This version of the Privacy Policy is effective as of August 21, 2026.

1. INTRODUCTION

1.1. This Data Privacy Policy (hereinafter – the “Policy”) sets out the principles according to which Mellifera Kartiera Limited (hereinafter – the “Company”), registration number C 107685, with registered office at Villa Malitah, Mediterranean Street, The Village, St. Julians, STJ 1870, Malta, collects, uses, shares, stores, and otherwise processes Personal Data.

1.2. This Policy applies where a customer, prospective customer, former customer, or any related natural person, including a representative, beneficial owner, director, manager, board member, shareholder, employee, contractor, or other associated person of a legal entity customer, uses, has used, or intends to use services provided by the Company, or otherwise interacts with the Company in connection with its services.

1.3. The legal instruments behind the Policy:

2. DEFINITIONS

2.1. Customer – any private individual who uses, has used, or has expressed a wish to use or is in other way related to any of the services provided by the Company. For the purposes of this Policy, this Customer definition also includes any private individual such as the representative, beneficial owner, manager, board member or member of the management body of the customer – legal entity, whose Personal Data is collected and processed by the Company.

2.2. Personal Data – means any information relating to an identified or identifiable Customer.

2.3. Processing – any operations carried out with Personal Data (incl., collection, recording, storing, alteration, grant of access to, making enquiries, transfer, etc.).

2.4. Personal Data Controller – the Company.

2.5. Mellifera Holding Limited – a Private Exempt Single Member Limited Liability Company incorporated in the Republic of Malta, company registration number: C 104995 with registered address: Villa Malitah, Mediterranean Street, The Village, St. Julians, STJ 1870, Malta.

2.5A. Mellifera Operations Limited (MOL) – a company incorporated in Malta, registration number C105114, with registered address Villa Malitah, Mediterranean Street, The Village, St. Julian’s, STJ 1870, Malta, which operates the online software platform through which Customers may register and which, on the Customer’s own-initiative request, shares the Customer’s identity and onboarding data with the Company.

2.5B. Colibrix Limited – a company incorporated in Malta, registration number C105114, with registered address Villa Malitah, Mediterranean Street, The Village, St. Julian’s, STJ 1870, Malta, which operates the online software platform through which Customers may register and which processes Personal Data on the Company’s behalf as a Processor under Article 28 GDPR pursuant to a written intra-group Data Processing Agreement between the Company and MOL, in particular in connection with the operation of the online platform, the Group CRM and the packaging and secure transmission of Customer identity and onboarding data to authorised recipients on the Company’s documented instructions.

2.5C. Cloverum Finance (CY) Limited (Cloverum, Partner CASP) – a company incorporated in Cyprus, registration number HE 474703, with registered office at Kypranoros 13, Evi Building, Floor 2, Office 201, 1061 Nicosia, Cyprus, which is pursuing authorisation as a crypto-asset service provider under Regulation (EU) 2023/1114 (“MiCA”) and with which the Company operates a controller-to-controller data sharing arrangement for the purpose of enabling Customers to access Cloverum’s crypto-asset services on their own-initiative request, and for the Company’s and Cloverum’s own AML/CTF, sanctions and financial-crime obligations.

2.6. Affiliated Entity – any legal entity under common ownership or control with the Company, including entities cooperating with the Company in relation to onboarding, compliance, customer servicing, provision of services, or operational support.

2.7. Partner Institution – a regulated financial institution, payment service provider, electronic money institution, credit institution, or other regulated financial sector entity which cooperates with the Company in relation to onboarding, provision of services, compliance controls, fraud prevention, transaction processing, or operational support.

2.8. Recipient means any natural or legal person, public authority, agency, or other body to which Personal Data is disclosed, whether a third party or not, in accordance with applicable law.

3. GENERAL PROVISIONS

3.1. This Policy describes general principles on how the Company processes Personal Data. Specific details on the processing of Personal Data might be also included in agreements entered or to be entered between the Customer and the Company.

3.2. The Company ensures, within the framework of the applicable law, the confidentiality of Personal Data and has implemented appropriate technical and organizational measures to safeguard Personal Data from unauthorized access, unlawful Processing or disclosure, accidental loss, modification or destruction.

