Ping Exchange: Privacy Policy

1. Introduction

Thank you for using Ping Exchange, a digital hybrid asset trading platform. This Privacy Policy (the "Policy") explains how Ping Exchange (the "Company", "Ping Exchange", "we", "us" or "our") collects, uses, stores, discloses, transfers and otherwise processes Personal Data in connection with the Ping Exchange platform, including ping.exchange, associated applications, application programming interfaces ("APIs") and other interfaces through which our services are provided (collectively, the "Platform").

This Policy applies to the processing of Personal Data in connection with access to and use of the Platform and the services, products, technologies, functionalities and related services made available through it (collectively, the "Services").

For the purposes of this Policy, a "User" may, where applicable, be a natural person using the Services in their own name and on their own behalf or a Business using the Services through one or more duly authorised natural persons.

Where a Business uses the Services, this Policy also applies to Personal Data relating to natural persons associated with that Business, including, but not limited to, Ultimate Beneficial Owners ("UBOs"), directors, officers, shareholders, controlling persons, Authorised Representatives, Business Users and other persons whose Personal Data is processed in connection with the Business's registration, KYB verification, account or use of the Services.

For the avoidance of doubt, information relating solely to a legal entity does not constitute Personal Data unless it relates to an identified or identifiable natural person. Business information may nevertheless be processed by the Company in connection with the provision of the Services and applicable legal, regulatory and compliance requirements.

To provide the Services and comply with applicable legal and regulatory obligations, the Company may collect, receive, use, verify, store and otherwise process Personal Data, including information obtained through CorePass in connection with registration, KYC, KYB, authentication, wallet verification and other supported functionality. Certain information may be stored or represented within the Ping Exchange secure vault or other systems used in connection with the Services, as further described in this Policy.

The Company may also receive or process Personal Data through third-party service providers and integrations used in connection with the Services. The categories of Personal Data processed, purposes of processing, recipients of Personal Data and applicable data transfers are described further in this Policy.

We do not sell Personal Data. We disclose or otherwise make Personal Data available to third parties only as described in this Policy or where otherwise permitted or required by Applicable Data Protection Law.

This Policy is principally based on and should be read in accordance with the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), as amended from time to time:https://www.fedlex.admin.ch/eli/cc/2022/491/en

Where the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies to the processing of Personal Data, the Company processes Personal Data in accordance with the GDPR:https://eur-lex.europa.eu/eli/reg/2016/679/oj

The Swiss Federal Data Protection and Information Commissioner ("FDPIC") is the competent federal data protection supervisory authority in Switzerland:https://www.edoeb.admin.ch/edoeb/en/home/deredoeb/kontakt.html

This Policy may be amended from time to time. Updated versions will be made available through the Platform or otherwise communicated where required by Applicable Data Protection Law.

2. Definitions

For the purposes of this Privacy Policy:

"Personal Data" means any information relating to an identified or identifiable natural person (a "Data Subject"). An identifiable natural person is a person who can be identified, directly or indirectly, including by reference to a name, identification number, location data, online identifier or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"Sensitive Personal Data" means Personal Data subject to enhanced protection under Applicable Data Protection Law, including, where applicable, data concerning religious, philosophical, political or trade-union views or activities; health; intimate sphere or sex life; racial or ethnic origin; genetic data; biometric data uniquely identifying a natural person; data concerning administrative or criminal proceedings or sanctions; and data concerning social assistance measures. Where the GDPR applies, this term also includes special categories of Personal Data and other data subject to specific protection under the GDPR, as applicable.

"Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including, but not limited to, collecting, recording, organising, structuring, storing, adapting, retrieving, consulting, using, disclosing, transmitting, making available, combining, restricting, erasing or destroying Personal Data.

"Data Controller" or "Controller" means the person or entity that determines, alone or jointly with others, the purposes and means of Processing Personal Data.

"Data Processor" or "Processor" means a person or entity that Processes Personal Data on behalf of and in accordance with the instructions of a Data Controller.

"Applicable Data Protection Law" means any data protection or privacy law applicable to the relevant Processing of Personal Data, including, but not limited to, the Swiss Federal Act on Data Protection ("FADP") and, where applicable, the General Data Protection Regulation (EU) 2016/679 ("GDPR"), together with applicable implementing or supplementary legislation.

