Legal Center

Privacy Policy

Last updated: 7 August 2026
1

Introduction

This Privacy Policy explains how PrimCard collects, uses, stores, shares and protects personal information when you access our website, create an account, use our wallet functions, request or manage a virtual card, fund a card, make transactions or otherwise use any part of the PrimCard platform.

PrimCard is designed as a digital platform for users who want to fund and manage virtual payment cards using supported digital assets. To provide these services, PrimCard relies on a combination of its own technology and carefully selected third-party infrastructure providers. These providers may support wallet infrastructure, blockchain connectivity, card issuing, card processing, transaction monitoring, security, hosting, communications and other operational services.

Although some of these services are provided through third-party infrastructure, your relationship as a user remains with PrimCard when you access and use the PrimCard platform.

We take the protection of personal information seriously and aim to collect only the information that is reasonably necessary to operate the platform, protect users, prevent fraud, manage transactions, maintain system security and meet applicable legal, contractual and operational requirements.

PrimCard does not operate a traditional document-based onboarding process for every user. In most cases, users are not required to upload a passport, driving licence or proof of address when opening an account. Instead, PrimCard uses a risk-based verification model, sometimes referred to as soft KYC, which may include automated checks, sanctions screening, fraud detection, behavioural analysis, device information and other internal or third-party risk controls.

The level of verification applied to an account may vary depending on the way the platform is used. Additional information may be requested where transaction activity, account behaviour, geographical exposure, security events or other risk factors indicate that further checks are appropriate. Where additional verification is required, PrimCard may temporarily restrict certain services until the requested information has been provided and reviewed.

This Privacy Policy should be read together with the PrimCard Terms and Conditions, Cookies Policy, Risk Disclosure, Refund and Dispute Policy and AML and Compliance Policy.

By creating an account or continuing to use PrimCard, you acknowledge that your personal information may be processed in accordance with this Privacy Policy.

This policy applies to personal information collected through the PrimCard website, dashboard, wallet interface, card management functions, support channels and any other services made available under the PrimCard brand.

It does not apply to websites, applications or services operated independently by third parties, even where those services are connected to PrimCard. Where a third-party provider processes information under its own terms and privacy policy, that provider is responsible for explaining how it handles such information.

PrimCard may update this Privacy Policy from time to time to reflect changes in the platform, our service providers, technology, security practices, business model or applicable legal requirements. The most recent version will always be published on the PrimCard website together with the date of the latest update.

2

Who we are

PrimCard is a digital platform that enables users to create, fund and manage virtual payment cards using supported digital assets.

Our objective is to provide a simple, secure and efficient way for users to access virtual card services without the complexity traditionally associated with digital asset payments. The PrimCard platform has been developed to combine cryptocurrency funding, virtual card management and payment technology into a single customer experience.

PrimCard operates the website, customer interface, account management system, wallet interface, card management functions and all customer support services made available under the PrimCard brand.

To provide these services, PrimCard works with carefully selected third-party technology and infrastructure providers. These providers assist with wallet infrastructure, blockchain connectivity, virtual card issuing, payment processing, cloud hosting, fraud prevention, security monitoring, communications and other technical services required to operate the platform.

These providers act solely as service providers or infrastructure partners supporting the operation of PrimCard. They do not control the PrimCard platform or your relationship with PrimCard unless expressly stated otherwise. PrimCard remains responsible for the customer experience, the operation of the platform and the protection of personal information processed through our services.

PrimCard is not a bank and does not accept customer deposits as a banking institution. The platform does not provide savings accounts, current accounts or regulated banking products.

PrimCard does not provide investment advice, tax advice, legal advice or financial planning services. Any information made available through the platform is provided for general information and operational purposes only and should not be considered professional advice.

The availability of certain services may depend on your country of residence, applicable laws, the requirements of our service providers and our internal risk policies. Some services may not be available in every jurisdiction and PrimCard reserves the right to restrict or refuse access where necessary to comply with legal, contractual or operational requirements.

PrimCard operates a risk-based compliance framework designed to protect the platform and its users. Although users are not normally required to complete a traditional document-based verification process during registration, PrimCard may carry out automated identity verification, sanctions screening, fraud prevention checks, behavioural analysis and other security measures as part of its ongoing monitoring programme.