3.3. As a general rule, the Company stores and processes Personal Data within the European Union or the European Economic Area. However, in connection with the provision of financial services, technology solutions, payment processing, compliance controls, or cooperation with Affiliated Entities, Partner Institutions, processors, or service providers, Personal Data may also be transferred outside the EU/EEA, including to the United Kingdom or other jurisdictions, where permitted by applicable law and subject to appropriate safeguards.

3.4. The Company uses authorized processors and service providers for Personal Data Processing where appropriate. In such cases, the Company takes reasonable steps to ensure that such data processors process Personal Data only on the Company’s documented instructions, implement appropriate security measures, and comply with applicable data protection law.

3.4A. Where the Company shares Personal Data with an Affiliated Entity, or Partner Institution acting as an independent controller or joint controller, such sharing shall be carried out in accordance with applicable law, relevant contractual arrangements, and this Policy.

3.5. If Customer fails to provide the Company with Personal Data that is necessary for the conclusion and/or performance of an agreement or provision of the Company services whereof is required by law or under the agreement, the Company may be unable to provide services to Customer.

3.6. The Company may use various technologies to collect and store information when Customer visits the Company web page, and this may include using cookies or similar technologies to identify Customer’s browser or device. The Company’s Cookies Policy is available on the Company website.

4. CATEGORIES OF PERSONAL DATA

4.1. Personal Data categories which the Company processes are the following:

4.1.1. Identification data such as name, surname, personal identification number or equivalent identifier, place and date of birth, citizenship, data regarding identity documents (including type, number, country and date of issue, expiry date, issuing authority, and copy where required), photograph or video image collected for identification or verification purposes, and signature.

4.1.2. Contact data such as phone number, email address, residence address, and language of communication;

4.1.3. Financial data such as account number, cash flow, i.e., incoming and outgoing payments and information included thereof, transaction history, loan obligations and other obligations, accounts held at other financial institutions;

4.1.4. Information related to the Customer’s tax residence such as country of residence, country of tax residence, taxpayer identification number (TIN), citizenship;

4.1.5. Family data such as information about the Customer’s family, heirs and another related person’s;

4.1.6. Professional activity data such as the Customer’s place of work, profession, position, occupation, length of service and education;

4.1.7. Communication data collected when the Customer communicates with the Company via telephone, visual and/or audio recordings, email, messages, and other communication channels such as social media; data related to the Customer’s visit to the Company web page or communicating through other communication channels of the Company (such as chat).

4.1.8. KYC data such as data about the Customer’s due diligence, including the relationships with legal entities for the execution of transactions on behalf of the legal entity, legal representatives (acting with relevant authorization or on any other basis), contracting parties and contract participants, funds and wealth sources, ultimate beneficial owners (UBOs), general manager of a company; shareholder, amount of shares owned; member of the management board or any other management body; self-declaration of politically exposed person (PEP); information publicly available in public registers, social networks and other media, information obtained in screenings against sanction lists, PEP status; data on origin of assets and wealth such as data regarding the Customer’s transaction partners and business activities;

4.1.9. Data related to the services the Customer received from the Company such as the performance of the agreements or the failure thereof, executed transactions, usage of ATMs, concluded and expired agreements, submitted applications, requests and complaints, interests and service fees;

4.1.10. Card and payment instrument data such as cardholder name, masked card number, card expiry date, tokenised card credentials, and limited payment instrument verification data, to the extent necessary for payment processing, fraud prevention, dispute handling, and compliance with applicable payment industry requirements.

4.1.11. Data obtained from public registers and/or created while performing an obligation arising from law or resulting from enquiries made by investigative bodies, notaries, central tax administrators, courts and bailiffs, details of income, credit commitments, property holdings, and debt balances;

4.1.12. Location data such as Internet Protocol (IP) address, Handset ID or data processed on an electronic communications network or processed by means of electronic communications services, indicating the location of the electronic communications terminal equipment, including the location of the terminal equipment (address), and connection point address.

4.1.13. Technical, device, and usage data such as device identifiers, authentication logs, login history, browser type, operating system, app usage data, cookie-related information, and system event logs.

4.1.14. Compliance and screening data such as sanctions screening results, fraud indicators, AML/CFT monitoring flags, account restrictions, alert history, suspicious activity indicators, and records of internal compliance assessments.

