Privacy Notice

How Klaro Gate collects, uses, shares, and protects personal information.

1. Scope and who we are

This Privacy Notice (the "Notice") describes how Klaro Gate ("Klaro Gate," "we," "us," or "our") collects, stores, uses, discloses, and protects personal information. Klaro Gate provides a business payment infrastructure platform for crypto payment operations, including payment invoices, payment accounts, payment addresses, payment reporting, settlement workflows, APIs, dashboards and related operational tools.

This Notice applies to the Klaro Gate website and to other Klaro Gate websites, applications, interfaces, and Services on which this Notice appears (collectively, the "Sites").

This Notice applies to personal information. It does not apply to information that is anonymous, aggregated, or deidentified so that it cannot reasonably be linked to an identified or identifiable person. Additional notices may apply in particular jurisdictions or to specific products. If a product-specific notice conflicts with this Notice, the product-specific notice will control for that product.

2. People covered by this Notice

We may process personal information relating to:

• Visitors to our Sites and people who contact us, request a demo, subscribe to communications, or interact with our sales or support teams;
• Businesses, platforms, merchants, marketplaces, fintechs, neobanks, nonprofits, and other organizations that use or evaluate the Services (collectively, "Business Customers");
• Beneficial owners, directors, representatives, administrators, employees, contractors, and other authorized users of Business Customers;
• Individuals who make or receive a crypto payment, receive an invoice or payment address, request a refund, or otherwise interact with a Business Customer through the Services ("End Users");
• Payees or withdrawal recipients, such as employees, contractors, vendors, customers, or partners; and
• Prospective and current vendors, service providers, integration partners, and their personnel.

3. Personal information we collect

The personal information we collect depends on how you interact with Klaro Gate, the Services used, the jurisdiction involved, the risk profile of a transaction or account, and applicable legal requirements. We collect information you provide, information generated through use of the Services, information collected automatically, and information received from Business Customers or third parties.

3.1 Site visitors, demo requests, and support contacts

We may collect:

• Name, business name, job title, country, and professional contact details;
• Email address, phone number, and communication preferences;
• The content of messages, support requests, consultation requests, and other correspondence;
• Account registration and sign-in information, such as email address, password hash, authentication tokens, and security settings; and
• Marketing subscription, engagement, and opt-out information.

3.2 Business Customers and authorized users

To onboard and provide Services to a Business Customer, manage risk, and meet compliance obligations, we may collect:

• Legal and trading names, company registration details, tax identifiers, registered and operating addresses, and business contact details;
• Names, roles, email addresses, phone numbers, and login credentials of authorized users;
• Information about beneficial owners, directors, controllers, and authorized representatives;
• Government-issued identification documents, identification numbers, dates of birth, photographs, proof of address, and, where legally required, biometric verification results;
• Proof of business activity, source-of-funds or source-of-wealth information, recent bank statements, bank account details, and supporting compliance documents;
• Risk, sanctions, politically exposed person, fraud, and identity-verification results; and
• Contracts, service configuration, integration details, billing information, and account administration records.

3.3 Payments, invoices, and End Users

When the Services are used to create or pay an invoice, share a payment address, track a payment, process a refund, or support a related transaction, we may collect:

• Transaction amount, currency or digital asset, invoice number, timestamps, status, confirmations, fees, and related transaction metadata;
• Blockchain network, public wallet address, transaction hash, and other public on-chain data;
• Email address or other contact information provided by the Business Customer or End User;
• Information about goods or services associated with the payment when supplied to Klaro Gate;
• Refund amount, settlement destination, reason, and supporting communications; and
• Fraud, risk, sanctions, or compliance signals associated with the transaction.

A Business Customer determines what information it submits to Klaro Gate and may be independently responsible for providing its own privacy notice to End Users. In some contexts, Klaro Gate acts as a processor or service provider on the Business Customer's instructions; in others, Klaro Gate acts as an independent controller or business for compliance, security, fraud prevention, and operational purposes.

3.4 Payment Accounts, Reporting and Settlement Operations

To operate managed accounts and wallet infrastructure, we may collect or generate:

• Tenant, customer, project, account, and wallet identifiers;
• Public wallet addresses, supported blockchain networks and assets, payment account configuration, and account status;
• Payment reporting information; transaction history; exports; and reconciliation records;
• Settlement instructions, destination addresses, amounts, approval and confirmation records, and status information;
• API keys or tokens, webhook configuration, integration logs, authentication records, and permissions; and
• Security and audit logs associated with account actions and administrative changes.

