CUSTOMER PRIVACY NOTICE

This notice was last updated on 8 November 2024.

The Ccoin website(ccoin.finance) and the Ccoin mobile application are operated by CCOIN FINANCE CORPORATE STRUCTURE CO., LTD (company number 768281712-000, with registered office at Phon Kham Village, Sikottabong District, Vientiane, Lao DPR),referred to in this notice as “CCOIN”, “we”, “us” or “our”. CCOIN is the controller of your personal data.

Ccoin operates as at echnology and connectivity platform. The financial accounts, payment cards and related services accessible through the platform are operated by independent regulated third-party service providers and remain subject to their applicable regulatory, jurisdictional and operational frameworks.

Most of the financial data associated with your services (such as account balances, full payment carddetails and transaction information) is held directly by the relevant service providers and accessed by you through secure, user-authenticated channels. CCOIN does not have direct access to this data and cannot view, retrieve or modify it on your behalf.

What is this document about?

We’re committed top rotecting and respecting your privacy.

We will:

•    always keep your personal data safe and private

•    never sell your personal data

•    allow you to manage and review your marketing choices at any time

1. About us

CCOIN is the controller of your personal data for all Ccoin products and services. References to “Ccoin”in this notice refer to the Ccoin platform (ccoin.finance and the Ccoin mobile application) operated by CCOIN.

2. Why do I need to read this notice?

We collect your personaldata when you use:

•    our website at ccoin.finance

•    the Ccoin app

•    any of the services available to you through the Ccoin app or website

When we say ‘personal data’, we mean information which:

•    we know about you (for example, your registration details and how you interact with the Ccoin app and its features)

•    can be used to personally identify you (for example, a combination of your name and postal address)

This notice explains whatinformation we collect, how we use it, and your rights over your personal data.

Sometimes, we may also provide you with ‘just in time’ privacy explanations in the Ccoin app. When you use a new Ccoin product or service for the first time:

•    these explanations will help you to understand what specific personal data Ccoin collects, uses or shares about you for that product or service

•    where relevant, you will be prompted to review your in-app privacy preferences

We may provide privacy notices and explanations in languages other than English. If there are any discrepancies between other language versions and the English language version, the English language version is authoritative.

If you have concerns about how we use your personal data, you can contact support@ccoin.finance.

3. What personal data do you collect about me?

The table below explainswhat personal data we collect and use.

Type of personal data

Details

Information you give us

We collect information you provide  when you:

• fill in any forms

• correspond with us

• respond to any of our surveys

• register to use the Ccoin app

• open an account or use any of our  services

• take part in online discussions or  promotions

• speak with a member of our social  media or customer support teams

• enter a competition or share  information with us on social media

• contact us for other reasons

We will collect the following  information:

• your name, address, and date of  birth

• your email address, phone number  and details of the device you use

• your Ccoin username (your ‘UserID’)

• your registration information

• basic details of your Ccoin cards  (such as the card type, masked card number and activation status). Full card  details (full card number, CVC, expiry date) are provided directly by the  card issuing service provider through secure channels and are not stored by  or accessible to Ccoin

• copies of your identification  documents and any other information you provide to prove you are eligible to  use our services

• your country of residence, tax  residency information, and tax identification number

• records of our discussions, if you  contact us or we contact you (including records of phone calls)

• your image in photo or video form,  and facial scan data extracted from your photo or video (‘biometric data’),  to verify your identity during onboarding as part of our Know-Your-Customer  (KYC) checks, to authenticate you as an authorised user of our services, or  to detect and prevent fraud

• information about other people  (such as your spouse or family) when we are required to collect this  information to comply with KYC, anti-money laundering and other laws  applicable to the service providers operating the services you have applied  for.

If you give us personal data about  other people, or you ask us to share their personal data with third parties,  you confirm that you have brought this notice to their attention beforehand.