5. PURPOSES AND BASIS OF PROCESSING PERSONAL DATA

5.1. The Company processes Personal Data only where it has a valid lawful basis under applicable data protection law and only to the extent necessary for specified, explicit, and legitimate purposes.

5.2. The Company processes Personal Data for the following purposes and on the following lawful bases:

5.2.1. To take steps at the request of the Customer before entering into an agreement and to conclude, perform, administer, and terminate agreements relating to the Company’s services. Lawful basis: performance of a contract or steps prior to entering into a contract.

5.2.2. To identify and verify Customers and related persons, perform onboarding, customer due diligence, KYC, sanctions screening, anti-money laundering and counter-terrorist financing checks, fraud prevention, transaction monitoring, risk scoring, and related compliance controls. Lawful basis: compliance with legal obligations and, where applicable, legitimate interests in preventing fraud, safeguarding the Company, its customers, and the financial system.

5.2.3. To provide payment services and related financial services, including executing domestic and international transactions, maintaining accounts, managing access to services, customer support, dispute handling, complaint handling, and service continuity. Lawful basis: performance of a contract, compliance with legal obligations, and, where applicable, legitimate interests in service administration and operational resilience.

5.2.4. To comply with legal and regulatory obligations, including reporting to supervisory authorities, responding to lawful requests from public authorities, maintaining records, conducting audits, managing governance obligations, and complying with financial services, AML/CFT, sanctions, tax, accounting, consumer protection, and data protection laws. Lawful basis: compliance with legal obligations.

5.2.5. To protect the Company’s legal rights and interests, manage disputes and claims, defend legal proceedings, ensure information security, maintain business continuity, prevent misuse of services, and improve internal governance, controls, and systems. Lawful basis: legitimate interests, except where another lawful basis applies.

5.2.6. To communicate with Customers and related persons, including providing service notices, security alerts, policy updates, and information relating to agreements or requested services. Lawful basis: performance of a contract, compliance with legal obligations, and legitimate interests in effective customer communication.

5.2.7. To send direct marketing communications where this is permitted by law and, where required, based on the Customer’s consent. Lawful basis: consent and, where applicable, legitimate interests permitted by law.

5.2.8. To carry out analytics, service improvement, product development, internal reporting, and statistical analysis, using anonymised or aggregated data where possible. Lawful basis: legitimate interests and, where required, consent or legal obligation.

5.2A. Special categories of personal data and criminal-offence data. Where the Company processes special categories of personal data — in particular biometric data used to uniquely identify a Customer during electronic identity verification — it does so on a condition under Article 9(2) GDPR, namely the Customer’s explicit consent or, where applicable, reasons of substantial public interest or compliance with obligations in the field of anti-money laundering and financial-crime prevention laid down by EU or Maltese law. Where the Company processes personal data relating to criminal convictions and offences or related security measures — for example through sanctions, adverse-media and financial-crime screening — it does so only where authorised by EU or Maltese law (Article 10 GDPR).

5.3. Where the Company relies on legitimate interests, it does so only where such interests are not overridden by the rights and freedoms of the relevant data subject.

5.4. Where the Company relies on consent, the data subject may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5.5. The Company may share Personal Data with Affiliated Entities, Partner Institutions, service providers, and other recipients where such sharing is necessary for the purposes set out in this Policy and supported by an appropriate lawful basis. Such sharing may take place, for example, in connection with onboarding, provision of services, compliance, fraud prevention, operational resilience, customer support, and continuity of services.

6. REPORTING AND OVERSIGHT

6.1. The Company maintains processes for identifying, assessing, documenting, and responding to personal data breaches in accordance with applicable law.

6.2. Where required by law, the Company will notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within the time limits required by law, but no longer than 72 hours after the Company becomes aware of the breach (Article 33(1) GDPR).

6.3. The Company identifies and assesses the nature, scope, and impact of the data breach, including identifying affected systems, data categories, and individuals.

6.4. Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the Company’s Data Protection Officer (hereinafter – DPO) will notify affected individuals without undue delay, unless an exception under applicable law applies. This notification includes:

6.4.1. A clear description of the breach and its potential impact.

6.4.2. Actions individuals can take to protect themselves (e.g. changing passwords, monitoring accounts).

6.4.3. Steps the Company has taken or will take to mitigate risks.

6.4.4. Contact information for further inquiries.

6.5. All breaches are documented in an internal incident register, including the facts, effects, and remedial actions taken. This documentation is subject to periodic review to improve future responses.

