Privacy Notice for Customers

Mellifera Kartiera Limited – kartiera.eu

This version of the Privacy Notice is effective as of 21 August 2026.

1. General information

1.1. In the course of providing services to you, Mellifera Kartiera Limited (part of the Mellifera Holding Group), registration number C107685, registered address: Villa Malitah, Mediterranean Street, The Village, St. Julians, STJ 1870, Malta (“Company”, “we”, “us”, or “our”), collects and processes Personal Data relating to you.

1.2. This Privacy Notice applies to:

customers;
prospective customers;
former customers;
natural persons related to a legal entity customer, including representatives, directors, shareholders, beneficial owners, authorised persons, employees, and other associated persons whose Personal Data is processed by the Company.

1.3. For the purposes of this Privacy Notice, “Personal Data” means any information relating to an identified or identifiable natural person.

1.4. The Company is the data controller and is responsible for the processing of your Personal Data.

1.5. Some Personal Data is necessary for the Company to comply with legal and regulatory requirements and to enter into and perform agreements with you. If you do not provide such Personal Data, the Company may be unable to onboard you, provide services to you, or continue the business relationship.

1.6. The provision of certain additional Personal Data may be voluntary. However, if you choose not to provide such information, the Company may not be able to provide certain services or functionalities, respond to your request, or achieve some of the purposes described in this Notice.

2. Beneficial Owners, Directors and Other Related Persons

2.1. Where our customer is a legal entity, or where you act for or are otherwise connected to a customer, the Company also processes Personal Data about the natural persons connected to that customer – including beneficial owners, shareholders, directors, officers, authorised representatives, signatories, and other associated persons (“related persons”). This section explains how the Company processes Personal Data about related persons and applies in addition to the other sections of this Notice.

2.2. Source of the data. The Company usually collects Personal Data about related persons directly (provided by the corporate customer and its representatives) or indirectly. Indirectly such Personal Data may be obtained from:

the corporate customer and its representatives, directors, or authorised persons;
company, beneficial-ownership, commercial, and other public registers;
sanctions, politically exposed person (PEP), and adverse-media screening tools;
credit, fraud-prevention, and risk-assessment databases;
partner crypto-asset service providers with whom the Company cooperates (in particular Cloverum), where the Company receives information about you from the partner in connection with a service you have requested or for AML/CTF, sanctions and fraud-prevention purposes;
other publicly available or lawfully obtained sources.

2.3. Categories of Personal Data. Depending on the role of the related person and applicable legal requirements, the Company may process the following categories of Personal Data:

identification data, such as full name, date and place of birth, nationality, and gender;
identity document details, such as passport or ID card number, issuing country, and validity;
contact details;
role and relationship data, such as position held, nature and extent of ownership or control, shareholding, and authority to act;
tax residence and tax identification numbers;
due diligence and screening data, including PEP status, sanctions screening, and adverse-media check results;
other information necessary to comply with AML/CTF, sanctions, and applicable legal obligations.
information relating to criminal convictions and offences (Article 10 GDPR) that may be revealed by sanctions, PEP, or adverse-media screening, processed only where authorised by law and subject to appropriate safeguards.

2.4. Purposes and legal bases. The Company processes related persons’ Personal Data for the purposes described in this Notice, in particular identification and verification, customer due diligence, AML/CTF, sanctions and fraud-prevention checks, ongoing monitoring, regulatory reporting, and risk management. This processing is based principally on compliance with legal and regulatory obligations (Article 6(1)(c) GDPR) and on the legitimate interests of the Company and third parties (Article 6(1)(f) GDPR), and, where relevant, on the performance of a contract (Article 6(1)(b) GDPR). Where special category data is processed, an additional condition under Article 9 GDPR will apply.

2.5. Provision of this Notice. As the Company often does not deal with related persons directly, it relies on the corporate customer and its representatives to bring this Privacy Notice to the attention of, and make it available to, the related persons whose Personal Data they provide. This Notice is also published on the Company’s website. Where required, the Company will otherwise provide the information under Article 14 GDPR within a reasonable period after obtaining the Personal Data, and at the latest within one month, or at the point of first communication with the related person where earlier, unless an exemption applies.

2.6. Restrictions. To the extent permitted by applicable law, the Company may restrict, defer, or decline to provide some or all of the information referred to in this Notice, or to act on a related person’s request, where doing so would be likely to prejudice the prevention, detection, investigation, or reporting of money laundering, terrorist financing, sanctions breaches, fraud, or other unlawful activity, or would otherwise conflict with a legal or regulatory obligation or prohibition. In such cases, the Company will provide information only to the extent, and at the time, permitted by law.

