Privacy Statement

1. Introduction

This Privacy Statement applies to BiyaPay's processing activities involving the personal data of its customers, prospective customers, and website visitors.

This Privacy Statement applies to the processing of your personal information when you visit our websites, whether or not you register an account, use our mobile applications, and use our services as a customer. Our websites may contain links to third-party websites, and this Statement does not apply to those third-party websites.

Your privacy is extremely important to us. Our policy is to protect the confidentiality of information and respect personal privacy.

Please see below for information about how we manage personal data and about your rights in relation to the processing of personal data.

2. Definitions

The following terms are defined as follows:

2.1 "AML" means anti-money laundering.

2.2 "Assets" means any digital representation of value that may be remitted and traded through the BiyaPay services, excluding non-fungible tokens.

2.3 "BiyaPay," "we," "us," and "our" refer collectively to BIYA GLOBAL LIMITED and its subsidiaries.

2.4 "Personal Data" means any information relating to an identified or identifiable natural person, including a name, identification number, location data, online identifier, or one or more factors specific to the physical, economic, cultural, or social identity of that natural person.

2.5 "Sensitive Personal Information" means information that, if disclosed or unlawfully used, may have a material adverse impact on an individual, including, without limitation, government-issued identification numbers (such as passport or driver's license numbers), biometric information (such as facial recognition photos/videos), financial account details (such as bank account numbers), and precise geolocation information. We process Sensitive Personal Information only with your explicit consent or where permitted by laws and regulations.

3. Your Data Controller

Our products and services are provided through local operating entities belonging to BIYA GLOBAL LIMITED.

You are entering into a contract with BIYA GLOBAL LIMITED in accordance with our Terms of Service. The company with which you contract is your data controller and is responsible for collecting, using, disclosing, retaining, and protecting your personal data in accordance with our global privacy standards, this Privacy Statement, and any applicable national laws.

4. Information We May Collect About You

We obtain information about you in various ways through your use of our products and services, including through any of our websites, the registration process, user surveys, event subscriptions, subscriptions to news and updates, and information provided in the course of ongoing support service communications.

To open an account with us, you must first complete and submit a registration form with the required information. By completing this form, you are required to disclose personal data so that BiyaPay can assess your application and comply with relevant laws and regulations.

The minimum information required to enter into a contract governing your use of our products and services and to enable us to fulfill our legal obligations relating to AML, crime prevention, and fraud prevention consists of profile and contact information, verification information, PEP information (as defined below), and financial information. Without this information, we cannot begin or continue providing our services or products to you.

Information We Collect From You

• Full name, residential address and contact details (such as email address, telephone number, etc.), date of birth, place of birth, gender, and nationality ("Profile and Contact Information");

• Bank account information, wallet addresses, credit card details, your source of funds, details of assets and liabilities, and information relating to economic and trade sanctions lists ("Financial Information");

• Trading account balances, trading activity, your inquiries, and our responses ("Transaction Information");

• Information about whether you, or a person close to you, holds a prominent public function ("PEP Information");

• Verification information, including information required to verify your identity, such as a passport, driver's license, selfie photo/video, login credentials, or government-issued identification ("Verification Information");

• When you use the mobile application, we may collect your precise geolocation information (GPS) solely to detect abnormal logins or meet specific regional regulatory requirements ("Location Information");

• Other personal data or business and/or identity information that we, in our sole discretion, consider necessary to comply with legal obligations under various AML requirements, such as the EU Fifth Anti-Money Laundering Directive and the U.S. Bank Secrecy Act ("Other Information").

Information We Automatically Collect About You

• Browser information, which is information automatically collected from your browser by analytics system providers, including your IP address, domain name, any external page that referred you to us, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform ("Browser Information");

• Log information, which is information generated when you use BiyaPay-branded websites, applications, services, or tools operated by BIYA GLOBAL LIMITED and is automatically collected and stored in our logs. This may include device information, such as device identifiers, device operating system and model, device storage, media access control (MAC) address and subscriber identity module (SIM) information, signals relating to user behavior and device interactions, marketing identifiers, battery usage, location information, network addresses, system activity, and any internal and external information relating to pages you visit, including the full uniform resource locator (URL) clickstream to, through, and from our websites or applications (including date and time, page response times, download errors, length of visits to certain pages, page interaction information such as scrolling, clicks, and mouse-overs, and methods used to leave a page) ("Log Information").

Information We Receive About You From Other Sources

We also obtain information about you from third parties, such as your payment providers, service providers that assist with AML, anti-fraud, and security compliance, and publicly available sources. For example:

• Banks that you use to transfer funds to us will provide us with basic personal data, such as your name and address, as well as your financial information, such as your bank account details.

• Your business partners may provide us with your name and address, as well as financial information.