Where additional verification is considered necessary, PrimCard may request further information before allowing certain transactions or services to continue. Such requests may be made at any time during the lifetime of an account where required to protect the platform, comply with contractual obligations or investigate potentially suspicious activity.

By creating an account and using the PrimCard platform, you acknowledge that certain information may be shared with our authorised service providers where this is necessary to provide the services you have requested, maintain the security of the platform, investigate fraudulent activity or comply with applicable legal or contractual obligations.

3

Scope of this Privacy Policy

This Privacy Policy applies to all personal information collected by PrimCard when you access or use our website, mobile applications, customer dashboard, wallet services, virtual card services or any other products and services made available under the PrimCard brand.

The Policy applies whether you are visiting our website, registering for an account, funding your PrimCard balance, creating or managing a virtual card, making transactions, contacting customer support or otherwise interacting with the PrimCard platform.

This Privacy Policy also applies to personal information collected through communications with PrimCard, including emails, support tickets, live chat, telephone conversations where applicable, surveys, feedback forms and other customer service channels.

Where third-party infrastructure providers process information solely on behalf of PrimCard in order to provide wallet services, virtual card services, payment processing, fraud prevention, cloud hosting or other technical services, such processing forms part of the PrimCard service and is covered by this Privacy Policy unless otherwise stated.

This Privacy Policy does not apply to websites, applications or services that are operated independently by third parties, even where those services are linked to or integrated with PrimCard. Where you access third-party websites or services, your personal information will be processed in accordance with the privacy policies and terms published by those providers.

PrimCard has no control over the privacy practices, security procedures or data processing activities of independent third-party websites or services and encourages users to review their privacy policies before providing any personal information.

This Privacy Policy applies to all users of the PrimCard platform regardless of their country of residence, although certain rights and obligations described in this Policy may vary depending on the laws applicable to your jurisdiction.

Some services offered through PrimCard may not be available in every country or region. The availability of particular products or features may depend on legal requirements, contractual obligations with our service providers, internal risk policies or technical limitations. Where local laws require additional privacy notices or disclosures, those notices shall supplement this Privacy Policy and apply only to the extent required by the relevant jurisdiction.

This Privacy Policy applies throughout the lifetime of your relationship with PrimCard, including the period during which your account is active, temporarily restricted, suspended or closed. Certain information may continue to be processed after an account has been closed where this is necessary to comply with legal obligations, resolve disputes, prevent fraud, enforce our contractual rights or maintain appropriate business records.

Nothing in this Privacy Policy limits any rights or obligations contained within the PrimCard Terms and Conditions, Refund and Dispute Policy, AML and Compliance Policy, Risk Disclosure or any other agreement governing your use of the PrimCard platform. Those documents should be read together with this Privacy Policy to obtain a complete understanding of how PrimCard operates and how your personal information is handled.

4

Personal information we collect

PrimCard collects personal information that is necessary to provide our services, protect the platform, prevent fraud, improve security and comply with applicable legal, contractual and operational requirements. The type of information we collect depends on how you use the PrimCard platform, the services you access and your interaction with us.

When you create a PrimCard account, we may collect information that identifies you as a user. This may include your full name, email address, mobile telephone number, country of residence, date of birth, preferred language, username and other information required to establish and manage your account.

We also collect information required to secure your account. This may include your encrypted password, transaction PIN, two-factor authentication settings, security preferences and account recovery information where applicable. Passwords are encrypted and cannot be viewed by PrimCard employees.

As you use the PrimCard platform, we automatically collect technical information required to maintain the security, stability and performance of our services. This information may include your IP address, browser type, browser version, operating system, device type, device identifiers, screen resolution, language settings, time zone, login history, session identifiers, network information and diagnostic data.

We may also collect information relating to how you interact with the PrimCard platform. This includes pages visited, features used, buttons selected, transactions initiated, session duration, navigation behaviour and other usage information that helps us improve the functionality, usability and security of the platform.

Where you use your PrimCard wallet, we collect information relating to wallet activity. This may include wallet balances, deposit history, withdrawal history where available, funding activity, blockchain transaction references, supported digital assets, transaction amounts, transaction timestamps, transaction status and associated ledger records.

