Privacy Policy of Docufi3d UG (haftungsbeschränkt)

Legally non-binding translation.

Last updated in May 2024.

§1 Subject of the Statement

• Protecting your privacy and personal rights is of significant concern to us at Docufi3d UG (haftungsbeschränkt) c/o TechHub K67 Kasernenstr. 67 40213 Düsseldorf, Germany. We take the responsible and lawful handling of personal data very seriously.
• This Privacy Policy ("Statement") describes how we process your personal data when you visit our website or use our services as a customer ("Docufi3d Online Services").
• The "Docufi3d Online Services" are: a) eKYC, b) identity wallet c) eMail, d) delegationcenter, e) eSign (test).
• This Statement applies and becomes part of the contract when listed in the contract document as part of the contract, referred to in the applicable General Terms and Conditions (GTC), or when you use the Docufi3d Online Services. In case of contradictions between this Statement and the GTC, the provisions of this Statement prevail.
• This document includes the Privacy Statement (EU/EEA) regarding our processing of personal data within the scope of the General Data Protection Regulation (GDPR) of the European Union.
• The processing of your personal data is generally based on one or more of the following legal grounds: Processing is necessary for the performance of a contract with you, for handling your contract request, for compliance with a legal obligation, or for the pursuit of a legitimate interest.
• If you already use Docufi3d's products and services, this Statement also applies to personal data about you collected by Docufi3d in the past and already stored by Docufi3d, which we may link and process with personal data collected in the future.
• By using the Docufi3d Online Services, you agree to this Statement and consent to us processing personal data in accordance with applicable data protection laws and the provisions below.
• We use your data based on various legal grounds, depending on the services you use from us (contract or pre-contractual measures, Art. 6 Para. 1b GDPR); a legal obligation (Art. 6 Para. 1c GDPR); your consent given to us (consent, Art. 6 Para. 1a GDPR); or; from a legitimate interest, for example, to ensure the security of the website, to send you information about the use of our platform or products, as long as they are similar to those you have already purchased or requested from us and you have not deactivated such communications (Art. 6 Para. 1f GDPR).
• To ensure the protection of your data, we implement appropriate technical and organizational measures, always considering the current state of technology. Our employees are regularly sensitized and trained. The infrastructure of our platform is operated on servers in Swiss data centers, which have an ISO 27001 certification and have implemented high-security standards.
• In the course of their service provision, Docufi3d also utilizes solutions from: a) Onboarding Chatbot and Identity Wallet: IAMX AG, Switzerland, b) Compliance Toolbox: KYC Spider AG, Switzerland, c) Identity Verification: Intrum AG, Switzerland, d) AML Checks: Intrum AG, Switzerland, e) KYT Checks: Merkle Science, Singapore, f) Chrome Webstore: Google, USA Datenschutzerklärung Docufi3d AG / May 2024 Seite 8 f) Android, Google Play Store: Google, USA g) iOS, Apple App Store: Apple Inc., USA h) Technical Email Sending: Mailgun Technologies Inc., USA, j) SMS dispatch: seven communications GmbH & Co. KG, Germany
• The Docufi3d website or the "Docufi3d Online Services" contain links to profiles on the following providers. By clicking on the links, you leave our website or the website of the "Docufi3d Online Services" and are redirected to the servers of the respective providers. a) LinkedIn Ireland Unlimited, Wilton Plaza, Gardner House 4,5,6, 2 Dublin, Ireland. Privacy Policy: https://www.linkedin.com/legal/privacy-policy b) Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Privacy Policy: https://twitter.com/de/privacy
• Please note your rights regarding your personal data according to this agreement.

