PRIVACY POLICY

This Privacy Policy explains which personal data Safirum AG processes when you use our services, why we do so, who receives the data, how long we keep it and which rights you have.

It applies to all of the following services (together the "Services"):

• (a) the website www.safirum.com, including its press and investment pages (the "Website");
• (b) the invitation, registration and admission pages for our events at safirum.mbco.io/launch, including the identity check, the admission pass and the door check-in ("Event Registration");
• (c) the Safirum user area, today at safirum.mbco.io/user and later at www.safirum.com/user, where you can open an account, sign in, link wallets and request whitelisting (the "User Area");
• (d) the Safirum mobile apps for iOS and Android, once we release them (the "Apps");
• (e) our internal administration panel (the "Panel"), but only as regards the data of our staff and of the persons we give access to it.

We process personal data in line with the Swiss Federal Act on Data Protection (FADP) and, where it applies to us, the EU General Data Protection Regulation (GDPR). The issuing, holding, transfer and redemption of CHF-S may be subject to separate documentation with its own data protection information. Where that documentation contains specific rules, they apply in addition to this Privacy Policy.

The controller for the processing described in this Privacy Policy is:

Please send all data protection questions and requests to privacy@safirum.com. For other matters you can reach us at info@safirum.com.

When you visit the Website, your browser sends technical data to our servers and to our hosting provider. This includes your IP address, the date and time of the request, the page requested, the referring page, your browser and operating system, and your language settings. We use this data to deliver the Website, to keep it secure and to find and fix errors.

The Website shows contact and enquiry forms. If you send us a message through a form or by e-mail, we process the details you give us, such as your name, company, role, e-mail address and the content of your message, to answer you and, where relevant, to manage a business or investor relationship with you.

The investment pages are protected by a password that we share with selected persons. When you enter it, we set a cookie that keeps you signed in for 24 hours. We do not link this cookie to your identity.

The fonts on the Website are delivered from our own servers. Your browser does not contact a font provider when you view the Website.

Our events are by invitation only. To invite you, we record your first name, last name and e-mail address, and we send you an invitation with a personal access code and link.

When you register, we process:

• (a) your first and last name as shown on your identity document, the e-mail address the invitation was sent to and, if you provide them, your company and role;
• (b) the public address of your Solana wallet;
• (c) the result of your identity check by Sumsub, including the applicant reference, the status of the check, any comment Sumsub gives you on a failed attempt, and the first and last name Sumsub has verified (see section 7);
• (d) the date and time you accepted the terms of the event;
• (e) your admission pass (a QR code), and the date and time of your check-in at the door with the label of the staff member or device that scanned it;
• (f) the IP address used for failed access code attempts and for requests to resend an invitation. We use it only to limit the number of attempts within one hour. After that hour we no longer use it, and our system deletes it automatically the next time it records an attempt.

We use this data to check that you are invited, to verify your identity as the law and our duties require, to prepare and admit you to the event, to place your wallet on the CHF-S whitelist and send CHF-S to it where the event provides for it, and to send you e-mails about your registration: the invitation, confirmation of receipt, your admission pass, a reminder and, where applicable, the notice that your registration could not be approved. We never ask for your seed phrase or private key.

At the door, our staff scan your pass with the camera of a phone or tablet and compare you with your identity document. Staff accounts are described in section 9.

In the User Area you can open an account and use it to manage your wallets and whitelisting requests. We process the following data:

• (a) Account data: an internal account identifier, your e-mail address and when you confirmed it, and, if you enter them, a nickname, your full name, your country and your telephone number.
• (b) Sign-in data: one-time e-mail codes (we store them only in a protected, hashed form; a code is valid for 15 minutes, works once and allows five tries), the identifier of a Google, X or Apple account you link (see section 6), and wallet sign-in messages with their one-time number.
• (c) Session data: a session cookie, the time the session started and was last used, the time you last confirmed your identity, your IP address and your browser or device type (user agent). We store only a hashed value of the session cookie. A session ends after 12 hours at the latest, and after 30 minutes without activity. Sensitive actions require that you confirmed your identity within the last 10 minutes.
• (d) Security and activity logs: for each request to the User Area we record the time, the action, the result, your IP address, your user agent and a shortened session tag. You can see your own recent activity in the User Area. While parts of the Services can only be opened with an access key, our access gateway also records each sign-in with a key, each sign-out and each blocked attempt, with the time, the label of the key (if any), your IP address and your user agent. It never records the key itself.
• (e) Wallet data: the public addresses of the wallets you link, which one is your master wallet, how you proved ownership (a signed message, a command-line signature or an on-chain memo), wallets you name without a proof, and the balances and transactions of your wallets, which we read from the blockchain.
• (f) Identity check data: the status and reference of your identity check (see section 7).
• (g) Whitelisting and payment data: your whitelisting requests and their status, the reason if we reject one, the payment reference, the amount, the paying wallet, the transaction signature and the memo of the payment.

