Date of issuance: 01/07/2022

The security and protection of your Personal Data is one of the top priorities of the Reserve Currency

Solutions RCS AG, a Swiss company established in Zug under registered number

CH-170.3.035.143-0 (“RCS”, “Us” or “We”), and which operates the website hosted at the URL

https://payfoot.com (“Website”) as well as the PayFoot Finance Application (Android and iOs)

(“Application”).

RCS collects Personal Data from both natural and legal persons who browse the Website (“Visitors”)

as well as from both natural and legal persons who are users of the Application (“Users”).

RCS uses privacy by default standards and undertakes to store such Personal Data in a secured

manner and to Process it with all appropriate care and attention in accordance with the Data

Protection Laws.

Capitalized terms defined in the Terms of Use available at the following address

https://payfoot.com/terms.pdf apply to this Policy.

1. DEFINITIONS

Consent shall mean any freely given, specific, informed, and unambiguous indication of

which the Data Subject, by a statement or by a clear affirmative action,

signifies agreement to the Processing of Personal Data relating to him/her/it.

Cookie(s) shall mean a piece of information that is placed automatically on your

electronic device’s hard drive when you access the Website and/or

Application and which is listed in this Policy. The Cookie uniquely identifies

your browser to the server. Cookies allow RCS to store information on the

server (for example language preferences, technical information, click or path

information, etc.) to help make the Visitor’s experience of the Website and the

User's experience of the Application better, and to conduct Website and

Application analysis and Website and Application performance review.

Data Controller(s) shall mean the natural or legal person, which, alone or jointly with others,

determines the purposes and means of the Processing of Personal Data and

who is in charge of this Processing. For the purpose of this Policy, the Data

Controller is RCS.

Data Protection Laws shall mean the Federal Data Protection Act (RS 235.1), the Ordinance on the

Federal Data Protection Act (RS 235.11) and, where applicable, the General

Data Protection Regulation.

Data portability shall mean the right of the Data Subject to receive its Personal Data in a

structured, commonly used, and machine-readable format and the right to

transmit those Personal Data to another controller without hindrance from the

Data Controller.

Data processor shall mean a natural or legal person, public authority, agency, or other body

which processes Personal Data on behalf of the Data Controller.

Data Subject(s) shall mean the natural or legal persons whose data is Processed, i.e. in the

context of this Policy, the Data Subject is the Visitor and the User.

Disclosure shall mean making Personal Data accessible, for example by permitting

access, transmission, or publication.

EEA shall mean the European Economic Area.

Newsletter shall mean the Newsletter of RCS that may be sent to you from time to time

with your Consent.

Personal Data shall mean any type of data and information relating to a person who is either

identified or identifiable.

Processing shall mean any operation with Personal Data, irrespective of the means

applied and the procedure, and in particular the collection, storage, use,

revision, disclosure, archiving or destruction of Personal Data.

Standard Contractual Clauses shall mean the Standard Contractual Clauses as attached to the Commission

Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual

clauses for the transfer of personal data to third countries pursuant to

Regulation (EU) 2016/679 of the European Parliament and of the Council.

Third-party(-ies) shall mean any natural and/or legal person who is not RCS, a Visitor, or a

User.

2. SCOPE

RCS provides this Policy to describe its policies and procedures regarding the Processing and

Disclosure of Personal Data collected by RCS through the Website and the Application.

It details the conditions at which, RCS may collect, keep, use, and save information that relates to you,

as well as the choices that you have made in relation to the collection, utilization, and Disclosure of

your Personal data.

This Policy shall apply to any use of the Website and of the Application, whatever the method or

medium used.

3. ACCEPTANCE

By browsing the Website and accessing the Application, Visitors and Users respectively acknowledge

that:

1. RCS may collect and process a certain number of Personal Data that relate to them,

2. RCS is free to use such Personal Data within the limits provided by law, especially Data

Protection Laws and this Policy,

3. that they have read and understood this Policy,

4. that they agree to be bound by this Policy, and

5. that they agree to comply with all applicable laws and regulations in respect to matters

covered by this Policy.

4. PRINCIPLES FOR PROCESSING PERSONAL DATA

While Processing Personal Data, RCS will always respect the following general principles:

a. Transparency

The Data subject must be informed of how his/her Personal Data is Processed.