"Business" means a corporation, company, partnership, organisation or other legal entity that registers for or uses the Services through one or more duly authorised natural persons.

"CorePass" means the digital identity, authentication and verification service used in connection with identification, KYC, KYB and other supported functionality relating to the Platform.

3. Collection of Data

The Company collects and processes Personal Data in accordance with Applicable Data Protection Law, including the Swiss Federal Act on Data Protection ("FADP") and, where applicable, the General Data Protection Regulation ("GDPR").

Where the GDPR applies, Personal Data is processed only where there is a lawful basis under Article 6 GDPR, including, but not limited to:

• Consent: where you have freely given specific, informed and unambiguous consent to the Processing of your Personal Data for one or more specified purposes;
• Performance of a contract: where Processing is necessary for the performance of a contract with you or in order to take steps at your request before entering into a contract, including where Processing is necessary to provide the Services;
• Compliance with a legal obligation: where Processing is necessary for the Company to comply with an applicable legal or regulatory obligation;
• Public interest: where Processing is necessary for the performance of a task carried out in the public interest and such Processing has an appropriate legal basis; and
• Legitimate interests: where Processing is necessary for the legitimate interests pursued by the Company or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the relevant Data Subject.

Where Sensitive Personal Data, special categories of Personal Data, biometric data, data relating to criminal convictions or offences, or other specially protected information is processed, the Company will process such information only where permitted under Applicable Data Protection Law and, where applicable, where an additional lawful condition for such Processing is satisfied.

When you access or use the Platform or Services, the Company may collect Personal Data directly from you, through CorePass, automatically through your use of the Platform or Services, or from third parties, including Data Processors, verification providers, payment or service providers, public sources, sanctions or AML/CFT databases and other sources where permitted or required by applicable law.

Where a Business uses the Services, the Company may also collect Personal Data relating to natural persons associated with that Business, including, but not limited to, Ultimate Beneficial Owners, directors, officers, shareholders, controlling persons, Authorised Representatives, Business Users and other persons whose identification or verification is required in connection with the Business.

Personal Data collected and processed may include, but is not limited to:

• full name;
• email address and other contact information;
• date and place of birth;
• nationality, residence and address information;
• photograph or facial image;
• information contained in government-issued identification documents, including document type, document number, issuing authority, date of issue and expiry date;
• proof of identity and proof of residence;
• KYC and verification information obtained through CorePass or an applicable verification provider;
• information relating to a Business, including the identity, role and authority of persons associated with the Business;
• ownership and control information, including information relating to Ultimate Beneficial Owners, controlling persons, shareholders, directors and Authorised Representatives;
• company or commercial-register documentation where it contains Personal Data relating to natural persons;
• financial information, including bank account information and, where applicable, payment-related information;
• bank statements and other financial documentation;
• employment, occupation or professional information;
• source-of-funds and source-of-wealth information and supporting documentation;
• information relating to expected or actual transaction activity where required for compliance, verification or risk-management purposes;
• information regarding politically exposed person ("PEP") status and related persons, where applicable;
• sanctions, watchlist, adverse information, criminal-record or other compliance-related information where its collection and Processing is permitted or required by applicable law;
• wallet addresses and information relating to verified external wallets;
• transaction and account information generated through use of the Platform and Services;
• CoreID and other identifiers associated with your CorePass profile;
• verification status and other status indicators received from CorePass;
• IP address;
• device, browser, application, network and technical information;
• cryptographic fingerprints, hashes and Boolean values generated in connection with information received through CorePass;
• records of communications with the Company, including correspondence with customer support; and
• any other Personal Data reasonably necessary to provide the Services, comply with applicable legal or regulatory requirements, prevent fraud or misuse, protect the Platform or Users, or otherwise fulfil the purposes described in this Privacy Policy.

The Company may also automatically collect technical and usage information when you access or use the Platform or Services, including, but not limited to, IP address, device information, browser information, session information, log data, security information and information relating to interactions with the Platform.

Personal Data may be collected from, including but not limited to:

• you directly;
• CorePass;
• a Business or duly authorised person acting in connection with a Business;
• the Company's Data Processors and service providers;
• KYC, KYB and other verification providers;
• financial institutions, payment providers or other service providers involved in a transaction or Service;
• sanctions, PEP, AML/CFT, fraud-prevention and other compliance databases;
• public registers, publicly available sources and official records;
• governmental, regulatory, judicial or law-enforcement authorities where permitted or required by applicable law; and
• other third parties where the collection of such Personal Data is lawful and relevant to the provision, security or compliance of the Services.