• Advertising networks, analytics providers, and search information providers may provide us with anonymous or de-identified information about you, such as confirmation of how you found our website.

• Our service providers may provide us with information relating to fraud, security, sanctions, AML, and other risks, such as confirmation of identity attributes and information about any attributes related to such matters.

• Credit reference agencies may provide us with your personal data during the credit reference process.

• We may read and store data from blockchains, other publicly available ledgers, or the public domain.

5. Legal Basis for Our Processing of Personal Data

Processing based on legitimate interests: You have the right to object at any time to our processing of your personal data based on legitimate interests. Please contact us at service@biyapay.com. We will assess and stop the processing within a reasonable time unless we can demonstrate compelling legitimate grounds for the processing.

If legitimate interests or performance of a contract is not a recognized legal basis in your jurisdiction, we will rely on consent, whether express or implied as applicable, where consent is required.

6. Disclosure of Your Personal Data

We disclose your personal data to third parties only to the extent necessary in the following circumstances:

• Service providers: to help provide core functions, including cloud hosting, identity verification, AML screening, customer support systems, and email delivery services.

• Payment processors: to complete deposits, withdrawals, or remittances initiated by you, such as through banking partners or cryptocurrency custodians.

• Compliance authorities: to make disclosures to government authorities, courts, and financial regulators, such as FinCEN, as required by law.

• Corporate transactions: if BiyaPay is involved in a merger, acquisition, or asset sale, we may transfer your personal data and will notify you in advance.

We do not sell your personal data to third parties for marketing or advertising purposes. You may request the current list of third-party service providers by contacting service@biyapay.com.

If BiyaPay discloses your personal data to service providers and business partners to perform services requested by customers or to fulfill our legal and regulatory obligations, such providers and partners may store your personal data in their own systems. We require them to protect the confidentiality of such personal data and comply with all relevant privacy and data protection laws.

BiyaPay may also disclose personal data when legally compelled to do so, such as disclosure to government agencies pursuant to a valid court order.

7. Where We Store Your Personal Information

Our operations are supported by a network of computers, servers, other infrastructure and information technology, and third-party service providers. We and our service providers store and process your personal data in Singapore, the United States, Hong Kong, China, and other locations. The level of data protection in these jurisdictions may differ from that in your country. For users in the European Economic Area (EEA) or the United Kingdom, we provide adequate protection based on the EU Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement. You may request a copy of the relevant agreement, which may be redacted or de-identified, by contacting service@biyapay.com. Courts, law enforcement agencies, and security authorities in these jurisdictions may be able to access your personal data through legal process.

8. Privacy When Using Digital Assets and Blockchains

Your use of digital assets may be recorded on public blockchains. Public blockchains are distributed ledgers designed to record transactions immutably across broad networks of computer systems. Many blockchains are subject to forensic analysis, which may result in the re-identification of individuals involved in transactions and the disclosure of personal data, especially when blockchain data is combined with other data.

Because blockchains are decentralized or third-party networks that are not controlled or operated by BiyaPay, we cannot delete, modify, or alter personal data on such networks.

9. Data Retention

We retain your personal data according to the following criteria:

• Identity verification and transaction records: retained for five years after account closure to comply with AML regulations (31 CFR § 1010.430).

• Accounts that have not been closed: retained for the duration of your account and for such period after closure as is reasonably necessary.

• Marketing preferences: if you opt out of receiving marketing communications, we will keep your contact details on a suppression list until you consent again.

• Technical logs (IP addresses, device information): retained for up to five years for security audits and fraud detection.

• Biometric information (selfie videos/photos): retained for no more than five years after verification is completed and permanently deleted thereafter.

After the five-year period expires, we will delete or anonymize your personal data. If extended retention is required due to legal proceedings or regulatory investigations, we will notify you in advance unless prohibited by law. Where deletion is not possible for technical reasons, we will implement additional security measures, such as segregated storage and restricted access.

10. Cookies

We use cookies, web beacons, and similar technologies to improve the service experience, analyze usage trends, prevent fraud, and, with your consent, conduct marketing. Cookies generally fall into the following four categories:

• Strictly necessary cookies: used for basic functions such as login, transactions, and security, and may be used without consent.

• Functional cookies: remember your preferences, such as language.

• Analytics cookies: help us measure traffic, click heatmaps, and similar analytics, such as Google Analytics.

• Advertising cookies: used to show you relevant advertisements, such as remarketing.

You can make choices through the cookie banner that appears on your first visit, or manage your choices at any time by accessing "Cookie Settings" in the footer of our website. We will not set analytics or advertising cookies without your explicit consent.

Please note that disabling certain cookies may cause some functions to be unavailable or not work properly.

11. Your Rights in Relation to Personal Data

The following summarizes the rights you have in relation to personal data that we process. You may request to exercise these rights, subject to any limitations under applicable data protection laws.