Information collected from your  use of our products and services

Whenever you use our website or the  Ccoin app, we collect the following information:

• technical information, including  the IP address used to connect your computer to the internet, your login  information, the browser type and version, the time zone setting, device  language, the operating system and platform, the type of device you use, whether  your device uses a VPN, a unique device identifier, mobile network  information, your mobile operating system and the type of mobile browser you  use

• information about your visit,  including the links you’ve clicked on, through and from our website or app  (including date and time), services you viewed or searched for, page response  times, download errors, length of visits to certain pages, page interaction  information (such as scrolling and clicks), and methods used to browse away  from the page

• service activity metadata  associated with the actions you initiate through the Ccoin app (such as event  time stamps, action type, and the service provider invoked). The detailed  financial information associated with these actions (amounts, balances, beneficiary  details, merchant data and full card details) is held directly by the  relevant service providers and is not stored by or accessible to Ccoin

• information stored on your device,  including if you give us access to contact information from your contacts  list (only if you have given us permission)

Information about your location

If you turn location services on in  the Ccoin app, we track your location using GPS technology.

Information from others

We collect personal data from third  parties or other people, such as official registers and data bases, fraud  prevention agencies and partners who help us to provide our services.

This includes information to help us  check your identity and any other information that may be required for KYC,  anti-money laundering or sanctions screening obligations applicable to us or  to the service providers operating the services you have applied for.

Sometimes other Ccoin customers may  give us information about you.

Information from social media

Occasionally, we’ll use publicly  available information about you from selected social media websites or apps  to carry out enhanced due diligence checks. Publicly available information  from social media websites or apps may also be provided to us when we conduct  general searches on you (for example, to comply with our anti-money  laundering or sanctions screening obligations).

Information from publicly  available sources

We collect information and contact  details from publicly available sources, such as media stories, online  registers or directories, and websites for enhanced due diligence checks,  security searches, and KYC purposes.

4. What is your legal basis for using my personal data?

We must have a legal basis(a valid legal reason) for using your personal data. Our legal basis will beone of the following:

Keeping to our contracts and agreements with you

We need certain personal data to provide our services and cannot provide them without this personal data.

Legal obligations

In some cases, we have alegal responsibility to collect and store your personal data (for example, under anti-money laundering laws we must hold certain information about our customers).

Legitimate interests

We sometimes collect and use your personal data because we have a legitimate reason to use it and this is reasonable when balanced against your rights and freedoms.

Substantial publicinterest

Where we process your personal data, or your sensitive personal data, to ad here to government regulations or guidance, such as our obligation to prevent fraud or support you if you are or become a vulnerable customer.

Consent

Where you’ve agreed to us collecting your personal data, or sensitive personal data, for example when you tick a box to indicate you’re happy for us to use your personal data in acertain way.

5. How do you use my personal data?

Explore the ways in which we may use your personal data using this table:

What we use your personal   data for

Our legal basis for using   your personal data

Checking your identity

Whenever you sign up with Ccoin,  we’ll use your personal data to check your identity (as part of our KYC  process). This may include facial scan data extracted from any photo or video  you submit (‘biometric data’).

Legal basis: Legal obligations;  Substantial public interest; Consent (where required by law).

Providing our services

Whenever you apply for or use a Ccoin  product or service, we’ll use your personal data to:

• decide whether or not to approve  your application

• meet our contractual and legal  obligations relating to any products or services you use

• help you understand your spending  behaviour and how you use Ccoin products and services

• recover debt and exercise other  rights we have under any agreement with you

• provide you with customer support  services (we may record and monitor any communications between you and us,  including phone calls)

Legal basis: Keeping to contracts and  agreements between you and us; Legitimate interests; Legal obligations.

Protecting against fraud

We use your personal data to check  your address and identity, protect against fraud, keep to financial crime  laws and to confirm that you’re eligible to use our services. We also use it  to help us better understand your financial circumstances and manage fraud  risks related to your Ccoin account.

Legal basis: Legitimate interests;  Substantial public interest; Consent (where required by law); Legal  obligations.

Marketing and providing products  and services that might interest you

We use your personal data to:

• personalise your in-app experience  and marketing messages about our products and services so they’re more  relevant and interesting to you (where allowed by law)

• if you agree, provide you with  information about our partners’ promotions or offers

• if you agree, allow our partners  and other organisations to provide you with information about their products  or services

• ask your opinion about our products  or services

Legal basis: Legitimate interests;  Consent (where required by law).

To keep our services up and  running

We use your personal data to manage  our website and the Ccoin app (including trouble shooting, data analysis,  testing, research, statistical and survey purposes), and to make sure that  content is presented in the most effective way for you and your device.

Legal basis: Keeping to contracts and  agreements between you and us; Legitimate interests; Consent (where required  by law).

