1. Introduction

Poolder Digital Asset Management B.V. (hereafter referred to as: "Poolder"), located at Patrijsweg 58 2289 EX Rijswijk, is responsible for the processing of personal data as outlined in this Privacy Policy. Poolder respects your privacy and the security of your personal data and processes personal data in accordance with the European General Data Protection Regulation. This means that your personal data:

• Are processed in a manner that is lawful, fair and transparent.
• Are collected for specific, explicitly defined and legitimate purposes and are not further processed in a way incompatible with these purposes.
• Must be adequate, relevant and limited to what is necessary for the purposes for which they are processed.
• Must be accurate and kept up to date.
• Must be kept securely.

In this Privacy Policy, we elaborate how we handle and protect your personal data.

2. Personal Data We Process

Poolder processes your personal data because you use our services and/or because you provide them to us. Below is an overview of the personal data we process:

• Basic information, such as your first and last name.
• Contact details, such as your email address, postal address and phone number.
• Personal data you provide to become a customer, such as your nationality, date of birth, place of birth, home address, bank account number and Citizen Service Number (BSN) or Tax Identification Number (TIN).
• Personal data that are part of the data of a legal entity, such as (evidence of) founding documents and additional legal documentation, such as the shareholders' register, extract from the UBO (Ultimate Beneficial Owner) register, structure chart, and personal data of all direct and indirect representatives, controllers, and (if applicable) other ultimate beneficiaries.
• Other personal data you actively provide to create an account on this website, such as your IP address and a password.
• Other personal data you provide to us that aim to establish the nature and purpose of the client relationship.
• All other personal data relating to you that you provide to us or that we may obtain in connection with the purposes and bases set out in this Privacy Policy.

We may also collect your personal data from other sources, such as the register at the Chamber of Commerce, counterparties, or by using publicly available sources. As our services develop and legislation changes, additional information may be required from you.

When this is the case, we will inform you of the purposes and bases for this additional processing of your personal data through an update of this Privacy Policy and a personal message.

3. The Purpose and Basis for Processing Personal Data

Poolder processes your personal data for the following reasons:

• To offer you the possibility to create an account.
• To identify and accept you as a customer.
• To provide you with our services..
• To be able to call or email you if necessary to carry out our service.
• To inform you about changes to our services and products.
• To prevent the use of Poolder's services for fraud, financing of terrorism, money laundering or other forms of criminality.
• Poolder analyzes your personal data and behaviour on the website for research and development purposes, in order to improve the website and our services.
• Poolder also processes personal data when we are legally obligated to do so, such as data required under anti-money laundering regulations, checking the PEP-status ('politically exposed persons') of clients, and, if applicable, for the legal obligation to pass on personal data to the Dutch 'UBO register for trusts and similar legal constructions'.

3.1 UBO-register trusts and similar arrangements

Since November 1, 2022, Poolder is legally required to register all clients as UBOs (Ultimate Beneficial Owners) of the investment institution in which they participate, with the "UBO register trusts and similar arrangements". For further details, see: www.uboregistertrusts.nl. To comply, Poolder must submit the following personal information:

• Personal details: your full name, nationality, date of birth, place of birth, residential address, email address and Burgerservicenummer (BSN) or another personal identification number.
• The nature and the extent of the economic interest in the investment institution.

Furthermore, Poolder is obliged to submit a copy of the document based on which your information has been verified by us to the register (a copy of your ID). The "UBO-register trusts and similar arrangements" is not public and can only be accessed by a select number of entities. For more information, visit: www.uboregistertrusts.nl.

4. Sharing Personal Data with Third Parties

In some cases, we may also share your personal data with third parties. Poolder shares your personal data with various third parties when this is necessary for the execution of the agreement or to comply with a possible legal obligation. These parties include:

• External suppliers, such as Amazon Web Services, Microsoft Azure, Mailjet, Evidos and Mollie, in connection with the processing of your personal data for the purposes described in this policy.
• Third parties, such as regulators and other government institutions, with whom we collaborate to comply with legal obligations.

With companies that process your data on our behalf, we enter into a processor agreement to ensure the same level of security and confidentiality of your data. Poolder remains responsible for these processing activities.

5. How We Secure Personal Data

Poolder takes the protection of your data seriously and implements appropriate measures to prevent misuse, loss, unauthorized access, unwanted disclosure, and unauthorized modification. If you have the impression that your data is not properly secured or there are indications of abuse, please contact us at legal@poolder.com.

6. How Long We Retain Personal Data

Poolder does not retain your personal data longer than is strictly necessary to achieve the purposes for which your data is collected. We apply the following retention periods for the following categories of personal data:

• Personal data processed in the context of anti-money laundering regulations: 5 years.
• Personal data processed in the context of tax legislation: 7 years.

7. Cookies, or Similar Techniques, That We Use

This website uses technical and functional cookies, as well as analytical cookies that do not infringe on your privacy. A cookie is a small text file that is stored on your computer, tablet, or smartphone upon your first visit to this website. The cookies we use are necessary for the technical operation of the website and your convenience. They ensure that the website functions properly and remember, for example, your preferred settings. We can also optimize our website with them. You can opt out of cookies by setting your internet browser to no longer store cookies. Additionally, you can also delete all information previously stored through your browser settings.

7.1 Hotjar

We use Hotjar to better understand the needs of our users and to optimize this service and experience. Hotjar is a technological service that helps us better understand our users' experiences (e.g., how much time they spend on which pages, which links they choose to click, what users do and do not like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users' behavior and their devices. This includes a device's IP address (processed during your session and stored in an anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any data collected on our behalf. For more details, see the 'about hotjar' section on Hotjar's support site.

7.2 Google Analytics

We use Google Analytics, an analysis tool from Google. Google Analytics uses cookies to collect data about the behavior of our users and their devices. The information gathered by these cookies about your use of the website (including your IP address) is transmitted to and stored by Google on servers in the United States. Google uses this information to track how our website is used, provides website owners with reports on website activity, and offers other services related to website activity and internet usage. Google may provide this information to third parties if legally required to do so, or if these third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. You can refuse cookies by selecting the appropriate settings on your browser. However, please note that you may not be able to use all the features of this website in that case. By using this website, you consent to Google processing your personal data in the manner and for the purposes set out above."

8. Accessing, Correcting, or Deleting Data

You have the right to access, correct, or delete your personal data. Additionally, you have the right to withdraw your consent to data processing or to object to the processing of your personal data by our company, and you have the right to data portability. This means that you can request us to send the personal data we have of you in a computer file to you or another organization specified by you. If you wish to exercise your right to object and/or right to data portability and/or your right to access, correct, or delete your personal data, or if you have other questions/comments about data processing, please send a specified request to legal@poolder.com. To ensure that the request for access has been made by you, we ask you to send a copy of your identity document with the request. In this copy, make your passport photo, MRZ (machine-readable zone, the strip with numbers at the bottom of the passport), passport number, and (if applicable) Citizen Service Number (BSN) black. This is to protect your privacy. Poolder will respond to your request as soon as possible, but within four weeks at the latest.

Poolder would also like to point out that you have the option to file a complaint with the national supervisory authority, the Dutch Data Protection Authority. This can be done via the following link: https://autoriteitpersoonsgegevens.nl/en/node/9.

9. Contact Information

Our contact details are: Website: https://www.poolder.com Address: Patrijsweg 58 2289 EX Rijswijk Email: legal@poolder.com