3. Purposes for Which We Use Personal Data

3.1. We may use your Personal Data for the following purposes:

Onboarding and service provision

to identify and verify you and any relevant related persons;
to assess your application for services;
to conclude, perform, administer, and terminate agreements with you;
to provide payment services and other financial services;
to maintain your account and enable access to our services;
to execute domestic and international payment transactions;
to provide customer support and handle service requests.

Compliance, fraud prevention, and risk management

to perform customer due diligence, KYC, AML/CTF, sanctions, and fraud prevention checks;
to monitor transactions and account activity;
to prevent, detect, investigate, and report suspicious or unlawful activity;
to assess and manage legal, regulatory, operational, ICT, security, and financial crime risks;
to protect the Company, its customers, counterparties, and the financial system.

Communication and relationship management

to communicate with you about your account, services, transactions, complaints, and requests;
to send service notices, security alerts, operational updates, and policy updates;
to manage complaints, disputes, and claims.

Legal and regulatory compliance

to comply with legal and regulatory obligations, including financial services, AML/CTF, sanctions, tax, accounting, consumer protection, audit, and data protection obligations;
to respond to requests from supervisory authorities, regulators, courts, law enforcement agencies, and other competent authorities;
to maintain records required by law.

Operational, security, and business administration purposes

to operate and secure our systems, applications, websites, and platforms;
to maintain business continuity, service resilience, and internal governance;
to improve our products, services, and internal processes;
to carry out analytics, reporting, and statistical analysis, using anonymised or aggregated data where possible.

Marketing

to send direct marketing communications where permitted by law and, where required, based on your consent.

3.2. We will only use Personal Data for the purposes described above, unless additional processing is expressly permitted by you or required by applicable law.

3.3. Where you are a customer of, or interact with, more than one entity within the Mellifera Holding Group, your Personal Data may be shared between relevant group entities for the purposes set out in this Notice, including, in particular AML / sanctions /fraud screening, service provision, customer support, complaint handling, internal audit, risk management, operational resilience, and group compliance oversight

3.4. To assist our staff with the checks described above — in particular reviewing identity and onboarding documents and analysing information for anti-money-laundering, counter-terrorist-financing, sanctions and fraud-prevention purposes — we use artificial-intelligence-based analytical tools provided by a specialist third-party service provider that acts as our processor and handles Personal Data only on our documented instructions. These tools support our staff, who review the results and make the relevant decisions; we do not take any decision that produces legal effects concerning you, or similarly significantly affects you, based solely on automated processing without human involvement. The provider processes your Personal Data only to provide the service to us and does not use it to train its models.

4. Legal Basis for the Processing of Personal Data

4.1. Your Personal Data may be processed on one or more of the following legal bases:

Point (a) of Article 6(1) GDPR – Consent

Processing based on your consent.

Examples:

sending direct marketing where consent is required;
processing optional data you choose to provide for a specific purpose;
using certain cookies or similar technologies where consent is required.

Point (b) of Article 6(1) GDPR – Performance of a contract

Processing necessary to take steps before entering into a contract with you or to perform a contract concluded with you.

Examples:

opening and maintaining your account;
executing payment transactions;
providing customer support and administering the services.

Point (c) of Article 6(1) GDPR – Legal obligation

Processing required to comply with legal and regulatory obligations.

Examples:

verifying your identity;
conducting AML/CTF, sanctions, and fraud prevention checks;
maintaining regulatory records;
reporting to regulators or authorities where required by law.

Point (f) of Article 6(1) GDPR – Legitimate interests

Processing necessary for the legitimate interests of the Company or a third party, provided such interests are not overridden by your rights and freedoms.

Examples:

ensuring information security and fraud prevention;
handling disputes and legal claims;
improving services and internal systems;
maintaining business continuity and operational resilience;
internal governance, audit, and risk management.

4.2. Where special category data is processed, the Company will do so only where a lawful condition under Article 9 GDPR also applies and where such processing is necessary and permitted by law.

4.3. Criminal convictions and offences data (Article 10 GDPR). In the course of sanctions, politically exposed person (PEP), and adverse-media screening and related financial-crime checks, the Company may process Personal Data relating to criminal convictions and offences, or to alleged offences, investigations, proceedings, and related enforcement or regulatory measures. The Company processes such data only where authorised by applicable EU or Maltese law and subject to appropriate safeguards – in particular to comply with its AML/CTF, sanctions, and financial-crime obligations, and to establish, exercise, or defend legal claims. Access to such data is restricted to authorised personnel, and it is retained only for as long as necessary and permitted by law.

4.4. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.5. Mellifera Holding Group intra-group sharing of your Personal Data may take place on one or more of the legal bases described above, depending on the relevant purpose. In particular, intra-group sharing is commonly based on legal obligation (for example AML / CTF, sanctions, fraud prevention, regulatory reporting and operational resilience), contractual necessity (where sharing is necessary to provide the requested product or service), and legitimate interests (for example internal governance, audit, security monitoring, and group-level risk management), provided your rights and freedoms are not overridden.

