This Privacy Policy applies to personal data processed by Axente in connection with:

• visits to the Axente website and online communications;

• enquiries, business development and pre-contractual communications;

• onboarding, KYC/KYB, due diligence and ongoing monitoring of prospective and existing clients;

• provision of Axente’s payment, settlement, merchant, FX, digital asset on/off-ramp, safeguarding and related services;

• use of the Axente platform, portals, APIs and other communication channels;

• persons connected with a client, including directors, officers, employees, authorised users, signatories, representatives, beneficial owners, controlling persons, beneficiaries, payees, counterparties, wallet holders and other individuals whose personal data is provided to or processed by Axente.

Axente may process the following categories of personal data, depending on the relationship, service and applicable legal requirements:

3.1 Identification and Contact Data

• name, surname, date of birth, nationality, citizenship, address and country of residence;

• email address, telephone number and business contact details;

• company name, affiliation, role, position, authority and relationship to the relevant client or transaction;

• other contact or identity information provided to Axente.

3.2 KYC/KYB, AML and compliance data

• identity documents and verification data;

• beneficial ownership, control and group-structure information;

• information on directors, officers, authorised representatives, signatories and controlling persons;

• source of funds, source of wealth, business activity, expected transaction profile and supporting documents;

• sanctions, PEP, adverse media, fraud prevention and risk-screening results;

• compliance notes, risk assessments, due diligence and enhanced due diligence records.

3.3 Account, payment and transaction data

• account, ledger, payment, beneficiary, payee, counterparty and settlement information;

• payment instructions, transaction history, references, amounts, currencies, corridors and timestamps;

• refund, dispute, chargeback and reserve-related data;

• merchant, settlement and payment-processing information.

3.4 Digital asset and blockchain-related data

• wallet addresses, wallet verification data and proof-of-control information;

• blockchain transaction hashes, asset type, network, amount and timestamp;

• Travel Rule information, including originator and beneficiary data;

• blockchain analytics, wallet-screening, risk-scoring and transaction-monitoring results;

• hosted wallet provider information where applicable.

3.5 Technical, security and usage data

• IP address, device identifiers, browser type, access logs, API logs, platform usage data and security events;

• login history, authentication data, audit trails and communication metadata;

• technical diagnostics and website or platform interaction data.

3.6 Communications and documents

• emails, platform messages, support requests, call notes, uploaded documents and other communications with Axente.

Axente may process personal data for one or more of the following purposes:

• responding to enquiries and managing communications;

• assessing, onboarding and approving prospective clients;

• performing KYC/KYB, AML/CTF, sanctions, PEP, adverse media, fraud prevention and risk checks;

• providing and administering payment, settlement, merchant, FX, digital asset on/off-ramp, safeguarding and related services;

• executing payment instructions, settlements, refunds, chargebacks, disputes and transaction monitoring;

• verifying wallets, processing Travel Rule information and performing blockchain analytics and wallet screening;

• managing authorised users, platform access, authentication, security and audit logs;

• complying with legal, regulatory, AML/SRO, tax, accounting, audit and reporting obligations;

• preventing fraud, abuse, misuse of services, sanctions evasion, money laundering and terrorist financing;

• enforcing contractual rights, resolving disputes and handling complaints;

• maintaining business records and internal administration;

• improving website, platform functionality, security and operational resilience.

Depending on the context and the applicable law, Axente may process personal data on one or more of the following legal bases:

• compliance with Swiss or international legal obligations, including AML, sanctions, tax, accounting, audit and related obligations;

• performance of pre-contractual steps or contractual measures;

• legitimate interests, including security, fraud prevention, compliance, business operations, governance, service delivery, website and platform administration;

• consent, where consent is required or expressly obtained; and

• compliance with EU GDPR where applicable.