When the Personal Data is collected, the Data subject must be informed of:

- the existence of the present Policy;

- the identity of the Data Controller;

- the purpose of Personal Data Processing;

- Third-parties to whom the data might be transmitted.

b. Restriction to a specific purpose

Personal Data Processed by RCS should be adequate and relevant to the purpose for which it was

collected. This requires ensuring that the types of Personal Data collected are not excessive but

proportionate to the purposes.

c. Fairness and lawfulness

When Processing Personal Data, the individual rights of the Data Subjects must be protected.

Personal Data shall be Processed lawfully, in a fair manner and in good faith.

d. Consent of the Data Subject

Personal Data shall be collected directly from the concerned Data Subject and the Consent of the said

Data Subject shall be required before such collection and further Processing. The Consent must be

obtained in writing or electronically, for the purposes of documentation. The Consent is valid only if

given voluntarily. If, for any reason, the Consent of the Data Subject was not obtained before collection

and/or Processing, it shall be obtained in writing as soon as possible after the beginning of such

Processing.

The Consent for the Processing of Personal Data is given or reiterated:

1. each time the the User ticks the box in a pop-up window which says, "I have read,

understood and hereby agree with the Terms and the Privacy Policy"”.

2. when the Visitor and/or the User freely submits Personal Data required to access a

specific functionality of the Website or the Application.

Personal Data can be processed without Consent if it is necessary to enforce a legitimate interest of

RCS. Legitimate interests are generally of a legal (e.g., filing, enforcing or defending against legal

claims) or financial (e.g. valuation of companies) nature.

The Processing of Personal Data is also permitted if national legislation requests, requires or allows

this.

e. Accuracy

Personal Data kept on file must be correct and if necessary, kept up to date. Inaccurate or incomplete

Personal Data shall not be kept on file and deleted.

5. COLLECTED DATA

This Policy applies to all data which is received during your visit to or use of the Website and

Application.

In particular, RCS will collect the following Personal Data:

a. Visitor data

When you browse the Website, even if you do not subscribe to our newsletter and do not contact us,

RCS automatically:

- collects your cookies in accordance with the Cookie Policy to be found at

https://payfoot.com/cookies.pdf ;

- uses Google Analytics; and

- uses Facebook pixel.

b. User data

When you use the Application, RCS collects:

- Your name and surname;

- A photo of you;

- A copy of an official identity document;

- Your email address;

- Your telephone number;

- A copy of a utility bill; and

- Data about your use of the Application (including transaction history).

c. Newsletter data

When you, as a Visitor or a User, subscribe to our newsletter, RCS collects your email address for the

sole purpose of sending you such newsletter.

Please note that you are entitled to unsubscribe from our newsletter whenever you want and at your

sole discretion by contacting us in accordance with this Policy.

6. USE OF DATA

The following paragraphs describe the various purposes for which RCS uses your Personal data.

Please note that not all the uses below will be relevant to every Visitor and User.

Generally, the main reason why RCS collects Personal Data is to enable you to enjoy and easily

navigate the Website, to use the Application and/or to advance the development of the Application.

Furthermore, if you contact RCS via email or post, RCS will keep a record of that correspondence.

a. Visitor data:

RCS will use Personal Data to provide Visitors a better browsing experience, and in particular to:

- communicate with them;

- conduct internal studies and measurements aimed at improving the Application;

- conduct research and compile statistics on usage patterns;

b. User data:

RCS will use Personal Data to provide Users with a better service, and in particular to:

- communicate with them;

- provide them with information about new products available, blog posts, promotions, special

offers and other information;

- personalize the promotional offers, in particular based upon their activity and their transaction

history;

- answer to their questions and comments (customer service);

- send them the newsletter, unless they unsubscribe;

- prevent potentially prohibited or illegal activities;

- conduct internal studies and measurements aimed at improving the Application;

- conduct research and compile statistics on usage patterns;

- process transactions;

- manage the accounts;

- enforce the Terms of Use available at the following address: https://payfoot.com/terms.pdf;

- comply with legal requirements;

- as otherwise described to the Users at the point of collection;

c. Collect of the cookies:

A Cookie is a piece of information that is placed automatically on your computer’s hard drive when you

access certain websites. The Cookie uniquely identifies your browser to the server.

Cookies allow RCS to store information on the server (for example language preferences, technical

information, click or path information, etc.) to help make the Web experience better for you and to

conduct Website analysis and Website performance review.

