Altcoinomy SA — Data Privacy Notice

1. Definitions

For the purposes of this Privacy Notice, the following terms have the meanings set out below:

• Consent: Any freely given, specific, informed, and unambiguous indication of the data subject's agreement to the Processing of Personal Data.
• Controller: The entity that determines the purposes and means of Processing Personal Data; in this case, Altcoinomy SA.
• Data Protection Officer (DPO): The person responsible for overseeing Altcoinomy's compliance with data protection obligations and assisting individuals regarding their Personal Data.
• KYC/AML: Know Your Customer and Anti-Money Laundering obligations under Swiss law and applicable international regulations.
• Personal Data: Any information relating to an identified or identifiable individual.
• Processing: Any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• Third-Party Providers: External entities that process Personal Data on behalf of or in conjunction with Altcoinomy to provide Services or comply with legal obligations.

2. About This Privacy Notice

Please find below the Privacy Notice of Altcoinomy SA (hereinafter "Altcoinomy" or the "Controller"), a company incorporated under the laws of Switzerland, with registration number CHE-209.239.695 and registered address at Place des Florentins 1, 1204 Geneva, Switzerland.

Altcoinomy is a regulated Swiss financial intermediary and is supervised by the VQF (Swiss Financial Services Standards Association).

This Privacy Notice applies when Personal Data concerning you is collected or processed by Altcoinomy in connection with:

• Your access to or use of content on the websites located at alt.co or any other websites, applications, pages, features, or content owned or operated by us (collectively, the "Sites"); and/or
• Your use of our services (collectively, the "Services").

Furthermore, any information you provide to Altcoinomy in response to an email request, to any other contact from Altcoinomy, or while using any of Altcoinomy's Services, will also be processed in accordance with this Privacy Notice.

Altcoinomy is committed to processing your Personal Data responsibly and in compliance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the General Data Protection Regulation (GDPR).

3. Data Controller

For the purposes of applicable data protection laws, Altcoinomy acts as the Controller of your Personal Data.

Altcoinomy has appointed a Data Protection Officer (DPO) to oversee compliance with data protection obligations and to assist you with any questions regarding your Personal Data or this Privacy Notice.

You can contact the DPO at:

4. Personal Data We Collect

When you use Altcoinomy's Sites and Services or provide information to us, we may collect Personal Data necessary to provide and improve our Sites and Services, comply with legal obligations, and ensure security.

Data Collected via the Sites

When you access or use our Sites, we may collect:

• Browsing data: Information about how you access and use our Sites, collected for security analysis and statistical purposes.
• IT and security data: IP addresses, device identifiers, browser type, login information, and access logs, collected to ensure the security, integrity, and proper functioning of our Sites;
• Cookies and tracking technologies: Cookies, web beacons, and similar technologies may be used to remember your preferences, analyze Sites traffic, detect fraud or abuse, and enhance your experience.

Data Collected for the Provision of Services

When you apply for, onboard to, or use our Services, we may collect Personal Data necessary to perform contractual obligations and comply with legal and regulatory requirements, including KYC/AML obligations. This may include:

• Identification and contact information: Full name, date of birth, nationality, identity documents, tax identification number, address, phone number;
• Professional and contractual information: Occupation, employer details, beneficial ownership information, and corporate or business information related to contractual relationships, where applicable;
• Financial and blockchain-related data: Source and proof of funds, banking information, wallet addresses, transaction hashes, blockchain activity data, and information collected for forensic and AML screening and ongoing monitoring.

We may also collect additional information from trusted third-party sources, such as identity verification providers, blockchain analytics providers, or AML and sanctions screening databases, where required under Swiss law. Where Personal Data is required to comply with legal obligations (including AML regulations), failure to provide such data may prevent Altcoinomy from establishing or maintaining a business relationship.

5. Purpose & Legal Basis of Processing

Your Personal Data is processed for legitimate purposes, including but not limited to:

• Service Provision: To provide the Services you request.
• Information Security: Protecting accounts, Sites, and Services from unauthorized access or cyberattacks.
• Research & Development: Improving and customizing our Services.
• Customer Support: Resolving inquiries, disputes, or troubleshooting issues.
• Legal Compliance: To comply with applicable Swiss and international legal and regulatory obligations, including identification, KYC/AML, CFT, sanctions screening, suspicious activity monitoring, Travel Rule requirements, and regulatory reporting obligations.
• Internal Risk Management & Supervision: Personal Data may also be processed in connection with internal risk management, audit activities, compliance monitoring, internal control procedures, and supervisory examinations.

Such screening may also extend to beneficial owners, directors, authorized signatories, contracting parties, and other related persons where required under applicable AML regulations. For cryptoasset transactions, wallet addresses and blockchain transaction data may be analyzed using blockchain forensic tools.

Processing is based on one or more of the following legal grounds, as applicable: performance of a contract, compliance with legal obligations, legitimate interests pursued by Altcoinomy (provided such interests are not overridden by your rights), or your consent where required by law.

6. Cookies & Tracking

Our Sites use cookies and similar tracking technologies to enhance your experience, ensure security, prevent fraud, and analyze traffic for optimization. Cookies may be classified as:

• Essential Cookies – Necessary for the proper functioning of the Sites (cannot be disabled).
• Non-Essential Cookies – Used for analytics, preferences, or marketing.

Consent Requirement

Before placing any non-essential cookies on your device, we will request your explicit prior consent. You can provide, withdraw, or modify your consent at any time via the cookie banner or the cookie management settings on our Sites.

How to Control Cookies

You can manage or disable cookies through the cookie settings on our Sites. You can also adjust your browser settings to refuse cookies. Note that some features of the Sites may not function properly if cookies are deactivated.

