Privacy Policy

1. Introduction

In general, this Privacy Policy explains:

What information we collect, how we use it, and the choices you can make about the way your information is collected and used.

2. Information We Collect

A. Information you provide to us

We collect information when you use or interact with our Services or Sites. This may include:

B. Information we collect automatically from you

We or our vendors or service providers may also automatically collect information when you use the Sites or the Services to, for example, protect against fraud or to improve our products, Services, and user experience.

This information can include:

• Your browser type;
• Your device type or operating system;
• Your device's location and other information sent by your device;
• Your device's IP address;
• Your wallet address and blockchain transaction data;
• Your interaction with the Site or the Services, such as number of clicks, landing pages and pages viewed.

We utilize analytics software to capture this information, and by using the Site or the Services you consent to our capture and use of this information.

C. Information we collect from you with respect to your use of the Services

We may collect or have access to transactional information about your use of the Services. This information can include:

• Amount, type, and size of transactions or purchase details
• Date and time of transactions
• Cryptocurrency wallet addresses and blockchain transactions
• Merchants where you have transacted using a Karma Card
• Bank account information for off-ramp transactions
• Payment history and transaction records

D. Tracking and Cookie Data

Like many online services, we may use cookies or other tracking technologies to collect information about you. In addition, third parties may place cookies on your device to enable the collection of certain device identifier information, IP address, and information about your interactions with the Site and the Services. Cookies are small pieces of data placed on your computer, phone, or similar device when you use that device to visit the Sites or use our Services.

Examples of cookies we may use:

• Session cookies: Session cookies help us recognize users who visit our Sites.
• Tracking cookies: Tracking cookies help us remember preferences and other settings.
• Security cookies: Security cookies help us prevent fraud.

You can decide whether to accept cookies through your internet browser's settings. Most browsers have an option for turning off the cookie feature, which will prevent your browser from accepting new cookies. If you do not accept cookies, however, you may not be able to use some or all portions of our Sites.

E. Information that we may collect from third parties

We may also supplement any of the information that you provide to us or that we obtain with information that we receive from third parties, such as credit bureaus, data providers, fraud detection services and data analytics providers. Some of these third parties may obtain your Personal Information through your use of the Sites or the Services, and other third parties may already have your Personal Information that they then share with us. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. For information about how you can opt out of receiving targeted advertising from many providers, see the "Choices About Your Personal Information" section.

3. How We Use Information

We collect and use information for business and commercial purposes in accordance with the practices described in this Privacy Policy. Our business purposes for collecting and using information include:

• Helping us assess your eligibility to use the Services. Examples include verifying your identity for KYC compliance or assessing eligibility for a Karma Card.
• Supporting our internal business operations. Examples include maintaining your Karma Account, processing crypto-to-fiat transactions, or improving our Services or products or building new products or services.
• Contacting or communicating with you. Examples include providing customer services to you or marketing our products and services.
• Complying with our own policies and procedures. Examples include complying with our obligations under applicable law, regulation, or other legal process (including AML/KYC requirements) or complying with our contractual or audit obligations.
• Preventing and detecting potentially fraudulent or unauthorized transactions, breach of policies or terms, and threats of harm.

As described above, we may communicate with you if you've provided us the means to do so. For example, if you've given us your email address (either directly or through the Company), we may send you promotional email offers or email you about your use of the Services. Also, we may receive a confirmation when you open an email from us, which helps us improve the Services.

4. Sharing Information

We share information we collect, including information that identifies you, in accordance with the practices described in this Privacy Policy. The categories of parties with whom we share information include:

• Service providers, vendors, and advisors. For example, we may share your Personal Information with third parties who provide services or products to us and/or who help us provide the Services to you, including Bridge (our banking partner), card issuers, KYC/AML verification providers, blockchain infrastructure providers, and payment processors. Such service providers may further require your consent to obtain your Personal Information.

In connection with verifying your identity, we utilize a service provider that collects and uses biometric information from your government-issued ID to verify your identity. This biometric information is held by the service provider pursuant to its privacy policy, which can be found here: https://sumsub.com/privacy-notice-service/.

• Our affiliates for everyday business purposes.
• Our financing partners such as sources of debt or equity capital.
• Card issuers and payment networks (Visa, Mastercard).
• Merchants and businesses with whom you transact or use your Karma Card.
• Blockchain networks where transactions are publicly recorded.
• A third party as part of any due diligence process in relation to a partnership, financing arrangement, or potential purchase of Karma or its assets provided such party agrees to use such information only for such particular purpose.
• UK, EU, or other regulatory bodies, government agencies, courts, law enforcement officials, or any other judicial body as required by law or to protect our legal rights.