Location-based services and  analytics

If you turn location services on in  the Ccoin app, we use your personal data to:

• protect against fraud and detect  anomalies in account activity

• provide relevant advertising to you  (for example, information about nearby merchants)

• perform analytics on aggregate  location and usage patterns to improve our services

Legal basis: Keeping to contracts and  agreements between you and us; Legitimate interests; Consent (to track you  when you have location services switched on).

Preparing anonymous statistical  datasets

We prepare anonymous statistical  datasets about our customers’ spending patterns for forecasting purposes, to  understand how customers use Ccoin, and to comply with governmental  requirements and requests.

The information used and shared in  this way is never personal data and you will never be identifiable from it.

Legal basis: Legitimate interests;  Legal obligations.

Improving our products and  services

We use your personal data to help us  develop and improve our current products and services.

Legal basis: Legitimate interests.

Meeting our legal obligations,  enforcing our rights, protecting our business and other legal uses

We use your personal data:

• to share it with other  organisations (for example, government authorities, law enforcement  authorities, tax authorities, fraud prevention agencies)

• to recover debts from you

• if this is necessary to meet our  legal or regulatory obligations

• to identify and support vulnerable  customers

• to protect ourselves, including our  rights, property, personnel or products

• to help prevent and fight harmful  or unlawful behaviour and spam communications

• in connection with legal claims

• to help detect or prevent crime

Legal basis: Legitimate interests;  Substantial public interest; Legal obligations.

6. Do you make automated decisions about me?

Depending on the Ccoin products or services you use, we may make automated decisions about you.

This means that we may use technology that can evaluate your personal circumstances and other factors to predict risks or outcomes. This is sometimes known as profiling. We do this for the efficient running of our services and to ensure decisions are fair,consistent and based on the right information.

Where we make an automated decision about you, you have the right to ask that it is manually reviewed by a person. We may make automated decisions about you that relate to:

Onboarding and identityverification:

•    KYC, anti-money laundering and sanctions screening checks

•    identity and address verification

•    eligibility assessment for the services you have requested

Routing to serviceproviders:

•    matching your application to the appropriate service provider based on your jurisdiction, service type and other relevant criteria

Detecting fraud and anomalies:

•    monitoring your account activity to detect fraud, financial crime and unusual behaviour

Our legal basis is one or more of the following: keeping to contracts and agreements between you and us; legal obligations; legitimate interests.

7. How do you use my personal data formarketing?

If you sign up to our services, and where national laws allow, we’ll assume you want to be contacted by post, push notification, email and text message with information about Ccoin products, services, offers and promotions. Where national laws require us to get your consent to send marketing messages, we’ll do so in advance.

We use your personal data to personalise marketing messages about our products and services so they are more relevant and interesting to you (where allowed by law). This may include analysing how you use our services and your transactions.

You can object to profiling for direct marketing purposes. You can also adjust your preferences or tell us you don’t want to receive direct marketing at any time. Just use theprivacy settings in the Ccoin app or tap the unsubscribe links in any marketing message we send you.

We won’t pass your details on to any organisations outside Ccoin for their marketing purposes without your permission.

Our legal basis is: consent (where required by law); legitimate interests.

8. What are my rights?

Your right

What it means

You have the right to be told how  we use your personal data

We provide this privacy notice to  explain how we use your personal data.

You have the right to ask us for a  copy of your personal data

If you ask, we’ll provide a copy of  the personal data we hold about you. We can’t give you any personal data  about other people, personal data which is linked to an ongoing criminal or  fraud investigation, or personal data which is linked to settlement negotiations  with you.

You can ask us to correct your  personal data if you think it’s wrong

You can have incomplete or inaccurate  personal data corrected. Before we update your file, we may need to check the  accuracy of the new personal data you have provided.

You can ask us to delete your  personal data

You can ask us to delete your  personal data if:

• there’s no good reason for us to  continue using it

• you gave us consent and you have  now withdrawn it

• you have objected to us using your  personal data

• we have used your personal data  unlawfully

• the law requires us to delete your  personal data

We may not always be able to agree to  your request. We must keep certain customer personal data even when you ask  us to delete it (for example, to comply with anti-money laundering and KYC  regulations).

You can object to us processing  your personal data for marketing purposes

You can tell us to stop using your  personal data, including profiling you, for marketing.

