Privacy Policy (Global Account - ARQ)

DA GLOBAL LIMITED — PRIVACY POLICY

DA Global Limited ("DA Global," "Company," "we," "us," or "our") is dedicated to protecting the privacy of our customers and stakeholders. We take our data protection responsibilities very seriously. This Privacy Policy explains what Personal Data we collect, how we use it, how long we keep it, and outlines your rights as a data subject.

If you are a customer or user of our services, this Privacy Policy applies alongside our Terms and Conditions and any other agreements we may have with you. We may also issue separate policies for other stakeholders, including employees, connected persons, and business partners.

If you are not a customer or user of our services but are visiting our website, this Privacy Policy applies to you in conjunction with our Cookie Policy. If you do not agree with these policies, you should stop using our website immediately. Our website is designed so that you can browse and use it without providing Personal Data, except for limited information collected through cookies. This Policy should therefore be read together with our Cookie Policy, which explains how we use cookies. You can access the Cookie Policy at www.arqfinance.com.

As part of your registration process, we may request certain information from you, such as your name, address, tax information, your other user credentials and additional user information, as well as additional information in order to verify your identity (your "User Credentials"). This may require us to request documents to include, but not be limited to, certified copies of documents verifying: (i) your identity; (ii) your address; (iii) the source of your wealth; (iv) the source of funds used for the purposes of using our services; and (v) any other documents or data from which you can be identified. Your User Credentials, additional user information as well as the items referred to in sub-paragraphs (i) to (v) of this paragraph shall hereinafter be referred to as your "Personal Data".

Personal Data includes any information relating to you as an identified or identifiable natural person ("Data Subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an online identifier or to one or more factors specific to your physical, physiological, genetic, mental, economic, cultural or social identity. For the avoidance of doubt, Personal Data does not include data from which you cannot be identified (referred to simply as data, non-personal data, anonymous data, or de-identified data).

In this Policy, "processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1. About DA Global Limited

DA Global Limited is a company incorporated and registered in Gibraltar with registered number 124969, which is registered by the Gibraltar Financial Services Commission as a Virtual Asset Arrangement Provider under the Proceeds of Crime Act 2015 (Relevant Financial Business) Regulations 2021, having its registered address at Madison Building, Midtown, Queensway, Gibraltar GX11 1AA, Gibraltar.

If DA Global Limited forms part of a wider group, Personal Data may be shared within that group under appropriate safeguards as described in this Policy.

Navigating this Privacy Policy — In this Policy, you will find: Your Data and Blockchain Technology; Ways We Gather Information from You; Categories of Information We Collect; How We Use Your Data; When and How We Share Your Data; Automated Processing and Decisions; How Long We Retain Your Data; Safeguards and Security Practices; Your Rights Over Your Data (access, correction, deletion, restriction, transfer, objection, withdrawal of consent, lodging complaints); Getting in Touch and Additional Details.

2. Your Data and Blockchain Technology

Blockchain technology, also referred to as distributed ledger technology ("DLT"), may be used in connection with our products and services. A blockchain is a decentralized system that records data in linked packages called "blocks." These blocks are connected in chronological order, making the data extremely difficult to alter once it has been recorded. Because the ledger is distributed globally across multiple "nodes" (which typically replicate the ledger), there is no single individual or organization managing the system, nor is there a central location where it is stored.

By design, blockchain records are immutable, meaning they cannot be changed or deleted. This characteristic may limit your ability to exercise certain data rights — such as the right to erasure ("right to be forgotten"), the right to rectification, or the right to restrict or object to processing of your personal data. While some smart contracts can revoke access rights or make certain content less visible, the data itself is generally not deleted.

In certain situations, it may be necessary for us to record specific personal data — such as your cryptographic wallet address — on one or more blockchains to fulfill our contractual obligations to you. This may occur, for example, through the use of smart contracts, which may require you to authorize transactions using the private keys of your wallet.

