: you can ask Us to delete all the Personal data that We have about you. We will also deactivate your account. Please, note, that we cannot restore permanently deleted accounts;
• To object the processing: We will no longer process your Personal data, but We can still keep them;
• To transfer (in certain specific circumstances): if you wish, you can ask Us to download (export) all Personal data.
• To lodge a complaint with a supervisory authority: you are entitled to file a complaint against Pallapay with a supervising authority.

If User is intending to use one of the aforementioned rights, User shall send a mail or an email ([email protected]) to Pallapay.

STORAGE OF PERSONAL DATA

We strive to limit the period of Personal data processing to the necessary minimum and not to store them for longer than is reasonably necessary.

We may keep information that we may need to resolve any disputes, enforce our agreements with you and provide you with the possibility to use our Services, protect legal rights, and comply with technical and legal requirements and constraints related to the security and operation of our Services for as long as it is reasonably necessary or required. For example, we should keep some of your personal and transactional data for 1 (one) year minimum after termination of the business relations between you and us for KYC purposes.

In such cases, we keep and access your data only internally and on a need to know basis. Otherwise, we will delete information when it is not anymore reasonably necessary to keep it to provide you Services, to comply with applicable laws and regulations, and to run our business.