6.6. The Company conducts post-incident reviews to identify root causes, improve security measures, and update policies or procedures as needed to prevent recurrence.

6.7. All data processors and controllers working with the Company are subject to strict data processing agreements and regular compliance audits.

6.8. The Company requires relevant employees, processors, and service providers to comply with appropriate confidentiality, security, and data protection obligations.

7. PROVIDERS AND RECIPIENTS OF PERSONAL DATA

7.1. Personal Data is obtained:

7.1.1. When the Customer provides it to the Company:

7.1.1.1. while applying for and using products and services;

7.1.1.2. while addressing the Company by mail, email, over the phone, using chats and other communication channels;

7.1.1.3. while providing information related to payments;

7.1.1.4. while visiting the Company’s homepage and using a mobile application, i.e., the Customer’s profile and use data, how Customer uses these services, obtaining information from the Customer’s devices – computer, mobile phone, with the help of cookies or Internet monitoring software (more detailed information is available in the Cookie Policy).

7.1.2. When third parties provide it to the Company:

7.1.2.1. third parties that provide the Company with information relating to the Customer, conduct market research;

7.1.2.2. database maintenance companies, registers;

7.1.2.3. Affiliated Entities, and Partner Institutions;

7.1.2.4. state institutions and law enforcement agencies and officials thereof;

7.1.2.5. persons in relation to contracts and transactions which these persons intend to conclude or have concluded with the Company.

7.1.3. When the Company collects this information from:

7.1.3.1. other financial institutions, payment service providers, electronic money institutions, credit institutions, and other regulated financial sector participants;

7.1.3.2. official and public registers, social media;

7.1.3.3. legal entities, with respect to its representatives, employees, contractors, founders, shareholders, participants, owners, etc. of such legal entities.

7.2. Personal Data may be shared with recipients acting as processors, independent controllers, or joint controllers, as applicable, including:

7.2.1. Affiliated Entities, and Partner Institutions, where necessary for onboarding, provision of services, compliance controls, fraud prevention, customer support, service continuity, operational resilience, and risk management;

7.2.2. credit institutions, payment service providers, card schemes, payment system participants, settlement institutions, correspondent banks, and other counterparties involved in executing or supporting transactions and related services;

7.2.3. service providers acting on behalf of the Company, such as IT, cloud, software, artificial-intelligence and analytics tools, communications, identity verification, fraud prevention, sanctions screening, compliance support, customer support, document management, audit, legal, tax, accounting, consulting, translation, and other professional service providers;

7.2.4. competent authorities, regulators, supervisory bodies, law enforcement agencies, courts, notaries, bailiffs, tax authorities, and other persons where disclosure is required or permitted by applicable law;

7.2.5. public and private registers, databases, and information providers where necessary for identification, verification, compliance, creditworthiness, fraud prevention, risk assessment, or legal compliance;

7.2.6. potential assignees, successors, acquirers, investors, or other persons in connection with a merger, acquisition, restructuring, financing, transfer of business, or assignment of rights, subject to applicable confidentiality and data protection obligations.

7.2A. Where Personal Data is shared with another Affiliated Entity, or Partner Institution, each recipient may act as a processor, independent controller, or joint controller depending on the purpose and circumstances of the processing. Further information regarding such roles shall be provided in this Policy, in service documentation, or otherwise where required by applicable law.

7.3. State institutions, authorities and other statutory persons based on written requests or the duties binding upon the Company stipulated by the legal acts;

7.4. Providers of databases and registers, e.g. to credit registers, population registers, commercial registers, securities registers, pension registers, controllers who process consolidated debtor files, or other register holding or intermediating Personal Data, debt collectors, bailiffs, notaries or insolvency administrators;

7.5. The Company’s audit firms, financial and legal service providers, translators, or any other service providers of the Company.

