Connect Privacy Notice

Effective December 31, 2025

---

Privacy and security are very important to us at Connect Ltd. (together with any affiliate entities listed in Section XI below, referred to here as “Connect,” “we”, “us,” or “our”).  We respect and protect the privacy of those who explore our Services (generally, “Consumers”) and the Consumers who sign up for and access our Services (our “Users”) (Consumers and Users referred throughout this notice as “you” and “your”).

This Privacy Notice (the “Notice”) describes how we collect, use, and share your personal information when you explore, sign up for, or access our Services, which include any Services offered on or through: (i) our websites, including without limitation www.zerohash.com; (ii) the websites of any Platforms or Merchants that use our Services; (iii) when you use our Connect application or interface, whether directly or through a third party’s service or application that uses or relies on our Connect application or interface (together, the “Apps”) like a Platform or Merchant; or any other related Connect Services.

You should read this Notice carefully as it contains important information about your privacy rights and choices.  Except for residents of the United Kingdom (“UK”) and the European Union (the “EU”) or as otherwise noted in one of the Appendices referenced below, if you continue to access or use our Services after receiving this Notice that means you accept this Privacy Notice and its terms.

Connect’s Data Practices

Because we collect, use, and are responsible for certain personal information about Consumers or Users in numerous jurisdictions, we are subject to various laws in the United States and other jurisdictions, including the EU’s General Data Protection Regulation (“EU GDPR”) which applies across the European Union and its United Kingdom GDPR equivalent (“UK GDPR” and collectively with EU GDPR, “GDPR”). Please see the Appendices to this Privacy Notice for specific terms that apply to you if you are a resident of the following jurisdictions :

• Appendix A: United States Privacy Notice Appendix (including California)

• Appendix B: Brazil Privacy Notice Appendix

It is important that you understand how we use your information. You should read this page in full, but below are the key highlights and some helpful links:

• We may collect data that identifies or is associated with you ("personal information" or “PII”) when you access or use our websites, blogs, mobile sites, applications, widgets, Apps, APIs, SDKs, and other interactive features, when you register or attend an event organized or hosted by us, or when you otherwise contact us or provide us your PII (our "Services");

• We may collect your PII when you use our Services directly or when you access or utilize our Services through a third-party like a Platform or Merchant.

• If you do not wish for your personal information to be collected, used, or disclosed as described in this Privacy Notice, or you are under 18 years of age, you should stop accessing our Services immediately, including through any third-party;

• We collect, use, and process your personal information in order to provide our Services to you, improve our Services, monitor the use of Services, protect the security and integrity of our Services and the related systems, and meet our legal or regulatory obligations;

• We share your personal information with: (i) our affiliates and associated entities including those listed in Section XI below (collectively, the “Connect Affiliates”), (ii) any service or third-party that you used to apply for a Connect account, an account with any Connect Affiliates, and/or use to access or use our Services, whether directly or indirectly (“Platform”), (iii) any service or third-party you connect your Connect account with in order to make a purchase, send or transmit funds or assets (including cryptocurrency or stablecoins), receive payment in any form, or otherwise complete a financial transaction (a “Merchant”), and (iv) as well as our trusted third-party professionals and service providers, in order to offer our Services and fulfill our legal and regulatory requirements;

• We offer privacy opt-out tools for you to request access to or deletion of information we hold about you. You can use these tools by visiting our affiliated Support Portal. Depending on where you live, you may also have other privacy rights under law, which we address therein; and.

• If you have any questions, please Contact Us on the affiliated Support Portal or at [e-mail].

I. WHAT INFORMATION WE COLLECT

We collect data about Consumers, Users, or other visitors to our websites and any affiliated blogs, mobile sites, or applications; and about Users that access, directly or indirectly, our Services or Apps, or any other Consumers or Users that attend events organized or hosted by us; and about our clients, including any Platforms or Merchants, including their employees, agents and representatives (and these individuals about whom we collect data are incorporated into any reference to "you" or “your” in this Privacy Notice). Please refer to the below for further information about the personal information we may collect and how it may be used:

A. Information You Provide To Us

Information Category	Description
Basic Information	Name; Address; Date of birth; Nationality; Country of residence; Phone number; Email Address; Website; or similar
Supplemental Identification Information	Photographs and/or videos; Government-issued identity document (e.g., passport, driver’s license, or state identification card); Social security number; Employment information (e.g., company name, industry, etc.); Proof of residency; or similar
Electronic Identification (“EIDV”) Information	Biometric information generated based on photos, videos, or similar electronically identifiable biometric data you provide in order for us to verify your identity or location
Financial Information	Bank account number; Payment card numbers; Trading and investment experience; Tax identification number; Income types; net assets/wealth verification; Source of funds; Account balances; or similar
Crypto or Wallet Information	When utilizing our cryptocurrency, digital asset, or other cryptographic Services, we collect your associated personal information, including: wallet addresses; digital transaction information; public and private chain information; and information related to cryptographic integrations
Preferences	user settings and preferences selected on our Website, Apps, or otherwise when using our Services
Transaction Information	Information about the transactions made on our Services, such as: Name of the sender; Name of the recipient; Amount; Currency (fiat and/or digital); Payment method; Date; and/or Timestamp
Additional information you submit to us	Communications such as survey responses or Customer service information (e.g., emails or call recordings provided by you to our customer service teams)
Institutional Information (only for institutional Consumer or Users)	Employer Identification number (or comparable number issued by a government); Legal name; Jurisdiction of formation; Entity type; and Personal identification information for all beneficial owners of your business

B. Information Collected Automatically

Information Category	Description
App, browser, and device information and location data	Information about the device, operating system, and browser you’re using; Other device characteristics or identifiers (e.g., network connection characteristics); IP addresses or other location metadata
Product Usage Information	Information about your viewing history and logs from visiting the websites or using our Apps or Services, including diagnostic information about the performance of websites, Apps, or Services
Information from cookies and similar technologies	Please see our affiliated Cookies Policy for additional information

C. Information we obtain from Affiliates and Third-Parties

Information Category	Description
Connect Affiliate Information	We may obtain information about you, such as; Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Preferences; Transaction Information; Additional Information You Submit; Institutional Information (as applicable); App, browser, and device information and location data;  Product Usage Information; and Information from cookies and similar technologies; from other Connect Affiliates as part of normal business practices or to adhere to applicable legal and regulatory requirements.
Platform or Merchant  Account Information	We may obtain information about you, such as; Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Institutional Information (where applicable); Transaction Information; App, browser, and device information and location data; and Product Usage Information; from the Platform you used to sign up for and access the Connect Services or the Merchant you used to connect to or utilize the Connect Services.
Public Database Information	We obtain information about you from public databases – including without limitation from the UN Sanctions List, OFAC Screening List, and EDGAR – which may include your name, address, email address, phone number, gender, national ID number and nationality/country of residence, date of birth, job role, public employment profile, listing on any sanctions lists maintained by public or regulatory authorities, and other data as necessary
Blockchain Data	We may analyze public blockchain data, including timestamps of transactions or events, transaction IDs, digital signatures, transaction amounts, and wallet addresses
Information from our Marketing and Advertising Partners	We may receive information such as your name and contact information from our marketing partners, potentially including in what content you viewed or the actions you take on our Website or Apps
Information from Analytics and Providers	We may receive information such as your name and contact information from our marketing partners, potentially including in what content you viewed or the actions you take on our website or Apps
Retail Merchant Information	When you use your Connect account to conduct a transaction with a third-party merchant, the merchant may provide us with data about you, such as your name and contact details, and your transaction with that merchant
Research and Survey Information	We may use third party service providers to conduct surveys to better understand our Consumers’ or Users’ experience and improve our Services.