Where you create or manage a virtual card, we collect information necessary to provide those services. This may include card status, card funding history, available balance, transaction history, merchant information, payment amounts, refunds, reversals, declined transactions, card settings, card controls and other operational information relating to the use of your virtual card.

For security reasons, PrimCard does not permanently store complete card numbers, CVV codes or other sensitive authentication data in plain text. Where such information is temporarily displayed to you, appropriate security controls are applied to protect that information.

We may collect information relating to communications between you and PrimCard. This includes customer support enquiries, live chat conversations, emails, support tickets, feedback submitted through the platform, survey responses and other communications made in connection with your account or our services.

Where you choose to receive notifications from PrimCard, we may collect and process information necessary to deliver those notifications. This may include email addresses, mobile telephone numbers, device notification tokens and your communication preferences.

PrimCard also collects information generated by our security systems. This may include failed login attempts, password reset requests, changes to security settings, unusual account activity, fraud alerts, risk scores, sanctions screening results, behavioural analysis, device reputation information and other security-related events required to protect the platform and its users.

PrimCard operates a risk-based verification model designed to provide a streamlined onboarding experience while maintaining appropriate security controls. Users are not normally required to complete a traditional document-based identity verification process before accessing the platform. However, we may collect and process information from automated verification systems, fraud prevention providers, sanctions screening services and other trusted data sources to assess risk and protect the integrity of the platform.

Where additional verification becomes necessary, PrimCard may request further information or supporting documentation. Any information provided as part of that process will be processed in accordance with this Privacy Policy and used only for the purposes for which it was requested.

PrimCard does not intentionally collect personal information that is not reasonably required for the operation of the platform. We do not request access to your contacts, photographs, microphone, camera or location unless you choose to provide such information or the relevant permission becomes necessary for a feature that you have specifically chosen to use.

The information collected by PrimCard may be obtained directly from you, automatically through your use of the platform or, where appropriate, from trusted third-party service providers that assist us in providing secure and reliable services. PrimCard takes reasonable steps to ensure that any personal information collected is relevant, accurate and limited to what is necessary for the purposes described in this Privacy Policy.

5

How we collect your information

PrimCard collects personal information in several different ways depending on how you interact with our platform and the services you choose to use.

Most of the information we process is provided directly by you when creating an account, using our services or communicating with us. Additional information may be collected automatically while you use the platform, and in certain circumstances information may also be obtained from trusted third-party service providers that assist us in operating PrimCard.

When you register for a PrimCard account, you provide information required to create and secure your account. This includes information entered during registration, account preferences, security settings and any additional information you voluntarily choose to provide.

As you continue using PrimCard, we collect information generated through your use of the platform. This includes wallet activity, card activity, deposits, card funding requests, transactions, account settings, notification preferences and customer support interactions.

Some information is collected automatically when you access the PrimCard website or applications. This information helps us understand how the platform is being used, maintain system performance, improve security and identify technical issues before they affect users. Automatically collected information may include your IP address, browser type, operating system, device model, language settings, time zone, session information, pages visited, buttons selected, referral sources, error reports, device identifiers and other technical information generated during normal use of the platform.

PrimCard also records information relating to account security. This may include successful and unsuccessful login attempts, password changes, two-factor authentication events, transaction PIN changes, account recovery requests, changes to notification settings, new device registrations and other security-related events.

To protect both our users and the platform, PrimCard operates a continuous risk assessment programme. As part of this programme, certain information may be generated automatically by our fraud prevention systems, behavioural monitoring tools, sanctions screening providers and internal security controls. These systems may analyse account activity, transaction behaviour, login patterns, device information, geographical indicators and other technical information to identify unusual or potentially fraudulent activity.

PrimCard does not normally require customers to complete a traditional document-based identity verification process during registration. However, our risk-based verification model may collect information from trusted verification partners, fraud prevention providers or publicly available sources where this is necessary to protect the platform or satisfy contractual obligations with our service providers.

Additional information may also be collected if you contact our customer support team. This includes emails, live chat conversations, support tickets, telephone conversations where applicable, feedback forms and any documents or information you choose to provide in connection with your enquiry.