Most Web browsers are set up to accept cookies, although you can reset your browser to refuse all

cookies or to indicate when a cookie is being sent. Note, however, that some portions of the Website

may not work properly if you refuse cookies.

d. Use of Google Analytics:

The Website uses Google Analytics, an Internet site analysis service supplied by Google Inc.

(“Google”). Google Analytics uses cookies which are text files placed on your computer to help to

analyse the use made of the Website by its users. The data generated by the cookies concerning your

use of the Website (including your IP address) will be forwarded to, and stored by, Google on servers

located outside of Switzerland. Google will use this information to evaluate your use of the Website,

compile reports on site activity for its publisher and provide other services relating to the activity of the

Website and the use of the internet. Google may release these data to third parties if there is a legal

obligation to do so or when the third parties process these data for the account of Google including, in

particular, the publisher of the Website. Google will not cross-reference your IP address with any other

data held by Google.

You may deactivate the use of cookies by selecting appropriate parameters on your navigator.

However, deactivation of this kind might prevent the use of certain functions of the Website. By using

the Website, you specifically Consent to the Processing of your Personal Data by Google under the

conditions and for the purposes described above.

7. THIRD PARTY DISCLOSURE

RCS discloses your Personal Data with the following third parties and for the specified purpose:

Worldline (www.worldline.com) is our partner for management of the blockchain. The data you

provide for your account opening and the transactions you realize on the blockchain are shared with

Worldline.

Optiminvest SA (www.optiminvest.ch ), a Swiss company based in Geneva, is our partner for AML

and KYC checks. All data you share with us for your ID verification (including name, telephone

number, email, copies of your ID documentation and any other data assisting with ID verification) will

be shared with Optiminvest.

RCS may further share your Personal Data with any other relevant third parties, in particular if RCS is

requested to do so to comply with a court order or law enforcement request, or if RCS deems it

necessary, as determined at RCS’s sole discretion, to investigate, prevent or take action regarding

illegal activities, to defend our interest or as otherwise required or permitted by law.

In any case where cross-border transfer is done, RCS ensures that an adequate protection is

guaranteed for Personal Data to be transferred outside of Switzerland and the EEA by applying the

Standard Contractual Clauses as made available by the European Commission and approved for use

by the Swiss Data Protection Authority. These Standard Contractual Clauses will ensure an adequate

level of protection abroad.

Unless otherwise stated, the third parties who receive data from RCS are prohibited to use this

Personal Data beyond what is necessary to provide the product or service to you, directly or by

participating to RCS’s activities.

8. STORAGE OF YOUR PERSONAL DATA

Your Personal Data will be stored in Europe. You agree that RCS may store your Personal Data in any

country of the EEA, including Switzerland. Accordingly, your Personal Data may be stored at a

destination outside of your country of residence. Where permitted by law, by accepting this Policy, you

agree to such.

You also agree that Processing may lead to your Personal Data being transferred and stored to

countries offering a lower level of protection than your country of residence. In any such case, RCS

ensures that an adequate protection is guaranteed for Personal Data to be transferred outside of

Switzerland and the EEA by applying the Standard Contractual Clauses as made available by the

European Commission and approved for use by the Swiss Data Protection Authority. These Standard

Contractual Clauses will ensure an adequate level of protection abroad.

9. RETENTION OF YOUR PERSONAL DATA

In accordance with applicable laws, RCS will use your Personal Data for as long as necessary to

satisfy the purposes for which your Personal Data was collected or to comply with applicable legal

requirements.

10. SECURITY OF YOUR PERSONAL DATA

RCS applies high industry standards and will always apply adequate technical and organisational

measures, in accordance with applicable laws to ensure that your data is kept secure.

In the event of a Personal Data breach, RCS shall without undue delay, and where feasible, not later

than 72 hours after having become aware of it, notify the breach to the competent supervisory

authority, unless said breach is unlikely to result in a risk to your rights and freedoms. If the breach is

likely to result in a high risk to your rights and freedoms, RCS shall communicate this breach to you, if

it is feasible, without undue delay.

11. ACCESS TO YOUR DATA AND INFORMATION RIGHTS

You have the right to request access to or information about the Personal Data relating to you which

are processed by RCS.

Where provided by law, you, your successors, representatives and/or proxies may (i) request deletion,

correction or revision of your Personal Data; (ii) oppose the data Processing; (iii) limit the use and

Disclosure of your Personal data; and (iv) revoke Consent to any of our data Processing activities, if

RCS is relying on your Consent and does not have another legal basis to continue Processing your

data.

