Privacy
Policy.

This Privacy Policy explains how personal data is collected, processed, stored, shared, and protected in connection with the AnotherApp ecosystem, website, mobile application, and related services.

1. DATA CONTROLLERS

1.1 Offeror

Token Technologies International Ltd
Quijano Chambers
P.O. Box 3159
Road Town, Tortola
British Virgin Islands

Email: compliance@anotherapp.io

1.2 EU Legal Representative

TIECO Fintech Solutions Ltd
11 Zinonos Sozou
3rd Floor, Office 303
1075 Nicosia, Cyprus

2. PERSONAL DATA WE MAY COLLECT

We may collect the following categories of personal data.

2.1 Identification Data

• full name;
• date of birth;
• nationality;
• username;
• government-issued identification details.

2.2 Contact Data

• email address;
• telephone number;
• residential address.

2.3 Technical Data

• IP address;
• browser information;
• operating system;
• device identifiers;
• session data;
• application logs;
• analytics data;
• wallet addresses.

2.4 Compliance Data

Where required:

• passport or ID documentation;
• a selfie and liveness check (see 2.6);
• proof of address;
• source-of-funds information;
• sanctions screening results;
• AML/KYC verification information;
• transaction monitoring information.

2.5 Blockchain Data

Blockchain networks may publicly display:

• wallet addresses;
• transaction hashes;
• token balances;
• smart contract interactions.

Blockchain records are generally immutable and cannot be deleted.

2.6 Face Data and Images

Identity verification. To verify your identity we ask you to photograph your identity document and to take a selfie. The selfie step includes a liveness check: a short face scan or video that confirms a real person is present. Our identity verification provider compares your face with the photo on your document. We use this face data only to verify your identity, to prevent fraud and to meet our anti-money-laundering obligations. We never use it for marketing, advertising or profiling, and we never sell it.

Who receives it. The images are captured in the app by our identity verification provider, Ondato, UAB, and are sent directly to Ondato. We do not keep a copy of your selfie on our own servers. We receive the result of the check and the details of your document. Authorised compliance staff may view the images when a manual review is needed. If you are issued a card, a copy of your selfie and identity document is passed to the card issuer, Atomo Sàrl (trading as Unblock), through its card processor, Verestro, because the issuer must identify its cardholders. If you open a bank account, our banking partner may ask you to complete its own identity check, run by its verification provider (Sumsub for SquareFi, Persona for Bridge). Those images go directly to that provider. Each of these providers processes face data only for identity verification and is required to protect it to a standard equal to this policy.

Where it is stored. Face data is stored on the systems of Ondato, UAB and, for card users, of Atomo Sàrl (Unblock) and its card processor, Verestro. Face data captured in a banking partner's own identity check is stored by that partner's verification provider.

How long it is kept. Face data collected for identity verification is kept for five years after the end of your relationship with us, as anti-money-laundering law requires. It is then deleted.

Deletion. You can ask us to delete your face data at any time by writing to compliance@anotherapp.io. We will delete it unless the law requires us to keep it for the period stated above.

Face ID and Touch ID. If you use Face ID or Touch ID in the app, the check is done by your device. We never receive or store your face or fingerprint data.

Profile picture. Adding a profile picture is optional. It can be any image you choose and we do not analyse it. It is shown to people you interact with in the app. It is stored on our servers in the European Union until you remove it, which you can do at any time in the app, or until your account data is erased.

3. HOW WE COLLECT PERSONAL DATA

Personal data may be collected:

• directly from users;
• through website forms;
• through mobile app usage;
• through wallet integrations;
• through onboarding procedures;
• through customer support interactions;
• through cookies and analytics tools;
• through blockchain interactions;
• through regulated third-party providers.

4. PURPOSES OF PROCESSING

We may process personal data for purposes including:

• operating the Website and App;
• providing ecosystem functionalities;
• user authentication;
• wallet integrations;
• customer support;
• onboarding and compliance;
• fraud prevention;
• AML/CFT compliance;
• sanctions screening;
• regulatory reporting;
• analytics and platform improvement;
• security monitoring;
• dispute resolution;
• communications and updates.

5. LEGAL BASIS FOR PROCESSING

We process personal data under one or more of the following legal bases:

6. THIRD-PARTY SERVICE PROVIDERS

Personal data may be shared with independent third-party providers including:

• EMIs;
• payment service providers;
• CASPs;
• exchanges;
• cloud providers;
• analytics providers;
• cybersecurity providers;
• KYC/AML providers;
• legal and compliance advisors;
• regulators and competent authorities.

Third-party providers operate under their own privacy policies and compliance obligations.

Providers that receive face data (see 2.6) process it only for identity verification and are required to protect it to a standard equal to this policy.

7. INTERNATIONAL DATA TRANSFERS

Personal data may be transferred outside the European Economic Area, including to:

• the British Virgin Islands;
• cloud hosting providers;
• infrastructure providers;
• compliance service providers.

Where required, appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent lawful transfer mechanisms will be implemented.

8. COOKIES & TRACKING TECHNOLOGIES

The Website and App may use cookies and similar technologies to:

• maintain platform functionality;
• authenticate sessions;
• improve security;
• analyse usage patterns;
• enhance user experience;
• measure platform performance;
• support analytics and operational monitoring.

Cookies may include:

• essential cookies;
• analytics cookies;
• session cookies;
• performance cookies;
• security cookies.

Certain analytics or service providers may place cookies on behalf of the platform in accordance with their own privacy policies.