7A. DATA SHARING WITH AFFILIATED ENTITIES AND PARTNER INSTITUTIONS

7A.1. The Company may share Personal Data with with Mellifera Holding Limited, Affiliated Entities and Partner Institutions where this is necessary for onboarding, customer identification and verification, service provision, customer support, fraud prevention, anti-money laundering and counter-terrorist financing controls, sanctions screening, transaction monitoring, complaint handling, service continuity, operational resilience, internal governance, audit, risk management, or compliance with legal and regulatory obligations.

7A.2. Such recipients may act as processors, independent controllers, or joint controllers depending on the purpose and circumstances of the processing. Where required by law, the Company will make available information regarding the roles of such recipients and the main aspects of any relevant joint controllership arrangement.

7A.3. Personal Data shared under this section may include identification data, contact data, KYC and due diligence information, transaction information, account-related information, fraud and compliance indicators, and communications relevant to the customer relationship, to the extent necessary for the relevant purpose.

7A.4. The Company takes reasonable steps to ensure that sharing with such recipients is limited to what is necessary and is subject to appropriate contractual, organisational, technical, and legal safeguards.

7A.5. Data received from the MOL platform. MOL processes Personal Data on the Company’s behalf as the Company’s Processor under Article 28 GDPR pursuant to a written intra-group Data Processing Agreement between the Company and MOL. In particular, MOL operates the online platform through which the Company’s Customers register and interact with the Company’s regulated services, operates the Group CRM instance in which the Company’s Customer data is maintained under the Company’s control, and packages and securely transmits Customer identity and onboarding data (including full name, date and place of birth, nationality, residential address, government identifier or passport number and document image, photograph or selfie where used, contact details, account and registration identifiers and, where applicable, sanctions, PEP and adverse-media screening results and source-of-funds information) to authorised recipients on the Company’s documented instructions. MOL does not process such data for its own purposes and does not determine the purposes or means of the processing. The Company is the Controller and remains responsible for the lawfulness of the processing under Article 6 (and, where applicable, Article 9 and Article 10) GDPR. As both MOL and the Company are established in Malta, this arrangement does not involve a transfer of Personal Data outside the EEA. Sub-Processors engaged by MOL to process on the Company’s behalf are subject to the general authorisation and equivalent flow-down obligations under the intra-group DPA.

7A.6. Reliance arrangement with Colibrix Limited (United Kingdom). The Company and Colibrix Limited operate an intra-group reliance arrangement under which each party may provide the other with, and rely on, customer due diligence and KYC information and documentation (including identity and verification data of Customers, beneficial owners, directors, authorised signatories and legal representatives, together with sanctions, PEP and adverse-media screening results and risk information) for the purpose of onboarding Clients introduced between the two entities and meeting each party’s own anti-money-laundering, counter-terrorist-financing and regulatory obligations. Each party acts as an independent controller and retains ultimate responsibility for its own compliance; neither acts as the other’s processor. Where Personal Data is transferred between the Company (Malta / EEA) and Colibrix Limited (United Kingdom), the transfer relies on the European Commission’s adequacy decision for the United Kingdom (renewed on 19 December 2025 and valid until 27 December 2031) and, for transfers originating in the United Kingdom, on the corresponding UK adequacy regulations for the EEA.

7A.7. Partner CASP arrangement with Cloverum Finance (CY) Limited (Cyprus). The Company cooperates with Cloverum Finance (CY) Limited (Cloverum, Partner CASP) under a written Master Commercial Infrastructure and Settlement Services Agreement, a Data Sharing Agreement (controller-to-controller) and a related Data Processing Addendum between MOL and Cloverum. Where a Customer actively requests access to Cloverum’s crypto-asset services (“Crypto Activation”), the Company shares with Cloverum, and Cloverum receives, the Customer’s identity and onboarding data (including full name, date and place of birth, nationality, residential address, government identifier or passport number and document image, photograph or selfie where used, contact details, account and registration identifiers, source-of-funds information and, where applicable, screening results) as necessary for Cloverum to onboard the Customer and to comply with its own AML/CTF, sanctions and MiCA-related obligations. On a case-specific basis, the Company also receives from Cloverum transaction and wallet-screening data, risk-scoring reports, enhanced due diligence information and, where applicable, information relating to Cloverum’s screening output, for the Company’s own AML/CTF, sanctions, fraud-prevention, audit and record-keeping obligations. Where crypto-asset transfers between the Company and Cloverum are initiated on a Customer’s behalf, information required by Regulation (EU) 2023/1113 (the Travel Rule) is exchanged. The Company and Cloverum each act as independent controllers in respect of the data they process, are not joint controllers, and neither processes the data on the other’s behalf. As both the Company (Malta) and Cloverum (Cyprus) are established in the EEA, this sharing does not, in itself, involve a transfer of Personal Data outside the EEA; any onward transfer by Cloverum or its sub-processors to a country outside the EEA is governed by Cloverum’s own arrangements. The arrangement is governed by the aforementioned Data Sharing Agreement and by the Mellifera Holding Group Data Sharing Policy.