We use this data to run your account, to let you sign in safely, to verify your identity, to process whitelisting requests and payments, to show you your balances, transactions and activity, to protect the Services against misuse, and to meet our legal duties.

The identity check in the User Area is in a test phase. Until it is connected to Sumsub, the details you type into it stay in your browser, and we record only which steps you completed.

We limit how often e-mail codes can be requested (five per hour for each address) and how often our blockchain gateway can be used. These limits protect you and the Services against abuse.

You can sign in to the User Area with your Google or X account. The iOS App will also offer Sign in with Apple. You choose whether to use these methods. You can also sign in with an e-mail code or a wallet.

• (a) Google: we ask for the scopes "openid", "email" and "profile". Google then gives us your Google account identifier, your e-mail address, whether Google has verified it, and your basic profile (such as your name and profile picture). We store only the account identifier and, if Google has verified it, your e-mail address. We do not store your name or picture from Google.
• (b) X: we ask for the scopes "users.read" and "tweet.read", which X requires to identify you. We read only your X account identifier and store it. We do not receive your e-mail address from X, and we do not read, store or publish your posts.
• (c) Apple (iOS App): we will receive an Apple account identifier and, if you choose to share it, your e-mail address or an Apple relay address.

We use this data only to sign you in, to link the sign-in method to your account, to keep that account secure and, where you have no other confirmed address, to contact you about your account. We do not keep the access tokens the providers issue after sign-in is complete. We never use data from these providers for advertising, we never sell it, and we do not share it with third parties except as needed to provide the Services or where the law requires it.

Safirum's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove a linked sign-in method in the User Area as long as another way to sign in remains. You can also revoke our access in your Google, X or Apple account settings. The providers process your data under their own privacy policies.

As a financial intermediary under the Swiss Anti-Money Laundering Act (AMLA), we must identify the persons we deal with. We use the identity verification service of Sumsub for this purpose. Sumsub processes the data on our behalf.

During the check, Sumsub collects and processes:

• (a) images of your identity document and the data on it, such as your name, date of birth, nationality, document number, expiry date and photograph;
• (b) a selfie and a liveness check (a short sequence of images or video of your face), which Sumsub compares with the photograph on your document;
• (c) in the Apps, the data stored on the chip of your passport or identity card, which your phone reads by NFC. The chip holds the same personal data as the document page, your facial image and data that shows the chip is genuine;
• (d) technical data of the device you use for the check, such as your IP address and, if you allow it, your location.

Facial images used for comparison, the biometric data derived from them and the chip data are sensitive personal data under the FADP and special category data under Art. 9 GDPR. We process them only with your explicit consent, which you give in the verification flow before the check starts. You can refuse or withdraw your consent at any time. Without the check, however, we cannot admit you to an event, whitelist your wallet or offer services that require identification. Withdrawal does not affect processing that took place before it, nor records we must keep by law.

Sumsub sends us the result of the check: the applicant reference, the status and outcome of the review, the reason or comment on a failed attempt, the first and last name it has verified and, in the Apps, whether the chip check passed. We do not copy your document images, your selfie or your chip data into our own systems. Sumsub keeps them for us, and we can access them when our legal duties require it.

If your identity check was completed without the chip of your document, for example in the User Area on the web, you confirm it with a bank transfer: you send CHF 1.00 from a bank account in your own name to our bank account, with the reference we give you. This shows that you hold a bank account in your own name and completes your identification when no chip check was possible. From the transfer we receive:

• (a) the name of the account holder;
• (b) the IBAN of the account;
• (c) the amount and the reference;
• (d) the date and time we receive the transfer.

We compare the account holder's name with the name Sumsub verified, and the amount with the one we asked for. If both match, the step is complete. If not, authorised Safirum staff review the transfer and decide, and for this review we keep the verified name with the transfer. Whatever the outcome, we send the amount back to the account it came from and record when we did so.

