C.2 Privacy Policy

PART C.2 — PRIVACY POLICY

This page forms part of Part C (ODIX Deposit by Card). It explains how the Privacy Policy of our card-purchase partner, a licensed on/off-ramp partner (the "Card Purchase Partner"), applies when you use Deposit by Card in the ODIX Pay App, and summarises its main points.

Important: this is a summary prepared by ODIX for your convenience. The legally binding document is the Card Purchase Partner's Privacy Policy, which is shown to you at checkout before you accept it and is available on request from support@odixpay.com. If this summary and the partner's document differ, the partner's document applies.

1. HOW THIS RELATES TO ODIX

ODIX makes Deposit by Card available in the ODIX Pay App. The service itself — the card payment, the exchange and the delivery of Digital Assets to your ODIX Wallet — is provided entirely by the Card Purchase Partner, which for customers in the United Kingdom and the European Economic Area is a company of its group established in the European Union.

When you use Deposit by Card, the Card Purchase Partner collects and uses personal data as an independent data controller under its own Privacy Policy. ODIX remains the controller of the data we hold about you under our own Privacy Policy.

To start your order, the ODIX Pay App may pass the Card Purchase Partner the information needed for the checkout, such as your ODIX Wallet address and the amount you choose. The Card Purchase Partner carries out its own identity checks and may ask you for information directly.

The Card Purchase Partner does not share your full card number with ODIX. Requests about the data the Card Purchase Partner holds should be sent to the Card Purchase Partner; requests about the data ODIX holds should be sent to us.

2. WHO CONTROLS YOUR DATA AT THE CARD PURCHASE PARTNER

For customers in the European Economic Area and other international jurisdictions the controller is the Card Purchase Partner's EU company. For customers in the United States it is the Card Purchase Partner's US group company. The Card Purchase Partner's Data Protection Officer can be reached through the contact details in its Privacy Policy, which is shown at checkout and available on request from support@odixpay.com.

3. WHAT THE CARD PURCHASE PARTNER COLLECTS

Identity data (name, date of birth, nationality, photographs); contact data; verification data (ID documents, proof of address, politically exposed person status, source of wealth); biometric data from your ID and selfie for facial matching; financial and transaction data, including a card token and the last four digits of your card and wallet addresses; tax data; information about your investment knowledge; technical and usage data such as IP address, device and location; and support communications.

4. WHY THE CARD PURCHASE PARTNER USES IT

To open and run your account and carry out transactions (performance of contract); to verify your identity and screen for money laundering and sanctions (legal obligation); for biometric matching (substantial public interest under AML law, supported by your explicit consent); to comply with the Travel Rule and EU tax reporting (DAC8); for support, fraud prevention and security (contract, legal obligation and legitimate interests); and for marketing (consent or legitimate interest). The Card Purchase Partner states that it does not make decisions about you based solely on automated processing within the meaning of Article 22 GDPR.

5. CARD DATA

The Card Purchase Partner does not store full card numbers or CVV codes. Its payment processors keep an encrypted token and the last four digits of a saved card. Visa and Mastercard account updater services may send the Card Purchase Partner updated card details from your card issuer; you can opt out through your bank.

6. WHO THE CARD PURCHASE PARTNER SHARES IT WITH

Companies in the Card Purchase Partner's group; identity verification and sanctions screening providers; acquiring banks, card networks and payment processors; other crypto and payment providers for Travel Rule purposes; public blockchains (transaction data); professional advisers and insurers; and authorities such as financial intelligence units, tax authorities, regulators, law enforcement and courts.

7. INTERNATIONAL TRANSFERS

Where data leaves the EEA, the Card Purchase Partner relies on European Commission adequacy decisions, the 2021 Standard Contractual Clauses or Binding Corporate Rules within its group.

8. HOW LONG THE CARD PURCHASE PARTNER KEEPS IT

Compliance and AML records: at least five years after your account is closed or the relationship ends. Account and contract data: for the relationship plus any period needed for disputes. Tax records: as required by tax law and DAC8. Marketing data: until you withdraw consent or object.

9. YOUR RIGHTS

Depending on where you live, you can ask the Card Purchase Partner for access, correction, deletion, restriction, objection, data portability and withdrawal of consent, and you can complain to the data protection supervisory authority in the partner's EU country of establishment. US residents have rights under US state privacy laws. Requests go to the Card Purchase Partner's Data Protection Officer and are free unless manifestly unfounded or excessive.

10. SECURITY

The Card Purchase Partner describes measures including encryption with managed keys, role-based access, network and endpoint protection, monitoring, patch management, backups, pseudonymisation, physical security, staff training and processing agreements with suppliers. It will notify you of a breach without undue delay where there is a high risk to you.

11. FULL DOCUMENT AND QUESTIONS

The complete Privacy Policy of the Card Purchase Partner is shown to you at checkout before you accept it and is available on request from support@odixpay.com. The Card Purchase Partner may update it at any time; the version it currently publishes is the one that applies.

Questions about the card-purchase service go to the Card Purchase Partner through the support channels shown at checkout, or via support@odixpay.com. Questions about the ODIX Pay App go to us at support@odixpay.com.