Axente may share personal data and documents where legally permissible and necessary for the purposes described in this Privacy Policy, including with:

• banks, payment institutions, PSPs, correspondent banks, intermediary banks, virtual IBAN providers and payment-rail providers;

• acquirers, alternative payment method providers, card schemes, payment processors, gateway and settlement providers;

• liquidity providers, VASPs, digital asset service providers, wallet infrastructure providers and other Partner Providers;

• SWIFT and other interbank messaging or payment communication networks;

• identity-verification, KYC/KYB, sanctions-screening, PEP-screening, adverse-media, fraud-prevention and transaction-monitoring providers;

• blockchain analytics, wallet-screening and Travel Rule service providers;

• cloud hosting, IT, cybersecurity, API, platform, communications and operational service providers;

• auditors, accountants, legal advisers, compliance advisers, outsourced AML/MLRO providers and professional consultants;

• referral partners or business partners, where necessary for the relevant business relationship and permitted by law;

• Swiss self-regulatory organisations, including VQF, FINMA, MROS, tax authorities, courts, law enforcement, regulators and other competent Swiss or foreign authorities where required or permitted by law.

Some recipients may act as processors on behalf of Axente. Other recipients, including banks, payment institutions, acquirers, card schemes, VASPs, liquidity providers, regulators, authorities and certain compliance or fraud-prevention providers, may act as independent or separate controllers and may process or retain personal data for their own legal, regulatory, compliance, fraud-prevention, risk-management, audit, security, service-integrity, product-improvement, model-improvement, evidentiary or legal-claims purposes.

Axente implements appropriate contractual, due diligence and governance measures where required, but independent or separate controllers remain responsible for their own processing activities.

Axente does not sell personal data.

Personal data may be transferred to, stored in or accessed from countries outside Switzerland, the EU or the EEA, including countries that may not provide a level of data protection equivalent to Swiss or EU/EEA law.

Where required, Axente relies on appropriate safeguards, such as standard contractual clauses, data transfer agreements or other recognised transfer mechanisms. In certain cases, Axente may rely on statutory exceptions, including where the transfer is necessary for the performance of a contract, execution of a payment or transaction instructed by the client, compliance with a legal obligation, establishment or defence of legal claims, or cooperation with competent authorities.

International transfers may occur in particular where banks, payment institutions, correspondent banks, card schemes, liquidity providers, VASPs, Travel Rule providers, blockchain analytics providers, cloud/IT providers, regulators or authorities are located outside Switzerland or the EEA.

Axente retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy and to comply with legal, regulatory, contractual, audit or evidentiary obligations.

For KYC/KYB, AML/CTF, transaction, accounting, contractual and compliance records, retention periods are typically at least ten (10) years after the end of the relevant business relationship or transaction, or longer where required by applicable law, regulatory obligations, disputes, investigations, audits or enforcement of legal rights.

Where personal data has been shared with third-party recipients, their own retention periods may apply. In particular, where a third party processes personal data as an independent or separate controller, Axente may not be able to require deletion or return of all data held by that third party where such data is retained for the third party’s own lawful purposes, including legal, regulatory, audit, security, fraud-prevention, service-integrity or evidentiary purposes.

Axente will, where applicable, instruct processors acting on its behalf to delete or return personal data in accordance with contractual terms and applicable law.

Axente implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, destruction, disclosure, misuse or other unlawful processing.

Access to personal data is restricted to authorised persons on a need-to-know basis, subject to appropriate confidentiality, access-control, governance and security measures.

Axente may record and store platform activity, technical logs, API logs, authentication records, security events and communications for security, fraud prevention, compliance, audit, dispute-resolution and record-keeping purposes, subject to applicable law.

Subject to applicable law, you may have the right to:

• request access to your personal data;

• request correction or update of inaccurate or incomplete data;

• request deletion where legally permissible;

• request restriction of processing;

• object to processing in certain circumstances;

• withdraw consent where processing is based on consent; and

• lodge a complaint with a competent authority.

Requests may be sent privacy@axente.ch. Axente may request information necessary to verify identity before processing a request.

Where a request relates to personal data processed by a third-party recipient acting as an independent or separate controller, Axente may, where appropriate, direct the individual to contact that third party directly or assist in forwarding the request, subject to applicable law and contractual arrangements. Such third-party controllers are responsible for handling rights requests relating to their own controller processing activities.