§2 Processing of Data for Service Provision and Contract Execution

• Personal Data: Docufi3d collects, stores, and processes "with your active consent" personal data of its customers as far as it is a) necessary for the provision of their services, b) for the assertion of legal claims or c) due to legal regulations. Personal data are all details and information relating to a specific or identifiable person.
• Technical Usage Data: In the context of your use of our information, communication, and technology services, Docufi3d collects, stores, and processes technical data. Technical usage data can be processed for personal purposes as far as it is necessary for the provision of their services, the assertion of legal claims, or due to legal regulations.
• We process "with your active consent" personal data and various categories of data from you, such as a) Contact and identification data like Name, first name, street, house number, postal code, city, country, title, email address, phone number, customer number, copy and number of the official ID, date of birth, gender, nationality, place of birth, residence status, marital status, language, relative data, contract data, wallet address, company data, phone number, location data, IP address, device identification numbers, interaction and usage data, device type, device settings, operating system, software, cookie information, browser settings. b) Personal details like age, gender, nationality, and language. c) Biometric data, d) User account information like username, password, and user account number; e) Financial data like bank details, payment information (incl. credit card data), payment history, and average revenue; f) Contract data like type of contract, start of contract, content of the contract, type of products and services, applicable terms and conditions, start of the contract, contract duration, compensation claims, invoice data, and offer restrictions; g) Interaction and usage data like Correspondence, chat content, customer preferences, type, and scope of the use of products and services, h) Customer service information like Complaints, delivery information, etc., customer segment and target group information, information about the devices used (device type, device ID, manufacturer, operating system, language, device settings, etc.), information from the assertion of rights and feedback; Information regarding the use of the website and platform.
• Docufi3d bases the processing of your personal data on the following interests in processing: a) Provision of their services on the legal basis of contract fulfillment Contact and identification data, personal details, user account information, financial data, contract data, data from telecommunications, interaction and usage data, website information. b) Assertion of legal claims on the legal basis of a legitimate interest in avoiding damages and compliance with Swiss legal regulations Contact and identification data, personal details, user account information, financial data, contract data, data from telecommunications, interaction and usage data, website information. Datenschutzerklärung Docufi3d AG / Feb 2024 Seite 9 c) based on legal regulations on the legal basis of legal obligation and legitimate interest in compliance with Swiss legal regulations. Contact and identification data, personal details, user account information, financial data, contract data, data from telecommunications, interaction and usage data, website information.
• We store and process your personal data as long as it is necessary to achieve the purpose of their collection or as required or permitted by law. For example, we have a legitimate interest in storing your personal data as long as they are subject to a retention obligation or storage is necessary for reasons of evidence or security. After that, your personal data will be deleted from our systems or anonymized so that you can no longer be identified.
• Please note your rights regarding your personal data according to this statement.

§3 Processing of Data from Telecommunications

• Docufi3d is obligated to the secrecy of telecommunications for the product Email and processes data from telecommunications within the legally permissible or prescribed framework. Docufi3d processes data from telecommunications, in particular, for establishing a connection, for transmitting information.
• In addition, Docufi3d processes location data from telecommunications exchanged between you and your communication partner during your use of telecommunications services, if this is legally required.
• The transmitted messages like email messages are neither recorded nor read by Docufi3d in any form. This also applies to data that you entrust to us as part of your use of our email services or storage solutions.
• The product adamail.me is classified by the ÜPF as a provider of derived communication services (AAKD).

§4 Acquisition and Disclosure of Information from Data Analyses

• By using data analysis procedures, we gain statistical and analytical information that we use to improve your customer experience and do not disclose to third parties.
• The customer has the option to actively choose a merger of attributes: Stake address, assets in the wallet, stake email with the Docufi3d Online Service product Email. The customer can revoke this consent at any time. When registering to set up your Single Sign-on, you can choose whether we identify you through an electronic Know-Your-Customer Check (eKYC). After you have registered and logged in with your access data, we can link your online usage data with further customer data and use it to provide our services.
• Data use occurs as far as legally required only with your additional consent.

§5 Disclosure of Data

• We may process and disclose your personal data to third parties if this is necessary or appropriate to comply with or verify compliance with applicable laws and regulations and to respond to requests from competent authorities.
• We may disclose personal data to third parties to prevent or eliminate fraudulent or abusive use of Docufi3d services.