II. HOW WE USE YOUR INFORMATION

We use your personal information to deliver, personalize, operate, improve, create, and develop our Services, to provide you with a secure, smooth, efficient and safe experience, and for legal and regulatory compliance, theft and loss prevention, and anti-fraud purposes. Below is additional information about how we use your personal information and our legal basis for doing so:

A. As Necessary to Perform a Contract with Users

We may use certain information that is necessary to perform our duties under an applicable Connect Affiliate company user agreement (e.g., the Connect User Agreement) or similar customer or end-user agreement or other relevant contract with you. We may need to suspend or terminate our Services or otherwise close your user account if we cannot process your personal information or similar data for these purposes.

Why & How We Use Your Information	Information Categories Used
To create and maintain your User account In order to provide you with our Services, and to allow you to set up a customer account and profile.	Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Institutional Information (as applicable); App, browser, and device information and location data; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information
To provide you with Connect or other crypto Services In order to provide you with Services to buy, sell, save, trade, or spend digital assets within your account, including hosting and maintaining your digital wallets.	Basic Customer Information; Supplemental Identification Information; Financial Information; Crypto Information; Transaction Information; Institutional Information (as applicable); App, browser, and device information and location data; Product Usage Information; Information from cookies and similar technologies; Connect Affiliate Information, Platform or Merchant Account Information; Blockchain Data
To provide you with Third-Party Access In order to provide you with Third-Party Access, which may include tools, such as APIs, SDKs, or other infrastructure for accessing our Services, which may include sharing information with the Platform(s) you used to sign up for or access the Connect Services.	Basic Customer Information; Supplemental Identification Information; Financial Information; Preferences; Institutional Information(as applicable); App, browser, and device information and location data; Product Usage Information; Connect Affiliate Information; Platform or Merchant Account Information
To provide customer support To address your request for support on the Websites or by email and to respond to customer care and other inquiries, including providing telephone-based support to Users (who provide their telephone numbers), chat message support, and other social support.	Basic Customer Information; Supplemental Identification Information; Financial Information; Crypto Information; Transaction Information; Product Usage Information; Additional information you submit to us; Institutional Information(as applicable); Connect Affiliate Information; Platform or Merchant Account Information
To send Service communications To send you administrative or account-related communications about our Services, which can include security updates or transaction-related information, through email, telephone, or in-product/push notifications. You may not opt-out of receiving critical service communications, such as emails or mobile notifications sent for legal, regulatory, or security purposes.	Basic Customer Information; Crypto Information; Transaction Information; Product Usage Information; Additional information you submit to us; Institutional Information(as applicable); Connect Affiliate Information; Platform or Merchant Account Information
To ensure or promote the safety, security, and integrity of our Services To verify accounts and related activity, find and address violations of a Connect Affiliate company User Agreement, investigate suspicious activity, detect, prevent and combat harmful or unlawful behavior, detect fraudulent behavior, comply with applicable laws and to maintain the integrity of our Services.	Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Transaction Information; Institutional Information(as applicable); App, browser, and device information and location data; Product Usage Information; Information from cookies and similar technologies; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information; Blockchain Data

B. Data used to comply with our legal obligations

Our Services are subject to laws and regulations – including laws in the local jurisdiction you sign up for or access the Connect Services – that require us to collect, use, and store your personal information in certain ways and for specified periods. If you do not provide and continue to provide access to the personal information as required by law, we may have to suspend or close your account.

Why & How We Use Your Information	Information Categories Used
To verify your identity We are generally required to collect various pieces of personal information to properly identify or verify your identity and comply with other specific anti-money laundering (“AML”) or sanctions laws/regulations (e.g., funds transfer rules). Our verification processes may also involve electronic identification through the comparison of your photo against your provided verification information. All such information is securely maintained by Connect and its service providers, and is only disclosed when and where required by law.	Basic Customer Information; Supplemental Identification Information; EIDV Information; Institutional Information (as applicable); App, browser, and device information and location data; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information
To determine your legal eligibility for certain regulated products When you use certain locally regulated products or engage in certain advanced trading activities, we may be required to carry out additional checks to ensure your suitability (e.g., under the European Market Infrastructure Regulation).	Basic Customer Information; Supplemental Identification Information; Financial Information; Crypto Information; Institutional Information (as applicable); App, browser, and device information and location data; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information
To comply with other Connect Affiliate legal and regulatory obligations We may access, read, preserve, and disclose information when we believe it is reasonably necessary to comply with applicable law, legal obligations, regulations, law enforcement, governmental, and other legal requests, court orders, or for disclosure to tax authorities.	Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Transaction Information; Additional information you submit to us; Institutional Information (as applicable); App, browser, and device information and location data; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information; Blockchain Data
To comply with other Platform legal and regulatory obligations We may access, read, preserve, and disclose information to the Platform(s) through which you signed up for or access the Connect Services when we believe it is reasonably necessary to comply with applicable law, legal obligations, regulations, law enforcement, governmental, and other legal requests, court orders, or for disclosure to tax authorities.	Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Transaction Information; Additional information you submit to us; Institutional Information (as applicable); App, browser, and device information and location data; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information; Blockchain Data

C. Data use for our Legitimate Interests

We rely on our legitimate interests or those of third parties (like Platforms, our other customers and potentially the public) where they are not outweighed by your rights. In certain jurisdictions – including the EEA and UK – you may have the right to object to, and seek the restriction of this processing.