8. ADVERTISING AND DIRECT MARKETING

8.1. The Company sends advertising and direct marketing communications relating to its services, products, campaigns, and updates where permitted by law and, where required, on the basis of the Customer’s consent or another lawful basis recognised under applicable law.

8.2. The Customer may give his/her consent to the receipt of commercial communications of the Company by visiting website www.kartiera.eu, registering on the website, as well as by providing application forms.

8.3. Where direct marketing is based on consent, the Customer may withdraw that consent at any time. The Customer may also object to the processing of Personal Data for direct marketing purposes at any time and free of charge. Such withdrawal or objection shall not affect the lawfulness of processing carried out before the withdrawal or objection.

9. PROFILING, PERSONALIZED OFFERING AND AUTOMATED DECISION MAKING

9.1. The Company may use profiling and analytics to assess certain characteristics relating to the Customer or related persons, such as financial behaviour, risk indicators, service usage patterns, transaction behaviour, residence, or likely fraud or compliance risks, where this is necessary for service provision, fraud prevention, compliance, risk management, system development, or marketing.

9.2. The Company may use automated tools or partially automated processes in relation to identity checks, onboarding, fraud detection, sanctions screening, anti-money laundering controls, account monitoring, transaction monitoring, and risk management. Depending on the circumstances, such processing may involve human review.

9.3. Where the Company makes a decision based solely on automated processing that produces legal effects concerning the Customer or similarly significantly affects the Customer, the Customer may have the right to request human intervention, to express their point of view, and to contest the decision, subject to applicable law.

9.4. As part of the automated and partially automated processing referred to above, the Company uses artificial-intelligence-based analytical tools provided by a specialist third-party service provider that acts as the Company’s Processor under Article 28 GDPR and processes Personal Data only on the Company’s documented instructions. These tools assist the Company’s personnel in tasks such as reviewing identity and onboarding documentation and analysing information for anti-money-laundering, counter-terrorist-financing, sanctions and fraud-prevention purposes. The output of these tools is advisory only and is reviewed by the Company’s personnel, who take the relevant decision; the Company does not take any decision producing legal effects concerning the Customer, or similarly significantly affecting the Customer, based solely on automated processing without human involvement. The provider processes the data solely to provide the service to the Company and does not use it to train its models.

10. STATISTICAL DATA

10.1. The Company may create aggregated, de-identified, or anonymised statistical information regarding customer behaviour, service usage, transaction patterns, and related trends. The Company may collect statistical data regarding the Customer, such as typical behaviour and spending patterns based on the Customer’s interactions with the Company through its software application and transactions carried out across all currencies and jurisdictions relevant to the Customer.

10.2. The Company may use statistical data for creating segment profiles which may include data collected from external sources and may be combined with the Company’s internal data. The Company may use such information for analytics, forecasting, service development, internal reporting, business planning, market analysis, and risk management.

10.3. The Company may share anonymised or aggregated statistical information internally within the Group and, where appropriate, with third parties, provided that such information does not identify the Customer.

10.4. The Company does not treat anonymised statistical information as Personal Data where the Customer is not identifiable from that information.

10.5. The lawful basis for the collection and usage of statistical data may be either one or both of the following:

10.5.1. legitimate interests (to conduct research and analysis, including to produce statistical research and reports);

10.5.2. or compliance with legal obligations.

11. GEOGRAPHICAL AREA OF PROCESSING

11.1. Generally, the Personal Data are processed within the European Union/European Economic Area (EU/EEA).

11.2. Due to the international nature of financial services, payment infrastructure, technology services, compliance arrangements, and cooperation with Affiliated Entities, Partner Institutions, processors, or service providers, Personal Data may in some cases be transferred to or accessed from countries outside the EU/EEA, including the United Kingdom.

