We collect personal information and non-personal information that you provide to us.

Personal Information

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. Personal information means information that we could reasonably use to directly or indirectly identify you. The personal information that we collect depends on the context of your interactions with the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• Names
• Usernames or other similar identifiers
• Postal addresses
• Email addresses
• Wallet addresses
• Social media account information
• Any other identifier we may use to contact you online or offline
• Any other information required by us or Third Party Service Providers (e.g. the Issuers), including for purposes such as account verification, trade execution, compliance checks, and settlement

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• Information revealing religious or philosophical beliefs
• Information revealing political opinions
• Information revealing race or ethnic origin

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.

Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

• Geolocation Information. We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's settings.
• Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Non-Personal Information

We may also collect the following types of non-personal information:

• Information and data relating to your transactions and/or any other information required by Third Party Service Providers
• Information that does not directly or indirectly reveal your identity or directly relate to an identified individual, such as demographic information, statistics, or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal information. For example, we may aggregate personal information to calculate the percentage of users accessing a specific Website feature
• Information about your interactions with our Services, including the full Uniform Resource Locators (URLs), clickstream information to, through, and from our Services (including date and time), products viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from the page

If we combine or connect non-personal, demographic, or technical data with personal information so that it directly or indirectly identifies an individual, we treat the combined information as personal information.

We use different methods to collect data from and about you including through:

Direct interactions. You may give us information about you by filling in forms or by corresponding with us by phone, email or otherwise. This includes information you provide when you create an account, subscribe to our Services, participate in interactive functions or other social media functions available as part of our Services, enter a competition, promotion or survey, call our customer service number and when you report a problem with our Services.

Automated technologies or interactions. As you interact with our Services, we may automatically collect technical data about your equipment, browsing actions and patterns as specified above. We collect this information by using cookies, server logs, and other similar technologies (see 10. Cookies and Automatic Data Collection Technologies).

Third parties or publicly available sources. We may receive information about you if you visit other websites employing our cookies or from third parties, including, for example, business partners, sub-contractors in technical, payment, and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies, data brokers, or aggregators.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• Facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate efficient and effective delivery of Services to you. We may process your information to provide you with the requested Service or other information or support that you require from us.
• To meet our obligations and enforce our rights arising from any contracts with you, or comply with legal requirements.
• To notify you about changes to our Services.
• To conduct internal operations, including for troubleshooting, data analysis, testing, research, statistical, and survey purposes.
• To improve our Services, marketing, or customer relationships and experiences.
• To protect our Services, employees, or operations.
• To make suggestions and recommendations to you and other users of our Services about goods or services that may interest you or them.
• To fulfill the purposes for which you provided the data or that were described when it was collected.

We may use non-personal information for any business purpose.

We may need to share your personal information in the following situations:

Intra-Group Disclosures: We may share or transfer your information to any member of our corporate group, which means our subsidiaries, our ultimate holding company and its subsidiaries, and our affiliates.

Operational Disclosures: We may share or transfer your information to the Third Party Service Providers, our business partners, suppliers, service providers, sub-contractors, and other third parties we use to support our business (such as analytics and search engine providers that assist us with improvement and optimization of our Services).

Marketing: We may share or transfer your information to third parties to market their products or services to you, unless you have opted out of these disclosures.

Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Legal: We may share or transfer your information to: (a) enforce or apply our Terms of Use and other agreements; (b) comply with any court order, law, or legal process, including responding to any government or regulatory request; or (c) protect the rights, property, or safety of our business, our employees, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of cybersecurity, fraud protection, and credit risk reduction.

Consent and other purposes: We may share or transfer your information with your consent, to fulfill the purpose for which you provided the personal information, or for any other purposes that we disclose when you provide the information.

We may share non-personal information without restriction.

Our Services may offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us to keep your personal information for longer than the period of time in which users have an account with us.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services.

If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at support@elfa.ai.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time, including your consent for us to process your personal information for specific purposes. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS PRIVACY NOTICE?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent. Please also note that depending on your choices, we may be unable to provide you with all or part of the Services.

Account Information

You can access, review, and change your personal information by accessing the Services and visiting your account profile page. You may also email us at support@elfa.ai to request access to, correct, or delete personal information that you have provided to us. In some circumstances, we may not be able to delete your personal information except by also deleting your user account. We may not accommodate a request to change or delete information if we believe the change or deletion would violate any law or legal requirement or negatively impact the information's accuracy.

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.
• Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at support@elfa.ai.

Our Services use cookies (small files placed on your device) or other automatic data collection technologies to distinguish you from other users of our Services. This helps us deliver a better and more personalized service when you use or access our Services. It also allows us to improve our Services by enabling us to:

• Estimate our audience size and usage patterns.
• Store your preferences so we may customize our Services according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our Services.

You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, certain parts of our Services may become inaccessible and certain features may not work correctly. Unless you adjust your browser settings to refuse cookies, our system will issue them.

Our Services may contain web beacons (small transparent embedded images or objects, also known as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count website page visitors or to compile other similar statistics such as verifying system and server integrity.

Third-Party Use of Cookies

Some content or applications, including advertisements, on the Services are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Services. They may associate the information collected with your personal information or they may collect information, including personal information, about your online activities over time and across different websites or other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

We do not control how these third-party tracking technologies operate or how they may use the collected data. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice. (See 12. Do we make updates to this Privacy Notice?)

We may update this Privacy Notice from time to time. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

If you have questions or comments about this Privacy Notice, you may contact our Data Protection Officer (DPO) by email at support@elfa.ai.