5. Recipients of Personal Data

5.1. Third-party service providers

Your Personal Data may be shared with carefully selected third-party service providers engaged by the Company to support its operations. These providers process Personal Data on behalf of the Company or otherwise in accordance with applicable law and contractual arrangements.

Such service providers may include:

IT, cloud, software, and hosting providers;
artificial-intelligence and analytical tools used to assist identity verification, onboarding review, and transaction monitoring;
customer support and communication providers;
identity verification, KYC, AML/CTF, sanctions screening, and fraud prevention providers;
payment, settlement, and card service providers;
document management, storage, and archiving providers;
auditors, accountants, legal advisers, tax advisers, consultants, and translators.

5.2. Financial institutions and payment ecosystem participants

Your Personal Data may be shared with:

banks, credit institutions, payment service providers, electronic money institutions, correspondent banks;
card schemes and payment system participants;
counterparties involved in executing or supporting transactions or related services.

5.3. Intra-group data sharing

Your Personal Data may be shared within the Mellifera Holding Group, including with Mellifera Operations Limited (acting as the Company’s Processor under a written intra-group Data Processing Agreement for the operation of the Company’s customer platform – CRM) and Colibrix Limited, where this is necessary for:

onboarding and KYC / AML checks;
provision of combined or related services;
transaction monitoring, fraud prevention, and sanctions screening;
customer support, complaint handling, and dispute resolution;
internal audit, risk management, compliance oversight, and group governance;
business continuity, security monitoring, and operational resilience.

The receiving group entity may act as:

processor,
independent controller,
or, where applicable, joint controller,
depending on the processing activity.

5.4A. Partner crypto-asset service provider (CASP)

The Company cooperates with Cloverum Finance (CY) Limited (“Cloverum” or the “Partner CASP”), a crypto-asset service provider incorporated in Cyprus (registration number HE 474703, registered address Kypranoros 13, Evi Building, Floor 2, Office 201, 1061 Nicosia, Cyprus), which is pursuing authorisation as a crypto-asset service provider under Regulation (EU) 2023/1114 (MiCA). Cloverum acts as an independent controller of your Personal Data for its own crypto-asset onboarding, custody and compliance purposes.

Where you actively request access to Cloverum’s crypto-asset services (“Crypto Activation”), the Company may share your identity, contact and onboarding data with Cloverum on a controller-to-controller basis, as necessary to enable Cloverum to onboard you and comply with its own regulatory obligations. This sharing is governed by a written Data Sharing Agreement between the Company and Cloverum. Where any transfer of crypto-assets is initiated on your behalf between the Company and Cloverum, information required by Regulation (EU) 2023/1113 (the “Travel Rule”) may also be shared.

The Company may also receive from Cloverum, on a case-specific basis, information about you that is necessary for the Company’s AML/CTF, sanctions, fraud-prevention, audit and record-keeping obligations. Such information may include transaction and wallet-screening data, risk-scoring reports, enhanced due diligence information and, where applicable, information relating to Cloverum’s screening output. The categories of Personal Data received from Cloverum are those described in Section 3 above; the purposes and lawful bases for the Company’s further processing are those described in Sections 2 and 3.

The sharing between the Company and Cloverum takes place within the European Economic Area (Malta and Cyprus) and does not, in itself, involve any transfer of Personal Data outside the EU/EEA. Any onward transfer by Cloverum or its sub-processors to a country outside the EU/EEA is governed by Cloverum’s own arrangements and by the safeguards described in Section 6 (International transfers).

5.4. Partner institutions

Where necessary, your Personal Data may be shared with:

partner institutions cooperating with the Company in relation to onboarding, service provision, compliance controls, fraud prevention, transaction processing, operational support, or continuity of services.

Such recipients may act as processors, independent controllers, or joint controllers depending on the circumstances of the processing.

5.5. Public authorities and regulators

Your Personal Data may be disclosed to:

supervisory authorities and regulators;
tax, accounting, and other public authorities;
courts, tribunals, law enforcement agencies, notaries, bailiffs, insolvency administrators, and other persons where disclosure is required or permitted by law.

5.6. Registers and databases

Your Personal Data may be obtained from or shared with:

public and private registers;
credit, commercial, and population registers;
screening, fraud prevention, and risk assessment databases;
shared compliance, customer support, and operational platforms used within the Mellifera Holding Group;
other lawful information sources used for identification, verification, compliance, and risk management purposes.

5.7. Corporate transactions

If the Company is involved in a merger, acquisition, restructuring, financing, transfer of business, or assignment of rights, your Personal Data may be shared with potential assignees, acquirers, investors, or advisers, subject to appropriate confidentiality and data protection safeguards.

