PERSONAL DATA PROCESSING POLICYPERSONAL DATA — ORBICHAIN LABS S.A.S.

This Policy sets out the corporate guidelines for the collection, storage, use, transfer, and deletion of personal data processed by ORBICHAIN LABS S.A.S. (hereinafter “Orbichain”), ensuring users’ constitutional right to know, update, and rectify information collected about them in our databases or files.

● Authorization: The data subject’s prior, express, and informed consent to the processing of their personal data.

● Sensitive data: Data affecting the data subject’s privacy or whose misuse may lead to discrimination (e.g., biometric data).

● Processor: A natural or legal person that processes personal data on behalf of the controller, alone or jointly with others (e.g., identity verification infrastructure providers).

● Data subject: The natural person whose personal data are processed (the User).

Orbichain collects and processes the following data under the principles of necessity and proportionality:

● Identification and contact data: Full name, ID type and number, e-mail, mobile phone number, and residential address.

● Biometric (sensitive) data: Facial recognition records and “liveness” checks used solely for identity authentication and fraud prevention.

● Technical and transactional data: Virtual wallet addresses, blockchain transaction hashes, IP address, geolocation, and device metadata.

● Compliance data: Information on source of funds and results of screening against national and international restrictive lists (OFAC, UN, etc.).

Orbichain processes personal data exclusively for the following purposes:

1. Service delivery: Enabling access to the technological infrastructure and digital asset management features.

2. Security and fraud prevention: Verifying users’ identity through biometrics to prevent impersonation.

3. Regulatory compliance: Implementing anti–money laundering and counter-terrorist financing procedures in accordance with UIAF Resolution 314 of 2021.

4. Technical support: Handling inquiries, requests, complaints, and claims (PQRs) related to platform operations.

5. Notifications: Sending technical information, security updates, and transactional communications.

Orbichain informs data subjects that biometric data are classified as sensitive. Collection is optional; however, because they are essential to secure the technological mandate and prevent crime, refusal to provide them will make it impossible to provide the service.

Orbichain ensures that processing of this data uses military-grade encryption measures and that it will not be transferred to third parties for commercial purposes.

In accordance with Law 1581 of 2012, the User has the right to:

● Access: Request information on which data are being processed.

● Update and rectify: Request correction of partial, inaccurate, incomplete, or fragmented data.

● Revoke and erase: Request deletion of their data when constitutional principles, rights, and guarantees are not respected.

● Proof of authorization: Request a copy of the authorization granted to Orbichain.

The User understands and accepts that, under anti–money laundering rules (UIAF) and tax obligations (DIAN), Orbichain must retain identification information and transaction records for a minimum period of ten (10) years. Therefore, the right to erasure will not apply while a legal or contractual duty to remain in the database subsists.

Orbichain may transfer or disclose data internationally to cloud infrastructure providers (e.g., AWS, Google Cloud) or parent or partner companies that meet data protection standards equivalent to or stricter than Colombian standards, always preserving information integrity.

To exercise their rights, the data subject must send a written request to the Compliance Officer at legal@orbichain.com. Requests will be answered within a maximum of ten (10) business days for inquiries and fifteen (15) business days for complaints, in accordance with legal time limits.

Orbichain implements technical, human, and administrative measures necessary to secure records and prevent tampering, loss, consultation, or unauthorized or fraudulent use or access.