Where additional verification becomes necessary, PrimCard may request further information directly from you. Any documentation or information provided during this process will only be used for the purpose for which it was requested and will be handled in accordance with this Privacy Policy.

PrimCard may also receive information from our infrastructure partners when you use services provided through the platform. This may include transaction confirmations, payment status updates, wallet activity, card activity, fraud alerts, security notifications and other operational information required to deliver our services.

Information received from third-party providers is used only for legitimate business purposes, including operating the platform, providing requested services, protecting customer accounts, investigating suspicious activity and complying with applicable legal or contractual obligations.

We take reasonable steps to ensure that personal information collected from any source is relevant, accurate and limited to what is necessary for the operation of the PrimCard platform. Where we become aware that information held by us is inaccurate or no longer required, we will take reasonable steps to update, correct or securely remove that information in accordance with our data retention policies and applicable legal requirements.

6

How we use your information

PrimCard uses your personal information only where it is necessary to provide our services, operate the platform, protect users, improve security and comply with applicable legal, contractual and operational obligations.

The information we collect enables us to create and manage your account, provide wallet functionality, issue and manage virtual cards, process transactions, respond to customer enquiries and maintain the overall operation of the PrimCard platform.

Your personal information is used to create your customer profile and establish your PrimCard account. This allows us to authenticate your identity when you sign in, protect your account from unauthorised access and provide access to the services available through the platform.

We use your information to operate your PrimCard wallet, display account balances, process deposits, manage wallet activity and maintain accurate transaction records. Information relating to your wallet is also used to process card funding requests, monitor transaction status and maintain the integrity of your account.

Where you use a PrimCard virtual card, we process information necessary to issue the card, manage card settings, process card funding requests, display transaction history, process refunds and reversals, monitor card activity and maintain accurate financial records.

Your information is used to protect both your account and the PrimCard platform. This includes detecting fraudulent activity, monitoring suspicious transactions, identifying unusual account behaviour, investigating security incidents and preventing unauthorised access.

PrimCard operates a risk-based verification programme rather than a traditional document-based onboarding process for every customer. Information collected through automated verification systems, behavioural monitoring, sanctions screening, fraud prevention services and internal security controls may be used to assess the level of risk associated with an account or transaction. Where additional verification becomes necessary, your information may be used to request, review and verify further documentation before allowing certain services or transactions to continue.

We use your information to communicate with you regarding your account and the services you use. This includes sending account notifications, security alerts, transaction confirmations, password reset instructions, platform announcements, support responses and other service-related communications.

PrimCard may also use your information to improve the quality, reliability and performance of the platform. This includes analysing how features are used, identifying technical issues, monitoring system performance, improving the customer experience and developing new products and services.

Technical information may be used to diagnose software issues, investigate service interruptions, improve website performance, optimise application functionality and enhance the security of our infrastructure.

Where you contact our customer support team, the information you provide may be used to investigate your enquiry, verify your identity, resolve technical issues, process complaints and improve the quality of our customer support services.

PrimCard may use aggregated and anonymised information for internal reporting, business planning, service improvement, statistical analysis and operational monitoring. Information used for these purposes does not identify individual users.

Your personal information may also be processed where necessary to comply with applicable laws, contractual obligations, regulatory requests, court orders, law enforcement enquiries or other legal requirements that apply to PrimCard or our service providers.

Where required to protect the security and integrity of the platform, PrimCard may use your information to investigate suspected breaches of our Terms and Conditions, identify misuse of the platform, enforce our contractual rights or protect the rights, property and safety of PrimCard, our users and our service providers.

PrimCard does not sell your personal information to third parties and does not use your personal information for unrelated commercial purposes. Personal information is processed only where there is a legitimate business, contractual, security or legal reason for doing so.

Where marketing communications are provided, users may choose to opt out at any time through their account settings or by following the unsubscribe instructions included within the relevant communication. Essential service notifications relating to security, transactions, account activity or the operation of the platform cannot be disabled, as these communications are necessary for the safe and effective use of PrimCard.

7

Sharing your information

PrimCard treats your personal information as confidential and does not sell, rent or trade your personal information to third parties for marketing purposes.