Why & How We Use Your Information	Legitimate Interest(s)	Information Categories Used
To customize or improve our Services for you and others In order to improve the experience with our Services, we collect information about your online activity while you are using the Services.	It is in our interest to understand how you interact with the Services in order to customize and/or improve our products and Services and enable accurate and reliable reporting.	Basic Customer Information; Preferences; Transaction Information; Additional information you submit to us; Institutional Information (as applicable); App, browser, and device information and location data; Product Usage Information; Information from cookies and similar technologies
To preserve and share information with others, including law enforcement, regulators, civil litigants, and others who may issue vetted legal requests Where not otherwise required by law, and depending on the circumstances, we may preserve and share your information: - as required to respond to third parties legal and regulatory requests (e.g., fraud investigations); - to promote the safety, security, and integrity of the Connect Service or support thereof; - to protect Connect in litigations or other disputes; or - to respond to Consumer/Users/claimant requests, communications, litigations or disputes.	It is in our interest and the interest of the general public to prevent and address fraud, unauthorized use of the Services, violations of our terms or policies, or other harmful or illegal activity; to protect Connect and Connect Affiliates, our Consumers or Users, or others, including as part of investigations or regulatory inquiries; to defend our legal rights and resolve disputes; to secure our platform and network, to verify accounts and activity, to combat harmful conduct, to detect, prevent and address fraud, abuse, spam and other bad experiences or to prevent death, imminent bodily harm, or exploitation.	Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Preferences; Transaction Information; Additional information you submit to us; Institutional Information (as applicable); App, browser, and device information and location data; Product Usage Information; Information from cookies and similar technologies; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information; Blockchain Data; Information from our Marketing Partners; Information from Analytics and Providers; Retail Merchant Information; Research and Survey Information
To promote safety, security and integrity Outside of performing our contract with you, we may use and analyze your information to protect the integrity of our Services.	It is in our interest and the interests of our Consumers and Users to secure our platform and network, to verify accounts and activity, to combat harmful conduct, to detect, prevent and address fraud, abuse, spam and other bad experiences.	Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Transaction Information; App, browser, and device information and location data; Product Usage Information; Information from cookies and similar technologies; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information; Blockchain Data
To provide customer support To provide communications and customer support through our Customer Support team and User Research team, including communications with interfaces such as our chatbots.	It is in our interest and our Consumers’ or Users’ interest to provide customer support and improve our Services.	Basic Customer Information; Supplemental Identification Information; Financial Information; Crypto Information; Transaction Information; Product Usage Information; Additional information you submit to us; Institutional Information(as applicable); Connect Affiliate Information; Platform or Merchant Account Information

D. Data use based on your consent

When we use your information based on your consent, you have the right to withdraw your consent at any time on a go-forward basis (which will not affect our prior use of your data, based on your previously given consent). Please see our Privacy Opt Out or contact Customer Support to make changes to your consent preferences.

Why & How We Use Your Information	Information Categories Used
To enable device-based settings Collecting information that you allow us to receive through the device-based settings you enable (such as access to your location, camera or photos) which we use to provide the features or services described when you enable the setting	Basic Customer Information; Preferences; Institutional Information (as applicable); App, browser, and device information; Product Usage Information; Information from cookies and similar technologies
To provide marketing communications to you To send you targeted marketing communications through email, mobile, or push notifications or by SMS or text message.	Basic Customer Information; Preferences; Transaction Information; Additional information You Provide to Us; Institutional Information (as applicable); App, browser, and device information; Product Usage Information; Information from cookies and similar technologies; Information from our Marketing Partners; Information from Analytics and Providers; Research and Survey Information

E. Data use to protect your or others’ vital interests

Why & How We Use Your Information

Information Categories Used

Preserving, reviewing, and sharing information with law enforcement and others We may preserve, review, and share information with law enforcement and others in circumstances where someone’s vital interests require protection, such as in the case of emergencies. For example, where there is a risk to the well-being or life of a Connect Consumer or User.

Basic Customer Information; Supplemental Identification Information; EIDV Information; Financial Information; Crypto Information; Transaction Information; Institutional Information (as applicable); App, browser, and device information and location data; Product Usage Information; Information from cookies and similar technologies; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information; Blockchain Data

If you reside outside the UK or EEA, the legal bases on which we rely in your country may differ from those listed above.

III. HOW AND WHY WE SHARE YOUR INFORMATION

We work with service providers, partners and other third parties to help us provide our Services, and as a result we need to share certain information with these third parties.  Here’s how:

A. Affiliates

Personal information that we process and collect may be transferred between Connect Affiliate companies, Services, and personnel affiliated with us as a normal part of conducting business and offering our Services to you and to comply with our legal or regulatory obligations. See Section XI. for a list of our affiliated companies.

B. Platform Third Party

Personal information that we process and collect may be transferred between Connect and the Platform or Merchant which you use to sign up for and/or access the Connect Services as a normal part of conducting business and offering our Services to you and to comply with our respective legal or regulatory obligations. Please note that when you use a Platform or Merchant’s other services and products, which are not governed by this Privacy Notice, the Platform or Merchant’s own terms and privacy policies will govern your use of those services and products.

C. Linked Third Party Websites or Applications

When you utilize certain Services that use third-party services or websites (e.g., AML/KYC services, pay with crypto, withdrawal services, etc.) that are linked through to our Services, the providers of those services or products may receive information about you that Connect, you, or others share with them. Please note that when you use third-party services or websites, which are not governed by this Privacy Notice, their own terms and privacy policies will govern your use of those services and products.

D. TRUST

TRUST is a global, secure, and industry-driven solution designed to comply with a requirement known as the Travel Rule while protecting your security and privacy. Connect, including Connect Affiliates, and other custodial cryptocurrency exchanges and financial institutions share certain basic information about their customers when sending funds over a certain amount to another financial institution. To learn more, see Travel Rule FinCEN Advisory.

E. Professional advisors, industry partners, authorities and regulators

We may share your information described in Section I. with our professional advisors, regulators, tax authorities, law enforcement, government agencies, Platforms, and industry partners to:

• respond pursuant to applicable law or regulations, court orders, legal process or government requests; 

• comply with our reporting and information sharing obligations with industry partners (e.g., other Virtual Asset Service Providers (“VASPs”) and regulatory authorities)

• detect, investigate, prevent, or address fraud and other illegal activity or security and technical issues; and 

• protect the rights, property, and safety of our Consumers, Users, Connect or Connect Affiliates, or others, including to prevent death, imminent bodily harm, or exploitation.

F. Asset Transfer or Company Acquisition

We may choose to buy or sell assets, and may share and/or transfer information about our Consumers or Users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, your personal information could be one of the assets transferred to the acquiring party.