Ultimately, decisions such as (i) whether to transact on a blockchain using your wallet address, and (ii) whether to share your wallet's public key with others (including us), rest with you. If you want to ensure that your privacy rights remain fully protected, you should avoid transacting on blockchains, as certain rights may not be available or enforceable by you or by us. In particular, blockchains are public, and any personal data recorded on them may become permanently and publicly accessible. Your information may also be written on other blockchains depending on the network(s) you use.

3. Ways We Gather Information from You

We collect information about you when you:

  • use our applications (including both web and mobile versions);

  • contact us through the applications or by other forms of direct electronic communication;

  • engage with us or make use of our services;

  • enter into an agreement with us (for example, to access or use our services);

  • provide instructions regarding your account with us;

  • establish any other form of relationship with us or otherwise interact with us or our services;

    and/or

  • authorize us to request information about you from third parties — whether financial or non-financial entities — that are legally permitted to share such information, regardless of whether they act as data controllers, processors, or joint controllers.

We may also automatically collect certain information when you use our applications, as described below.

4. Categories of Information We Collect

The personal information we collect may include: your name, address, email address, phone number, date of birth, nationality, identification documents (such as ID card or passport), tax identification number and/or other government-issued identification numbers, employment or business details, financial information (including salary, income, and employer details), source of income, geolocation data, device information, cryptographic wallet address, biometric data (where permitted by law and with your explicit consent, if required), electronic signature, any public keys you share with us, communications, 2FA reset codes, names of family beneficiaries, details of financial transactions and operations conducted through other financial institutions, information on how you use our website or applications, and any other data required by applicable laws.

We may also request proof of identity, such as a copy of your passport, driver's license, proof of residence or income, or other relevant identification documents issued by a jurisdiction that is not prohibited.

We are required to collect this information to comply with anti-money laundering (AML) and counter-terrorist financing (CTF) laws and regulations, and to help detect, prevent, and report any suspicious activity.

5. How We Use Your Data

We may collect technical and usage information such as: the domain type used to access the Internet, your assigned IP address, geolocation data (where permitted), login credentials, timestamps of access to our applications, traffic logs, API interactions, pages viewed, device identifiers, browser type, operating system or platform, search engines and keywords used to locate the applications, as well as other comparable data required to facilitate communication with our services.

You consent to the collection of geolocation information for the purpose of verifying the legitimacy of transactions or new device sessions.

6. When We Share Your Data

When you carry out transactions in supported virtual currencies, certain details may be recorded on the corresponding blockchain(s), including:

  • the wallet address from which you transfer funds to us (where applicable);

  • the value of virtual currency you provide as payment (where applicable);

  • the wallet address to which we transfer virtual currency to you (where applicable); and/or

  • the value of virtual currency we send to you.

7. How We Share Your Data

We process your personal data for the following purposes:

Service delivery and account management

  • to supply the products, services, or information you request from us;

  • to execute and finalize transactions you initiate with us;

  • to recover any amounts you owe;

  • to fulfill our contractual commitments to you;

  • to comply with legal and regulatory requirements; and

  • to grant rewards, incentives, or other benefits.

Service Enhancement — We may use your information in order to:

  • optimize how content is displayed within our applications for your experience;

  • manage and operate our applications, including internal functions such as troubleshooting, analytics, testing,

    research, statistics, and surveys;

  • reach out to you for customer support or other lawful business purposes;

  • inform you of updates or modifications to our services; and

  • protect the integrity, safety, and security of our website and services.

Marketing — We may use your personal data in order to:

  • share details about products or services — offered by us or by selected third parties — that are comparable to

    those you already use or have expressed interest in;

  • send you marketing communications, including newsletters and updates; and

  • reach out to you for promotional activities, including special offers, campaigns, or contests.

If you do not want your personal information to be used for marketing purposes, please contact us using the details below or use any available unsubscribe mechanism.

8. How We Share Your Information

Why and when we share your information — We may disclose your personal data to third parties (including other companies within our corporate group) where such disclosure is:

  • necessary

    to fulfill a contractual obligation

    with you or on our behalf; or

  • required under applicable laws,

    regulations, or legal proceedings.