We only share personal information where it is necessary to provide our services, operate the platform, protect our users, comply with legal obligations or support the security and reliability of PrimCard.

To provide the PrimCard platform, we work with carefully selected service providers who perform specific functions on our behalf. These functions may include wallet infrastructure, virtual card issuing, payment processing, blockchain connectivity, fraud prevention, cloud hosting, customer support, email delivery, SMS services, analytics, system monitoring and cybersecurity.

Where it is necessary to provide these services, limited personal information may be shared with the relevant service provider. Each provider receives only the information required to perform the services requested by PrimCard and is expected to process that information in accordance with appropriate confidentiality, security and data protection obligations.

PrimCard may also share information with fraud prevention providers, sanctions screening providers, identity verification providers and other security partners where this is necessary to detect fraud, prevent financial crime, investigate suspicious activity or protect the integrity of the platform.

Where payment transactions are processed through our infrastructure partners, transaction information necessary to complete, monitor or reconcile the transaction may be shared with those providers. This may include transaction identifiers, wallet information, card information, payment amounts, timestamps and transaction status.

If you contact our customer support team, information relating to your enquiry may be shared internally with the relevant departments or, where necessary, with the service provider responsible for resolving the issue. Information will only be shared where it is reasonably necessary to investigate or resolve your enquiry.

PrimCard may disclose personal information where required to comply with applicable law, court orders, regulatory requirements, lawful requests from public authorities or other legal obligations. Where permitted by law, we will seek to ensure that such requests are valid and proportionate before disclosing personal information.

We may also disclose information where we believe it is reasonably necessary to protect the rights, property or safety of PrimCard, our users, our employees, our service providers or the public. This may include investigating fraud, preventing financial crime, enforcing our Terms and Conditions or responding to security incidents.

If PrimCard undergoes a merger, acquisition, corporate restructuring, sale of assets or similar business transaction, personal information may be transferred as part of that transaction. Should this occur, we will take reasonable steps to ensure that your information continues to be protected in accordance with this Privacy Policy or an equivalent level of protection.

PrimCard may share information with professional advisers, auditors, insurers, accountants, legal advisers and other professional service providers where such disclosure is necessary for legitimate business, legal or regulatory purposes.

Certain information may also be shared with technology providers responsible for maintaining the availability, security and performance of the PrimCard platform. Such providers may have limited access to technical information solely for the purpose of maintaining or supporting the systems they operate on our behalf.

Where personal information is transferred to a third party, PrimCard takes reasonable steps to ensure that appropriate technical and organisational measures are in place to protect that information against unauthorised access, disclosure, alteration or misuse.

PrimCard does not permit third-party service providers to use your personal information for their own independent marketing purposes unless you have separately agreed to receive communications directly from those providers.

Where anonymous or aggregated information is shared for reporting, statistical analysis or business intelligence purposes, that information will not identify you personally and cannot reasonably be used to identify any individual user.

Any sharing of personal information by PrimCard is limited to what is reasonably necessary to provide the services you have requested, protect the security of the platform, fulfil contractual obligations or comply with applicable legal requirements.

8

How we protect your information

Protecting your personal information is one of PrimCard's highest priorities. We recognise that users trust us with sensitive account and transaction information, and we are committed to maintaining appropriate technical, organisational and operational measures to protect that information against unauthorised access, disclosure, alteration, misuse or destruction.

PrimCard uses industry standard security practices throughout the platform to safeguard customer information. Security is considered throughout the design, development and operation of our services, with the objective of reducing risk while maintaining a reliable and secure customer experience.

All communication between your device and the PrimCard platform is encrypted using secure communication protocols. This helps protect information transmitted between you and our systems from interception or unauthorised access.

Sensitive information stored by PrimCard is protected using appropriate encryption technologies, secure infrastructure and controlled access procedures. Passwords are encrypted before being stored and cannot be viewed by PrimCard employees. Where supported, sensitive authentication information is never stored in plain text.

Access to customer information is restricted to authorised personnel who require access in order to perform their duties. Access rights are granted according to business requirements and are reviewed periodically to ensure that only appropriate personnel retain access to sensitive systems and information.