G. Third-Party Service Providers

We work with third-party service providers to help us provide our Services. When we share information with third-party service providers in this capacity, we require them to use your information on our behalf in accordance with our instructions and terms and only process as necessary and proper for the limited purpose of the contract. We work with different types of third-party service providers, including:

Why & How We Use Your Information	Information Categories Used
Third-Party Electronic ID Verification Service Vendors, including those that process biometric information In the US, we may use Plaid Inc. (“Plaid”) to verify your identity through verification of identifiable personal information. The information collected from you may include biometric data. Plaid’s Privacy Policy, available at https://cognitohq.com/privacy-statement, describes its collection and use of personal information. In other jurisdictions, we may use Persona Identities Inc. (“Persona”) to verify your identity through verification of identifiable personal information. The information collected from you may include biometric data. Persona’s Privacy Policy, available at https://withpersona.com/legal/privacy-policy, describes its collection and use of personal information.	Basic Customer Information; Supplemental Identification Information; EIDV Information; Additional information You Provide to Us; Institutional Information (as applicable); App, browser, and device information and location data; Connect Affiliate Information; Platform or Merchant Account Information; Public Database Information
Vendors for tax reporting Retail merchants (to provide rewards/incentives) Telecommunications technology providers (to send you messages, including SMS messages) AML service providers (for the purposes of transaction monitoring) Data hosting service providers and payment vendors (for off-site data hosting) Security service providers (for investigating fraud and security incidents) Analytics providers (to understand how you use our Services) Payment processing companies (to process transactions on our behalf) Document repository services providers Customer support vendors	Basic Customer Information; Supplemental Identification Information; Financial Information; Crypto Information; Transaction Information; Additional information You Provide to Us; Institutional Information (as applicable); App, browser, and device information and location data; Connect Affiliate Group Information; Platform or Merchant Account Information; Public Database Information; Blockchain Data

IV. HOW LONG WE RETAIN YOUR PERSONAL INFORMATION

We retain your information as needed to provide our Services, comply with legal or regulatory obligations, or protect our, your, or others’ vital or necessary interests. While retention requirements vary by country, we maintain internal retention policies on the basis of how information needs to be used. This includes considerations such as when the information was collected or created, whether it is necessary in order to continue offering you our Services, whether we are required to hold the information to comply with our legal obligations, including AML/KYC compliance and other regulatory obligations, whether we need it is necessary to protect a vital interest, or if it meets other information preservation requirements. We also keep certain information where necessary to protect the safety, security and integrity of our Services, Platforms, Consumers, and Users. Our third-party electronic identity verification providers collect and retain information, which may include biometric information, for the period required for financial regulatory compliance or otherwise as required by applicable law. They retain this information as described in their respective policies.

In line with these considerations, we delete information that is no longer required or needed for the above purposes when you close your account, or when you request deletion of your information (which you can initiate through our Privacy Opt Out), and delete any other information when permitted pursuant to the above considerations.

V. CHILDREN'S PERSONAL INFORMATION

The Services are not directed to persons under the age of 18, and we do not knowingly request or collect any information about persons under the age of 18. If you are under the age of 18, please do not provide any personal information to any Connect Affiliate company. If a User or Customer submitting personal information is suspected of being under 18 years of age, we will require the relevant Customer or User to close the account, and will take all reasonable steps to delete or purge the individual’s information as soon as possible.

VI. INTERNATIONAL TRANSFERS

To facilitate our global operations, Connect, its Affiliates, third-party partners, and service providers may transfer, store, and process your personal information throughout the world, including Australia, Bermuda, Brazil, Germany, the Netherlands, the UK, and the United States. Further information is available at Appendix C.

If you reside in the EEA, Switzerland, or the United Kingdom, we rely upon a variety of legal mechanisms to facilitate these transfers of your personal information (collectively, “European Personal Data”).

• We rely on the European Commission and the UK Information Commission Office’s Standard Contractual Clauses to facilitate the international and onward transfer of European Personal Data to third countries, including from our EU and UK operating entities to Connect Affiliate entities in the United States. For further information about our standard contractual clauses, please contact [e-mail].

• We further rely on exemptions and adequacy decisions provided for under data protection law for our international transfers, including from the European Commission. For example, we operate globally and need to share information with Connect Affiliate companies and to data centers outside the EEA in order to develop and Connect Services (Article 49(1)(b) GDPR). In addition, we may rely on certain exemptions for sharing personal information with law enforcement or regulators outside of the EEA in emergency situations (Article 49(1)(f) GDPR).

VII. YOUR PRIVACY RIGHTS AND CHOICES

Depending on where you live, you may be able to exercise certain privacy rights related to your personal information. For any of your privacy rights and choices referenced below, requests relating to your personal information can be made by contacting Customer Support or by submitting a request via our Privacy Opt Out or at [e-mail]. If any of the rights listed below are not provided under law for your operating entity or jurisdiction, Connect has absolute discretion in honoring your request regarding these rights.

• Right to access and portability: 

You may request that we provide you a copy of your personal information held by contacting Customer Support, or by submitting a request [e-mail].

• Right to rectification:

You may update or request us to rectify or update any of your personal information held by Connect that is incomplete or inaccurate by logging in to your Platform or Merchant account and/or Connect account and updating the details in your account profile, by contacting Customer Support, or by submitting a request [e-mail].

• Right to deletion/erasure: 

You may request to erase your personal information, subject to applicable law. If you close your Connect Account, we will retain or delete information associated with your account in accordance with our obligations under applicable law and as described in Section IV.

• Right to withdraw your consent: 

To the extent the processing of your personal information is based exclusively on your consent, you may withdraw your consent at any time. The lawfulness of Connect’s processing before you withdraw your consent will not be affected by such withdrawal.

• Right to object to or restrict processing: 

You may have the right to restrict or object to us using or transferring your personal information based on our legitimate interests, in the public interest, or for marketing purposes. We may continue to process your personal information where permitted or required by applicable law. You can opt-out of certain processing or communications by contacting Customer Support, or by submitting a request [e-mail]. 

• Right to non-discrimination:

We will not discriminate against you for exercising any of your rights provided to you under law.

• Right to lodge a complaint:  

If you reside in the EEA, Switzerland, or the UK, you have the right to lodge a complaint about our practices with respect to your personal information with the supervisory authority of your country or state. In the UK, the relevant data protection authority is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, [phone], email: [e-mail]. In the Netherlands, the relevant data protection authority is the Dutch Personal Data Authority, PO Box 93374, 2509 AJ, The Hague, Netherlands, ([phone], email: [e-mail] or by using the following Online Form.

If you reside in Australia, you may lodge a complaint about our practices with respect to your personal information with the supervisory authority of your country. In Australia, the relevant data protection authority is the Office of the Australian Information Commissioner, and complaints may be made through their website at www.oaic.gov.au.

To protect your privacy and security, we may take steps to verify your identity before complying with your request and we may decline your request if we are unable to verify your identity.

Under certain US data privacy laws, as well as in Brazil, you may also designate an authorized agent to make these requests on your behalf. 

These rights are not absolute, and may be denied: (a) when granting access or assisting portability would adversely affect the rights and freedoms of others; (b) to protect our rights and properties; (c) where the request is frivolous, vexatious, or abusive; or (d) as otherwise permitted by law.

VII. ADDITIONAL PRIVACY NOTICES FOR RESIDENTS OF SPECIFIC JURISDICTIONS

1. If you are a United States Resident, you can learn more about how we use your information and your privacy rights, including rights provided to residents of certain states like California, by reviewing Appendix A: United States Privacy Notice. Any terms defined in the California Consumer Privacy Act (as amended) (“CCPA”) have the same meaning when used in the US Privacy Notice.

2. If you are a Brazilian Resident, you can learn more about how we use your information and your privacy rights by reviewing Appendix B: Brazil Privacy Notice. Any terms defined in the Brazil General Data Protection Law (“LGPD”) have the same meaning when used in the Brazil Privacy Notice.

