This Privacy Policy (“Policy”) describes how Sentora Digital Holdings (BVI) Ltd, a BVI business company (“Sentora,” “we,” “us,” or “our”), together with its Affiliates, collects, uses, shares, and protects information in connection with www.sentora.com and any related websites, applications, dashboards, interfaces, and APIs (collectively, the “Website”), and the Offerings made available through them. Capitalised terms used but not defined in this Policy have the meanings given to them in the Terms of Use.

By accessing, browsing, connecting a digital wallet to, or otherwise using the Website or Offerings, you acknowledge the collection, use, and processing of information as described in this Policy.

Data Covered by This Policy

For the purposes of this Policy, “Personal Information” means information that directly or indirectly identifies an individual, such as a name, email address, identification number, location data, or online identifier, and includes information referred to as “personal data” or “personally identifiable information” under applicable data protection laws.

This Policy does not cover the practices of parties we do not own or control, including third-party protocols, decentralised applications, wallet providers, blockchain networks, and other Third-Party Services. We recommend that you review their privacy policies.

Non-custodial architecture and on-chain data. Sentora does not custody, hold, or control your Digital Assets or private keys at any time, and has no access to private keys, seed phrases, or wallet credentials. Transactions conducted on public blockchain networks are transparent and permanent: wallet addresses, transaction amounts, timestamps, and smart contract interactions are publicly visible, immutable, and accessible by anyone. Sentora does not control how third parties collect or use on-chain data, and has no technical ability to amend, delete, or restrict data recorded on a blockchain. Where Sentora itself processes on-chain data, that processing is governed by this Policy.

What Information We Collect

Information You Provide to Us

• Contact information, including your name and email address, when you subscribe to alerts or mailing lists, complete an inquiry form, or otherwise contact us.

• Public wallet addresses that you connect to the Website or use to interact with the Offerings. We do not collect private keys, seed phrases, or wallet credentials.

• Records of your activity in connection with the Offerings, including Vault participation, Strategy selections, and deposit and withdrawal activity, to the extent available to us through our systems or from publicly accessible blockchain data.

• Billing and payment information, where you or your organisation is invoiced for fees, including billing contact details, billing address, and settlement details. Payment information may be processed by third-party payment processors on our behalf.

• Identity verification information, where required by applicable law or our compliance procedures, including government-issued identification documents, proof of address, date of birth, nationality, and tax identification numbers, in order to satisfy know-your-customer (“KYC”), anti-money laundering (“AML”), and sanctions screening obligations. Where this information is a condition of access, we may be unable to grant or continue your access to the Offerings if you do not provide it.

• Eligibility and participation information in connection with any Incentive Program or grant programme administered through the Offerings.

• The content of your communications with us, together with associated metadata.

• Information about others, where you choose to provide it — for example a referral or an authorised representative. Please do not give us information about another person unless you are authorised to do so and have brought this Policy to their attention.

Information We Collect Automatically

We and our service providers automatically collect certain information when you access the Website, including:

• information about your device, browser, and operating system;

• your IP address, which may be used to derive your approximate geographic area, such as city and country;

• device and advertising identifiers;

• information about your interactions with the Website, including pages viewed, features accessed, clickstream data, and referring and exit URLs;

• information about your interactions with our email communications, such as whether you opened an email or clicked a link contained in it; and

• information about crashes, errors, and other technical issues.

Some of this information is collected through cookies, pixels, and similar technologies. For details of the technologies we use, and how to manage your preferences, please see our Cookie Policy.

Information We Collect from Other Sources

We may receive information about you from analytics providers; blockchain data and analytics providers; identity verification, sanctions screening, and fraud prevention providers; business partners and organisers of events in which Sentora participates; and social media platforms, subject to your settings on those platforms.

How We Use Information

We collect and process Personal Information for the following purposes:

• To provide, maintain, and improve the Website and Offerings, and to deliver functionality you request.

• To communicate with you, including to respond to your enquiries and support requests, to send technical notices, security alerts, and administrative messages, and, where permitted by applicable law, to send marketing and promotional communications.

• To understand how the Website and Offerings are used, and to analyse trends and user interactions.

• For our advertising and marketing purposes, including interest-based advertising.

• To administer Incentive Programs and grant programmes, including determining eligibility and calculating, distributing, and reconciling allocations.

