Clapp Privacy Policy

Last Revised: 25.08.2026

1. Who We Are

1.1 This Privacy Policy explains how the companies of the Clapp group collect, use, share and protect your personal data when you use the website https://clapp.finance/, the Clapp mobile application (together, the “Platform”) and the services available through them (the “Services”).

1.2 “Clapp” is a brand name used by several companies. The controller of your personal data depends on the service you use. Where two or more group companies determine the purposes and means of the same processing (for example, group-wide KYC performed once for all Services), they act as joint controllers and have allocated their responsibilities in an intra-group arrangement. You can exercise your rights against any of them through the contact points below.

1.3 The App Operator is the representative in the European Union of the non-EEA controllers listed above for the purposes of Article 27 of the EU General Data Protection Regulation (“GDPR”). You can address any request under the GDPR to the App Operator.

1.4 Data protection contact for the whole group: [email protected].

2. Personal Data We Collect

2.1 Identity and verification data: name, date of birth, nationality, residential address, government-issued identification documents, photographs and short video recordings, biometric identifiers derived from liveness checks, tax identification numbers.

2.2 Contact data: email address, phone number, correspondence with support.

2.3 Financial and transaction data: wallet balances, deposits, withdrawals, trades, savings and credit line activity, card transactions (merchant, amount, currency, date), bank account and IBAN details, source of funds and wealth information.

2.4 Blockchain data: wallet addresses, transaction hashes and related on-chain information, including risk scores produced by blockchain analytics tools.

2.5 Technical and usage data: device identifiers, IP address, operating system, app version, log data, session information, approximate location derived from IP address, and cookie data as described in our Cookie Policy.

2.6 Data from third parties: sanctions, politically exposed person and adverse media screening results, fraud prevention data, credit and risk data, and data from identity verification providers.

2.7 We do not knowingly collect data from persons under 18. If we learn that we hold data of a minor, we will delete the account and the data unless we must retain it by law.

3. Purposes and Legal Bases

3.1 We process your personal data for the following purposes and, where the GDPR or a similar law applies, on the following legal bases:

Providing the Services and performing our contract with you (account management, executing transactions, customer support): performance of a contract.

Identity verification, sanctions screening, transaction monitoring, reporting to financial intelligence units and other AML/CTF obligations: compliance with legal obligations of the relevant controller, including under Canadian, Salvadoran, Hong Kong and EU anti-money laundering laws.

Security, fraud prevention, risk management, enforcement of our terms, and defense of legal claims: our legitimate interests in protecting the Platform, our customers and our business.

Product analytics and service improvement: our legitimate interests in understanding how the Platform is used, based on aggregated or pseudonymized data where possible.

Marketing communications: your consent, or our legitimate interest in sending you information about similar services where permitted by law. You can opt out at any time via the App or the unsubscribe link in each message.

Biometric verification (liveness detection during KYC): your explicit consent, which you give when starting the verification flow. If you do not consent, we cannot open or maintain your account, because we cannot satisfy our legal obligations.

3.2 Automated decisions. Parts of onboarding and monitoring are automated (for example, document checks, sanctions screening, risk scoring). Where an automated decision produces legal or similarly significant effects for you, you may request human review, express your point of view and contest the decision by writing to [email protected]

4.1 We share personal data with: (1) other Clapp group companies, to the extent needed to provide the Services, perform group-wide KYC and comply with law; (2) identity verification and screening providers (currently SumSub); (3) custody infrastructure providers (currently Fireblocks); (4) blockchain analytics providers (currently Crystal Intelligence); (5) the Card Issuer, its processors and the card network (Visa) in connection with the Card program; (6) Partner Financial Institutions providing EUR accounts and payments; (7) cloud hosting and security providers (currently Amazon Web Services and Cloudflare); (8) banking, liquidity and payment partners used to execute your transactions; (9) professional advisers and auditors; (10) courts, regulators, tax authorities, financial intelligence units and law enforcement, where required by law; and (11) a purchaser or successor in the event of a corporate transaction, subject to this Policy.

4.2 We do not sell your personal data, and we do not share it with third parties for their own direct marketing.

5. International Transfers

5.1 Because the Clapp group operates from several countries, your data will be transferred between group companies and service providers located outside your country, including outside the EEA and the United Kingdom.

5.2 Where the GDPR applies, we rely on adequacy decisions of the European Commission where available and otherwise on the European Commission’s Standard Contractual Clauses, supplemented by technical and organizational measures. A copy of the relevant safeguards can be requested at [email protected].

6. Retention

6.1 We keep personal data for as long as your account is active and afterwards for as long as required by law. As a rule: KYC and transaction records are kept for at least five years after the end of the business relationship or the transaction, as required by applicable anti-money laundering laws (and up to seven years where local law requires); records relevant to disputes are kept until the dispute is resolved and limitation periods have expired; marketing preferences are kept until you opt out. When retention periods expire, data is deleted or irreversibly anonymized.

7. Your Rights

7.1 Subject to applicable law, you have the right to: access your data and obtain a copy; rectify inaccurate data; erase data; restrict processing; object to processing based on legitimate interests, including profiling; receive your data in a portable format; withdraw consent at any time, without affecting prior processing; and not be subject to solely automated decisions with legal effect, except as permitted by law.

7.2 These rights are limited where we must retain or process data to comply with legal obligations, including AML laws. Where we refuse a request on this basis, we will tell you so, unless the law prohibits it.

7.3 To exercise your rights, write to [email protected]. We respond within one month, extendable by two further months for complex requests. Verification of your identity will be required.

7.4 You have the right to lodge a complaint with a supervisory authority. In the EU, you may complain to the supervisory authority of your habitual residence or place of work, or to the Czech Office for Personal Data Protection (ÚOOÚ), which is the authority of the group’s EU establishment. In Canada, you may complain to the Office of the Privacy Commissioner of Canada. In Hong Kong, to the Privacy Commissioner for Personal Data.

8. Country-Specific Notices

8.1 EEA and UK: the GDPR and the UK GDPR apply to processing connected to our EU establishment and to the offering of services to persons in the EEA and the UK. The legal bases in Section 3 apply.

8.2 Canada: Clapp Finance Limited handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). By using the Services you consent to the collection, use and disclosure of your personal information as described in this Policy, to the extent consent is the applicable basis.

8.3 Hong Kong: personal data processed in the Card program is handled in accordance with the Personal Data (Privacy) Ordinance (Cap. 486). Card data is shared with the Card Issuer, its processors and the card network as described in the Card Terms. We will not use your card transaction data for direct marketing without your separate consent.

8.4 El Salvador: Clapp S.A. de C.V. processes data in accordance with applicable Salvadoran law and the regulations of the Central Reserve Bank and the Superintendence of the Financial System applicable to Bitcoin Service Providers.

9. Security

9.1 We protect personal data with encryption in transit and at rest, access controls, network security, logging and monitoring, staff confidentiality obligations and vendor due diligence. In the event of a personal data breach likely to result in a risk to your rights, we will notify the competent authority and, where required, you, without undue delay.

10. Cookies

10.1 The Website and the App use cookies and similar technologies as described in our Cookie Policy, which explains the categories used, their purposes and how you can manage them.

11. Changes and Contact

11.1 We may update this Policy from time to time. Material changes will be announced through the App or by email before they take effect. The “Last Revised” date shows the current version.

11.2 Questions and requests: [email protected].

11.3 General support: [email protected].