The AMLA requires us to keep identification records for 10 years after the business relationship ends or the transaction is completed (Art. 7 AMLA). During this period we cannot delete them, even if you ask us to.

Sumsub checks documents and faces with automated tools. A check can therefore end in a decision made without human involvement, for example a rejection, and a passed check can lead automatically to the next step, such as the whitelisting of your first wallet in the Apps. If an automated decision affects you, you can ask for it to be reviewed by a person, explain your point of view and ask how the decision was reached. Write to privacy@safirum.com.

The Apps give you access to your account in the User Area. They process the account, sign-in, wallet and identity check data described in sections 5 to 7. In addition, they process:

• (a) Device data: a device identifier created for the App, the platform, the operating system version and the App version. We link this data to your session so that you can see and sign out your devices.
• (b) Attestation data: the result of the integrity checks of Apple (App Attest) and Google (Play Integrity). They tell us whether a request comes from a genuine copy of the App on a genuine device. We use them to protect your account and to prevent misuse, in particular of free whitelisting.
• (c) Push tokens: if you allow notifications, the App receives a token from Apple or Google that lets us send notifications to your device. We use it to tell you, for example, that your identity check is complete or that a wallet has been whitelisted. Our notifications contain no personal data in their text. You can turn notifications off in your device settings at any time.
• (d) Sign-in data on the device: the App stores your session in the secure storage of your device, bound to that device. If you turn on biometric unlock, your device checks your fingerprint or face. We never receive your fingerprint or face data from this check.

The App asks for the following permissions, each only when it is needed: the camera, the microphone and the photo library for the identity check, NFC to read the chip of your document and, if the verification provider asks for it, your location. You can refuse each permission. Some steps may then not be possible.

The Apps never hold or ask for the private keys or seed phrases of your wallets. When you prove that you own a wallet or approve a payment, you do so in your own wallet app, such as Phantom or Solflare, or with your own command-line tools. The Apps do not track you across apps or websites of other companies, and they contain no advertising.

Apple and Google run the app stores through which you download the Apps. They process data about your download and use of their stores under their own privacy policies.

Our staff and the persons we give access to the Panel or to the door check-in sign in with an access key, a wallet signature, an e-mail code or a password. For them we process their name, e-mail address, wallet address, role, access rights, sign-in sessions, the times of their last sign-in and the actions they take, which we log. We store passwords only in hashed form. We use this data to control access, to keep a record of who did what, and to meet our duties of oversight.

CHF-S runs on the Solana blockchain. Data on a public blockchain can be read by anyone, is copied to many computers around the world and cannot be changed or deleted, by us or by anyone else.

The following data becomes public and permanent on the blockchain when you use the Services:

• (a) Whitelist entries: each whitelisted wallet has its own on-chain entry that links the wallet address to the CHF-S token. The transfer rules read these entries on every transfer, so they must be public.
• (b) Transactions: transfers of CHF-S and SOL, including whitelisting payments, with the sending and receiving addresses, the amounts and the time.
• (c) Memos: a whitelisting payment carries a memo with a payment reference and a code that does not reveal which wallets the payment was for. If you choose to prove ownership of a wallet with an on-chain memo, that memo contains your Safirum account identifier and the wallet address.

We never write your name, e-mail address or other contact details on the blockchain. However, we keep the link between your account and your wallet addresses in our own systems. Anyone else who learns that a wallet belongs to you can see all of its public transactions. Removing a wallet from the whitelist closes its entry, but earlier records of that entry and of all transactions remain on the blockchain.

Under the FADP, we process personal data in line with its principles. Where a justification is needed, we rely on your consent, on a legal duty, or on an overriding private interest of ours or of third parties (Art. 31 FADP), which includes the conclusion and performance of a contract with you. Where the GDPR applies, we rely on the legal bases in Art. 6 GDPR, and for special category data on Art. 9 GDPR. For duties under Swiss law, we rely under the GDPR on our legitimate interest in complying with the law that governs us (Art. 6(1)(f) GDPR).