• To verify your identity, assess eligibility, conduct sanctions screening, and evaluate compliance, legal, and reputational risk.

• To detect, investigate, and prevent fraud, unauthorised access, security incidents, and other harmful or unlawful activity.

• To comply with our legal, regulatory, and tax obligations, including KYC, AML, counter-terrorist financing, and sanctions requirements, and to respond to lawful requests from governmental and regulatory authorities.

• To enforce the Terms of Use and this Policy, and to protect our rights and the rights of others.

• In connection with a corporate transaction, such as a merger, acquisition, financing, reorganisation, or sale of assets.

• To create aggregated or de-identified information that does not identify you, which we may use for any lawful purpose.

Legal Bases for Processing

We will not process your Personal Information unless we have a legal basis for doing so. Where the EU or UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, or the Data Protection Act, 2021 of the British Virgin Islands applies to our processing, we rely on the following:

• Contractual necessity — where processing is necessary to provide the Website and Offerings, or to take steps at your request before entering into a contract.

• Legal obligation — where processing is necessary to comply with a legal or regulatory requirement, including KYC, AML, counter-terrorist financing, sanctions, tax, and reporting obligations.

• Legitimate interests — where processing is necessary for our legitimate interests or those of a third party and is not overridden by your rights. These interests include operating and improving the Offerings, communicating with you, ensuring security and preventing fraud, administering Incentive Programs, and marketing and analytics where consent is not required. Where we rely on legitimate interests, we balance them against your rights and put safeguards in place.

• Consent — where required by applicable law, including for non-essential cookies and similar technologies, interest-based advertising, and certain marketing communications. You may withdraw your consent at any time, through our cookie preference tool or by contacting us. Withdrawal does not affect processing carried out beforehand.

• Vital interests — in limited circumstances where processing is necessary to protect your life or that of another person.

How We Share Information

We may share Personal Information in the following ways:

• With service providers acting on our behalf, including hosting and infrastructure providers, analytics providers, communications platforms, payment processors, identity verification and compliance providers, security and fraud prevention consultants, and support providers. They are contractually required to use Personal Information only for the purposes for which it is disclosed.

• With blockchain networks. When you initiate a transaction through the Website or Offerings, information including your public wallet address and transaction data is broadcast to the applicable network and becomes publicly visible.

• With our Affiliates, for the purposes described in this Policy.

• With advertising networks, analytics providers, and social media platforms, so that we can market and advertise on third-party platforms and measure the effectiveness of that advertising. Where required by applicable law, this takes place only with your consent, or where you have not exercised an applicable opt-out right.

• With business partners, in connection with co-marketing or joint initiatives.

• With our professional advisors, including lawyers, auditors, accountants, and insurers.

• With governmental, regulatory, law enforcement, and judicial authorities, where required by applicable law or legal process, or where we consider in good faith that disclosure is necessary to protect our rights or the safety of any person.

• In connection with a corporate transaction, including during due diligence and integration.

• With your consent or otherwise at your direction, including where you use features of the Website that allow you to export information to Third-Party Services.

How Long We Keep Personal Information

We retain Personal Information for as long as necessary for the purposes described in this Policy, and for longer where required by law. Identity verification and other compliance records are subject to statutory minimum retention periods under British Virgin Islands anti-money laundering legislation. We may also retain information in order to pursue legitimate business interests, conduct audits, comply with and demonstrate compliance with our legal obligations, resolve disputes, and enforce our agreements. When Personal Information is no longer required for any lawful purpose, we delete, destroy, or anonymise it, and we may retain aggregated or anonymised information indefinitely. These periods do not, and cannot, apply to data recorded on a public blockchain, which is immutable and outside our control.

How We Secure Personal Information

We maintain appropriate technical and organisational measures designed to protect the security, confidentiality, and integrity of Personal Information against loss, misuse, and unauthorised access, disclosure, alteration, and destruction. While we take reasonable steps to safeguard Personal Information, no security system is impenetrable and we cannot guarantee the absolute security of any information we process.

You are responsible for keeping your wallet credentials, private keys, seed phrases, and other access credentials confidential. Please notify us at legal@sentora.com if you become aware of any unauthorised access to or use of your information in connection with the Website or Offerings.

