1. Purpose and Legal Status

This Privacy & Data Protection Notice (the "Privacy Notice") explains how personal data is collected, used, stored, shared, and protected in connection with the services provided within the Polar Tensor™ group.

This Privacy Notice is provided in accordance with applicable data protection laws, including, where relevant:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);
• applicable EU Member State data protection laws;
• U.S. federal and state privacy laws; and
• other applicable international data protection standards.

This Privacy Notice must be read together with the applicable customer agreements and entity-specific disclosures.

2. Data Controllers and Scope

Depending on your residency and the services used, personal data is processed by one or more of the following entities acting as independent data controllers within their respective scopes:

• Polar Tensor™ US LLC – U.S. and non-EU client onboarding, custody, and compliance
• Polar Tensor™ Europe SP ZOO – EU client onboarding, custody, and compliance
• Polar MSB Inc. – payment services and fiat on-/off-ramping
• Polar Tensor™ Corp. – technical execution and platform operations (limited data access)

Each entity processes personal data only within the scope of its legal and operational role.

3. Categories of Personal Data

The following categories of personal data may be processed, as applicable:

• identification data (name, date of birth, nationality);
• contact information (email address, phone number);
• account and onboarding information;
• KYC and AML verification data (identity documents, liveness checks);
• transaction and activity data;
• technical data (IP address, device identifiers, logs);
• communications and support records.

Sensitive data is processed only where strictly necessary and permitted by law.

4. Purposes of Processing

Personal data is processed for the following lawful purposes:

• client onboarding and account administration;
• identity verification and compliance with AML/CFT and sanctions laws;
• provision and operation of services;
• transaction processing and record-keeping;
• security, fraud prevention, and system integrity;
• regulatory reporting and legal obligations; and
• customer support and communications.

Data is not processed for automated decision-making that produces legal or similarly significant effects without appropriate safeguards.

5. Legal Bases for Processing

Processing is carried out on one or more of the following legal bases, as applicable:

• performance of a contract;
• compliance with legal and regulatory obligations;
• legitimate interests (including security and fraud prevention);
• consent, where required by law.

Where consent is relied upon, it may be withdrawn at any time, subject to legal and contractual limitations.

6. Data Sharing and Recipients

Personal data may be shared, where necessary and lawful, with:

• group entities acting within their defined roles;
• regulated service providers (e.g., KYC vendors, payment processors);
• execution venues and infrastructure providers (limited to technical necessity);
• auditors, legal advisers, and regulators where required by law.

Data is not sold to third parties.

7. International Data Transfers

Where personal data is transferred outside the jurisdiction of collection, appropriate safeguards are applied, including:

• adequacy decisions;
• standard contractual clauses; or
• other lawful transfer mechanisms.

Transfers are limited to what is necessary for operational and compliance purposes.

8. Data Retention

Personal data is retained only for as long as necessary to:

• fulfil contractual obligations;
• comply with legal and regulatory requirements; and
• resolve disputes or enforce rights.

Retention periods vary depending on data type and applicable law.

9. Data Security

Appropriate technical and organisational measures are implemented to protect personal data against:

• unauthorised access;
• loss or destruction;
• alteration; and
• misuse.

No system can be guaranteed to be fully secure, but reasonable safeguards are maintained in accordance with industry standards.

10. Data Subject Rights

Subject to applicable law, individuals may have the right to:

• access their personal data;
• request correction or deletion;
• restrict or object to processing;
• request data portability; and
• lodge a complaint with a supervisory authority.

Requests may be subject to verification and legal limitations.

11. Cookies and Tracking

Websites may use cookies or similar technologies for:

• security and functionality;
• analytics and performance monitoring; and
• user experience optimisation.

Where required, consent mechanisms are provided.

12. No Waiver of Regulatory Obligations

Nothing in this Privacy Notice limits or excludes rights or obligations imposed by mandatory data protection laws.

13. Amendments

This Privacy Notice may be updated from time to time to reflect legal, regulatory, or operational changes.

The most current version will be made available on the relevant websites.