In addition, we may be legally compelled by courts, regulators, or other competent authorities to provide certain information about you or your relationship with us. We may also share your data when it is necessary to establish, exercise, or defend our legal rights.

Your personal data may be shared with and processed by us, other entities within our corporate group (including subsidiaries and affiliates), and trusted third parties such as agents, vendors, consultants, or service providers acting on our behalf. These may include outsourced service partners, legal advisers, financial institutions, cloud hosting providers, analytics companies, identity verification services, sanctions and PEP screening providers, and fraud prevention specialists.

Such third parties are granted access to your personal data only to the extent necessary to perform the contracted services or to comply with legal obligations. They are not authorized to use your information for their own purposes and must process it strictly in line with our instructions. We also require them to apply security safeguards consistent with this Privacy Policy and applicable law.

In some cases, we may share limited personal data with third parties engaged to provide advertising or marketing services, whether located domestically or internationally. Any such sharing will be restricted to the minimum data necessary and will include appropriate security measures, such as encryption. Sensitive personal data under our protection will never be disclosed without a valid legal basis.

We may also transfer your personal data to third parties in the event of a sale, merger, restructuring, or reorganisation of our business or assets. Additionally, we may be obliged to disclose or share your personal data in order to meet legal or regulatory requirements. In all such circumstances, we will take steps to ensure your privacy rights remain safeguarded.

Transfers of Your Information Outside the EEA/UK — Some of our business partners, service providers, agents, subsidiaries, affiliates, subcontractors, or other associated organisations may be based outside the European Economic Area (EEA) and/or the United Kingdom. Such transfers are often referred to as "third-country transfers." We may share your personal data with these parties when we have a valid legal basis to do so — for example, to provide our services or because we rely on service providers located outside the EEA/UK.

Whenever your information is transferred internationally, we take steps to ensure your privacy rights remain protected in line with this Policy. If the country in question has not been deemed by the European Commission or the UK Government to provide adequate protection, we may implement safeguards such as standard contractual clauses, international data transfer agreements/addenda, or other lawful transfer mechanisms. In certain situations, we may ask for your explicit consent before making a third-country transfer. Where this applies, we will explain in writing why the transfer is necessary, what your rights are, and how you may withdraw consent at any time (including the consequences of withdrawal).

Please note, however, that when interacting with a blockchain — as described above — any personal data recorded on it may be stored and transferred globally, since blockchains operate as decentralized public networks.

9. Automated Processing and Decisions

We do not rely on automated decision-making (including profiling) that has legal consequences for you or otherwise produces a similarly significant impact. However, we may carry out risk profiling of clients where required to comply with anti-money laundering and sanctions regulations. In addition, certain third-party providers may employ automated systems for purposes such as fraud prevention or identity verification. Please note that we are not responsible for the privacy practices of such third parties, and we encourage you to review their privacy policies.

10. How Long We Retain Your Data

We retain your information only for as long as is necessary for the purposes for which we process it, as set out in this Policy. Records can be held on a variety of media (physical or electronic) formats. Retention periods are determined based on the type and nature of the record and on legal or regulatory requirements that apply to those records.

Typically, personal data collected pursuant to our legal obligations (such as AML/CTF) is retained for 10 years. Where personal data is collected pursuant to a contract or prior to entering into a contract, it is typically retained for 5 years after the termination of the contract pursuant to our legitimate interests in defending any legal claims which may be brought against us.

We may retain your personal data for a longer period where such retention is necessary for compliance with a legal obligation to which we are subject, in order to protect your vital interests or the vital interests of another natural person, or where we have a legitimate interest to do so.

11. Safeguards and Security Practices

We implement physical, technical, and administrative safeguards designed to protect your information from accidental loss, unauthorized access, misuse, alteration, or disclosure. Significant precautions have been adopted to maintain the confidentiality and integrity of your data.