Where you contact the Company, the Company may retain the correspondence and any Personal Data contained in it in accordance with this Privacy Policy and applicable record-retention requirements.

4. Restrictions

The Platform and Services are intended only for natural persons who are at least eighteen (18) years of age.

A natural person may not register for, access or use the Platform or Services, whether in their own name or on behalf of a Business, if they are under eighteen (18) years of age.

Where a Business uses the Services, each natural person accessing or operating the Business Account, including any Authorised Representative or Business User, must satisfy the applicable minimum age and eligibility requirements.

Persons under eighteen (18) years of age must not access or use the Ping Exchange Platform or Services. Any use of CorePass by such persons is subject separately to the applicable CorePass terms, eligibility requirements and Privacy Policy.

5. Utilization of Your Personal Data

The Company uses Personal Data for purposes connected with the operation, provision, security and administration of the Platform and Services, including, but not limited to:

• registering and maintaining User and Business Accounts;
• performing KYC, KYB, identity verification, Business verification and related onboarding processes;
• identifying and verifying natural persons associated with a Business, including Ultimate Beneficial Owners, controlling persons, directors, Authorised Representatives and Business Users;
• authenticating Users and managing access to the Platform and Services;
• verifying and administering external wallets and other account-related information;
• processing, administering and recording transactions and other activities carried out through the Platform;
• communicating with Users and Businesses regarding accounts, transactions, verification, security, support, operational matters and changes affecting the Services;
• providing customer support and responding to questions, complaints and requests;
• complying with applicable legal, regulatory, AML/CFT, sanctions, tax, record-keeping, reporting and other compliance obligations;
• conducting fraud prevention, security monitoring, sanctions screening, risk management and other measures intended to protect the Company, the Platform, Users and third parties;
• investigating suspected breaches of the Terms, unlawful activity, fraud, misuse or security incidents;
• maintaining records required for legal, regulatory, compliance, audit and evidentiary purposes;
• operating, maintaining, testing, analysing, improving and developing the Platform and Services;
• monitoring performance, diagnosing technical issues and improving security, reliability and functionality;
• generating aggregated, statistical or anonymised information for analytical, operational, business-development or service-improvement purposes;
• communicating information about Ping Exchange products, Services or related offerings where permitted by Applicable Data Protection Law and, where required, subject to your consent or applicable marketing preferences; and
• any other purpose reasonably connected with the provision of the Services and permitted under Applicable Data Protection Law.

Where information has been irreversibly anonymised so that it no longer relates to an identified or identifiable natural person, it is no longer treated as Personal Data under this Privacy Policy.

The Company does not disclose Personal Data to third parties except where such disclosure is permitted or required under Applicable Data Protection Law or as described in this Privacy Policy, including, but not limited to, disclosures to Data Processors, service providers, verification providers, financial or payment service providers, competent authorities, regulators, courts, law-enforcement authorities or other recipients where necessary for the provision of the Services, compliance with legal or regulatory obligations, protection of legal rights, prevention of fraud or misuse, or other purposes described in this Privacy Policy.

6. Storage and Safeguarding of Personal Data

The Company is committed to protecting the Personal Data it collects and processes. We implement appropriate technical and organisational measures designed to protect Personal Data against unauthorised access, unlawful or improper use or disclosure, unauthorised alteration, accidental loss, destruction, damage or other unauthorised Processing.

The Company uses security technologies, access controls, operational procedures and other safeguards appropriate to the nature of the Personal Data processed and the risks associated with the relevant Processing.

No physical, electronic or technological security system can provide absolute security. Accordingly, while the Company takes appropriate measures to protect Personal Data, it cannot guarantee that Personal Data will never be accessed, disclosed, altered, lost or intercepted without authorisation, including during transmission over the internet or other networks.

Certain Personal Data received through CorePass may be transferred to and stored within a sealed secure vault. Information stored in the vault is designed to remain inaccessible in its underlying form while sealed.

For verification, comparison, compliance and operational purposes, the Company may generate and retain cryptographic fingerprints, hashes, Boolean values or other derived technical indicators associated with information received through CorePass.

