Solowin Digital Horizon SP (BVI) Ltd.

a business company incorporated in the British Virgin Islands

Privacy Notice

Solowin Digital Horizon SP (BVI) Ltd. and its applicable affiliates (collectively, "we", "us" or "our") is committed to protecting the privacy of individuals whose personal data it collects and processes in connection with the operation of its services (the "Services"), including activities in relation to the Tokens, the Platform (our web interface/application), APIs, and any related online or offline services.

This privacy notice (the "Privacy Notice") explains how and why we, as a data controller, collect, use, retain, disclose, and safeguard your personal data as a prospective or current holder of the Tokens ("Tokenholders") or Platform user. In this Privacy Notice, capitalised terms shall have the meanings given in the terms and conditions for the issue, holding and redemption of the Tokens issued by us (the "Terms and Conditions"). For the purposes of this Privacy Notice, the terms "data controller" and "personal data" have the meanings given to them under the Data Protection Act, 2021 (as revised) of the British Virgin Islands (the "DPA").

Scope

This Privacy Notice applies to all interactions with us including use of our Services, Platform, Protocol, APIs, and any communications with us. By using our Services, you agree to the terms of this Privacy Notice. If you do not agree, please refrain from using our Services.

Categories of Personal Data Collected

We may collect and process personal data about you including:

· Name, home address, date of birth, nationality, contact details

· Identity verification documents (e.g. passport/driving licence)

· KYC/AML information (including source of funds/wealth, sanctions screening data)

· Personal data relating to you, your agents, your beneficial owners or controllers, or any other individuals affiliated with you who are relevant for investor due diligence or regulatory purposes;

· Transaction-related information, including stablecoin wallet addresses, transaction hashes, subscription/redemption amounts relating to Tokens

· Wallet, exchange or bank account details

· Communications and correspondence with us

· Usage data and online identifiers, such as your IP address, browser and device information, operating system, geolocation, and information collected via cookies or similar tracking technologies (see our Cookie Policy for details)

We may also collect limited technical data from visitors to our Platform, such as IP address, browser type, and device details (see our cookie policy for more information).

Much of the personal data will typically be provided by you through written/ electronic requests, other documentation, calls, email, or through use of our Platform, but we may also obtain information from third party sources, such as public registers, publicly available databases, credit reference agencies, or sanctions lists. If you provide us with personal data relating to third parties (such as agents, beneficial owners, or other individuals affiliated with you), you must ensure that such individuals are made aware of this Privacy Notice and you have the right to provide their data to us.

Cookies and Tracking Technologies

We and certain authorised third parties may use cookies and similar tracking technologies for analytics, security, and functionality. You can manage your cookie preferences using your browser settings, but disabling cookies may affect functionality. Please see our Cookie Policy for further details.

Purpose and Legal Basis for Processing

We process your personal data for the following purposes:

· To process, execute, and manage your subscriptions to, and redemptions of, Tokens and to carry out Activities as described above, including any minting, burning, or redemption requests.

· To maintain our register of Tokenholders in accordance with applicable corporate and regulatory requirements.

· To conduct anti-money laundering, counter-terrorist financing, sanctions screening, and other due diligence processes required by law.

· To comply with our legal, regulatory and contractual obligations, or to respond to lawful requests from regulatory, supervisory or law enforcement authorities.

· To communicate with you regarding your holdings, transactions and relevant operational or technical updates.

· For purposes of risk management, fraud prevention, IT administration, website security and audit.

· To operate, maintain, customise, measure, and improve our Services, manage our business operations, and process and facilitate transactions, as outlined in our Terms and Conditions

· To send you essential communications, such as security alerts, support or administrative messages, confirmations, notices, and updates

· To generate de-identified or aggregated data for lawful and analytical purposes

Our legal basis for processing includes your consent (where given), the necessity to perform our contract with you as a Tokenholder, and compliance with legal obligations. Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time. Where we rely on your consent as the legal basis for processing, you may withdraw your consent at any time. Please note that withdrawal of consent may limit our ability to provide you with certain services or to process your requests.

Disclosure of Personal Data

We may share your personal data with:

· Professional advisers, agents, banks, payment providers, OTC vendors and exchanges as necessary to facilitate the Activities, including conversion of virtual assets and payment of redemption proceeds in accordance with your instructions.