These rights can be exercised by contacting us through our contact form or writing to us at

dpo@payfoot.com and attaching a copy of your ID. If the request is submitted by a person other than

you, without providing evidence that the request is legitimately made on your behalf, the request will

be rejected.

The request is free of charge unless your request is unfounded or excessive (e.g. if you have already

requested such Personal Data multiple times in the last twelve months or if the request generates an

extremely high workload). In such case, RCS may charge you a reasonable request fee according to

applicable laws.

RCS may refuse, restrict, or defer the provision of Personal Data where it has the right to do so, for

example if fulfilling the request will adversely affect the rights and freedoms of others.

12. PORTABILITY OF YOUR DATA

You also have the right to receive your Personal data, which you have provided to RCS with, in a

structured, commonly used, and machine-readable format and have the right to transmit those data to

another controller without hindrance from RCS.

This right can be exercised by contacting us through our contact form or writing to us at:

dpo@payfoot.com, attaching a copy of your ID. If the request is submitted by a person other than you,

without providing evidence that the request is legitimately made on your behalf, the request will be

rejected.

The request is free of charge unless your request is unfounded or excessive (e.g. if you have already

requested such Personal Data multiple times in the last twelve months or if the request generates an

extremely high workload). In such case, RCS may charge you a reasonable request fee according to

applicable laws.

RCS may refuse, restrict or defer the provision of Personal Data where it has the right to do so, for

example if fulfilling the request will adversely affect the rights and freedoms of others.

13. PRIVACY BY DESIGN AND BY DEFAULT

RCS will, both at the time of the determination of the means for Processing and at the time of the

Processing itself, implement appropriate technical and organizational measures, such as

pseudonymization, which are designed to implement data-protection principles, such as data

minimization, in an effective manner and to integrate the necessary safeguards into the Processing in

order to meet the requirements of the Data Protection Laws and to protect your rights.

RCS will implement appropriate technical and organizational measures for ensuring that, by default,

only Personal Data which are necessary for each specific purpose of the Processing are processed.

This obligation applies to the amount of your Personal Data We collect, the extent of their Processing,

the period of storage and their accessibility. These measures will ensure that by default your Personal

Data are not made accessible without your intervention to an indefinite number of third parties.

14. CONTACTING RCS AND COMPLAINTS

RCS hopes to be able to answer any questions or concerns you may have about your Personal Data.

You can get in touch with RCS at the postal address or email address given in section 19 hereafter.

RCS’s representative in the EU for the purposes of the GDPR is Thibault Verbiest and can be

contacted at dpo@payfoot.com.

You have the right to make a complaint if you feel your Personal Data has been mishandled or if RCS

has failed to meet your expectations. You are encouraged to contact RCS about any complaints or

concerns, but you are entitled to complain directly to the relevant supervisory authority.

15. CHANGES TO THE PRIVACY POLICY

The most current version of this Policy will be made available on the Website and the Application.

RCS may modify this Policy from time to time. If a modification reduces your rights, a pop-up window

will inform you immediately upon access to the Website and the Application, and you will have to

accept such changes before further use.

16. DATA CONTROLLER

The Data Controller of the file is RCS.

17. LINKS

The Website and the Application may contain links which direct you to third party sites. RCS rejects

any liability relating to the privacy policy in force on said third party sites, the collection and use of your

Personal Data by the latter and relating to the contents of such sites (whether the links are hypertext

links or deep-links).

Furthermore, the Data Subject acknowledges and agrees that using some functionalities on our

Website or Application could involve the download and use other applications such as, for example,

Metamask. Under no circumstances RCS shall be liable for the utilization of these other applications,

especially regarding to the data protection rules.

18. JURISDICTION AND GOVERNING LAW

This Policy and any questions relating thereto shall be governed by the laws of Switzerland, to the

exclusion of any rules of conflict resulting from private international law.

Any dispute relating to this Policy must exclusively be brought before the courts of Zug, subject to an

appeal to the Swiss Federal Court.

19. CONTACT

To ask questions or make comments on this Policy or to make a complaint about our compliance with

applicable privacy laws, please contact us through:

a. our contact form available on our Website;

b. our email address: dpo@payfoot.com; or

c. our address: Untermuli 7, 6300 Zug, Switzerland.

We will acknowledge and investigate any complaint pursuant to this Policy.