Privacy Statement

1. Introduction and objective

In its capacity as controller, BlockTech B.V. (hereafter: “BlockTech”) collects and processes personal data to enable itsbusiness objectives and to comply with applicable laws and regulations, such as the General Data ProtectionRegulation1 (GDPR). BlockTech respects the privacy of its staff, business partners, website visitors and everyone elserelated to BlockTech and therefore we strive to protect your personal data, that we collect, adequately. Hence, thePrivacy Policy of BlockTech B.V. (hereafter: “Policy”) describes the different manners in which BlockTech collects,controls, processes and transmits personal data. This Policy includes the following topics:

• Personal data that BlockTech collects;
• How BlockTech collects personal data
• Purpose and lawfulness of processing;
• Purpose and lawfulness of processing of personal data of applicants/candidates;
• Sharing personal data with third parties;
• Transferring personal data to third countries;
• Privacy rights of data subject;
• Retention periods of personal data;
• Handling of questions and/or complaints; and
• Review and update of this Policy

2. Personal data that BlockTech collects

BlockTech can collect and process personal data in order to run its daily business processes in an adequate manner.BlockTech only collects and processes personal data in compliance with applicable laws and regulations. This includes,but is not limited to:

• Personal data of potential candidates (e.g. name, nationality, date of birth);
• Identification details (e.g. print screen of passport, social security number);
• Pre-employment screening information (e.g. statement of conduct);
• Financial and tax information of staff (e.g. bank account details);
• Counterparty information (e.g. company details, due diligence records); and
• Information collected from cookies

3. How BlockTech collects personal data

In principle, BlockTech collects and processes personal data directly from the relevant individual. Nevertheless,BlockTech can use personal data collected and processed from or by third parties, such as, but not limited to:

• Publicly available sources and/or information (e.g. newspapers, internet);
• Pre-employment screening agencies;
• Regulatory authorities; or
• Any other party that has collected and/or processed personal data of and/or from the relevant individual

4. Purpose and lawfulness of processing

BlockTech processes personal data of relevant individuals for various lawful business and/or regulatory purposes. Thesepurposes are, but not limited to:

• Provided consent by relevant individual;
• Compliance with applicable laws and regulations: BlockTech can collect and process personal data in order tocomply with legal obligations (e.g. in accordance with anti-money laundering regulations) and/or to fulfilregulatory requests;
• Performance of contractual obligation(s): when BlockTech enters into an agreement with a business partner orcounterparty, BlockTech can collect and process personal data (e.g. details of the contact person or authorisedsignatory);
• Necessary for the performance of the legitimate interest of BlockTech and/or a third party to e.g. perform itsbusiness activities properly;• administration;
• Statistical and/or historical research; and/or
• Establishing, exercising and/or defending of (possible) legal claimsSpecial categories of personal data3 and/or criminal records4 will only be collected and/or processed by BlockTech if:
• The relevant individual provides consent to the collection and processing of this special personal data;
• The collection and processing is required by applicable law and/or regulations; or
• The collection and processing is in any other way permitted by GDPR.

5. Purpose and lawfulness of processing of personal data of applicants/candidates

BlockTech would like to give special attention to the process of collecting and processing of personal data during therecruitment process. Besides above lawful grounds (see section Purpose and lawfulness of processing), the followinglegitimate business and regulatory purposes apply to the recruitment process:

• To sustain the application process. The following personal data shall be collected and/or processed:
  • contact information such as name;
  • email address;
  • phone number;
  • address;
  • copy of passport;
  • CV;
  • cover letter;
  • educational institution;
  • degree;
  • discipline and grades;
  • assessment results (if applicable);
  • compensation;
  • characteristics of the job; and
  • start date.
• To sustain the personnel administration. The following personal data shall be collected and/or processed:
  • name;
  • email address;
  • phone number;
  • address;
  • date of birth;
  • gender (in accordance with applicable laws and regulations);
  • type of employment contract;
  • payment structure;
  • nationality (in accordance with applicable laws and regulations); and
  • relevant permit (if applicable).
• To administer employee relations and talent management using the following personal data:
  • full name;
  • employee ID;
  • start date;
  • location;
  • department;
  • full-time or part-time status;
  • gender (if permitted by applicable data protection laws and with consent where required);
  • performance rating; and
  • licenses or certifications required to hold the position.
• To fulfil regulatory obligations. The following personal data shall be collected and/or processed: taxinformation, social security information and other information required by applicable laws and regulations.
• To monitor and enforce policies and procedures of BlockTech, such as personal investments.