Users may manage cookie preferences through browser settings or cookie consent tools where available. Disabling certain cookies may affect platform functionality.

A cookie consent banner is displayed to users upon first accessing the Website or App. The banner describes the categories of cookies in use and allows users to accept or reject non-essential cookies prior to their placement. Consent preferences are recorded and can be reviewed or withdrawn at any time through the cookie preference centre accessible via the footer of the Website.

Non-essential cookies and analytics technologies are placed only with prior user consent where required under applicable law, including the ePrivacy Directive and GDPR. Essential and security cookies necessary for platform operation are placed on the basis of legitimate interest and do not require consent.

8.1 COOKIE CATEGORIES AND CONSENT BASIS

9. DATA RETENTION

Personal data will be retained only for as long as necessary for the purpose for which it was collected, taking into account applicable legal and regulatory obligations. The following table sets out the indicative retention periods applied to each category of personal data.

Where retention beyond the periods set out above is required for the establishment, exercise, or defence of legal claims, or where a competent authority directs extended retention, data may be held for such additional period as is necessary. Data that is no longer required will be securely deleted or anonymised.

10. SECURITY MEASURES

We implement commercially reasonable technical and organisational safeguards designed to protect personal data and ecosystem infrastructure, including:

• encryption technologies;
• authentication controls;
• access management systems;
• infrastructure monitoring;
• audit logging;
• cybersecurity monitoring;
• incident response procedures;
• vulnerability management processes;
• secure cloud infrastructure practices.

Access to sensitive data is restricted to authorised personnel and service providers subject to confidentiality obligations.

Despite reasonable safeguards, no method of electronic transmission or storage can guarantee absolute security.

Users should always maintain appropriate cybersecurity practices when interacting with blockchain applications and digital assets.

10.1 DATA BREACH RESPONSE

In the event of a personal data breach that is likely to result in a risk to users’ rights and freedoms, appropriate notifications will be made in accordance with applicable GDPR requirements.

Where legally required, affected users may be notified without undue delay after the Company becomes aware of the incident.

Notifications may include:

• the nature of the breach;
• categories of affected data;
• potential consequences;
• mitigation measures undertaken;
• recommended user actions where applicable.

11. USER RIGHTS

Under Regulation (EU) 2016/679 (“GDPR”), users may have the following rights regarding their personal data, subject to applicable legal and regulatory limitations:

• the right to obtain confirmation as to whether personal data concerning them is being processed;
• the right to access personal data and related processing information;
• the right to request correction of inaccurate or incomplete personal data;
• the right to request deletion of personal data (“right to erasure”);
• the right to request restriction of processing;
• the right to object to certain processing activities;
• the right to data portability;
• the right to withdraw consent at any time where processing is based on consent;
• the right not to be subject to decisions based solely on automated processing, including profiling;
• the right to lodge a complaint with a competent supervisory authority.

The exercise of certain rights may be limited where processing is necessary for:

• compliance with legal obligations;
• AML/CFT requirements;
• fraud prevention;
• regulatory investigations;
• establishment, exercise, or defence of legal claims.

Requests relating to personal data may be submitted to:

compliance@anotherapp.io

We may request additional information to verify the identity of the requesting individual before responding to requests.

11.1 EXERCISING YOUR RIGHTS

Requests relating to personal data access, correction, deletion, restriction, portability, or objection to processing may be submitted in writing to:

compliance@anotherapp.io

We may require identity verification before processing requests to protect user privacy and security.

Responses will generally be provided within the timeframes required under applicable GDPR requirements, unless extended due to legal complexity or regulatory obligations.

Certain information may be retained where necessary for:

• AML/CFT compliance;
• fraud prevention;
• legal obligations;
• dispute resolution;
• regulatory recordkeeping.

11.2 AUTOMATED DECISION-MAKING

The platform does not generally rely on solely automated decision-making or profiling that produces legal or similarly significant effects on users, except where required for:

• fraud prevention;
• AML/CFT compliance;
• sanctions screening;
• security monitoring.

12. MARKETING COMMUNICATIONS

Users may opt in to receive:

• ecosystem updates;
• platform announcements;
• newsletters;
• promotional communications;
• token-related updates.

Users may unsubscribe at any time.

13. CHILDREN

The Website and App are not intended for individuals under 18 years of age.

14. BLOCKCHAIN DISCLOSURE

Users acknowledge that blockchain technology may publicly expose certain transaction-related information including wallet addresses and transaction data.

Blockchain transactions are generally irreversible and immutable.

The Offeror and EU Legal Representative cannot alter or delete blockchain records.

15. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be updated from time to time.

Updated versions will be published on the Website.

Continued use of the Website or App constitutes acceptance of updated versions.

16. CONTACT INFORMATION

Compliance & Privacy

compliance@anotherapp.io

Website: https://www.anotherapp.io/

EU Legal Representative

TIECO Fintech Solutions Ltd
11 Zinonos Sozou
3rd Floor, Office 303
1075 Nicosia, Cyprus

16.1 SUPERVISORY AUTHORITY

Users located within the European Union have the right to lodge complaints with their local supervisory authority.

For Cyprus, the competent supervisory authority is:

Office of the Commissioner for Personal Data Protection
1 Iasonos Street
1082 Nicosia, Cyprus
P.O. Box 23378, CY-1682 Nicosia, Cyprus

Telephone: +357 22818456

Office of the Commissioner for Personal Data Protection