Your Rights and Choices

Cookies and opt-out preference signals. You may manage non-essential cookies and similar technologies through our cookie preference tool, or at the browser or device level. You may also enable Global Privacy Control or a similar opt-out preference signal, which we will honour for each browser or device on which it is implemented. Please note that blocking or deleting cookies may affect the functionality of the Website.

Direct marketing. You may unsubscribe from marketing and promotional emails at any time by clicking the “Unsubscribe” link in our emails, or by contacting us at legal@sentora.com. We may continue to send you non-promotional messages, such as security alerts and administrative notices relating to the Offerings.

Your rights. Depending on where you live, you may have the right to:

• access the Personal Information we hold about you and obtain a copy of it;

• correct inaccurate or incomplete Personal Information;

• have your Personal Information deleted, subject to certain exceptions — for example where we are required to retain it by law, or need it to establish, exercise, or defend a legal claim. We have no technical ability to amend or erase data recorded on a public blockchain, and this right cannot extend to such data;

• restrict or object to our processing, including processing for direct marketing purposes;

• receive your Personal Information in a structured, commonly used, machine-readable format and transmit it to another controller;

• opt out of the sale or sharing of Personal Information and of targeted or cross-context behavioural advertising, and to limit the use and disclosure of sensitive Personal Information, to the extent applicable in your jurisdiction;

• decline decisions based solely on automated processing that have a legal or similarly significant effect on you;

• withdraw your consent, where we rely on it; and

• not be discriminated against for exercising your privacy rights.

Exercising your rights. Please contact us at legal@sentora.com. We may need to verify your identity and place of residence before completing your request, and we will use information provided in a request only to verify you and to respond. Where permitted by applicable law you may submit a request through an authorised agent, in which case we may require written proof of their authority. We respond to valid requests within the period required by applicable law.

Complaints. If you believe our processing of your Personal Information infringes applicable data protection law, you may lodge a complaint with the supervisory authority in your jurisdiction. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/board/members_en. The UK supervisory authority may be contacted at https://ico.org.uk/make-a-complaint. Complaints concerning processing subject to British Virgin Islands data protection law may be directed to the Office of the Information Commissioner of the British Virgin Islands.

U.S. state residents. Depending on your state of residence, you may have additional rights under applicable state privacy laws, including the rights to know, access, correct, and delete Personal Information, to opt out of its sale or sharing and of targeted advertising, to limit the use and disclosure of sensitive Personal Information, and not to be discriminated against for exercising those rights. We do not sell Personal Information for monetary consideration. To the extent that our sharing of information with advertising or analytics partners constitutes a “sale” or “sharing” under applicable state law, you may opt out using the “Your Privacy Choices” link on the Website, through our cookie preference tool, by enabling a recognised opt-out preference signal, or by contacting us at legal@sentora.com.

International Transfers of Personal Information

We operate globally and may transfer Personal Information to, and process it in, countries other than your country of residence, including the British Virgin Islands and the United States, as well as other countries in which our Affiliates, service providers, and partners operate. Some of these countries may not provide a level of data protection equivalent to that of your country of residence.

Where we transfer Personal Information from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction that has not been recognised as providing an adequate level of data protection, we implement appropriate safeguards in accordance with applicable law. These may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another legally recognised transfer mechanism. You may request further information about these safeguards by contacting us.

Children’s Privacy

The Website and Offerings are not intended for or directed at anyone under the age of eighteen (18), or the age of legal majority in their jurisdiction if higher, consistent with the eligibility requirements set out in the Terms of Use. Access by any such person is not permitted, and we do not knowingly collect their Personal Information. If we become aware that we have collected Personal Information from someone below the applicable age, we will delete it promptly and restrict or terminate any associated access. If you believe we hold information from or about such a person, please contact us at legal@sentora.com.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, applicable law, or the Offerings. When we do, we will revise the “Last Updated” date above, and where required by applicable law we will notify you of material changes. Your continued access to or use of the Website or Offerings after a revised Policy is posted constitutes your acceptance of it. We encourage you to review this Policy periodically.

Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, please contact us at:

Sentora Digital Holdings (BVI) Ltd

Floor 4, Banco Popular Building, Road Town, Tortola VG1110, British Virgin Islands

Email: legal@sentora.com

Website: www.sentora.com