Privacy Notice

Bloxley UK Ltd. ("Bloxley", "we", "us", "our") is the data controller responsible for your personal data collected and processed in connection with the Bloxley platform and website. We are incorporated in England and Wales (No. 16630486) with registered office at 128 City Road, London, EC1V 2NX.

This Privacy Notice applies to personal data collected via our website (www.bloxley.com), our mobile and web application (the "Platform"), and in connection with our services generally.

If you have any questions about how we handle your personal data, or wish to exercise your rights, please contact us at:

• Email: privacy@bloxley.com
• Post: Data Privacy, Bloxley UK Ltd., 128 City Road, London, EC1V 2NX

Where personal data is processed by our Regulated Providers (Equals Money Plc and Equals Money International Limited) for the purposes of regulated payment and e-money services, those entities act as separate and independent data controllers. Please refer to the Equals Money privacy notice for information about their processing activities.

2.1 Data You Provide to Us

When you register for or use the Platform, we collect the following categories of personal data:

• Identity data: your full name and date of birth;
• Contact data: your email address, phone number, and country of residence;
• Account data: your account preferences, settings, and communications with us;
• Verification data: identity documents and related information collected and processed by our third-party KYC provider on our behalf during onboarding; and
• Correspondence: any communications you send us, including support queries and complaints.

2.2 Data We Collect Automatically

When you use the Platform or visit our website, we may automatically collect:

• Technical data: IP address, device type, operating system, browser type, and version;
• Usage data: pages visited, features used, session duration, and click-stream data;
• Location data: country or region-level location inferred from your IP address; and
• Cookie data: as described in our Cookie Policy.

2.3 Data We Receive from Third Parties

We may receive personal data about you from:

• identity verification and KYC providers, who process verification data on our behalf;
• fraud prevention and sanctions screening agencies;
• our Regulated Providers, where relevant to your use of the Services; and
• publicly available sources, including company registries and regulatory databases.

We only process your personal data where we have a lawful basis to do so. The table below sets out our processing purposes and the corresponding legal bases under the UK GDPR and EU GDPR.

• Providing and managing your Account and access to the Platform — Performance of a contract (Article 6(1)(b))
• Identity verification and onboarding (KYC) — Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f))
• Fraud prevention, security monitoring, and risk management — Legitimate interests (Article 6(1)(f)) and legal obligation (Article 6(1)(c))
• Compliance with AML, sanctions, and regulatory obligations — Legal obligation (Article 6(1)(c))
• Communicating with you about the Services, updates, and support — Performance of a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f))
• Sending marketing communications (where you have opted in) — Consent (Article 6(1)(a)) — you may withdraw consent at any time
• Improving and developing the Platform and our services — Legitimate interests (Article 6(1)(f))
• Complying with legal and regulatory requirements, including responding to regulatory and law enforcement requests — Legal obligation (Article 6(1)(c))
• Handling complaints and disputes — Performance of a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f))

Where we rely on legitimate interests as our legal basis, we have assessed that our interests are not overridden by your rights and interests. You may contact us to request further information about this assessment.

We do not sell your personal data. We share your personal data only where necessary and only with the following categories of recipients:

• Regulated Providers: Equals Money Plc and Equals Money International Limited, for the purposes of providing regulated payment and e-money services;
• KYC and identity verification providers: third-party vendors who process verification data on our behalf as data processors;
• Fraud prevention and sanctions screening agencies: to detect and prevent fraud, money laundering, and other financial crime;
• IT and infrastructure providers: cloud hosting, data storage, and platform infrastructure providers acting as data processors under our instruction;
• Customer support providers: third parties who assist in delivering support services on our behalf;
• Legal and regulatory authorities: including the FCA, HMRC, law enforcement agencies, and courts, where required by law or regulatory obligation; and
• Professional advisers: lawyers, auditors, and accountants, subject to binding confidentiality obligations;
• Digital wallet providers: Google Pay and Apple Pay, acting as data processors in connection with digital wallet payment functionality; and
• Crypto infrastructure and custody providers (coming soon).

All third parties who process personal data on our behalf are subject to data processing agreements and are required to implement appropriate technical and organisational security measures.

