Effective Date: 10/03/2026

WALLY INTERNATIONAL TECHNOLOGY LTD, a company duly established and operating under the laws of Seychelles, with registration number 248428 and registered office at Suite 23, 1st Floor, Eden Plaza, Eden Island, Victoria, Grand Anse Mahe, Seychelles ("WALLY", "we", "our", or "us"), acknowledges the significance of your personal data and is strongly committed to protecting your privacy and safeguarding your rights in accordance with applicable data protection regulations. We encourage you to carefully read this Privacy Policy, as it outlines how we collect, use, disclose, and otherwise handle your personal data.

IF YOU DO NOT ACCEPT THIS PRIVACY POLICY, YOU MUST IMMEDIATELY EXIT THE WEBSITE, REMOVE ANY MOBILE APPLICATIONS AND/OR EXTENSIONS, AND DISCONTINUE USING XWALLY SOFTWARE AND SERVICES.

Unless otherwise defined in this Privacy Policy, all terms used herein shall carry the same meanings as those set forth in our Terms of Service.

1. Our Relationship with You

We gather various types of information that you provide, depending on how you interact with Xwally Software and Services. Certain Personal Data is necessary for accessing and using the Xwally Software and Services, while other information is optional and provided at your discretion.

2. Your Personal Data

"Personal Data" refers to any information relating to an identified or identifiable natural person. This includes:

• (a) information that you provide directly to us;
• (b) information that is automatically collected about you; and
• (c) information obtained from third parties, including but not limited to publicly available sources, affiliated entities, service providers, other trusted third parties, or through your use of our (or our service providers') digital tools and services.

2.1 Personal Data You Provide to Us

We collect a range of information that you voluntarily provide, depending on your use of and interaction with Xwally Software and Services. Some Personal Data is essential for the provision of our services, while other data may be optional.

(a) Account and Profile Information

When you register an account or use Xwally Software and Services, you may provide Personal Data including, but not limited to:

• Your full name;
• Government-issued identification documents (such as passport, national ID card, or driver's license);
• National identification numbers;
• Facial images, selfies, or video recordings used for biometric identity verification;
• Any additional information required for account setup, maintenance, or compliance purposes.

Where permitted under applicable laws or based on your explicit consent, we may collect and process biometric information, such as facial recognition data derived from your selfies or videos, for identity verification purposes. This may involve comparing your facial data with the photograph contained in your submitted government-issued identification documents, as part of our Know Your Customer (KYC), Anti-Money Laundering (AML), and fraud prevention processes.

We will only collect and use biometric data under the following conditions:

• With your explicit and informed consent;
• Solely for identity verification and regulatory compliance purposes;
• In compliance with applicable data protection and biometric data regulations;
• Through service providers who are contractually obligated to ensure secure and confidential handling of your data.

Your biometric information will be securely stored and retained only for the duration necessary to fulfill the specified purposes or to comply with legal and regulatory obligations. You retain the right to withdraw your consent at any time; however, doing so may restrict or prevent your access to services requiring identity verification.

(b) Contact Information

When you reach out to us via email, website forms, or other communication channels, you may provide Personal Data such as:

• Your name and contact details (e.g., email address);
• The content of your communications with us.

(c) Support Information

If you request technical or customer support, we may collect:

• Your contact information;
• Details regarding your request;
• Any additional information you choose to provide;
• Data related to your usage of Xwally Software and Services to facilitate support assistance.

(d) Other Information

You may also choose to provide additional information, including:

• Your wallet address;
• Uploaded materials or content;
• Preferences and settings relevant to the Services.

For certain Xwally Software and Services, additional Personal Data may be required to verify your identity or to deliver specific functionalities. Where applicable, we will notify you accordingly.

You are responsible for ensuring that all Personal Data you provide is accurate, complete, and kept up to date. You should inform us promptly in writing of any changes.

Where the collection of Personal Data is based on your consent, you have the right to withdraw such consent at any time. Please note, however, that withdrawal of consent may impact our ability to:

• provide the Xwally Software and Services;
• comply with legal or contractual obligations.