Sensitive authentication credentials are protected through appropriate security controls and are processed only where necessary to provide and secure the Services. We treat authentication credentials, API secrets, and other security information as confidential and process them only as necessary to operate and secure the Services.

3.5 Payees and withdrawal recipients

Where a Business Customer uses the Services to make a payout or withdrawal, we may collect:

• Name, email address, and other contact details;
• Public wallet address, wallet provider, blockchain network, and digital asset;
• Payment amount, status, history, and reference information; and
• Identification, proof of address, tax, sanctions, or other compliance information where required by law or risk controls.

3.6 Information collected automatically

When you use the Sites or Services, we and our service providers may automatically collect technical and usage information, including:

• IP address, approximate location derived from IP, browser type, device type, operating system, language, time zone, and device or browser identifiers;
• Pages and features viewed, links clicked, referring and exit pages, access dates and times, session duration, and navigation events;
• Login, authentication, API, webhook, error, diagnostic, performance, and security logs; and
• Cookie identifiers, consent choices, and marketing or analytics information where permitted.

3.7 Information from third parties

We may receive information from Business Customers, End Users, public blockchain records, identity-verification providers, sanctions and watchlist providers, fraud-prevention services, analytics providers, integration partners, public databases, financial institutions, professional advisers, and other lawful sources. We may combine this information with information already held by Klaro Gate.

4. Cookies and similar technologies

We may use first- and third-party cookies, pixels, local storage, software development kits, web beacons, and similar technologies (collectively, "cookies") to operate the Sites, remember preferences, maintain security, understand usage, improve performance, and, where permitted, measure marketing effectiveness.

Some cookies are necessary for the Sites to function. Other cookies may require consent, depending on your location. You can manage available choices through the cookie banner or browser settings. Blocking cookies may affect functionality. Further information about our use of cookies and similar technologies is available in our Cookie Policy. Our consent tools are configured to reflect the technologies currently used on our Sites.

5. Why and how we use personal information

We may use personal information to:

• Provide, operate, maintain, and support the Sites and Services;
• Create and administer accounts, authenticate users, manage permissions, and secure access;
• Create and track invoices, payments, balances, payment operations, transactions, refunds, and withdrawals;
• Provide customer support, respond to requests, and communicate service, security, or account information;
• Verify identity and business information, conduct due diligence, assess risk, screen sanctions and watchlists, and prevent fraud or other illegal activity;
• Comply with legal, regulatory, tax, accounting, recordkeeping, reporting, and law-enforcement requirements;
• Enforce agreements, collect fees, resolve disputes, investigate incidents, and establish, exercise, or defend legal claims;
• Monitor reliability, debug errors, analyze usage, develop features, improve user experience, and maintain the quality and security of the Services;
• Perform audits, reconciliation, analytics, research, and business planning;
• Send product updates or marketing communications in accordance with your preferences and applicable law; and
• Support a merger, financing, acquisition, reorganization, asset sale, insolvency, or similar corporate transaction.

6. Consent and other grounds for processing

Where applicable law requires consent or another lawful ground for processing, Klaro Gate relies on one or more of the following, depending on the context:

• Consent: processing based on your tacit, express, or express written consent, as required by the type of information and applicable law;
• Legal relationship: processing necessary to establish, maintain, or perform a contractual or other legal relationship with you or the organization you represent;
• Legal obligation: processing necessary to comply with applicable laws, court orders, regulatory requirements, or lawful requests;
• Permitted business purposes: operating and improving the Services, protecting systems and users, preventing fraud, managing risk, communicating with business contacts, and pursuing or defending legal claims, where allowed by law; and
• Other statutory grounds: processing permitted without consent under applicable law, such as information from lawful public sources, disassociated information, emergencies, or other recognized exceptions.

You may withdraw consent at any time using the procedure described in Sections 11, 13, and 17. Withdrawal does not have retroactive effect and may not apply where processing is required or otherwise permitted by law.

7. How we share personal information

We may disclose personal information to:

• Klaro Gate affiliates and group companies for operations, security, compliance, support, and administration;
• Business Customers and their authorized users when necessary to provide the Services, investigate a payment, process a refund, or address suspected fraud;
• Cloud hosting, infrastructure, identity verification, sanctions screening, fraud prevention, analytics, communications, customer-support, security, accounting, payment, and professional service providers;
• Blockchain networks and network participants when a public transaction is initiated or processed;
• Banks, financial institutions, liquidity or settlement partners, and other counterparties where relevant to a Service;
• Law enforcement, courts, regulators, tax authorities, government agencies, or other parties when required by law or reasonably necessary to protect rights, safety, property, users, or the public;
• A buyer, investor, lender, adviser, or successor in connection with an actual or proposed corporate transaction; and
• Other parties at your direction, with your consent, or as disclosed when the information is collected.