• (a) Providing the Website and keeping it secure: overriding interest (FADP); legitimate interest (Art. 6(1)(f) GDPR).
• (b) Answering enquiries and managing business and investor relationships: contract or steps before a contract, and overriding interest (FADP); Art. 6(1)(b) and (f) GDPR.
• (c) Running Event Registration and admitting guests: contract (FADP); Art. 6(1)(b) GDPR.
• (d) Opening and running your account in the User Area and the Apps, sign-in and sessions: contract (FADP); Art. 6(1)(b) GDPR.
• (e) Identity verification and our duties against money laundering, terrorist financing and sanctions breaches: legal duty under the AMLA (FADP); Art. 6(1)(c) GDPR where EU or member state law applies, otherwise Art. 6(1)(f) GDPR.
• (f) Processing facial images, biometric data and chip data in the identity check: your explicit consent (FADP); Art. 9(2)(a) GDPR.
• (g) Whitelisting wallets and processing whitelisting payments: contract and legal duty (FADP); Art. 6(1)(b), (c) and (f) GDPR.
• (h) Security logs, rate limits, fraud prevention, device attestation and protection of free whitelisting against misuse: overriding interest (FADP); Art. 6(1)(f) GDPR.
• (i) Push notifications: your consent, which you give in your device settings (FADP); Art. 6(1)(a) GDPR.
• (j) Sign-in with Google, X or Apple: contract, at your request (FADP); Art. 6(1)(b) GDPR.
• (k) Staff and Panel access: employment or other contract, and overriding interest (FADP and Art. 328b of the Swiss Code of Obligations); Art. 6(1)(b) and (f) GDPR.
• (l) Keeping business records, answering authorities, and establishing, exercising or defending legal claims: legal duty and overriding interest (FADP); Art. 6(1)(c) and (f) GDPR.

We do not send newsletters or marketing e-mails today. If we start, we will do so only with your consent or where the law otherwise allows it. Where we rely on consent, you can withdraw it at any time with effect for the future.

We use only cookies and browser storage that the Services need to work. We do not use analytics, advertising or tracking cookies. For this reason we do not show a cookie banner.

• (a) NEXT_LOCALE (Website): stores the language you chose. It is deleted when you close your browser.
• (b) safirum_investment_auth (Website): keeps you signed in to the investment pages for 24 hours.
• (c) launch_auth (Event Registration): links your browser to your invitation until the invitation expires, for at most 30 days.
• (d) safirum_door_auth (door check-in, staff only): keeps a staff member signed in for 12 hours.
• (e) chf_session (User Area): keeps you signed in. It lasts at most 12 hours and stops working after 30 minutes without activity.
• (f) chf_oauth (User Area): protects sign-in with Google, X or Apple against misuse. It lasts 10 minutes.
• (g) chf_panel (Panel, staff only): keeps a Panel user signed in for at most 12 hours.
• (h) Browser storage: the User Area and the Panel store settings in your browser, such as the network you chose and the wallet app you used last. The registration page stores whether you have already seen the help guide.
• (i) Access-key cookie (safirum.mbco.io): while parts of the Services can only be opened with an access key, our access gateway sets a cookie when you enter a valid key. It keeps you signed in for up to 30 days, or until you sign out.

You can delete cookies and browser storage in your browser settings at any time. If you block them, you may not be able to sign in.

We do not use web analytics or similar tools on the Services. If we introduce them, we will update this Privacy Policy first and ask for your consent where the law requires it.

We disclose personal data only where this is needed for the purposes described above or where the law requires it. Recipients are:

• (a) Service providers that process data on our behalf: Vercel (hosting of the Website), Cloudflare (network and security services), the providers of the servers and database on which the User Area runs, Resend (sending of e-mails), and Sumsub (identity verification). In the Apps, Apple and Google also provide device attestation and the delivery of push notifications, and we may use Expo or Firebase to send notifications. These providers may use the data only on our instructions and must protect it.
• (b) Solana network services (RPC providers): to read balances and transactions and to send the transactions you sign, our systems and your wallet app contact Solana network access points. These providers see the wallet addresses and transactions concerned and the IP address of the computer making the request.
• (c) Sign-in providers: Google, X and Apple, when you choose to sign in with them.
• (d) Your wallet app: providers such as Phantom or Solflare, when you use their apps with the Services. They act under their own terms.
• (e) Custodian banks and other regulated counterparties, where this is needed to provide our services to business partners.
• (f) Auditors, lawyers, tax advisers and other professional advisers who are bound by confidentiality.
• (g) The Financial Services Standards Association (VQF), the Swiss Financial Market Supervisory Authority FINMA, the Money Laundering Reporting Office Switzerland (MROS), courts and other authorities, where the law requires it.
• (h) Acquirers or merger partners in the context of a corporate transaction, subject to confidentiality.
• (i) Our bank: the bank that holds our bank account receives your identity transfer with the account holder's name, the IBAN, the amount and the reference, and sends the amount back on our instruction. It also processes these data under its own legal duties.