IX. HOW TO CONTACT US WITH QUESTIONS

If you have questions or concerns regarding this Privacy Notice, or if you have a complaint, please reach out to us at Customer Support or at [e-mail], or by writing to us at the address of your Connect service provider, provided in Section XI.

X. CHANGES TO THIS PRIVACY NOTICE

We’re constantly trying to improve our Services, so we may need to change this Privacy Notice from time to time as well. We post any changes we make to our Privacy Notice on this page and, where appropriate, we will provide you with reasonable notice of any material changes before they take effect or as otherwise required by law. The date the Privacy Notice was last updated is identified at the top of this page.

We may provide additional specific or immediate disclosures or information about how we collect or use your information in the context of specific Services; these in-product or supplemental notices may supplement or clarify our privacy practices or may provide you with additional information or choices about how we use your information.

XI. OUR RELATIONSHIP WITH YOU

Connect will maintain a direct relationship with you and serve as your primary point of contact for all Services we provide and regarding any terms of our relationship defined in the Connect User Agreement.  In addition, to ensure: (i) you received the best possible service and (ii) we meet all applicable regulatory requirements and guidelines you may be required to open or maintain an account or relationship with a local Connect Affiliate, which is described in greater detail in the Connect User Agreement.  We may also share your personal information with these affiliates to: (i) meet our legal or regulatory requirements, (ii) provide the Services under our contracts with you, or (iii) to protect our respective legitimate interests. A list of applicable affiliates is disclosed below for your ease of reference throughout this Notice:

1. If you reside in the EU or Switzerland, Connect Ltd. may act as joint controller, together with its affiliates Zero Hash Europe B.V. or Zero Hash Payments Europe B.V., with respect to your personal information and has primary responsibility thereto, including with respect to providing you with information and responding to any requests you may make under the GDPR.

2. If you reside in the UK, Connect Ltd. may act as joint controller, together with its affiliate Zero Hash UK Ltd., with respect your personal information and has primary responsibility thereto, including with respect to providing you with information and responding to any requests you may make under the UK GDPR.

3. If you reside in the United States or Canada, Connect Ltd. may act as joint controller, together with its affiliates Zero Hash LLC and Zero Hash Trust Company LLC, with respect to your personal information and has primary responsibility thereto, including with respect to providing you with information and responding to any requests you may make under applicable law.

4. If you reside in Australia or New Zealand, Connect Ltd. may act as joint controller, together with its affiliate Zero Hash Australia PTY Ltd., with respect to your personal information and has primary responsibility thereto, including with respect to providing you with information and responding to any requests you may make under applicable law.

5. If you reside in Brazil, Connect Ltd. may act as joint controller, together with its affiliate Zero Hash Brazil Limitada, with respect of your personal information and has primary responsibility thereto, including with respect to providing you with information and responding to any requests you may make under the LGPD.

6. If you reside in any other jurisdiction not other listed in this Section IX, Connect Ltd. acts as controller with respect to your personal information and has primary responsibility thereto, including with respect to providing you with information and responding to any requests you may make under the applicable law, including without limitation the Bermuda Personal Information Protection Act (PIPA).

   ---

APPENDIX A

 

United States Privacy Notice

Updated: December 31, 2025

This United States Privacy Notice (“Notice”) is for Connect Consumers or Users living in the U.S., and clarifies or further describes how we collect, use, and disclose your personal information. This Notice supplements the Connect Global Privacy Notice (“Privacy Notice”). For purposes of the Notice, the terms “personal information” and “sensitive personal information” encompass the terms “personal data” and “sensitive personal data” and have the meaning provided under applicable U.S. state privacy laws, including the California Privacy Rights Act of 2020 (“CCPA”).  Any capitalized terms not defined herein shall have the meaning provided in the Privacy Notice.

Continued Use. By continuing to use the Connect Services, Apps, APIs, or SDKs, by accessing or using our websites, or by contacting us on our systems, you agree to this Notice and the Global Privacy Notice.

Purpose for Collection and Disclosure of Personal Information. We’ve collected and disclosed the below categories for personal information to create, develop, operate, deliver, and improve our Services, to communicate with you, to ensure the safety, security and integrity of our Services, and for the business and commercial purposes outlined in Section II and Section III of the Privacy Notice. We do not collect, use, or disclose sensitive personal information for purposes other than those specified in this Privacy Notice, to provide the Services, or as permitted under applicable law. In addition, to the extent that Connect de-identifies personal information, we take reasonable measures to maintain and use the information in a de-identified manner and do not make any attempts to re-identify such information, except as permitted under applicable law.

Collection and Disclosure of Personal Information.  We collect the below categories of personal information, and disclose the specified types of personal information below (as that data is further referenced and outlined in Section I of the Privacy Notice) with the following categories of third parties:

Category of Personal Information	Information Collected and  Disclosed	Categories of Recipients
Personal Identifiers	Basic User Information; Supplemental Identification Information; Institutional Information (as applicable); Financial Information	Platforms; Third party identity verification services; Financial institutions; Service providers; Professional advisors;  Connect Affiliates; Law enforcement/Regulators
Protected personal data classifications under California and federal law, (e.g., gender, age, and citizenship)	Supplemental Identification Information; EIDV Information	Platforms; Third party identity verification services; Service Providers; Connect Affiliates; Law enforcement/Regulators
Commercial information such as records of services purchased, obtained, or considered	Transaction Information	Platforms; Third party identity verification services; Financial institutions; Service providers; Professional advisors;  Connect Affiliates; Law enforcement/Regulators
Internet or other electronic network activity information	Product Usage Information; App, browser, and device information; Information from cookies and similar technologies	Platforms; Third party identity verification services; Service providers; Professional advisors; Connect Affiliates; Law enforcement/Regulators
Geolocation data	App, browser, and device information	Platforms; Third party identity verification services; Service providers; Professional advisors; Connect Affiliates; Law enforcement/Regulators
Audio, electronic, visual, or similar information	Additional information You Provide to Us; Information from our Marketing Partners; Information from Analytics and Providers; Research and Survey Information	Platforms; Third party identity verification services; Service providers; Professional advisors; Connect Affiliates; Law enforcement/Regulators
Professional or employment related information	Basic User Information; Supplemental Identification Information; Institutional Information (as applicable); Financial Information	Platforms; Third party identity verification services; Financial institutions; Service providers; Professional advisors;  Connect Affiliates; Law enforcement/Regulators
Inferences about preferences, characteristics, predispositions, etc.	Preferences; Additional information You Provide to Us; Information from our Marketing Partners; Information from Analytics and Providers; Research and Survey Information	Platforms; Service providers; Professional advisors;  Connect Affiliates; Law enforcement/Regulators

Collection and Disclosure of Sensitive Personal Information. We collect and disclose the following categories of sensitive personal information, with the following categories of third parties:

Category of Personal Information	Information Collected and  Disclosed	Categories of Recipients
Government identifiers	Supplemental Identification Information; EIDV Information	Platforms; Third party identity verification services; Service providers; Professional advisors;  Connect Affiliates; Law enforcement/Regulators
A consumer’s account log-in, financial account, payment card number in combination with any required security or access code, password, or credentials allowing access to an account	Basic User Information; Supplemental Identification Information; EIDV Information
The contents of a consumer’s mail, email, and text messages	Additional information You Provide to Us; Information from our Marketing Partners; Information from Analytics and Providers; Research and Survey Information	Platforms; Third party identity verification services; Service providers; Professional advisors; Connect Affiliates; Law enforcement/Regulators
Biometric information (via our service providers)	EIDV Information	Platforms; Third party identity verification services; Connect Affiliates; Law enforcement/Regulators

Sources of Personal Information. We gather various types of personal information from our Consumers or Users who access or use our Services from a range of sources, such as:

• information you give us when you sign up for, or otherwise use our Services;

• information we receive from our Affiliates and third parties; and

• information we collect automatically through cookies and similar technologies (see our Cookie Policy for more information on this type of information).

Selling or Sharing of Personal Information. We share (as that term is defined in the CCPA) identifiers with third party analytics providers or advertising partners, for analytics and advertising purposes.

We do not have actual knowledge that we sell or share the personal information of individuals under 16 years of age.

How Long We Retain Your Personal Information.

We retain your information as needed to provide our Services, comply with legal obligations, or protect our or others’ interests. We decide how long we need information on a case-by-case basis.

• Here is what we consider:
• When the information was collected or created,
• Whether it is necessary in order to continue offering you our Services,
• Whether we are required to hold the information to comply with our legal obligations, including AML/KYC compliance or other financial regulatory obligations, or information preservation requirements.
• We also keep certain information where necessary to protect the safety, security and integrity of our Services, Consumers, and Users.

Privacy Rights. Residents of specific states (e.g., California) have certain rights with respect to personal information collected and processed under state privacy laws.  You may exercise the following rights, subject to certain exceptions and limitations:

• Right to Know. You have a right to request the following information about our collection, use and disclosure of your personal information, and ask that we provide you with a copy of the following: 
  • categories of and specific pieces of personal information we have collected, sold, or shared about you; 
  • categories of sources from which we collect personal information; 
  • the business of commercial purposes for collecting personal information; 
  • categories of third parties to whom the personal information was disclosed for a business purpose; and 
  • categories of personal information disclosed about you for a business purpose.  
• Right to Correct. You have a right to request that we correct inaccurate personal information maintained about you. 
• Right to Delete. You have a right to request that we delete personal information, subject to certain exceptions. 
• Right to Opt Out. You have the right to opt out from the “sale” / “sharing” of your personal information, including the processing of your personal information for purposes of targeted advertising.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.

Exercising Your Rights. You may exercise your rights by contacting us at Customer Support or at [e-mail]. We may take steps to verify your identity before complying with your request to protect your privacy and security, and may decline your request if we are unable to verify your identity. To verify your identity, we may collect information such as your email address, government issued ID, or date of birth, before providing a substantive response to the request. 

Authorized Agent. Under certain U.S. state privacy laws, you may designate an authorized agent to exercise privacy rights on your behalf. To do so, you must: (1) provide that authorized agent written and signed permission to submit such a request; and (2) verify your own identity directly with us. Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

Appeal. You have the right to appeal Connect’s decision regarding a privacy right request.  In order to appeal a declined request, please email [e-mail].

Questions. If you have questions or concerns regarding this Notice, or if you have a complaint, please contact us at Customer Support or at [e-mail], or by writing to us at the address of your Connect service provider (provided in Section XI of the Privacy Notice.

---

APPENDIX B

 

Brazil LGPD Notice

Updated: December 31, 2025

This Brazil LGPD Notice (“Notice”) is part of the Connect Privacy Notice and is applicable to Consumers, Users, or clients of Connect Limited in Brazil (“Connect” herein), a Bermuda limited company, registration No. 20254744, an affiliate of a Zero Hash Brazil Limitada, a limited company enrolled with the CNPJ No. 46.534.916/0001-22, with its head office at Avenida Brigadeiro Luis Antonio, 300, 10th floor, conjunto 104, in the city of São Paulo, state of São Paulo, CEP 01318-903.

The purpose of this Notice is to illustrate Connect's commitment to processing data in accordance with its responsibilities under the Law No. 13,709 of August 14th, 2018 - General Data Protection Law (“LGPD”). Connect is committed to protecting the privacy and security of your personal data. The information you share with Connect and its affiliates worldwide (the “Connect Affiliates”) allows Connect to provide you the best experience with our products and services. Connect has implemented a privacy program to protect all personal data collected and to help Connect properly handle your personal data.

This Notice explains our specific privacy practices in Brazil. Please read this notice together with the Connect Privacy Notice to understand how Connect collects and uses your personal data. Should any terms conflict, the terms of this Notice shall control. Any capitalized terms not defined herein shall have the meaning provided in the Privacy Notice.

If you do not agree with the practices or policies described in this Notice or the Connect Privacy Notice, we ask that you discontinue use of our website or other services. Likewise, both this Notice and Connect Privacy Notice may change from time to time and your continued use will be deemed to be acceptance of such changes. 

Definitions

• Anonymization: Refers to the use of reasonable and available technical means at the time of the processing, through which the data loses the possibility of being directly or indirectly associated with an individual.
• Anonymized data: Data that went through the anonymization process, i.e., related to a data subject who can no longer be identified, considering the use of reasonable and available technical means at the time of the processing.
• ANPD: The National Data Protection Authority, which is the federal public administration body responsible for ensuring the protection of personal data and for regulating, implementing and supervising compliance with the LGPD in Brazil.
• Blocking: Temporary suspension of any processing operation, by means of retention of the personal data or the database
• Consent: Means any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by an affirmative action, signifies agreement to the Processing of personal data relating to him or her.
• Controller: A natural person or legal entity, either public or private, that makes decisions about the processing of personal data.
• Data Protection Officer: A person named by the company to act as a channel of communication between the controller, the data subjects and the National Data Protection Authority (ANPD)
• Data subject: Means a natural person, such as an individual, a customer, a prospect, an employee, a contact person, etc, to whom the personal data that are the object of processing refer to.
• Database: Is a structured set of personal data, kept in one or several locations, in electronic or physical support.
• Deletion: Refers to the exclusion of data or a set of data stored in a database, irrespective of the procedure used.
• International transfer of data: Means the transfer of personal data to a foreign country or international organization of which the country is a member. Examples of activities with international data transfer: sharing a database between companies of the same economic group, storing data in data centers located abroad, hiring a cloud computing service provider, among others.
• Operator (or Processor): A natural person or legal entity, either public or private that processes personal data on behalf of the controller.
• Personal data: Any information relating to an identified or identifiable person (data subject).
• Processing: Covers any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, diffusion or extraction.
• Processing Agents: Refers to the controller and the operator (or processor).
• Research body/entity: Means a body or entity from the direct or indirect public administration or nonprofit legal entity of private law, legally organized under Brazilian law, with headquarters and jurisdiction in the Country. This body or entity includes in its institutional mission, in its corporate or statutory purposes basic or applied research of historical, scientific, technological or statistical nature.
• Sensitive personal data: Means the personal data concerning racial or ethnic origin, religious belief, political opinion, trade union or religious, philosophical or political organization membership, data concerning health or sex life, genetic or biometric data, when related to a natural person.
• Shared use of data: Communication, dissemination, international transfer, interconnection of personal data or shared processing of personal databases by public bodies and entities in compliance with their legal powers, or between these and private entities, reciprocally, with specific authorization, for one or more types of processing allowed by these public entities, or between private entities.
• Third Party means a natural or legal person, public authority, agency or body other than the data subject, controller, operator (or processor) who, under the direct authority of the controller or Processor, are authorized to process personal data.