· Technology and IT service providers supporting our Platform and token protocol administration.

· Regulatory, supervisory or governmental authorities where required by law or regulation (e.g. for the purposes of compliance, audit, or crime prevention).

· Auditors, legal counsel and tax advisers in connection with our operations, transactions or dispute resolution.

· Other recipients as necessary to give effect to your requests, or with your explicit consent.

· Potential buyers or transferees (and their professional advisers) in the event of any proposed sale, restructuring or transfer of any part of our business.

· Service providers acting on our behalf are contractually required to use your personal data solely as necessary to perform services for us, and not for their own purposes.

We may share your data with third-party service providers who help operate our business (including IT, data hosting, cloud, and analytics providers), always under contracts requiring that such providers process your data solely for our lawful business purposes. We may share aggregated or de-identified data with partners or service providers for analytics or lawful purposes.

We may also share your data in connection with legal requirements (e.g. in response to a subpoena, court order, governmental investigation, or audit), to protect our or others' rights, property, or safety, or during business transfers (such as mergers, asset sales, or restructuring).

We do not sell, rent, or otherwise commercially exploit your personal data.

Overseas Data Transfers

Where personal data is transferred outside the British Virgin Islands (e.g. to service providers, exchanges or cloud systems located outside the territory), we ensure that adequate safeguards are in place as required under the DPA, or seek your express consent for such transfers. These safeguards may include contractual terms, technical protections, or reliance on adequacy findings. Please note that personal data transferred to overseas jurisdictions may not be subject to the same data protection regime as in the British Virgin Islands.

Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected, including for legal, regulatory, accounting or reporting requirements, after which it will be securely deleted or anonymised in accordance with our data retention policy. As a general rule, we will retain your personal data for a minimum of five years following the end of our relationship with you, or longer if required by law or regulation. We will not retain your personal data for longer than is necessary for the purposes for which it is processed, and for any period required by law.

Data Integrity

We take reasonable steps to ensure that your personal data is accurate, complete and up to date. Please inform us promptly of any changes to your data.

Your Rights

Under the DPA, you have rights to:

· Request access to the personal data we hold about you

· Request correction of inaccurate or incomplete data

· Withdraw consent for processing at any time (without affecting the lawfulness of past processing)

· Request erasure of your data or object to certain processing

· Request transfer of your data in a portable form (where applicable)

· Lodge a complaint with the BVI Information Commissioner if you have concerns about our handling of your data

Further rights include the right to receive information regarding: (i) the purposes and legal basis for processing; (ii) any recipients or classes of recipients of your data; (iii) whether providing data is obligatory or voluntary and the consequences of not providing, if applicable; and (iv) your right to complain to the Information Commissioner of the British Virgin Islands. Please note that if you do not wish to provide us with requested personal data, or subsequently withdraw your consent, we may not be able to provide our services to you or process your request. We may require evidence of your identity before we can respond to your request to exercise any of your data subject rights.

Please contact us at privacy@alloyx.com to exercise your rights or seek further information.

Security

We have implemented appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, alteration, or disclosure. This includes encryption of sensitive data, secure storage, access controls, and contractual requirements for service providers to adopt equivalent protections.

While we take reasonable measures to protect your personal data, no system is completely secure and you are responsible for maintaining the secrecy and security of your own credentials and devices.

Automated Decision-Making

We do not engage in automated processing or profiling that produces legal or similarly significant effects for data subjects. Where a process is fully automated (such as smart contract execution), it is performed solely for technical or transactional purposes, and does not involve any profiling or automated decision-making with significant effects on you.

Age Limitations

Our Services are not directed at individuals under the legal age in their jurisdiction or under the age of 18, whichever is higher. If we become aware that such an individual has provided personal data to us, we will take steps to promptly delete that data and restrict access.

Policy Updates

We reserve the right to update this Privacy Notice from time to time. The most recent version will be posted on our Platform with the date of last update. We encourage you to review this notice periodically. If we make material changes to this Privacy Notice, we may also notify you via email or through our Services. Continued use after such changes will constitute acceptance.

Contact Us

For questions, concerns, or to exercise your rights under this notice, please contact:

Solowin Digital Horizon SP (BVI) Ltd.

Email: privacy@alloyx.com