PrimCard maintains detailed audit logs of significant account activity and administrative actions. These logs help us investigate security incidents, identify suspicious activity, resolve technical issues and maintain the integrity of the platform.

To help protect customer accounts, PrimCard supports multiple security features including encrypted passwords, transaction PINs, two-factor authentication, login notifications, device monitoring and automated fraud detection.

Our security systems continuously monitor account activity to identify unusual behaviour that may indicate fraud, unauthorised access or misuse of the platform. This monitoring may include login patterns, device information, transaction behaviour, geographical indicators, account changes and other security-related events.

Where suspicious activity is identified, PrimCard may temporarily delay transactions, restrict certain account functions, request additional verification or suspend access to an account while the activity is investigated.

PrimCard regularly reviews and updates its security controls to address new threats, technological developments and changes to the services we provide. Security testing, software updates, vulnerability management and infrastructure monitoring form part of our ongoing security programme.

Although PrimCard takes reasonable steps to protect customer information, no internet-based service, software application or electronic storage system can guarantee absolute security. For this reason, users also play an important role in protecting their accounts.

Users are responsible for maintaining the confidentiality of their login credentials, passwords, transaction PINs, one-time verification codes and any recovery information associated with their account. This information should never be shared with any other person.

Users should immediately notify PrimCard if they believe their account has been compromised, if they become aware of unauthorised access or if they suspect that their login credentials have been disclosed or misused.

PrimCard will never ask users to provide their password, transaction PIN or two-factor authentication codes by email, telephone, social media or any other unsolicited communication. Users should remain cautious of phishing attempts, fraudulent websites and any communication claiming to represent PrimCard that appears suspicious.

Where security incidents affect personal information, PrimCard will investigate the incident, take appropriate corrective action and, where required by applicable law or contractual obligations, notify affected users and relevant authorities within the required timeframes.

Security is an ongoing process rather than a single measure. PrimCard continuously evaluates its systems, policies and procedures to strengthen the protection of customer information and maintain a secure environment for all users of the platform.

9

International transfers of personal information

PrimCard provides digital services that may be accessed by users from different countries. As a result, your personal information may be processed, stored or transferred to countries other than the country in which you reside.

To operate the PrimCard platform, we work with carefully selected service providers located in different jurisdictions. These providers may support cloud hosting, wallet infrastructure, virtual card services, payment processing, blockchain connectivity, fraud prevention, cybersecurity, customer communications, system monitoring and other operational services required to deliver the platform.

Whenever personal information is transferred internationally, PrimCard takes reasonable steps to ensure that appropriate safeguards are in place to protect your information and that it continues to receive a level of protection consistent with this Privacy Policy.

Where required, we rely on contractual obligations, confidentiality agreements, security requirements and other appropriate safeguards when transferring personal information between countries or to our service providers.

International transfers are carried out only where they are necessary to provide the services you have requested, operate the PrimCard platform, maintain security, investigate fraud, comply with legal obligations or fulfil contractual requirements.

Some countries may have privacy laws that differ from those in your country of residence. Where personal information is transferred internationally, PrimCard seeks to ensure that the receiving organisation applies appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, misuse or loss.

PrimCard regularly reviews the security standards of its service providers and expects all providers handling personal information on our behalf to maintain appropriate security controls and confidentiality obligations. Where a service provider no longer satisfies our security, contractual or operational requirements, PrimCard may suspend or terminate the relationship and migrate services to an alternative provider where appropriate.

In certain circumstances, personal information may also be transferred internationally where required by law, regulatory authorities, courts or competent public authorities. Where legally permitted, PrimCard will assess such requests before disclosing personal information and will only disclose information that is reasonably necessary to comply with the applicable legal obligation.

By creating an account and using the PrimCard platform, you acknowledge that your personal information may be processed in multiple jurisdictions where necessary for the operation of the services provided by PrimCard. Regardless of where your personal information is processed, PrimCard remains committed to protecting your information and applying appropriate security standards throughout the lifecycle of your data.

PrimCard does not transfer personal information internationally for the purpose of selling customer data or allowing third parties to carry out independent marketing activities. International transfers are made solely to support the operation, security and lawful provision of the PrimCard platform.