We do not sell personal data.

Some of our providers process data outside Switzerland and the European Economic Area (EEA), in particular in the United States. We transfer personal data to such a country only if it offers adequate data protection according to the Swiss Federal Council or the European Commission, or if we have put suitable safeguards in place. Where a provider in the United States is certified under the Swiss-US Data Privacy Framework or the EU-US Data Privacy Framework, we rely on that certification. Otherwise we use the standard contractual clauses of the European Commission, with the adjustments required for Switzerland, or another safeguard the law permits.

Data on the blockchain is copied to computers around the world. We cannot limit where it goes (see section 10).

You can ask for a copy of the safeguards we use by writing to privacy@safirum.com.

We keep personal data only as long as we need it for the purposes for which we collected it, or as long as the law requires. In particular:

• (a) Account data in the User Area and the Apps: for as long as your account exists. After it is closed, we delete or anonymise the data unless one of the periods below applies.
• (b) Identification records, identity check results, the data of the bank transfer that confirms your identity, and records of transactions: 10 years after the business relationship ends or the transaction is completed (Art. 7 AMLA).
• (c) Business correspondence, accounting records and contractual records: 10 years (Art. 958f of the Swiss Code of Obligations).
• (d) Security and activity logs: for as long as we need them to protect the Services and to investigate incidents, and longer where they form part of the records under (b) or (c).
• (e) Event Registration data: for as long as we need it to prepare and run the event and to follow up on it, and longer where it forms part of the records under (b).
• (f) IP addresses of failed access code attempts and resend requests: used for one hour, then deleted automatically when the next attempt is recorded, and in any case under (e).
• (g) Enquiries: for as long as needed to deal with them, and longer where they form part of a business relationship.

Data on the blockchain cannot be deleted (see section 10).

We protect personal data with technical and organisational measures that match the risks. Among other things, we encrypt connections, store session identifiers, sign-in codes and passwords only in hashed form, limit access to those who need it, log access to our systems and limit the number of attempts at sign-in. We review these measures regularly. No system is completely secure, however. Please keep your devices, e-mail account and wallet keys safe.

Subject to the applicable law, you have the following rights:

• (a) Access: to learn whether we process personal data about you, and to receive a copy of it.
• (b) Correction: to have incorrect or incomplete data corrected.
• (c) Deletion: to have your data deleted, unless we must or may keep it (see sections 16 and 19).
• (d) Restriction: to have the processing of your data restricted in certain cases.
• (e) Objection: to object to processing based on our legitimate or overriding interests.
• (f) Data portability: to receive data you have given us in a common electronic format, or to have it sent to another controller, where the law provides for this.
• (g) Withdrawal of consent: to withdraw your consent at any time, with effect for the future.
• (h) Human review: to have an automated decision reviewed by a person (see section 7).

To exercise your rights, write to privacy@safirum.com. We may ask you to prove your identity before we answer. We will reply within the periods set by law, normally within 30 days.

You can lodge a complaint with a data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. In the EU or EEA, you can contact the supervisory authority in the country where you live or work, or where you believe a breach occurred.

You can ask us at any time to close and delete your account. Write to privacy@safirum.com from the e-mail address linked to your account, or use the deletion function in the User Area or the Apps once it is available. We will confirm the request with you before we act on it.

When we delete an account, we end all sessions, remove device registrations and push tokens, and delete or anonymise the account data. We keep only what the law requires us to keep, in particular the identification records and transaction records under the AMLA for 10 years (see section 16). We keep these records separately and use them only for these legal purposes.

Whitelist entries and transactions on the blockchain cannot be deleted. We may remove your wallets from the whitelist when your account is closed. The earlier records remain on the blockchain in any case.

The Services are for adults aged 18 or over. We do not knowingly collect personal data from children. If we learn that a person under 18 has registered, we will close the account and delete the data, except where the law requires us to keep it.

We may change this Privacy Policy when our Services or the law change. The current version is always available at www.safirum.com/privacy, with the date of the last update. If we make material changes, we will inform account holders by e-mail or in the User Area or the Apps before the changes take effect.

This Privacy Policy is available in English, German, French and Italian. If the versions differ, the English version prevails.