Certain Personal Data and technical information that are necessary for the operation, security, administration, compliance or functionality of the Platform and Services may be stored and processed outside the sealed vault. Such information may include, but is not limited to, account identifiers, verification status, transaction information, wallet-related information, technical identifiers, security records, logs and other operational data necessary to provide or protect the Services.

Personal Data is retained only for as long as necessary for the purposes for which it is processed or as required or permitted by Applicable Data Protection Law, legal, regulatory, AML/CFT, accounting, audit, dispute-resolution or other applicable record-retention obligations.

7. Managing, Modifying, and Removing Personal Data

You are responsible for ensuring that the Personal Data provided in connection with the Platform and Services is accurate, complete and current. Information received through CorePass may be subject to verification against identification documents, verification records and other information available through the applicable verification process.

If you become aware that Personal Data held by the Company is inaccurate, incomplete or outdated, you should notify the Company and, where applicable, update the relevant information through CorePass or the functionality made available through the Platform.

Subject to Applicable Data Protection Law, a Data Subject may request, as applicable:

• access to Personal Data processed by the Company;
• information concerning the Processing of their Personal Data;
• correction or completion of inaccurate or incomplete Personal Data;
• deletion or erasure of Personal Data;
• restriction of Processing;
• provision or portability of Personal Data in an applicable format;
• objection to certain Processing;
• withdrawal of consent where Processing is based on consent, without affecting the lawfulness of Processing carried out before withdrawal; and
• any other right available to the Data Subject under Applicable Data Protection Law.

These rights are not absolute. The Company may refuse, restrict or delay a request where permitted or required by Applicable Data Protection Law, including, but not limited to, where Personal Data must be retained for AML/CFT, sanctions, regulatory, tax, accounting, record-keeping, fraud-prevention, dispute-resolution, legal-claims or other legal or compliance purposes.

In particular, closure of a Platform Account, termination of the Services or withdrawal of consent does not necessarily require the Company to delete Personal Data that it is legally required or otherwise permitted to retain.

Where Personal Data relates to a natural person associated with a Business, including an Ultimate Beneficial Owner, director, controlling person, Authorised Representative or Business User, that natural person may exercise applicable Data Subject rights in relation to their own Personal Data, subject to Applicable Data Protection Law and any legal or regulatory retention requirements.

The Company may require reasonable information or verification of identity before processing a Data Subject request in order to protect Personal Data against unauthorised access, alteration or deletion.

Requests relating to access, correction, deletion or other Data Subject rights may be submitted through the Company's Support Center with the subject "DATA INQUIRY".

8. Legal Notifications

The Company may be required to provide Users with notices concerning changes to the Platform, Services, Terms, Privacy Policy, legal or regulatory requirements, account status, security matters or other information that the Company is required or considers necessary to communicate.

The Company may process Personal Data, including contact information, for the purpose of delivering such legal, regulatory, contractual, security or service-related notifications.

Such communications are separate from direct marketing communications. Where a User opts out of receiving marketing communications, the Company may continue to send legal, regulatory, contractual, security, account-related or other service communications where necessary or permitted under Applicable Data Protection Law.

9. Disclosure of Personal Information

The Company does not disclose Personal Data or confidential information relating to Users or Businesses to third parties except where such disclosure is permitted or required under Applicable Data Protection Law, these Terms, this Privacy Policy or other applicable legal or regulatory requirements.

The Company may disclose Personal Data, including, but not limited to, where:

• disclosure is required or permitted by applicable law, regulation, court order, regulatory requirement or other legally binding obligation;
• disclosure is requested or required by a competent regulatory, governmental, judicial, law-enforcement or supervisory authority;
• disclosure is necessary for the establishment, exercise or defence of legal claims or the protection of the Company's legal rights;
• disclosure is necessary for the Company's legitimate business, operational, security, compliance or risk-management purposes, subject to Applicable Data Protection Law;
• disclosure is necessary for the provision, administration or operation of the Platform or Services;
• disclosure is contemplated by the Terms or this Privacy Policy;
• disclosure is necessary in connection with KYC, KYB, AML/CFT, sanctions screening, fraud prevention, transaction monitoring or other legal or regulatory compliance activities;
• disclosure is made at the request of, or with valid authorisation from, the relevant Data Subject or duly authorised person acting on behalf of a Business; or
• any other disclosure is permitted or required under Applicable Data Protection Law.