11.2A. In particular, Personal Data may be shared with, and received from, Colibrix Limited in the United Kingdom under the intra-group reliance arrangement described in section 7A; such transfers rely on the UK adequacy decision referred to in 11.4A. Personal Data received by the Company from the MOL platform (section 7A) is shared within Malta and does not involve a transfer outside the EEA. Personal Data shared between the Company and Cloverum Finance (CY) Limited under section 7A.7 takes place within the EEA (Malta and Cyprus) and does not, in itself, involve a transfer outside the EEA.

11.2B. Certain of the Company’s service providers, including the provider of the artificial-intelligence analytical tools referred to in section 9, are established in, or process Personal Data in, the United States. Where Personal Data is made available to such a provider, the transfer relies on the European Commission’s standard contractual clauses, supported by a transfer impact assessment and appropriate technical and organisational measures (including data minimisation), or, where the provider is certified, on the EU–US Data Privacy Framework. The Company limits the Personal Data made available to such tools to what is necessary for the relevant purpose.

11.3. Where Personal Data is transferred outside the EU/EEA, the Company will ensure that such transfer is carried out in accordance with applicable data protection law and supported by an appropriate transfer mechanism.

11.4. Depending on the circumstances, the transfer mechanism may include:
11.4.1. an adequacy decision issued by the European Commission;
11.4.2. standard contractual clauses or other approved transfer clauses;
11.4.3. binding corporate rules; or
11.4.4. another lawful transfer mechanism recognised under applicable law.

11.4A. For example, the European Commission has recognised the United Kingdom as ensuring an adequate level of protection under the renewed adequacy decision of 19 December 2025 (valid until 27 December 2031), and recognises the United States as adequate for organisations certified under the EU–US Data Privacy Framework. Standard contractual clauses are used, supported by a transfer impact assessment where required, for transfers to other jurisdictions without an adequacy decision.

11.5. Further information about international transfers and relevant safeguards may be requested from the Company or the Data Protection Officer, unless restricted by law.

12. RETENTION PERIOD

12.1. The period for which the Company stores Personal Data depends on the purposes for which it is processed, the applicable lawful basis, and the legal, regulatory, contractual, and operational requirements applicable to the Company.

12.2. When determining retention periods, the Company considers, among other things:
12.2.1. the need to retain Personal Data for the establishment, performance, and termination of agreements and the provision of services;
12.2.2. legal and regulatory retention requirements, including AML/CFT, accounting, tax, financial services, and audit obligations;
12.2.3. the need to retain Personal Data in order to establish, exercise, or defend legal claims;
12.2.4. the need to retain records relating to consents, objections, restrictions, complaints, disputes, and evidence of lawful processing;
12.2.5. the Company’s legitimate interests or those of third parties, where applicable and lawful;
12.2.6. whether processing is based on consent and whether that consent remains in force.

12.3. Where Personal Data is no longer required for the relevant purpose and no lawful basis for continued retention applies, the Company will delete, anonymise, or securely dispose of such data.

12.4. Different categories of Personal Data may be retained for different periods depending on the purpose of processing and the applicable legal or operational requirements.

13. CUSTOMER’S RIGHTS AS A DATA SUBJECT

13.1. The Customer (data subject) has rights regarding their data processing that is classified as Personal Data under applicable law. Such rights are in general the following:

13.1.1. require their Personal Data to be corrected if it is inadequate, incomplete or incorrect;

13.1.2. object to Processing of their Personal Data, if the use of Personal Data is based on a legitimate interest, including profiling for direct marketing purposes (such as receiving marketing offers or participating in surveys);

13.1.3. require the erasure of their Personal Data, for example, that is being processed based on the consent, if they have withdrawn the consent. Such right does not apply if Personal Data requested to be erased is being processed also based on other legal grounds such as agreement or obligations based on applicable law;

13.1.4. restrict the Processing of their Personal Data under applicable law, e.g., during the time when the Company assesses whether the Customer is entitled to have their data erased;

13.1.5. receive information if their Personal Data is being processed by the Company and if so then to access it;