Bloxley is based in the United Kingdom. Where we transfer personal data outside the UK or the European Economic Area (EEA), we ensure that appropriate safeguards are in place in accordance with applicable data protection law, including:

• transfers to countries that have received a UK adequacy decision or EU adequacy decision;
• use of the International Data Transfer Agreement (IDTA) approved by the UK ICO, or the EU Standard Contractual Clauses (SCCs) approved by the European Commission; or
• other lawful transfer mechanisms as permitted under the UK GDPR or EU GDPR.

Where we transfer personal data to the United States, we ensure that such transfers are subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission or the International Data Transfer Agreement (IDTA) approved by the UK ICO, as applicable. A number of our service providers, including cloud infrastructure and KYC vendors, are US-based entities subject to US jurisdiction. We have assessed these arrangements and implemented transfer mechanisms accordingly. You may request further information about international transfer safeguards by contacting us at privacy@bloxley.com.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law or regulation. Our standard retention periods are as follows:

• Account and transaction data: retained for a minimum of five years following account closure, and up to seven years where required by AML and financial record-keeping regulations;
• Identity verification data: retained for five years following the end of the customer relationship, or longer where required by law;
• Marketing data: retained until you withdraw consent or opt out;
• Support and correspondence data: retained for up to three years following resolution of the relevant query or complaint; and
• Technical and usage data: retained for up to two years from collection, or shorter periods where anonymised for analytical purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymised. Where data cannot be immediately deleted due to technical constraints, it is restricted from active processing until deletion is complete.

Under the UK GDPR and, where applicable, the EU GDPR, you have the following rights in respect of your personal data:

• Right of access: to request a copy of the personal data we hold about you (a Subject Access Request);
• Right to rectification: to request correction of inaccurate or incomplete personal data;
• Right to erasure: to request deletion of your personal data, subject to legal and regulatory retention obligations;
• Right to restriction: to request that we restrict processing of your personal data in certain circumstances;
• Right to data portability: to receive your personal data in a structured, commonly used, and machine-readable format;
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes; and
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@bloxley.com. We will respond within one month of receiving your request. This period may be extended by a further two months where requests are complex or numerous, in which case we will notify you.

We may need to verify your identity before processing a request. We will not charge a fee for responding to requests unless they are manifestly unfounded or excessive.

We use cookies and similar tracking technologies on our website and Platform. Cookies are small text files placed on your device that help us operate and improve our services.

We use the following categories of cookies:

• Strictly necessary cookies: required for the Platform to function and cannot be disabled;
• Performance and analytics cookies: help us understand how users interact with the Platform, used only with your consent; and
• Functionality cookies: remember your preferences and settings, used only with your consent.

We do not currently use advertising or targeting cookies. You can manage your cookie preferences via the cookie settings on our website. For full details, please see our Cookie Policy.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. These measures include:

• encryption of data in transit and at rest;
• access controls and role-based permissions limiting data access to authorised personnel only;
• regular security testing and vulnerability assessments;
• incident response and breach notification procedures; and
• contractual security obligations imposed on all third-party processors.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (the ICO in the UK, and/or the relevant EU supervisory authority) within 72 hours of becoming aware, and will notify you directly where required by law.

The Services are not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us at privacy@bloxley.com and we will take prompt steps to delete it.

We may use automated processes to assist with identity verification, fraud detection, and risk assessment during onboarding and ongoing monitoring. Where a decision is made solely by automated means and produces legal or similarly significant effects on you, you have the right to:

• request human review of the decision;
• express your point of view; and
• contest the decision.

To exercise these rights, please contact us at privacy@bloxley.com. We will explain the logic involved and the significance of the automated decision where legally required to do so.

Our website and Platform may contain links to third-party websites or services. This Privacy Notice does not apply to those third parties. We encourage you to review the privacy notices of any third-party services you access. We are not responsible for the privacy practices or content of third-party websites.

If you are located in the United Kingdom, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the EU/EEA, you have the right to lodge a complaint with the supervisory authority in your country of residence or the supervisory authority in the country where the alleged infringement occurred.

We would, however, appreciate the opportunity to address your concerns before you contact a supervisory authority. Please contact us at privacy@bloxley.com in the first instance.

We may update this Privacy Notice from time to time to reflect changes in our processing activities, applicable law, or our services. Where changes are material, we will notify you via the Platform or by email prior to the changes taking effect. The "Last updated" date at the top of this document indicates when it was most recently revised. We encourage you to review this Privacy Notice periodically.