Where appropriate and permitted by law, the Company seeks to limit disclosures to information reasonably necessary for the relevant purpose. The Company may be prohibited from notifying a User or Business of a disclosure where notification is restricted by law, regulation, court order, regulatory instruction or other legally binding requirement.

Personal Data may be disclosed to recipients including, but not limited to:

• affiliates, subsidiaries and other entities within the Company's corporate group;
• Data Processors, service providers and technology providers supporting the operation of the Platform and Services;
• CorePass and other identity, KYC, KYB or verification providers;
• payment service providers, banking partners, financial institutions and fiat on-ramp or other transaction-related service providers, including MoonPay where applicable;
• hosting, cloud, communications, cybersecurity, fraud-prevention, analytics, monitoring and technical service providers;
• professional advisers, including legal, tax, accounting, audit, compliance, insurance and financial advisers;
• debt-recovery or claims-management service providers where applicable;
• regulatory, governmental, supervisory, judicial, law-enforcement or other competent authorities;
• counterparties, purchasers, successors or advisers in connection with an actual or proposed merger, acquisition, restructuring, financing, sale of assets, transfer of business or similar corporate transaction, subject to applicable confidentiality and data protection requirements; and
• any other recipient where disclosure is permitted or required under Applicable Data Protection Law or is necessary for the purposes described in this Privacy Policy.

Where the User is a Business, Personal Data relating to its Ultimate Beneficial Owners, directors, controlling persons, Authorised Representatives, Business Users or other associated natural persons may be disclosed where necessary for the Business's registration, verification, account operation, compliance requirements or use of the Services.

Third-party recipients that process Personal Data on behalf of the Company are required, where applicable, to process such information in accordance with appropriate contractual, confidentiality, security and data protection obligations. Where a recipient processes Personal Data as an independent controller, its processing may also be subject to its own privacy policy and applicable legal obligations.

The Company does not sell Personal Data.

10. Location of Your Personal Data Storage

The Company's operations are supported by information technology infrastructure, including computers, servers, cloud services and third-party service providers.

Personal Data may be stored or processed in jurisdictions in which the Company, its affiliates, Data Processors, service providers or business partners operate or maintain infrastructure. These jurisdictions may include, but are not limited to, Switzerland, Slovakia, Italy, Finland, Germany, France, Belgium, Spain, the Netherlands, the United Kingdom and Poland.

Where Personal Data is transferred to or processed in a jurisdiction outside Switzerland or, where applicable, outside the European Economic Area, the Company will implement appropriate safeguards where required by Applicable Data Protection Law, including, where applicable, adequacy decisions, recognised contractual safeguards or other lawful transfer mechanisms.

The location of storage or Processing may vary depending on the Service, Data Processor, service provider, technical infrastructure or functionality used.

11. Privacy Considerations in Digital Asset and Blockchain Usage

Transactions involving Assets and other Digital Assets, may be recorded on public or otherwise accessible blockchain or distributed-ledger networks.

Such networks are designed to record and retain transaction information across distributed systems. Information recorded on a blockchain may include, but is not limited to, wallet addresses, transaction amounts, transaction timestamps and other transaction-related data.

Although blockchain addresses may not directly identify a natural person, blockchain data may be analysed and combined with other information in a manner that may permit identification or deanonymization of a Data Subject or reveal information concerning their transactions, holdings or financial activity.

Public blockchains and other distributed-ledger networks may be operated independently of the Company and may be decentralised or controlled by third parties. The Company does not control such networks and cannot guarantee the confidentiality, modification, correction, restriction or deletion of information recorded on them.

Accordingly, even where the Company deletes, restricts or otherwise ceases Processing Personal Data within its own systems, information that has been validly recorded on a blockchain or other distributed ledger may remain permanently or indefinitely available and may not be capable of being erased, modified or altered by the Company.

12. Data Retention

The Company retains Personal Data for as long as necessary for the purposes for which it was collected or otherwise processed, including, but not limited to, the provision of the Services, maintenance of the business relationship, compliance with applicable legal and regulatory obligations, AML/CFT requirements, accounting and audit requirements, fraud prevention, dispute resolution, enforcement of agreements and the establishment, exercise or defence of legal claims.

Different categories of Personal Data may be subject to different retention periods depending on the nature of the information, the purpose for which it is processed and the applicable legal or regulatory requirements.