6. International transfers

6.1. As a general rule, your Personal Data is processed within the European Union or the European Economic Area.

6.2. Due to the international nature of financial services, payment infrastructure, technology services, and cooperation with service providers, affiliated entities, and partner institutions, your Personal Data may in some cases be transferred outside the EU/EEA, including to the United Kingdom and other jurisdictions where lawful transfer mechanisms are available.

6.3. Where Personal Data is transferred outside the EU/EEA, the Company will ensure that the transfer takes place only where an appropriate level of protection is guaranteed in accordance with applicable data protection law, including through:

an adequacy decision;
Standard Contractual Clauses;
binding corporate rules; or
another lawful transfer mechanism recognised under applicable law.

6.4. Further information regarding applicable safeguards may be obtained by contacting the Company or the Data Protection Officer.

6.5. Some of our service providers, including the provider of the artificial-intelligence analytical tools referred to in Section 3, are located in, or process Personal Data in, the United States. Where your Personal Data is made available to such a provider, the transfer is protected by the European Commission’s Standard Contractual Clauses, together with a transfer impact assessment and additional measures such as data minimisation, or by the EU–US Data Privacy Framework where the provider is certified. We limit the Personal Data made available to these tools to what is necessary for the relevant purpose.

7. Personal Data Integrity and Retention

7.1. Data Integrity

The Company takes appropriate technical and organisational measures to ensure that your Personal Data is accurate, complete, and kept up to date where necessary. You are responsible for helping us keep your data accurate by informing us promptly of relevant changes, including changes to your contact details, address, identity documents, tax residence, beneficial ownership, authorised persons, or other relevant information.

7.2. Retention Periods

Your Personal Data will be retained only for as long as necessary to fulfil the purposes described in this Notice or to comply with legal, regulatory, contractual, or operational requirements. In particular:

customer relationship and service records may be retained for the duration of the business relationship and for a period thereafter as required by law or necessary for claims handling;
AML/CTF and related compliance records may be retained for the period required by applicable law;
tax, accounting, audit, and financial records may be retained for the period required by applicable law;
complaint, dispute, and legal claims records may be retained for as long as necessary to establish, exercise, or defend legal claims.

7.3. Where Personal Data is no longer required and no lawful basis for continued retention applies, the Company will delete, anonymise, or securely dispose of such data.

7.4. Please note that in some cases we may be unable to erase or fully restrict the processing of your Personal Data where continued retention or processing is required by applicable law, including AML / CTF, sanctions, fraud prevention, tax, accounting, complaint handling, or regulatory obligations.

8. Requests, Questions and Complaints

8.1. Where the processing of your Personal Data is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

8.2. You have the right to exercise the following data subject rights under the GDPR and other applicable data protection law, subject to any legal limitations:

the right of access to your Personal Data;
the right to rectification (correction) of inaccurate or incomplete data;
the right to erasure (“right to be forgotten”);
the right to restriction of processing;
the right to object to the processing of your Personal Data;
the right to data portability;
the right not to be subject to solely automated decision-making where applicable.

8.3. Requests to exercise these rights, or other questions concerning the processing of your Personal Data, may be submitted to the Company or to the Data Protection Officer.

8.4. Where your request relates to Personal Data processed by more than one Mellifera Holding Group entity, the relevant group entities may cooperate in order to identify the data concerned and provide you with a complete and lawful response.

8.5. You also have the right to lodge a complaint with the competent supervisory authority. In Malta, this is the Office of the Information and Data Protection Commissioner (IDPC) (website: https://idpc.org.mt/; address: Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta; phone number: +356 2328 7100; email: [email protected]).

8.6. In certain circumstances, applicable law may restrict the information the Company can provide or the action it can take in response to your request, particularly where this is necessary to protect the prevention, detection, investigation, or reporting of money laundering, terrorist financing, sanctions breaches, fraud, or other unlawful activity, or where disclosure is otherwise restricted by law.

9. Contact Details

9.1. For more detailed information about the categories of Personal Data processed, purposes of processing, lawful bases, recipients, international transfers, retention periods, and data subject rights, please refer to the Company’s Data Privacy Policy available on the Company’s website.

9.2. If you have any questions regarding this Privacy Notice or the processing of your Personal Data, please contact:

Mellifera Kartiera Limited

Villa Malitah, Mediterranean Street
The Village, St. Julians, STJ 1870, Malta
Website: www.kartiera.eu

9.3. Data Protection Officer

Email: [email protected]
Postal address: Villa Malitah, Mediterranean Street, The Village, St. Julian’s, STJ 1870, Malta
Please mark correspondence: “Data Protection Officer”