Public blockchain transactions are visible on the relevant blockchain and may be permanently accessible to third parties. Klaro Gate does not control how independent blockchain participants use publicly available transaction information.

8. International data transfers

Klaro Gate and its service providers may process personal information in countries other than the country where you are located. Data-protection laws in those countries may differ. Where required, we use appropriate transfer mechanisms, such as adequacy decisions, standard contractual clauses, contractual safeguards, or another lawful basis. You may contact us for information about applicable safeguards, subject to legal and confidentiality limitations.

9. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Notice, including providing the Services, maintaining security and audit records, resolving disputes, enforcing agreements, and satisfying legal, regulatory, tax, accounting, and reporting requirements. Retention periods vary according to the type of information, relationship, transaction, jurisdiction, and legal obligation.

Identity, due-diligence, transaction, and compliance records may need to be retained for several years after an account is closed or a transaction is completed, including periods required under applicable anti-money-laundering, sanctions, financial-services, or tax laws. When information is no longer required, we delete, anonymize, or securely isolate it in accordance with our retention procedures and legal obligations.

10. How we protect personal information

We use administrative, technical, and physical safeguards designed to protect personal information, including access controls, authentication, logging, monitoring, encryption where appropriate, vendor controls, incident-response procedures, and staff policies. The safeguards used depend on the nature and sensitivity of the information and the risks involved.

No system, network, storage method, or transmission over the internet is completely secure. Although we take reasonable steps to protect personal information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials and notifying us promptly if you suspect unauthorized access.

11. Your privacy rights and choices

Depending on your location and the circumstances, you may have the right to:

• Request access to personal information we hold about you and information about how it is processed;
• Request correction of inaccurate or incomplete information;
• Request deletion of personal information, subject to legal exceptions;
• Request restriction of processing or object to certain processing, including direct marketing;
• Receive certain information in a portable format and, where applicable, have it transmitted to another controller;
• Withdraw consent where processing is based on consent;
• Opt out of certain sales, sharing, targeted advertising, or profiling where applicable; and
• Lodge a complaint with a competent data-protection or consumer-protection authority.

To exercise a right, contact us using the details in Section 17. We may request information needed to verify your identity and authority. We will not unlawfully discriminate against you for exercising a privacy right. Rights may be limited by exceptions, including obligations to retain transaction, compliance, security, or legal records.

12. Marketing, cookies, and communications

You may unsubscribe from marketing emails using the unsubscribe link in the message or by contacting us. Even after opting out of marketing, you may continue to receive transactional, security, legal, or service-related communications.

Where required, non-essential cookies and similar technologies will be used only after the required notice or consent. You may use an available cookie preference tool or browser settings to limit these technologies. Browser-level signals may not have a uniform legal or technical standard, but we will process them where applicable law requires and our systems can recognize them.

13. Mexico and Latin America privacy supplement

This section supplements the rest of the Notice for people in Mexico and Latin America. Data-protection requirements differ by country. If local law gives you stronger rights or imposes stricter duties than this Notice, local law will apply. For Mexico, this section is intended to address the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, or "LFPDPPP"), as amended.

13.1 Data controller in Mexico

For processing subject to Mexican law, the responsible party (responsable) is the Klaro Gate legal entity identified in Section 17. Where Klaro Gate processes personal information only on documented instructions from a Business Customer, the Business Customer may be the responsible party and Klaro Gate may act as a processor (persona encargada).

13.2 Primary and secondary purposes

The primary purposes necessary for our relationship and the Services are:

• Registering and administering accounts and authorized users;
• Providing crypto invoices, payments, managed wallets, payment reporting, transaction tracking, refunds, settlement operations, APIs, and support;
• Verifying identity and business information, preventing fraud, managing risk, and complying with legal and regulatory obligations;
• Securing the Sites and Services, authenticating users, maintaining audit records, and investigating incidents; and
• Billing, reconciliation, accounting, dispute resolution, contract enforcement, and legal claims.