10

How long we keep your information

PrimCard retains personal information only for as long as it is necessary to provide our services, operate the platform, protect our users, resolve disputes, maintain accurate records and comply with applicable legal, contractual and operational obligations.

The length of time that information is retained depends on the type of information involved, the purpose for which it was collected and any legal or contractual requirements that apply to the services provided by PrimCard.

Information relating to your account is generally retained for as long as your account remains active. This allows us to provide continuous access to your wallet, virtual cards, transaction history, account settings and other services available through the PrimCard platform.

If your account is closed, suspended or terminated, certain information may continue to be retained where this is necessary to comply with legal obligations, investigate fraud, resolve disputes, enforce our Terms and Conditions, protect the security of the platform or maintain appropriate business and accounting records.

Financial records, transaction histories, wallet activity, card activity, audit logs and security records may be retained for longer periods where necessary to satisfy regulatory, contractual or operational requirements or to protect the legitimate interests of PrimCard and its users.

Information collected as part of fraud prevention, sanctions screening, risk monitoring, security investigations or account reviews may also be retained for an appropriate period following the closure of an account where this is necessary to investigate suspicious activity, prevent repeated abuse of the platform or respond to legal requests.

Where additional verification information has been provided by a user, such information will only be retained for as long as it is reasonably required for the purpose for which it was collected or to satisfy applicable legal or contractual obligations.

Technical information, system logs, access records and security monitoring data may also be retained for operational, diagnostic and cybersecurity purposes. Such information helps PrimCard investigate incidents, identify attempted attacks, improve platform stability and maintain the security of our infrastructure.

Customer support records, including emails, live chat conversations, support tickets and other communications, may be retained to improve the quality of our services, resolve future enquiries, investigate complaints and protect both PrimCard and our users in the event of disputes.

Where information is no longer required, PrimCard will take reasonable steps to securely delete, anonymise or permanently destroy the information using appropriate technical and organisational measures.

In some circumstances, complete deletion may not be immediately possible because information forms part of encrypted backups, disaster recovery systems or archived security records. Where this occurs, the information will remain protected and will only be retained until the relevant backup or archive reaches the end of its normal retention period.

Users may request the deletion of certain personal information where applicable law provides such a right. PrimCard will assess each request individually and will delete eligible information where there is no overriding legal, contractual, security or operational reason requiring continued retention.

Where PrimCard is required by law, regulation, court order or a competent authority to retain specific information, that information will be retained for the period required by the relevant obligation, even if the user's account has been closed or deleted.

Once the applicable retention period has expired and there is no longer a legitimate reason to retain the information, PrimCard will securely remove or anonymise the information so that it can no longer be linked to an identifiable individual.

11

Your rights

PrimCard believes that users should have clear and reasonable control over their personal information. Subject to applicable laws and the nature of the services provided, you may have certain rights regarding the personal information that PrimCard holds about you.

You may request access to the personal information we hold about you. Where permitted by applicable law, PrimCard will provide information about the categories of personal information we process, the purposes for which it is used and, where appropriate, the third parties with whom it has been shared.

If you believe that any personal information held by PrimCard is inaccurate, incomplete or no longer up to date, you may request that it be corrected. PrimCard will take reasonable steps to verify the information and update our records where appropriate.

You may request the deletion of your personal information where there is no legal, contractual or operational reason requiring us to retain it. Requests for deletion will be assessed individually and may be refused where PrimCard is required to retain information for legal, regulatory, accounting, fraud prevention, security or contractual purposes.

You may request a copy of certain personal information that you have provided to PrimCard, where such a right is available under applicable law. Where technically feasible and legally permitted, we will provide the information in a commonly used electronic format.

Where your personal information is processed on the basis of your consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before consent was withdrawn, nor will it affect any processing carried out on another lawful basis.

You may object to certain types of processing where applicable law grants you that right. PrimCard will consider any such request in accordance with the relevant legal requirements and the legitimate interests of the platform.

You may request that the processing of certain personal information be temporarily restricted while we investigate concerns regarding its accuracy, lawfulness or use. During any period of restriction, PrimCard may continue to retain the information where necessary but may limit further processing where appropriate.