§6 Data Processing Abroad by Commissioned Third Parties

• Docufi3d relies on products and services from manufacturers and suppliers abroad for its service provision, which can access personal data or telecommunications data on Docufi3d's systems from abroad as part of their contract fulfillment, for example, in providing maintenance services, or process them at their location abroad.
• Cross-border processing in countries outside the EEA (third countries): The recipients of your personal data may also be located abroad, even outside the European Economic Area (EEA comprising the EU member states and the EFTA excluding Switzerland). The concerned countries may not have laws that protect your personal data to the same extent as in Switzerland or the EU or EEA. If we transfer your data to such a country, we ensure the protection of your personal data in an Datenschutzerklärung Docufi3d AG / Feb 2024 Seite 10 appropriate manner, e.g., by concluding data transfer contracts based on the contracts approved, issued, or recognized by the European Commission, so-called standard contractual clauses (Art. 46 Para. 2 GDPR). An example of the contracts usually used can be found at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model- contracts-transfer-personal-data-third-countries_en. In exceptional cases, the transfer to countries without adequate protection is permissible, e.g., based on explicit consent (Art. 49 Para. 1a GDPR), for the performance of a contract with the data subject or for processing your contract request (b), for the conclusion or performance of a contract with someone else in the interest of the data subject (c) or for the assertion, exercise, or defense of legal claims (e).

§7 Your Rights Regarding Your Personal Data Under the GDPR, you have the following rights regarding your personal data:

• Access: You have the right to obtain confirmation from us as to whether we process personal data concerning you and, if so, to request access to the processing of your personal data. This information includes, in particular, information on the purpose of the processing, the categories of personal data, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. You can submit your request for access to us in writing and enclose a copy of your identity card or passport to our postal address, alternatively perform a KYC via kyc.Docufi3d.id and delegate your KYC file to Docufi3d.
• Correction: You have the right to have your personal data processed by us corrected and/or completed.
• Deletion: You are entitled to have your personal data deleted if we are not obliged to retain your personal data due to applicable laws and regulations, if the personal data are no longer necessary for the purposes pursued; you have withdrawn your consent and there is no other legal basis for processing; you have effectively objected to the processing, the data were processed unlawfully.
• Restriction of processing: You can request us to restrict processing in the following cases: a) If you dispute the accuracy of the data, for the duration of our examination and subsequent correction or rejection of the correction. b) If you refuse deletion in the case of unlawful processing and instead wish to restrict processing. c) If you request that the data not be deleted after the purpose has been fulfilled but to be kept for the assertion of rights. The affected personal data will be segregated or marked for the duration of the restriction. Besides storage, any further processing of these personal data takes place only with your consent.
• Data portability: Under certain conditions, you have the right to receive the personal data you have provided in a structured, commonly used, and machine-readable format. You are entitled to have these personal data transmitted unhindered to another company, as far as this is technically feasible.
• Right to object: You have the right, for reasons related to your particular situation, to object at any time to the processing of your personal data by us, and we may be required not to process your personal data any longer. If you have a right to object and exercise this right, your personal data will no longer be processed by us for such purposes. A right to object does not exist in particular if we have compelling legitimate grounds for processing that outweigh your interests, rights, and freedoms, or if the processing serves the assertion, exercise, or defense of legal claims or is necessary for the conclusion and performance of a contract.
• Right to withdraw consent: You have the right to withdraw consent to the processing of your personal data for one or more specific purposes. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• You can assert your rights in connection with the processing of your personal data at any customer contact point (compare contact).
• You also have the right to lodge a complaint with the competent supervisory authority, especially in the Member State of your habitual residence or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR. The competent supervisory Datenschutzerklärung Docufi3d AG / Feb 2024 Seite 11 authority for data protection in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

§8 Contact If you have any questions or concerns, you can contact us as follows: By email: datenschutz (a t) Docufi3d.id By mail: Docufi3d AG, Dammstrasse 16, CH-6300 Zug, Switzerland Official inquiries: legal (a t) Docufi3d.id