Personal data during the recruitment process may be collected and processed due to:

• Provided consent by the relevant individual;
• Required by laws and regulation;
• Performance of the contract between employee and employer; and/or
• Legitimate interests to perform its business activities properly.

Special categories of personal data and/or criminal records will only be collected and/or processed by BlockTech if

• The relevant individual provides consent to the collection and processing of this special personal data;
• The collection and processing is required by applicable law and/or regulations; or
• The collection and processing is in any other way permitted by GDPR.

The collection and process of special categories of personal data can be possible, during the pre-employment screening.

6. Sharing personal data with third parties

BlockTech limits the disclosure of personal data to third parties to the minimum required. However, in certain situationsBlockTech may be required to provide personal data to third parties or to other BlockTech entities. To process this dataadequately, BlockTech can use third party processors. Reasons of sharing personal data can be:

• Part of daily operations between different entities of BlockTech around the world;
• In order to fulfil its daily operations regarding e.g. trading venues or counterparties;
• To fulfil legal obligations regarding accountants, auditors etc.;
• Responding to requests of regulatory authorities; and/or
• Recruitment process, e.g. in order to perform a pre-employment screening.

7. Transferring personal data to third
countries

BlockTech may transmits personal data that is collected and/or processed inside the EEA to entities outside the EEA,such as Singapore. In addition, BlockTech entities outside the EEA may process this personal data as well for thepurposes mentioned in this Policy. In case BlockTech has transferred or processed personal data to third countries,BlockTech shall protect this personal data adequately and in accordance with applicable data protection laws andregulations.

8. Privacy rights of data subject

Relevant individuals may have rights regarding their privacy, these may include:

• Right to be informed about the collection of personal data;
• Right of access to the retained personal data;
• Right of rectification of the retained incorrect personal data;
• Right to be forgotten (request of erasing retained personal data);
• Right of data portability;
• Right to object; and/or
• Right to restrict the processing of personal data.

In case you would like to exercise your privacy rights, please send an e-mail to info@block-tech.io, with the title‘exercising privacy rights’. BlockTech will ask for proof of identity and/or any other additional information to verifyyour identity.

BlockTech shall analyse the request and, if reasonable and feasible, execute the request to access, delete, transmit orrestrict the (processing of) personal data. However, BlockTech may decline such requests, based on applicable laws andregulations.

In addition, in certain situations BlockTech is obliged - pursuant to any contractual or legal obligation - to process andprovide personal data of relevant individuals. In such a case, you can be required to provide the relevant personal data.Refusing to provide this data may result in consequences, such as but not limited to termination of the contract and/ornot entering into an agreement.

9. Retention periods of personal data

Within BlockTech, personal data shall be retained in accordance with (i) all applicable laws and regulations, such asGDPR and (ii) the Data Record and Retention Policy of BlockTech. This implies that personal data will no longer beretained than required to achieve its lawful (business) purpose(s) and/or to comply with regulatory obligations. Thespecific retention periods for retaining personal data depends on the mandatory retention periods determined byapplicable laws and regulations. Furthermore, BlockTech may retain personal data in case of a potential law suit and/orfor statistical or historical purposes.

10. Handling of questions and/or complaints

If you have any questions or a complaint regarding this Policy, the practices of this website or any other question and/orcomplaint related to privacy and/or data collection by BlockTech, please contact us via info[at]block-tech[dot]io or via+31(0)202090230.

In case of a received complaint, the Legal and Compliance department of BlockTech will handle the complaint within areasonable time. In addition, the complainant shall be informed by BlockTech - within a reasonable time - about theoutcome of its investigation.

It is also possible to file a complaint externally, with the Dutch Data Protection Authority viawww.autoriteitspersoonsgegevens.nl.

11. Review and update of this Policy

BlockTech reviews this Policy on a periodic basis and if required updates the Policy. The most recent version can befound on our website www.block-tech.io.