Third-Party Cookies & Analytics

We use third-party analytics, tag management, and user-behaviour tools to understand how visitors interact with our Sites and to optimize performance. These tools may collect technical information as well as interaction data. Such technologies are used for statistical analysis, service improvement, performance monitoring, and website optimization, and are activated only in accordance with your consent where required.

7. Data Sharing & International Transfers

Altcoinomy does not sell, rent, or trade your Personal Data. Personal Data is shared only when necessary to provide our Services, comply with legal obligations, or ensure the security and integrity of our Sites and systems.

Internal Access

Access to Personal Data is limited to Altcoinomy employees who need it to perform their duties. Sensitive information, including KYC/AML, or transaction data, is subject to reinforced access controls and handled strictly on a need-to-know basis.

Data Collected via the Sites

Browsing data and IT/security data collected when you access or use our Sites may be shared only to maintain the security, integrity, and proper functioning of our Sites.

Third-Party Service Providers

Personal Data collected to provide our Services may be shared with specialized third-party providers. These may include:

• Identity verification and AML screening providers;
• Blockchain analytics and crypto-forensics providers;
• Custodial or technical third-party service providers supporting digital asset security;
• IT infrastructure, cloud hosting, email, and communication service providers necessary for the operation of our Sites and Services.

These providers may process information such as identity documents, biometric data derived from identity verification processes, transaction metadata, and screening results, solely for the purposes of providing the Services and complying with applicable legal and regulatory obligations.

Financial Intermediaries and Partner Banks

Where necessary for the execution of specific services or transactions involving regulated financial institutions, Personal Data may be shared with such institutions strictly to the extent required for the performance of the requested Services or to comply with applicable legal or regulatory obligations.

Altcoinomy does not systematically transmit client KYC documentation to banking partners unless required for the provision of a specific service or by law.

Regulatory and Legal Authorities

Altcoinomy may disclose Personal Data where required by law or necessary in connection with regulatory supervision, statutory audits, compliance reviews, or other legal obligations. Where legally prohibited, Altcoinomy may be prevented from informing the data subject of such disclosure.

International Transfers

Some third-party service providers may be located outside Switzerland. Where Personal Data is transferred to jurisdictions that do not provide an adequate level of data protection under Swiss law, Altcoinomy implements appropriate safeguards in accordance with the FADP and, where applicable, the GDPR.

Transparency and Control

You will be informed of data sharing arrangements where required under applicable data protection laws. You retain the right to exercise your data protection rights in accordance with Article 8 and Article 9 of this Privacy Notice.

8. Data Retention & Deletion

Altcoinomy retains Personal Data only as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations.

KYC/AML Data: Retained for up to ten years after the end of a business relationship or occasional transaction, unless a longer retention period is required by law, supervisory authorities, or for compliance purposes.

Other Personal Data: Data collected via our Sites is retained for as long as necessary to support the functioning of Sites, provide Services, maintain records, or comply with legal obligations.

Deletion or Anonymization: Once the retention period expires or data is no longer required, Personal Data is deleted or anonymized in a secure manner.

9. Other Data Subject Rights

You have the right to access, correct, delete, restrict, object to the processing of your Personal Data, and to receive your Personal Data in a structured, commonly used, and machine-readable format, as permitted by law. Requests should be addressed to the DPO at hello@alt.co.

Certain rights may be restricted where processing is necessary to comply with legal obligations under KYC/AML regulations or financial supervisory requirements.

If you believe your data protection rights have been violated, you may lodge a complaint with the relevant authority:

• Switzerland (FADP): Federal Data Protection and Information Commissioner (FDPIC)
  Website: www.edoeb.admin.ch
  Address: Feldeggweg 1, 3003 Bern, Switzerland
• European Union (GDPR): Your local national Data Protection Authority (DPA). Full list: edpb.europa.eu

10. Special Cases

Children: Altcoinomy does not knowingly collect data from individuals under 18.

Links to Other Sites: Altcoinomy is not responsible for third-party content or policies.

Automated Decisions: Altcoinomy may use automated tools to support identity verification, risk assessment, transaction monitoring, sanctions screening, and fraud prevention. Where decisions significantly affect you, such decisions are not based solely on automated processing without human review, unless permitted by applicable law. Where required by law, you have the right to request human intervention, to express your point of view, and to contest such decisions.

11. Security Measures & Data Storage

Altcoinomy implements appropriate technical and organizational measures to safeguard Personal Data, including access controls, monitoring of access logs, secure storage of identification documents, and adherence to the need-to-know principle.

Sensitive Personal Data processed for AML purposes is subject to enhanced protection measures, including strict access restrictions, role-based access, and continuous monitoring of access logs to detect any unauthorized or inappropriate access.

Personal Data is primarily stored in Switzerland or in jurisdictions recognized as providing an adequate level of data protection under Swiss law. Where Personal Data is processed outside Switzerland, Altcoinomy ensures that appropriate safeguards are implemented in accordance with the FADP and, where applicable, the GDPR.

Access to Personal Data is strictly limited to authorized personnel on a need-to-know basis and is protected by appropriate technical and organizational measures, including access controls, encryption, monitoring, and secure storage protocols.

12. Data Breach Procedure

Altcoinomy maintains internal procedures to ensure that suspected or actual Personal Data breaches are promptly identified, investigated, contained, and remediated. Where required by applicable law, Altcoinomy will notify competent authorities and affected individuals within the legally prescribed timeframes.

13. Amendments to This Notice

Altcoinomy reserves the right to update this Privacy Notice at any time. Changes will be effective upon posting to the Sites.

For material changes that affect the processing of your Personal Data, you will be notified and may be asked to provide your consent before the updated Privacy Notice takes effect. Continued use of the Sites or Services after such notification may indicate acceptance of the changes where consent is not required by law.