13.1.6. receive their Personal Data that is provided by themselves and where feasible transmit such data to another service provider (data portability);

13.1.7. Withdraw consent to process Personal Data;

13.1.8. Not to be subject to fully automated decision-making, including profiling, if such decision-making has legal effects or similarly significantly affects the Customer. This right does not apply if the decision-making is necessary to enter into or to perform an agreement with the Customer, if the decision-making is permitted under applicable law or if the Customer has provided their explicit consent;

13.1.9. Lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta if the Customer considers that the processing of Personal Data infringes applicable law. The contact details of the supervisory authority are available on its official website https://idpc.org.mt/file-a-complaint/ ; the registered address at  Floor 2, Airways House, Triq Il – Kbira, Tas-Sliema SLM 1549, phone number: +356 2328 7100, email:  [email protected].

13.2. The Company takes every effort for the implementation of Customer’s rights and for answering all questions that arise to the Customer regarding the present Policy and matters envisaged in it. Customers may lodge a request regarding the exercise of the above-indicated rights as well as any complaints, notices or requests (hereinafter the ‘Request’) to the Data Protection Officer.

13.3. As a regulated financial institution, the Company is required by law to process certain Personal Data in order to comply with anti-money laundering, counter-terrorist financing, sanctions, fraud prevention, and related legal obligations. This may include processing Personal Data relating to Customers, prospective customers, former customers, beneficial owners, authorised persons, representatives, and other related persons.

13.4. In certain circumstances, applicable law may restrict the information that the Company can provide or the action that it can take in response to a data subject request, particularly where this is necessary to protect the prevention, detection, investigation, or reporting of money laundering, terrorist financing, sanctions breaches, fraud, or other unlawful activity, or where disclosure is otherwise restricted by law. In such cases, the Company will assess the request in accordance with applicable law and, where permitted, inform the data subject accordingly.

13.5. The Company will reply to the Customer’s Request without undue delay and in any event within one month of receipt of the Request. That period may be extended by up to two further months where necessary, taking into account the complexity and number of the requests; in such cases the Company will inform the Customer of the extension and of the reasons for the delay within one month of receipt (Article 12(3) GDPR).

13.6. The Company will usually not charge the Customer a fee when exercising their rights. However, the Company is allowed by law to charge a reasonable fee or refuse to act on the Customer’s Request if it is manifestly unfounded or excessive.

14. CONTACT DETAILS

14.1. Customers and other relevant data subjects may contact the Company with enquiries, requests to exercise data subject rights, withdrawals of consent, objections, or complaints regarding the processing of Personal Data.

14.2. Contact details of the Company are available on the website www.kartiera.eu.

14.3. Contact details of the appointed DPO email: [email protected], at the postal address: Villa Malitah, Mediterranean str., The Village, St. Julian’s, STJ 1870, Malta with a notice “Data Protection Officer”.

15. VALIDITY AND AMENDMENTS OF THE PRIVACY POLICY

15.1. The Policy is reviewed at least once per year or immediately after relevant applicable law changes or other significant circumstances occur. Where necessary, the relevant amendments are to be made. The latest version will be made available on the Company’s website. Where required by applicable law, the Company will notify Customers or other relevant data subjects of material changes by an appropriate means.

15.2. Relevant employees are informed in writing of the approval and amendment of the Policy or other documentation in relation to the Policy. The CRO shall be responsible for communicating relevant information below according to the Company’s organizational structure.

15.3. New employees shall be familiarized with the Policy before performing their duties.

16. ANNEX 1 Template of the “Request to Restrict Processing, Erase, or Delete Personal Data”

Data Protection Officer
Mellifera Kartiera Limited
Villa Malitah, Mediterranean Street, The Village, St. Julian’s, STJ 1870, Malta
Email: [email protected]

The template of the “Request to Restrict Processing, Erase, or Delete Personal Data” is available as a separate PDF document: Download Annex 1.

Note:
Mellifera Kartiera Limited will assess each request in accordance with applicable data protection law. In some cases, the Company may be unable to fully comply with the request where processing is necessary for compliance with legal obligations, including anti-money laundering, counter-terrorist financing, fraud prevention, record-keeping, legal claims, or other lawful regulatory requirements.