In the event of a merger, acquisition, or other sale or transfer of any or all of our assets, your Personal Information may be transferred to a buyer or other successor of our business. If that happens, we may not be able to limit how such other party may use or further transfer your information.

5. Aggregated or Anonymized Information

We may share aggregated and/or anonymized information with any third parties at any time and without restriction to the extent such information cannot be linked back to any identifiable person.

6. Analytics and Advertising

We may use analytics services to help us understand how users access and use the Services. Portions of the Site use Google Analytics. To learn more about Google Analytics, visit https://policies.google.com/technologies/partner-sites

As part of this process, we may incorporate tracking technologies into our own Services (including our Sites and emails) as well as into our ads displayed on other sites and services. Some of these tracking technologies may track your activities across time and services for purposes of associating the different devices you use, and delivering relevant ads and/or other content to you. Third parties independently decide how to process your information. As we do not control these third parties, we encourage you to familiarize yourself with and consult their privacy policies and terms of use.

7. Safeguarding Information

We maintain reasonable safeguards designed to ensure the protection of your information from unauthorized access or use. However, while we strive to protect your information, we cannot guarantee or warrant the security of any information you transmit to our Sites. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Sites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Please notify us immediately if you believe your information with Third National has been compromised in any way.

8. Retention of Information

We will retain your Personal Information as long as permitted by our internal data retention policies, or applicable law, and as long as necessary in order to:

• Provide the Services to you.
• Use for any of the purposes permitted by this Privacy Policy.
• To comply with any legal or regulatory requirements.

9. Children's online privacy

Protecting children on the Internet is very important to Third National. For that reason, we do not knowingly solicit or collect Personal Information from anyone under the age of thirteen (13), and no part of the Sites is intended to attract anyone under the age of thirteen (13). If you believe that a child under the age of thirteen (13) may have provided us Personal Information to us, please contact us immediately.

10. Do Not Track Signals

At this time, our Sites do not support Do Not Track ("DNT"). DNT is a privacy preference you can set in your web browser to indicate that you do not want certain information about your web page visits tracked and collected across the Sites. For more details, including how to turn on Do Not Track, visit https://www.donottrack.us/.

11. Your Account

You may access, update, or delete certain information within your Karma Account through our platform. Please note that if you delete information through your Account, we will retain and use information about you as necessary to comply with our legal obligations (including KYC/AML requirements), resolve disputes, and enforce our agreements. Certain blockchain transactions are permanently recorded on public ledgers and cannot be deleted.

12. International Data Transfers

Karma Fintech LTD is registered in the United Kingdom. However, some of our service providers may be located in other jurisdictions, including the United States. If you are located in the UK or EU, your information may be transferred to, stored, and processed in countries outside the European Economic Area. We ensure that appropriate safeguards are in place for such transfers in accordance with GDPR requirements. By using our Services, you consent to such international transfers of your personal information.

13. Choices About Your Personal Information

We strive to provide you with choices regarding the Personal Information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly.
• Promotional Offers from Karma. If you do not wish to have your email address or contact information used by us to promote our own or third parties' products or services, you can opt-out by sending us an email stating your request to team@karmapay.xyz. If we have sent you a promotional email, you may send us a return email asking to be omitted from future email distributions.

We do not control third parties' collection or use of your information to serve interest-based advertising. However these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website.

14. Contact Us

If you have any questions about this Privacy Policy, our data practices, or our compliance with applicable law, please contact us:

Additional Disclosures for UK and EU Residents (GDPR)

If you are a resident of the United Kingdom or European Union, you have specific rights under the General Data Protection Regulation (GDPR) regarding your Personal Information:

• Right to Access: You can request access to your personal data.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your data (subject to legal obligations).
• Right to Restrict Processing: You can request limitation on how we use your data.
• Right to Data Portability: You can request transfer of your data to another service.
• Right to Object: You can object to processing based on legitimate interests.
• Right to Withdraw Consent: You can withdraw consent at any time.

To exercise any of these rights, please contact us at team@karmapay.xyz. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local EU data protection authority.

Legal Basis for Processing: We process your personal data based on: (1) your consent, (2) performance of a contract with you, (3) compliance with legal obligations, or (4) our legitimate interests in providing and improving our Services.