Xwally Software and Services are not intended for individuals who have not reached the age of majority in their respective jurisdictions. If you are a parent or legal guardian and believe that a minor has provided us with Personal Data without your consent, please contact us.

If you provide Personal Data relating to third parties (such as employees, customers, or family members), you represent and warrant that:

• you have informed such individuals about this Privacy Policy and the purposes of data collection;
• you have obtained their consent to share their Personal Data with us where required; and
• you agree to indemnify us against any claims arising from our processing of such Personal Data in accordance with this Privacy Policy.

2.2 Permissions and Device Access

To provide and improve the functionality of Xwally Software and Services, we may request access to certain device permissions. These permissions are only requested when necessary for specific features and are used strictly for the purposes described below.

Camera Permission

Permission: android.permission.CAMERA

We may access your device camera to enable features such as identity verification, capturing photos, or recording videos. This permission is only used when you actively choose to use camera-related features.

Internet Access

Permission: android.permission.INTERNET

We require internet access to enable core functionalities of the Services, including communicating with our servers, processing requests, uploading files, and retrieving remote content.

Storage and Media Access

Permissions:

• android.permission.READ_EXTERNAL_STORAGE (Android 12 and below)
• android.permission.READ_MEDIA_IMAGES (Android 13 and above)
• android.permission.READ_MEDIA_VIDEO (Android 13 and above)
• android.permission.WRITE_EXTERNAL_STORAGE (legacy support)

These permissions allow the app to access images, videos, or files stored on your device when you choose to upload or use such content within the Services (e.g., profile images, verification documents, or attachments).

We only access the specific files you select and do not scan or collect unrelated files.

Microphone Access

Permission: android.permission.RECORD_AUDIO

We may use your device microphone when recording videos or using features that require audio input. This permission is activated only during such usage.

Display Over Other Apps

Permission: android.permission.SYSTEM_ALERT_WINDOW

This permission allows Xwally to display content over other applications, such as floating windows for specific features or system-level prompts. It is only used where necessary and will not be used to interfere with other applications.

Vibration Control

Permission: android.permission.VIBRATE

We may trigger vibration feedback to enhance user experience, such as confirming interactions or actions within the app.

How We Use Permissions

• Permissions are requested only when required for specific features.
• You may manage or revoke permissions at any time through your device settings.
• Denying certain permissions may limit the availability or functionality of some Services.
• We do not use permissions to collect data unrelated to the stated purposes.

Compliance with Platform Requirements

We ensure that all permission usage complies with applicable platform policies, including those of Google Play. We do not access, collect, or share data obtained through permissions for purposes unrelated to the core functionality of the Services without your explicit consent.

2.3 Personal Data Collected Automatically

When you access or use Xwally Software and Services, we may automatically gather certain categories of Personal Data, either directly or through third-party service providers. This information is collected to enhance functionality, maintain security, and comply with applicable legal and regulatory requirements. We do not collect your private keys and do not have access to your wallet, as such keys remain stored locally within your browser or mobile device.

(a) Financial and Transactional Information

We may collect certain financial-related data, including:

• Records of transactions;
• Holdings of digital assets;
• Wallet addresses.

This information is processed primarily to meet legal and regulatory obligations, including AML, KYC, and counter-terrorism financing (CTF) requirements.

(b) Technical and Device Information

We may automatically obtain technical information from your device or browser, including:

• IP (Internet Protocol) address;
• Device identifiers and hardware specifications;
• Browser type, operating system, and platform information;
• Error logs, crash reports, and performance diagnostics.

(c) Usage and Interaction Data

To better understand user behavior and interaction with Xwally Software and Services, we may collect:

• Clickstream and browsing activity;
• Pages accessed and session duration;
• Search inputs and navigation patterns.

Such data enables us to improve functionality, optimize user experience, and identify potentially suspicious activity.

(d) Cookies and Similar Technologies

We use cookies and comparable tracking technologies (such as web beacons, pixel tags, and local storage) to:

• Analyze usage trends;
• Improve performance and reliability of the Services;
• Customize and enhance your experience.

You may configure your browser or device settings to control cookie usage. However, disabling cookies may affect certain features or functionality.