Where the Company is subject to applicable AML/CFT record-retention requirements, relevant identification, KYC, KYB, transaction, account and compliance records may be retained for at least ten (10) years following termination of the relevant business relationship or completion of the relevant transaction, or for such longer period as may be required or permitted by applicable law, regulation, court order, regulatory authority or other legally binding requirement.

Personal Data may also be retained for a longer period where necessary in connection with an investigation, legal proceeding, regulatory inquiry, sanctions requirement, dispute, outstanding claim, enforcement action or other lawful purpose.

Where Personal Data is no longer necessary for the purposes for which it is processed and no legal or regulatory requirement or other lawful basis requires its continued retention, the Company will delete, destroy or irreversibly anonymise the relevant Personal Data in accordance with Applicable Data Protection Law.

Closure of a Platform Account, termination of the business relationship, withdrawal of consent or a request for deletion does not require the Company to delete Personal Data that it is required or permitted to retain under applicable law or for another lawful purpose.

Personal Data retained by the Company remains subject to appropriate technical and organisational safeguards for the duration of the applicable retention period.

13. Privacy Queries

Subject to Applicable Data Protection Law, Data Subjects may have rights in relation to their Personal Data, including, but not limited to:

• the right to be informed about the Processing of their Personal Data;
• the right to obtain information as to whether the Company Processes Personal Data concerning them and, where applicable, to access such Personal Data;
• the right to request correction or completion of inaccurate or incomplete Personal Data;
• the right to request deletion or erasure of Personal Data, where applicable;
• the right to request restriction of Processing, where applicable;
• the right to object to certain Processing, where applicable;
• the right to receive or request the transfer of Personal Data in a structured and commonly used format where the applicable requirements for data portability are satisfied;
• the right to withdraw consent at any time where Processing is based on consent, without affecting the lawfulness of Processing carried out before such withdrawal;
• rights relating to automated individual decision-making, where applicable; and
• any other rights available under Applicable Data Protection Law.

These rights are subject to the conditions, limitations and exceptions provided by Applicable Data Protection Law. In particular, the Company may be entitled or required to retain or continue Processing certain Personal Data notwithstanding a request for deletion, restriction, objection or withdrawal of consent, including where necessary to comply with AML/CFT, sanctions, regulatory, tax, accounting, record-retention or other legal obligations, or for the establishment, exercise or defence of legal claims.

If you wish to exercise any applicable Data Subject right or have questions concerning this Privacy Policy or the Processing of your Personal Data, you may contact the Company through its Support Center with the subject "PRIVACY REQUEST".

The Company may request information reasonably necessary to verify the identity of the person submitting a request and to protect Personal Data against unauthorized access, disclosure, alteration or deletion.

The Company will respond to Data Subject requests within the timeframe required by Applicable Data Protection Law. Under the FADP, information requested pursuant to the right of access is generally provided within thirty (30) days. If the information cannot be provided within that period, the Company may notify the Data Subject of the delay and the expected timeframe for response.

Where the GDPR applies, the Company will respond to applicable Data Subject requests within the periods prescribed by the GDPR, including any permitted extension for complex or multiple requests.

Data Subject requests are generally handled free of charge. However, where permitted by Applicable Data Protection Law, the Company may charge a reasonable fee or refuse to act on a request that is manifestly unfounded, excessive, repetitive or requires disproportionate effort. Under the FADP, requests involving disproportionate effort may, in applicable circumstances, be subject to a fee in accordance with applicable law.

Data Subjects may also have the right to raise a concern or lodge a complaint with a competent data protection supervisory authority.

In Switzerland, the competent federal supervisory authority is the Federal Data Protection and Information Commissioner ("FDPIC"), Feldeggweg 1, CH-3003 Bern.

Where the GDPR applies, a Data Subject may also have the right to lodge a complaint with the competent supervisory authority in the relevant European Union or European Economic Area jurisdiction.

14. Privacy Policy Updates

The Company may amend or update this Privacy Policy from time to time, including, but not limited to, where necessary to reflect changes to the Platform or Services, Processing activities, Applicable Data Protection Law, regulatory requirements, technology, security practices or the Company's business operations.

Updated versions of this Privacy Policy will be made available through the Platform or otherwise communicated to Data Subjects where required by Applicable Data Protection Law.

Where an update materially affects the manner in which Personal Data is processed, the Company may update this Privacy Policy, effective immediately and without prior notice, where required by Applicable Data Protection Law.