Access to your personal information is restricted to employees, contractors, agents, and third parties who require it for legitimate business purposes. Such individuals may only handle your data in accordance with our instructions and are bound by confidentiality and data protection obligations.

We have also established procedures for responding to suspected personal data breaches. Where required by law, we will notify both you and the relevant supervisory authority of any breach that may compromise your information.

12. Your Rights Over Your Data

Depending on the laws that apply to you — including the EU GDPR, UK GDPR, and/or Gibraltar GDPR — you may be entitled to exercise certain data protection rights. A summary of these rights is set out below. For further details, you should refer to the website of the supervisory authority responsible for data protection in your jurisdiction.

a. Right to information and access — You have a right to be informed about the processing of your Personal Data. You also have a right to access information we hold about you. To protect your Personal Data, we follow set storage and disclosure procedures and will require proof of identity from you prior to disclosing such information. You can exercise this right at any time by contacting us using the details in Getting in Touch and Additional Details.

b. Right to rectification — You have the right to have inaccurate personal information about you rectified and incomplete information completed. You may also request that we restrict the processing of that information while we verify accuracy.

c. Right to erasure ("right to be forgotten") — You have the general right to request the erasure of your personal information in the following circumstances: the personal information is no longer necessary for the purpose for which it was collected; you withdraw your consent to consent-based processing and no other legal justification applies; you object to processing for direct marketing purposes; we unlawfully processed your personal information; and erasure is required to comply with a legal obligation that applies to us.

We will comply with an erasure request without undue delay unless continued retention is necessary for: exercising the right of freedom of expression and information; compliance with a legal obligation; the performance of a task carried out in the public interest; archiving in the public interest, scientific or historical research, or statistical purposes under certain circumstances; and/or the establishment, exercise, or defence of legal claims.

Blockchain limitation: when interacting with a blockchain we may not be able to ensure that personal data already written to the blockchain is deleted. In these circumstances we will ensure that all personal data held by us off-chain is permanently deleted, subject to applicable law.

d. Right to restrict processing and right to object to processing — You may request that we restrict processing of your personal information, for example where you contest its accuracy, where processing is unlawful and you prefer restriction over erasure, or where we no longer need the information but you require it for legal claims. You may also object to certain processing, including processing based on our legitimate interests and direct marketing.

Blockchain limitation: as a public decentralized network, we will likely not be able to prevent external parties from processing any personal data that has been written onto a blockchain.

e. Right to data portability — Where the legal basis for our processing is your consent or the processing is necessary for the performance of a contract (or steps prior to a contract), you may have a right to receive the personal information you provided to us in a structured, commonly used and machine-readable format, or ask us to send it to another controller.

f. Rights related to automated decision-making — Where any automated decision-making takes place, you have the right to express your point of view, to contest the decision, and to request human review.

g. Right to object to direct marketing ("opting out") — You may opt out of direct marketing at any time.

h. Right to withdraw consent — Where the legal basis for processing your personal information is your consent, you have the right to withdraw that consent at any time by contacting us using the details below.

i. Raising a complaint with us — If you wish to raise a complaint on how we have handled your Personal Data, you can contact us using the details below.

j. Right to lodge a complaint with a supervisory authority — If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved to your satisfaction, you are entitled to make a complaint to the relevant supervisory authority:

Gibraltar Information Commissioner Gibraltar Regulatory Authority 2nd Floor, Eurotowers 4 1 Europort Road Gibraltar Email: info@gra.gi Phone: (+350) 200 74636 Fax: (+350) 200 72166

You also have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, place of work, or place of the alleged infringement.

Getting in Touch and Additional Details

We are committed to complying with applicable data protection laws and helping our users have visibility and control over their personal data. To exercise any of your rights set out in this Policy, or if you have any questions regarding this Policy or generally about the way we handle your Personal Data, please contact us at: privacy@arqfinance.com.

Updated on October 5, 2026

We may update this Policy from time to time. We will notify you of material changes by posting the updated Policy on our website and, where appropriate, by other means. Where required by law, we will obtain your consent to material changes.