§9 Cookies

• Cookies are used on the Docufi3d Internet pages. Most of the cookies we use are temporary session cookies that are automatically deleted from your computer or mobile device at the end of the browser session. In addition, we also use permanent cookies. These remain stored on your computer or mobile device after the end of the browser session. These permanent cookies remain stored on your computer or mobile device for a period between one month and ten years, depending on the type of cookie, and are automatically deactivated after the programmed time has elapsed.
• The cookies we use serve to enable various functions of our Internet pages. For example, cookies help to save your country and language settings across different pages of an Internet session. The use of cookies also allows us to capture and analyze the usage behavior of visitors to our Internet pages.
• Cookies capture usage information, such as the date and time of access to our Internet page, the name of the visited Internet page, the IP address of your end device, and the operating system used. Cookies also provide information about which of our Internet pages you visit and from which website you came to our Internet page. Similarly, with the help of cookies, we can understand which topics you research on our Internet pages.
• To gain insight into the use of our Internet pages and improve our Internet offer, we use web analysis tools. These tools are usually provided by a third party. In general, the information collected about the use of an Internet page by using cookies is transmitted to the server of the third party. Depending on the third-party provider, these servers are located abroad. The transmission of data is done by shortening the IP addresses, thereby preventing the identification of individual end devices. The IP address transmitted by your browser in the context of the use of third-party tools is not linked to other data of these third-party providers. A transmission of this information by third-party providers takes place only due to legal regulations or in the context of order data processing.
• Most Internet browsers automatically accept cookies. However, you can instruct your browser not to accept cookies or to ask you each time before accepting a cookie from a website you visit. You can also delete cookies on your computer or mobile device by using the corresponding function of your browser.

§10 Disclaimer

• In principle, no element, whether on the website, with the Docufi3d Online Services, or in other communication media of Docufi3d such as newsletters, Medium, YouTube, Twitter, email, other sources is a binding offer. If Docufi3d intends to make a binding offer, Docufi3d will state this clearly and unambiguously. If there are doubts in this regard, the visitor/reader/user must assume that Docufi3d does not intend to make a binding offer.
• Docufi3d disclaims any liability for information stored on external servers, on servers with public access, Usenet news servers, discussion forums, chat rooms, emails, etc. 3. Docufi3d can neither assure that this information on the Docufi3d website and other media according to No. 1 of this paragraph is complete nor that it is current. Their use is at the risk of the visitors.
• It is to be assumed that the information accessible via the Docufi3d website and newsletter is protected by copyright and its commercial use is only permitted with the consent of the author and against payment. Related content may be used by the customer exclusively on the mobile phone/computer onto which it was downloaded. No copies of the content may be created. Neither sublicenses may be granted nor rights transferred to third parties in any way. Furthermore, neither the content nor any underlying material forming part of or an element of the content may be Datenschutzerklärung Docufi3d AG / Feb 2024 Seite 12 modified, changed, adapted, disassembled, subjected to reverse engineering, or corrected. No trademarks of any licensors may be used. Any liability of third-party licensors is excluded.

§11 Application, Duration, and Amendment

• This statement is part of the contract. It applies as long as the contract with you exists. Therefore, this statement cannot be terminated separately.
• We reserve the right to amend and supplement this statement at any time and at our sole discretion.
• If we amend this statement to your disadvantage, we will inform you in advance and obtain your consent. Your consent is voluntary. If you do not agree with the respective amendment or supplement, you can object to it. If you do not object within the period previously announced, this is considered your consent to the respective amendment or supplement.
• Due to an amendment or supplement to this statement, there is no right to extraordinary termination of service contracts.
• Previous versions or an overview of the changes will be made accessible on our Internet page.
• If a provision of this statement is declared invalid, the statement remains fully valid and effective otherwise. In addition, no party is liable for performance failures due to actions beyond their control, including actions by regulatory authorities, force majeure, terrorism, supply shortages, labor difficulties (including strikes), war, riots, fire, floods, power failures, equipment or transmission errors, Internet interruptions, supplier failures (including providers of information technology), or other similar causes.