(e) Location Information

We may determine your approximate location (such as country or city level) based on your IP address. This information is used for:

• Compliance with legal requirements;
• Fraud detection and prevention;
• Localization and customization of Services.

We do not collect precise geolocation data unless you have expressly permitted us to do so.

(f) Single Sign-On and Third-Party Platforms

If you choose to access Xwally Software and Services through third-party platforms (such as Google or Apple), we may receive certain Personal Data including:

• Your name;
• Email address;
• Profile image or basic account details.

Such data is shared in accordance with the privacy policies of the respective third-party platforms. We recommend reviewing their privacy practices.

2.4 Personal Data Obtained from Third Parties

We may also obtain Personal Data about you from external sources and combine it with data collected directly. These sources may include:

• Affiliates and business partners: including identity verification data, transaction details, and usage information within our group or partner network.
• Public blockchain data: such as wallet addresses, transaction history, and token balances. While publicly accessible, such data may be treated as Personal Data when linked to identifiable individuals.
• Merchants and service providers: data obtained when you interact with third-party vendors via our platform.
• Public records and watchlists: including sanctions lists (e.g., OFAC, UN) and other publicly available databases used for compliance and fraud prevention.

3. Why We Process Your Personal Data

We process Personal Data only for legitimate, necessary, and proportionate purposes. Legal bases include contractual necessity, legal compliance, your consent, and our legitimate interests. These purposes include:

• Managing and maintaining your account;
• Providing access to Xwally Software and Services;
• Enabling integrations with third parties;
• Personalizing your experience;
• Improving products and developing new features;
• Communicating with you (including support and notifications);
• Sending marketing communications (subject to consent and opt-out options);
• Managing relationships with customers and partners;
• Performing data aggregation and analytics;
• Ensuring compliance with legal obligations;
• Detecting and preventing fraud or unauthorized activities.

We will not process your Personal Data for new purposes without notifying you and obtaining consent where required.

We may disclose your Personal Data to authorities where required by law. Where appropriate, we may attempt to notify you, unless prohibited.

4. With Whom We Share Your Personal Data

We do not sell your Personal Data. However, we may share it with:

• Affiliates within our corporate group;
• Third-party service providers (e.g., analytics, payment processing);
• Legal or regulatory authorities;
• Parties involved in business transfers;
• Entities assisting in fraud prevention and risk management.

All such parties are required to adhere to appropriate data protection standards.

5. How We Protect Your Personal Data

We implement technical and organizational measures to safeguard your data, including encryption and access controls. Access is limited to authorized personnel with a legitimate need.

You are advised to:

• Use strong, unique passwords;
• Enable multi-factor authentication where available;
• Log out from shared devices.

6. Your Rights Regarding Personal Data

You have the following rights:

• Right of access;
• Right to rectification;
• Right to erasure;
• Right to object;
• Right to restrict processing;
• Right to data portability;
• Right to withdraw consent;
• Right to lodge complaints;
• Right to non-discrimination;
• Right to opt out of targeted advertising or data sharing (where applicable).

Requests can be submitted via: official@xwally.com

7. Where Your Personal Data Is Stored

We take reasonable steps to protect your data, but absolute security cannot be guaranteed. You acknowledge risks such as cyberattacks or technical failures.

8. Data Retention

We retain Personal Data only as long as necessary, including for:

• Legal and regulatory compliance;
• Audit and reporting obligations;
• AML/KYC records.

Blockchain data cannot be altered or deleted due to its immutable nature.

9. International Data Transfers

Your data may be transferred to other jurisdictions where we or our service providers operate. We implement safeguards such as:

• Standard contractual clauses;
• Adequacy decisions;
• Other lawful transfer mechanisms.

By using Xwally Software and Services, you consent to such transfers.

10. Third-Party Data Collection

Xwally Software and Services may include links or integrations with third-party platforms. This Privacy Policy does not apply to those services.

You acknowledge that:

• We are not responsible for third-party practices;
• Their own privacy policies govern your data;
• You assume risks when using such services.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Updates will be communicated via:

• Revised Effective Date;
• Email or in-app notifications where appropriate.

Continued use of Xwally Software and Services constitutes acceptance of the updated policy. You are encouraged to review it regularly.