You can object to us processing  other personal data (if we’re using it for legitimate interests)

If our legal basis is ‘legitimate  interests’ and you disagree, you can object. If there is an over riding reason  why we need to use your personal data, we will not accept your request.

You can ask us to restrict how we  use your personal data

You can ask us to suspend using your  personal data while we investigate accuracy, if our use is unlawful but you  don’t want it deleted, or if we no longer need it but you want us to hold it  for a legal claim.

You can ask us to transfer  personal data to you or another company

Where allowed under regulatory  requirements, we’ll provide your personal data in a structured, commonly  used, machine-readable format.

You can withdraw your permission

If you’ve given us consent to use  your personal data, you can withdraw it at any time by changing your privacy  settings in the Ccoin app or sending an email to support@ccoin.finance.

You can ask us to carry out a  human review of an automated decision

If we make an automated decision that  significantly affects you, you can ask us to carry out a manual review of  this decision.

Your ability to exercise these rights will depend on a number of factors. Sometimes, we won’t be able to agree to your request.

9. How do I exercise my rights?

To exercise any of your rights set out in the previous section, you can contact us through the Ccoinapp or send us an email at support@ccoin.finance.

For security reasons, we can’t deal with your request if we’re not sure of your identity, so we may ask you for proof of ID.

If a third party exercises one of these rights on your behalf, we may need to ask for proof that they’ve been authorised to act on your behalf.

When you exercise one of your rights, or update your privacy settings in the Ccoin app, it may take usup to one month to respond or implement your changes.

Ccoin will usually not charge you a fee when you exercise your rights. However, we’re allowed by law to charge a reasonable fee or refuse to act on your request if it is manifestly unfounded or excessive.

10. Do you share my personal data with anyone else?

Services provided by third-party service providers

When you apply for or usea financial service through Ccoin (for example, opening a bank account or activating a payment card), your application and on going service data is shared with the regulated third-party service provider that operates that service.

When this happens:

•    The service provider becomes a separate data controller for the personal data they receive and process in connection with the service you have applied for.

•    The service provider processes your personal data underits own privacy policy and in accordance with the applicable laws and regulations of its country of operation.

•    The service provider may share your personal data withits own regulators, banking partners, payment networks, fraud prevention agencies, government authorities and other entities, as required by the laws applicable to it.

•    The service provider may retain your personal data for the periods required by its applicable banking, anti-money laundering, KYC and tax laws, which may differ from the retention periods set out in this notice.

Your personal data may be transferred to and processed in jurisdictions other than your country of residence, including the jurisdictions where the relevant third-party service providers operate. Data protection laws in these jurisdictions may differ from those that apply in your country. By applying for a service operated by a third-party service provider through Ccoin, you acknowledge and consent to this cross-border transfer of your personal data.

You should review the privacy policy of the relevant service provider when you apply for a service operated by them. A current list of our regulated banking and financial services partners and their privacy policies is available up on request via support@ccoin.finance.

Internal use

We use your personal data internally within CCOIN to:

•    provide you with the best service

•    protect you, other customers and our systems from fraud or harmful behaviour

•    facilitate you quickly signing up to use other Ccoin products or services

•    improve existing, or develop new, products or services

•    send you information about Ccoin products and services we think you’ll be interested in hearing about

Other Ccoin customers

We’ll ask you to let us sync your mobile phone contacts. This will help you to identify which of your trusted mobile phone contacts are Ccoin customers. Your ‘trusted contacts’ will also be able to see if you’re a Ccoin customer through our in-app discover ability settings.

If you have synced your mobile phone contacts, we show basic details about you in the Ccoin app to your trusted contacts who are also Ccoin customers (for example, your name as saved in your friend’s contacts list, mobile phone number, UserID, Ccoin profile photo if you have one).

You can choose not to syncyour contacts list with Ccoin, and you can also change your discoverability preferences through the privacy settings in the Ccoin app.

People or companies that you transfer money to or from

Where you make a payment from your Ccoin account, we’ll provide the recipient with your details alongside your payment (for example, your name and account identifier). Where you receive a payment to your Ccoin account, we’ll provide the payer with your details. This is necessary to confirm that the payment has been made to the correct account.

Suppliers and service partners

The table below explains which suppliers and partners we normally share your personal data with:

Type of supplier

Why we share your personal   data

Suppliers who provide us with IT,  payment and delivery services

To help us provide our services to  you.