LGPD Principles

Connect will ensure that all activities of processing personal data are done in good faith and in accordance with the principles defined by the Article 6 of LGPD, as follows:

1. Purpose: processing of personal data needs to be done for a legitimate, specific and explicit purpose of which the data subject is informed, with no possibility of subsequent processing in a way incompatible with these purposes.
2. Adequacy: Personal data shall be processed in a manner that is compatible with the purposes informed to the data subject, in accordance with the context of the processing.
3. Necessity (data minimization): Processing of personal data must be limited to the minimum necessary to achieve its purposes, covering only relevant, proportional and non-excessive data in relation to the purposes for which they are processed.
4. Free access: Guarantee to data subjects an easy and free of charge consultation way about the form and duration of the processing, as well as the integrity of their personal data.
5. Quality of the data (accuracy): Guarantee to data subjects the accuracy, clarity, relevancy and updating of the data, according to the need and for achieving the purpose of the processing.
6. Transparency: Guarantee to data subjects a clear, precise and easily accessible information about the carrying out of the processing and the respective processing agents, subject to commercial and industrial secrecy.
7. Security: Use of technical and administrative measures to protect personal data from unauthorized accesses and accidental or unlawful situations of destruction, loss, alteration, communication or dissemination.
8. Prevention: Adoption of measures to prevent the occurrence of damages due to the processing of personal data.
9. Nondiscrimination: Processing of personal data can not be done for unlawful or abusive discriminatory purposes.
10. Accountability: The data processing has to demonstrate the adoption of measures which are efficient and capable of proving the compliance with the rules of personal data protection, including the effectiveness of such measures.

Lawful Purpose of Processing 

All data processed by Connect will be done in accordance with the lawful bases provided by Article 5 of LGPD:

• With your consent¹. Connect will seek consent before using your personal data for commercial purposes, especially when/if the processing involves sensitive personal data. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent will be kept with your personal data. 
• For compliance with legal or regulatory obligations by the controller.
• For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data.
• When necessary for the execution of a contract, agreement or preliminary procedures related to a contract of which you are a party³.
• For the regular exercise of rights in judicial, administrative or arbitration procedures.
• For the protection of life or physical safety of you or a third party, if applicable.
• When necessary to fulfill our legitimate interests controller or of a third party, except when your fundamental rights and liberties which require personal data protection prevail.¹
• For the protection of credit, including as provided in specific legislation.

¹ If we process information based on your consent, you may withdraw such consent at any time, through a free and facilitated procedure. Please contact the Data Protection Officer outlined below to withdraw your consent.

Where communications are sent to you based on your previous consent, the option to revoke your consent (unsubscribe) should be clearly available and systems should be in place to ensure such unsubscription is reflected accurately in Connect’s systems.

² Note that Connect gathers and processes personal data to fulfill its anti-money laundering and know your customer obligations, open and manage your account, and track and monitor account activity. Besides being a regulatory obligation, Connect has determined these activities to be in its legitimate business interest. 

³ Connect also processes your personal data in furtherance of the User Agreement you have entered with Connect, including when onboarding you as a customer, funding your account, processing your orders, facilitating transactions, and processing withdrawals. Connect may share your personal data between its affiliated entities, in Brazil or abroad, or with Third Parties, also both in Brazil or abroad, to facilitate these actions, which are necessary in furtherance of your agreement(s) with Connect.

Connect will take reasonable steps to ensure personal data is accurate, so that, where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date, in accordance with the principle of quality of data.

The Data We Collect

Connect collects the data as described in the item “3. Personal Information We Collect About You” of the Connect Privacy Notice, such as, but not limited to:

• Identifying Information, including names, government issued identification, Taxpayer ID number, passport numbers, birth dates, addresses, telephone number, e-mail address, occupation and all other background information necessary for AML/KYC requirements, including a copy of your ID.
• Financial Information, including bank account number(s), transaction history, net worth, account balances, assets and liabilities, wallet address.
• Account Authenticating Information, including hashed representations of account passwords, PINs, and account recovery information.
• Biometric information generated based on photos or videos you provide to verify your identity
• Technical data such as IP address and device fingerprinting.
• Compliance and reputational data, such as news and media search, sanctions and PEP screenings.

Personal Data does not include generic email address or general business information that is not linked to an individual.

How We Collect Your Data

We collect this personal information directly from you – from in person contact, telephone, text, email, text or messaging service, or via our website. However, we may also collect information::

• Automatically via our IT systems or automatic electronic record capture and retention methods (e.g., logs, system files, electronic usage trackers, or cookies)
• From publicly accessible sources (e.g., property records);
• Directly from a third party (e.g., sanctions screening providers, credit reporting agencies, or customer due diligence providers);
• From a third party with your consent (e.g., your bank or platform provider);

Connect may also receive your data indirectly from vendors and third parties when conducting “know your customer” background checks or confirming the personal information you have provided. We only collect information that is reasonably necessary to fulfill the identified purpose. Although you access our services through an application provided by a platform based in Brazil, the data is processed in the United States given that Connect is an affiliate of a US based company that uses the systems based in the US.

How We Will Use Your Data

Connect will use your data:

• To properly identify you.
• To manage your account(s) with Connect.
• To determine your eligibility for products and services and the products and services of companies with whom we are affiliated.
• To respond to questions, requests, or concerns regarding the products and services provided by Connect.
• To process your orders related to the digital asset trading/custody/settlement/account servicing and related services contracted for.
• To communicate with you and email you with offers on other products and services we think you might like and inform you about the products and services we provide.
• To recruit for positions at Connect.
• To investigate legal claims.
• To detect suspicious activities and protect against fraud, money laundering and other illicit activities.
• To administer Connect websites and any Connect software applications.
• For such purposes for which Connect may obtain your consent from time to time.
• For such other uses as may be permitted or required by law.

