Privacy Protection Policy

1. Introduction

This Privacy Protection Policy ("Policy") explains how World Card Ltd, the U.S.-headquartered parent company of the Coinepay group, Green Banking Services Ltd. ("Green Banking"), which operates the Coinepay services from Canada, and their affiliates (together, "Coinepay", "we", "us" or "our"), collect, use, disclose, transfer and protect personal information when you visit our website, use our mobile application or use any of our services (the "Services").

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy laws, applicable U.S. federal and state privacy laws, and, where they apply to you, other laws such as the EU and UK General Data Protection Regulation ("GDPR"), Singapore's Personal Data Protection Act 2012, Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) and the Personal Information Protection Law of the People's Republic of China.

By using the Services, you acknowledge that you have read and understood this Policy. We obtain your consent for the collection, use and disclosure of personal information as required by law; where consent is required separately, we will ask for it.

2. Who Is Responsible for Your Data

Green Banking Services Ltd., 114 Santa Monica Boulevard, Unit B-1, Scarborough, Ontario M1L 4H5, Canada, is the organisation accountable for your personal information and acts as data controller for the Coinepay Services. World Card Ltd, 44 Wall Street, 2nd Floor, New York, NY 10005, United States, is our group headquarters and acts as a controller for activities carried out in the United States.

We have designated a Privacy Officer who is accountable for our compliance with this Policy (see Section 14). Our liaison offices in Singapore and Hong Kong may process personal information on our behalf for customer communications and business coordination. Our licensed partner banks and financial institutions may act as independent controllers for the data they process to provide card, custody and transfer services, under their own privacy notices.

3. Personal Data We Collect

Information you provide

• Identity data: name, date of birth, nationality, gender, identity document details and images, facial images for liveness checks;
• Contact data: email address, phone number, residential or business address;
• Business data: company name, registration details, directors, shareholders and beneficial owners;
• Financial data: source of funds, occupation, transaction purpose, beneficiary details and payment information;
• Communications: messages you send to our customer support.

Information collected automatically

• Device and log data: IP address, device identifiers, operating system, browser type, language, time zone;
• Usage data: pages viewed, features used, login times and actions taken;
• Cookies and similar technologies (see Section 10).

Information from third parties

• Identity verification and screening results from our KYC partner (Sumsub) and sanctions or PEP list providers;
• Information from licensed partner institutions, card networks and payment processors;
• Fraud-prevention and advertising attribution partners.

4. How We Use Your Data

We do not use your personal data for purposes that are incompatible with those listed above without notifying you and, where required, obtaining your consent.

5. How We Share Your Data

We do not sell your personal data. We share personal data only as necessary with:

• Licensed partner banks, card issuers, card networks and financial institutions that provide card, custody and transfer services;
• Group entities, for the purposes described in this Policy;
• Service providers acting on our behalf, such as identity verification (Sumsub), cloud hosting, customer support, analytics and security providers, under contractual confidentiality and data protection obligations;
• Advertising and measurement partners (such as Google), limited to website usage and conversion data;
• Regulators, tax authorities, courts and law enforcement agencies, where required by law;
• A purchaser or successor in the event of a merger, acquisition or reorganisation, subject to equivalent protections.

6. International Transfers

Because we serve users globally, your personal information may be transferred to, stored in and processed in countries other than your own, including Canada, the United States, Singapore and Hong Kong. When personal information is transferred to a service provider or affiliate, we use contractual and other measures to ensure a comparable level of protection. While outside your jurisdiction, personal information is subject to the laws of the country in which it is held and may be accessible to the courts, law enforcement and national security authorities of that country.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Identification and transaction records are retained for at least five (5) years after the end of our relationship with you, as required by anti-money laundering laws, or longer where required by law. When data is no longer needed, we delete or anonymise it securely.

8. Data Security

We use security safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, access controls on a need-to-know basis, multi-factor authentication, logging and monitoring, and staff confidentiality obligations. No system is completely secure; please keep your login credentials confidential and notify us immediately of any unauthorised use of your account. If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and other competent authorities, notify affected individuals, and keep records of breaches, as required by law.

9. Your Rights

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you and obtain information on how it has been used and to whom it has been disclosed;
• Challenge the accuracy and completeness of your personal information and have it corrected;
• Withdraw your consent, subject to legal or contractual restrictions and reasonable notice;
• Request deletion of your personal information, where it is no longer required by law to be retained;
• Object to or restrict certain processing, including direct marketing;
• Receive your data in a portable format, where this right is provided by law;
• File a complaint with the Office of the Privacy Commissioner of Canada or the data protection authority in your jurisdiction.

To exercise your rights, contact our Privacy Officer at [email protected]. We may need to verify your identity before responding, and will respond within 30 days or the period required by law. Some requests may be limited where we must retain data to meet legal obligations, for example anti-money laundering record-keeping.

10. Cookies and Similar Technologies

We use cookies, pixels and similar technologies to operate the website, remember your preferences (such as your language), analyse traffic and measure the effectiveness of advertising. These may include Google Analytics and Google Ads, as well as advertising and traffic-quality measurement tools from other partners. You can control or delete cookies in your browser settings; blocking some cookies may affect website functionality. Google's privacy policy is available at https://policies.google.com/privacy.

11. Children

The Services are not intended for persons under 18 years of age, and we do not knowingly collect personal data from them. If you believe a minor has provided us with personal data, please contact us so that we can delete it.

12. Third-Party Websites

Our website and application may contain links to third-party websites and services. We are not responsible for their privacy practices, and we encourage you to read their privacy notices.

13. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date at the top of this page shows when it was last revised. Where changes are material, we will notify you through the Services or by email before they take effect.

14. Contact Us and Privacy Officer

If you have any questions, requests or complaints about this Policy or our handling of personal information, please contact our Privacy Officer:

• Email: [email protected]
• Address: Privacy Officer, Green Banking Services Ltd., 114 Santa Monica Boulevard, Unit B-1, Scarborough, Ontario M1L 4H5, Canada