PrimCard will respond to requests relating to your personal information within a reasonable period and, where applicable law requires, within the time limits prescribed by that law.

Before responding to certain requests, we may ask you to verify your identity in order to protect your account and prevent unauthorised disclosure of personal information. Verification requests are intended solely to ensure that personal information is released only to the correct individual. Where identity cannot be reasonably verified, PrimCard may decline or delay a request until sufficient verification has been completed.

Some rights described in this section may not apply in every jurisdiction. In addition, certain requests may be limited where complying with the request would adversely affect the rights of another individual, compromise fraud prevention or security measures, interfere with ongoing investigations or prevent PrimCard from complying with legal or contractual obligations.

Where PrimCard is unable to comply with a request relating to your personal information, we will explain the reason where we are legally permitted to do so.

If you are dissatisfied with the way PrimCard has handled your personal information or responded to a request under this Privacy Policy, we encourage you to contact us first so that we have the opportunity to investigate the matter and attempt to resolve your concerns promptly.

Nothing in this Privacy Policy limits any rights that you may have under applicable data protection laws. Where local legislation provides additional rights or protections, those rights shall apply to the extent required by the relevant law.

12

Changes to this Privacy Policy

PrimCard may update this Privacy Policy from time to time to reflect changes to our services, technology, security practices, business operations, legal obligations or the requirements of our infrastructure and service providers.

As the PrimCard platform continues to develop, new features, products and services may be introduced. Where those changes affect the way we collect, use, process, store or protect personal information, this Privacy Policy may be revised to ensure that it continues to accurately describe our data processing practices.

We may also update this Privacy Policy where changes are required to comply with applicable laws, regulatory requirements, industry standards or contractual obligations with our partners.

Where changes are minor and do not materially affect your rights or the way your personal information is processed, we may update this Privacy Policy by publishing the revised version on the PrimCard website. The revised version will become effective from the date shown at the top of the document unless stated otherwise.

Where we consider that a change materially affects your rights or significantly changes the way your personal information is processed, we may provide additional notice through the PrimCard platform, by email, through account notifications or by any other appropriate communication method before the changes take effect, where reasonably practicable.

The latest version of this Privacy Policy will always be available on the PrimCard website. We encourage users to review this Privacy Policy periodically to remain informed about how PrimCard collects, uses and protects personal information.

Your continued access to or use of the PrimCard platform after an updated Privacy Policy becomes effective constitutes your acknowledgement of the revised Privacy Policy to the extent permitted by applicable law. Where applicable law requires your consent before certain changes can take effect, PrimCard will seek such consent in accordance with the relevant legal requirements before implementing those changes.

Previous versions of this Privacy Policy may be retained by PrimCard for record-keeping, legal, audit and compliance purposes.

13

Contact us

If you have any questions about this Privacy Policy or the way PrimCard collects, uses or protects your personal information, you may contact our support team at any time.

PrimCard aims to respond to privacy-related enquiries promptly and will make reasonable efforts to investigate and resolve any concerns regarding the processing of your personal information.

If you wish to exercise any of your rights under this Privacy Policy, including requesting access to your personal information, correcting inaccurate information, requesting deletion where applicable or making a complaint regarding the processing of your personal information, you should contact us using the contact details available on the PrimCard website or through your registered PrimCard account.

For security reasons, PrimCard may request additional information to verify your identity before responding to requests relating to your personal information. This helps protect your account and prevents personal information from being disclosed to unauthorised persons. Where additional verification is required, the processing of your request may be delayed until your identity has been reasonably confirmed.

PrimCard will review all privacy-related requests and respond within a reasonable period, taking into account the nature and complexity of the request, applicable legal requirements and any information necessary to verify your identity.

If you are dissatisfied with our response or believe that your personal information has not been processed in accordance with applicable law, you may have the right to submit a complaint to the relevant supervisory authority or data protection authority in your country of residence, where such rights are available.

Nothing in this Privacy Policy limits any legal rights or remedies that may be available to you under applicable data protection legislation.

For general enquiries, support requests or questions relating to your PrimCard account, please visit the contact page on the PrimCard website or contact our support team through your registered account.