Secondary purposes that are not necessary for the core relationship may include marketing communications, product research, non-essential analytics, and measuring campaign performance. Where Mexican or other applicable law requires a choice, you may refuse or withdraw consent for secondary purposes without affecting the core Services, except where the information is also needed for a primary purpose or legal obligation. To object, contact us under Section 17 or use an available unsubscribe or cookie preference mechanism.

13.3 Financial, patrimonial, and sensitive personal data

Klaro Gate may process financial or patrimonial information, such as bank-account details, transaction records, balances, source-of-funds information, and wallet or payment information. Under Mexican law, express consent may be required for this information unless a statutory exception applies. Klaro Gate may also process sensitive personal data only where necessary for legitimate, concrete purposes and with express written consent when required. Sensitive data will be identified and handled with safeguards appropriate to its nature and risk.

13.4 ARCO rights in Mexico

A person in Mexico may exercise the following ARCO rights, subject to applicable exceptions:

• Access (Acceso): know what personal data Klaro Gate holds and how it is processed;
• Rectification (Rectificación): request correction of inaccurate, incomplete, or outdated data;
• Cancellation (Cancelación): request deletion or blocking of data when legally appropriate; and
• Opposition (Oposición): object to processing for a legitimate reason or to certain automated processing that materially affects the person.

Exercising one ARCO right is not a prerequisite for exercising another. A request may be denied or limited where the requester's identity or authority is not established, Klaro Gate does not hold the data, third-party rights would be harmed, a legal restriction applies, or another ground under applicable law is present.

13.5 How to submit an ARCO request

Submit an ARCO request to [email protected] with the subject "Mexico Privacy / ARCO Request." The request should include:

• Your full name and an email address or other means for receiving notices;
• Documents reasonably necessary to verify your identity and, if applicable, the identity and authority of your representative;
• A clear description of the personal data concerned, except where the request is solely for access;
• The ARCO right you wish to exercise and the action requested;
• For rectification, the requested correction and supporting documentation; and
• Any information that may help us locate the relevant data, such as your account email, customer organization, invoice number, or transaction reference.

For requests governed by the LFPDPPP, Klaro Gate will communicate its determination within a maximum of 20 business days after receiving a complete request. If the request is granted, it will be made effective within the following 15 business days. These periods may be extended once for an equal period when justified by the circumstances. Access will be provided after identity verification and in an available lawful format.

13.6 Revoking consent and limiting use or disclosure

You may request to revoke consent or limit the use or disclosure of personal data by emailing [email protected] with the subject "Mexico Privacy / Revoke or Limit." Please identify the processing or purpose concerned. Revocation is not retroactive and may not be effective where processing is required to perform the Services, comply with law, protect security, complete a transaction, or satisfy another lawful ground.

13.7 Transfers within and outside Mexico

Klaro Gate may transfer personal data to recipients described in Section 7, including recipients outside Mexico. Where Mexican law requires consent for a transfer, we will request it or rely on an applicable legal exception. We will communicate this Notice and the purposes of processing to recipients as required and use contractual or other safeguards appropriate to the transfer.

13.8 Additional rights across Latin America

Residents of other Latin American countries may have rights to information, access, update, rectification, deletion or suppression, objection, revocation of consent, portability, restriction, review of automated decisions, or complaint to a competent authority, depending on local law. You may submit any such request using Section 17. Klaro Gate will apply the response periods and verification requirements required in the relevant jurisdiction.

14. Children's privacy

The Sites and Services are intended for businesses and adults and are not directed to children under 13 or any higher minimum age required by local law. We do not knowingly collect personal information directly from children in violation of applicable law. If you believe a child has provided personal information to us, contact us so that we can investigate and take appropriate action.

15. Third-party services and links

The Sites or Services may link to or integrate with third-party websites, wallets, platforms, blockchain explorers, or services. Their privacy practices are governed by their own notices. Klaro Gate does not control and is not responsible for the privacy, security, or content of independent third parties.

16. Changes to this Notice

We may update this Notice from time to time. We will post the revised version on the relevant Site and update the "Last updated" date. If required by law, we will provide additional notice or obtain consent before a material change takes effect. We encourage you to review this Notice periodically.

17. Contact information

For questions, concerns, or requests relating to privacy or this Notice, contact Klaro Gate using the details below. Please do not send passwords, private keys, seed phrases, or unnecessary identity documents by ordinary email.

If you are in Mexico, you may seek protection of your personal-data rights before the Secretaría Anticorrupción y Buen Gobierno or another competent authority in accordance with applicable law. In another Latin American country, you may also lodge a complaint with the competent national data-protection, consumer-protection, or supervisory authority.