Your data may also be anonymized or aggregated to enable Connect to manage its business, develop statistical information, test our performance, or develop products. Anonymized and/or aggregated data will not identify you. Connect does not sell your Personal Data or information.

Sharing Data With Third Parties

Connect may share your Personal Data with Third Parties, both within your jurisdiction and abroad:

• To provide and support Connect's products and services. For example, Connect may submit your information to credit bureaus or KYC vendors for identification purposes.
• To comply with legal obligations, such as responding to regulatory or criminal investigations or mandatory reporting to our regulators.
• To protect you from fraud, abuse, or illegal activity. In such cases, Connect may disclose your information to an appropriate governmental authority or next of kin to prevent illegal or fraudulent activity in your account.
• If, in our best judgment, we believe someone is seeking your information as your agent, with your consent, or if otherwise permitted by law.
• Any other situation or purpose for which Connect obtains your consent to share, as described in the Connect Privacy Notice.

Please note that Connect, in accordance with LGPD and other Data Protection laws applicable to the Connect Affiliates, has the right to share your personal data without your consent with any national/federal, state, local and international legal, governmental and regulatory entities, authorities and officials in order to cooperate with any investigation or governmental, legal or regulatory proceeding relating to any information collected and/or website content or to any purported unlawful activities of any visitor.

How We Protect Your Data

Connect has many processes and controls in place to protect your personal data. Controls include limiting access to private data and confidential information to authorized employees, service providers, representatives, or agents who have all been made aware of the importance of keeping your information confidential. That is, Connect only allows access to confidential information on a need-to-know basis and appropriate security will be in place to avoid unauthorized sharing of information.

Additionally, Connect uses safeguards that are consistent with the industry standard, including firewalls, data encryption, physical access controls, appropriate back-up and disaster recovery solutions. As stated above, Connect is an affiliate of a US based company and may store your personal data both in Brazil and in the United States. Data transfers are carried out in accordance with applicable laws and regulations, and transfers to another jurisdiction will also be subject to the laws of the jurisdiction where the data is held.

In the event of a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, Connect shall promptly assess the risk to people’s rights and freedoms and report the breach, if applicable, to the impacted individual(s) and the ANPD, within the deadline and format defined by the ANPD.

Retention and Deletion

According to LGPD, personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, but the storage is authorized for the following purposes:

• Compliance with a legal or regulatory obligation by the controller.

• Study by a research entity, ensuring, whenever possible, the anonymization of the personal data.

• Transfer to third parties, provided that the requirements for data processing as provided in the Law are obeyed

• Exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymized.

To ensure that personal data is kept for no longer than necessary, Connect adopts a records retention policy for each area in which personal data is processed and reviews this process periodically.

The records retention policy considers what data should/must be retained, for how long, and why. Your data is only retained for as long as reasonably necessary to fulfill the purpose for which it was collected. Your data will be destroyed or de-identified once no longer necessary or required to be stored by law. When personal data is deleted this must be done safely such that the data is irrecoverable.

Connect is required by regulators to keep and maintain much of your personal data for prescribed periods from 5 (five) to 10 (ten) years, this last one to comply with AML requirements provided by the Central Bank of Brazil.

Some of your personal data may be deleted prior to the expiration of the above period, if such deletion is permitted by the local laws and regulations.

Marketing

Connect would like to send you information about products and services of ours that we think you might like. If you have agreed to receive marketing, you may opt out at a later date.

You have the right at any time to stop Connect from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, you can unsubscribe through the link available in the communication or submit a request to our data privacy officer through the email: [e-mail].

Your Data Protection Rights

• Confirmation of the existence of treatment: In response to this request, we will inform you if we process your Personal Data or not. Note that, if you are an User of our website or any of our services, we necessarily process your Personal Data, as explained in this Notice and in the Connect Privacy Notice.
• The right to access - You have the right to request, free of charge, a copy of your personal data that is processed by us. 
• The right to rectification: If you consider that your personal data is incomplete, inaccurate or outdated, you can request the rectification, indicating what needs to be changed and why. It is possible that we request a proof or supporting document to make this change.
• The right to anonymization, blocking or erasure: If you consider that we are processing your Personal Data in an unnecessary and excessive manner or in breach of the LGPD, you can request that the Personal Data be anonymized, blocked or erased, under certain conditions.
• The right to data portability: You can request  the transfer of your Personal Data to another service or product supplier, by the means of an express request, pursuant with the regulations of the national authority, and subject to commercial and industrial secrets. The portability does not include data that has already been anonymized.
• The right to deletion: You can request deletion of your personal data processed on the basis of your consent, except in the events of retention of Personal Data prescribed by law.
• The right to obtain information about: 
  • Public and private entities with which we share your Personal Data.
  • The possibility of denying consent and the consequences of such denial, when the consent is used as legal basis for processing of personal data.

• The right to Withdraw your consent: If your personal data is processed based on your consent, you can withdraw this consent. With that, any processing of your data that is made based on consent will be interrupted. Please note that we may not be able to offer our services or features of the services without your consent.
• Request the revision of decisions taken based on  automated processes: It is possible that decisions are taken based on automated processing of your Personal Data. You have the right to request the review of such decisions that affect your interests, including decisions aimed at defining your personal, professional, consumption and credit profile.
• Right to lodge a complaint before the ANPD.

You can exercise your rights by submitting a request to [e-mail].

Note that the rights above can be exercised exclusively by you or your legal representative, upon express request. So, before answering any request for exercise of the abovementioned rights, we can request that you provide us with some information and supporting documentation to confirm and validate your identity.

Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. You may refuse to accept browser cookies by activating the appropriate setting on your browser. Check the cookies settings information available in the Connect Privacy Notice.

For further information about cookies visit the ANPD Orientation Guide here.

Minors

In the event that our products or services are made available to minors and the processing of personal data of children and teenagers under the age of 18 years old is necessary, it will be necessarily carried out with the specific and prominent parental (or legal guardian) consent. Measures to verify and validate the parent’s or legal guardian identity will also be applied.

Changes to Our Privacy Notice

Connect keeps this Notice and the Connect Privacy Notice under regular review and will place any updates on this web page. Your continued use of this Website or Services after we make changes is deemed to be acceptance of those changes, so please check the notice periodically for updates

Contact Information

Our Data Protection Officer is available through the email: [e-mail]  

Contact us if you have any questions or comments regarding this Notice, the Connect Privacy Notice or our privacy practices.

You can find more information about the LGPD here.

---

APPENDIX C

 

International Transfers

Updated: December 31, 2025

To facilitate our global operations, Connect, its Affiliates, third-party partners and service providers may transfer, store, and process your personal information throughout the world. Below is a list of geographic locations where your information may be transferred:

• Australia
• Argentina
• Bermuda
• Brazil
• Canada
• European Union (including, the Netherlands)
• New Zealand
• Philippines
• Switzerland
• United Kingdom
• United States