Regulated banking and financial  services partners (including bank account providers, card issuers, banking  intermediaries, payment networks such as Visa and Mastercard, and  international payment service providers)

To operate the financial accounts,  payment cards and related services accessible through the platform.

Identity verification and KYC  service providers

To help us verify your identity so we  can provide our services to you.

Card manufacturing,  personalisation and delivery companies

To create and deliver your  personalised Ccoin card.

Analytics providers and search  information providers

To help us improve our website or  app.

Customer-service providers, survey  providers and developers

To help us provide our services to  you.

Communications services providers

To help us send you emails, push  notifications and text messages.

Partners who help to provide ourservices

We may share your personal data with our partners to provide certain services you’ve asked us for, or to ensure you receive any reward we have promised you. We’ll only share your personal data in this way if you’ve made a qualifying purchase, asked for the relevant service or if it’s provided as part of your membership plan.

Other financial institutions

We may share your personal data with other financial institutions where this is necessary to facilitate a transaction. For example, if a payment is made to your account by mistake, we can share your information with the financial institution the payment came from to help return the payment.

For legal reasons

We also share your personal data with other financial institutions, financial services companies, insurance providers, government authorities, law enforcement authorities, tax authorities, and fraud prevention agencies to check your identity, investigate or protect against suspected fraud, keep to tax laws, anti-money laundering laws, or any other laws, and confirm that you’re eligible to use our products and services.

We may also need to share your personal data with other third party organisations or authorities:

•    if we have to do so under any law or regulation

•    if we sell our business

•    in connection with criminal or fraud investigations

•    to enforce our rights (and those of customers orothers)

•    in connection with legal claims

Social media and advertising companies

When we use social media for marketing purposes, your personal data (limited to your name, email address and app events) may be shared with the social media platforms so that they can check if you also hold an account with them. The personal data is hashed before we send it, and the advertising partner we share it with is only allowed to use that hashed personal data in the ways described in this notice.

Our legal basis is legitimate interests (to ensure Ccoin’s advertising is as effective aspossible).

You can contact us at anytime through the Ccoin app or by emailing support@ccoin.finance if you don’t want us to share your personal data for advertising purposes.

Where you ask us to share yourpersonal data

Where you direct us to share your personal data with a third party, we may do so. For example, you may authorise third parties to act on your behalf (such as a lawyer, accountant or family member). We may need to ask for proof that a third party has been validly authorised to act on your behalf.

11. How do you protect my personal data?

We recognise the importance of protecting and managing your personal data. Any personal data we process will be treated with the utmost care and security.

We use a variety of organisational and technical measures to:

•    maintain the confidentiality, availability andintegrity of your personal data

•    make sure your personal data is not improperly used or disclosed

We have detailed information security and data protection policies which our employees are required to follow when they handle your personal data. Our employees receive data protection and information security training. Personal data is stored on secure computer systems with access management controls in place to limit physical, system and information access to only authorised employees.

Ccoin has strict policies in place that control how we share your personal data with other companies. Before sharing personal data with any company, we thoroughly vet the company in advance and assess the security controls the company has in place to protect your personal data.

While we take all reasonable steps to ensure that your personal data will be kept secure from unauthorised access, we cannot guarantee it will be secure during transmissionby you to our app, our website or other services. We use HTTPS, encrypted through Transport Layer Security, for all our app, web and payment-processing services.

If you use a password, PIN or generated authorisation code or prompt to use the Ccoin app, our website or other services, you will need to keep it confidential. Please do not share it with anyone. Ccoin will never ask you for this credential.

When you use our public services, which include our social media accounts and the Ccoin community channels, do not share any personal data that you don’t want to be seen , collected or used by other customers, as this personal data will become publicly available.

12. How long will you keep my personal data for?

We will keep your personal data:

•    for as long as necessary to achieve the original purpose we collected it for

•    in line with relevant laws

We are required to keepcertain personal data for specified time periods by KYC, anti-money laundering and other applicable laws. These time periods vary from country to country, and may also be set by the regulatory frame works of the service providers operating the services you have applied for.

We may keep your personal data for a longer time period because of a potential or on going court claim, or for another legal reason.

13. How will you keep me updated about how you use my personal data?

If we change the way we use your personal data, we’ll update this notice and, if appropriate, let you know by email, through the Ccoin app or through our website.

‍