Right of Access

You may ask us to confirm whether we are processing your personal data and, if so, what information we process, and to provide you with a copy of that information.

Rectification

It is important to us that your personal data remains up to date. We will take all reasonable steps to ensure that your personal data is accurate, complete, and current. Please notify us if your personal data changes. If the personal data we hold about you is inaccurate or incomplete, you have the right to request correction. If we have disclosed your personal data to others, we will inform them of the correction where possible. If you ask us, and where it is possible and lawful to do so, we will also inform you with whom we have shared your personal data.

You may notify us at any time that your personal information has changed by emailing service@biyapay.com. Subject to applicable law, BiyaPay will change your personal data in accordance with your instructions. To continue processing such requests, in some circumstances we may need you to provide supporting documentation, namely personal data that we need to retain for regulatory or other legal purposes.

Response timeframe:

We will respond within 30 days after receiving your request. For requests that are manifestly unfounded or excessive, we may charge a reasonable fee, such as a copying fee, or refuse to act on the request. You do not need to pay any fee for your first exercise of rights.

Erasure

In certain circumstances, you may ask us to delete or remove your personal data. Such requests may be subject to any retention limitations with which we must comply under applicable laws and regulations. If we have disclosed your personal data to others, we will inform them of the deletion request where possible. If you ask us, and where it is possible and lawful to do so, we will also inform you with whom we have shared your personal data.

Restriction of Processing

In certain circumstances, you may ask us to block or restrict the processing of your personal data, for example, if you contest the accuracy of the personal data or object to our processing of the personal data. This will not prevent us from storing your personal data. If we have disclosed your personal data to others, we will inform them of the restriction of processing where possible. If you ask us, and where it is possible and lawful to do so, we will also inform you with whom we have shared your personal data.

Data Portability

In certain circumstances, you have the right to obtain the personal data you provided to us in a structured, commonly used, and machine-readable format and to reuse it elsewhere, or to request that we transmit it to a third party of your choice where technically feasible.

Objection

You may ask us to stop processing your personal data, and we will do so if we:

• rely on our own or another person's legitimate interests to process your personal data, unless we can demonstrate compelling legal grounds for the processing or for the establishment, exercise, or defense of legal claims;

• process your personal information for direct marketing; or

• process your personal data for research purposes, unless we reasonably believe that such processing is necessary for the performance of a task carried out for reasons of public interest, such as by regulatory or law enforcement authorities.

Authorized Agent

You may designate an agent to exercise rights on your behalf by written authorization. The agent must provide proof of your authorization and identity verification information.

Automated Decision-Making and Profiling

If we make a decision about you solely by automated means, such as through automated profiling, and that decision affects your ability to access our products and services or otherwise has a significant effect on you, you may request not to be subject to such decision unless we can demonstrate to you that the decision is necessary for entering into or performing a contract between you and us. Even if a decision is necessary for entering into or performing a contract, you may contest the decision and request human intervention. If we agree to such a request, including by terminating our relationship with you, we may be unable to provide our products or services to you.

Withdrawal of Consent

You have the right to withdraw your consent at any time for processing based on consent. Please note that this will not affect the lawfulness of processing carried out before your withdrawal of consent on the basis of consent or on grounds that do not require consent.

12. Changes to This Privacy Statement

We may update this Privacy Statement from time to time. For material changes, such as substantial changes to the types of personal data collected, the purposes of use, or the categories of third parties with whom data is shared, we will provide notice by Platform announcement at least 30 days in advance and publish the new version on our website. Your continued use of the services after the new version becomes effective constitutes your agreement to the updated Privacy Statement. If you do not agree, you may close your account. Non-material changes, such as grammar corrections or updates to examples, may take effect immediately without prior notice.

13. Our Products and Services Are Not Offered to Children

Our products and services are not directed to persons under the age of 18, referred to here as "minor children," and we do not knowingly collect children's personal data. If we learn that we have inadvertently processed a child's personal data, we will take legally permitted measures to delete that data from our records. BiyaPay will require child users to close their accounts and will not permit them to use our products and services. If you are the parent or guardian of a child and become aware that the child has provided personal data to us, please contact us at service@biyapay.com.

Age Verification

During registration, you must provide your date of birth. If we have reasonable grounds to believe that you are under 18 years old, we may require you to provide identification to verify your age or suspend your account until your age is confirmed. If you are under 18 years old, please do not create an account or use our services. We do not knowingly collect personal information from children under the age of 13. If we discover that we have collected personal data from a child under the age of 13 without parental consent, we will promptly delete that data and close the relevant account.

14. Contact Information

Questions, complaints, comments, and requests regarding this Privacy Statement are welcome and should be sent to service@biyapay.com.