Privacy Notice — CryptoBazar

Last updated: 19 December 2025

Effective date: 19 December 2025

CryptoBazar (“CryptoBazar”, “we”, “us”) is committed to protecting the privacy of our customers, business users, service providers and website and application users. We take our data protection responsibilities seriously and process personal data in accordance with applicable data protection laws and regulations in Iraq and the Kurdistan Region of Iraq (KRG), and we apply recognised privacy and security principles and controls appropriate for a custodial digital asset platform.

This Privacy Notice explains how we collect, use, share and protect personal data when you access or use the CryptoBazar websites, applications, APIs and related services (collectively, the “Platform” and “Services”). It also explains your rights and how you can exercise them.

Important note (Custodial)

CryptoBazar provides custodial digital asset services. Digital assets held through the Platform are safeguarded in custodial accounts administered by CryptoBazar, either directly or through appointed third-party custody infrastructure providers acting on CryptoBazar’s behalf. As part of providing custodial services, CryptoBazar processes personal data in connection with account administration, transaction processing, security, regulatory compliance and customer support.

This Privacy Notice does not apply to third-party websites or services that are not operated by CryptoBazar and that you may access via links or integrations on the Platform. Such third parties are responsible for their own privacy practices.

If you have questions about this Privacy Notice or wish to exercise your rights, please contact us at [email protected].

1. Who does this Privacy Notice apply to?

This Privacy Notice applies to personal data processing carried out by CryptoBazar in connection with the Services, including:

• Customers / Users: individuals and business users who register for or use CryptoBazar Services
• Website / App Users: individuals browsing or interacting with the Platform
• Business Contacts: representatives, directors, beneficial owners and authorised users of corporate customers
• Vendors and Service Providers: individuals working for suppliers, contractors and partners
• Event Attendees (if applicable): individuals participating in CryptoBazar events or meetings
• Any other individual where this Privacy Notice is referenced as applying

This Privacy Notice does not apply to job applicants or employees, who are covered by separate notices where required.

2. Who is responsible for your personal data?

The “data controller” is the entity responsible for determining the purposes and means of processing personal data.

Data Controller: CryptoBazar

Primary location: Erbil, Kurdistan Region of Iraq (KRG)

Contact: [email protected]

CryptoBazar acts as data controller for personal data processed in connection with the provision of custodial digital asset services, platform access, regulatory compliance and related business operations.

Where CryptoBazar engages third-party service providers (including custody infrastructure providers, identity verification vendors and security providers), such parties act either as processors on our instructions or as independent controllers, depending on the context. Where they act as independent controllers, their own privacy notices apply.

3. What personal data do we collect and process?

“Personal data” means information relating to an identified or identifiable natural person. We collect personal data in the following ways:

A. Data you provide to us

Depending on the Services used, this may include:

(i) Identification and contact data (individual users)

• Full name
• Email address and phone number
• Date of birth
• Address and country of residence
• Nationality (where required for compliance)

(ii) Business and corporate data

• Company name and registration details
• Role or title, corporate contact details
• Authorised user information
• Beneficial owner, director and signatory details where required by AML/KYC obligations

(iii) Verification and compliance data (KYC / AML)

• Government-issued identification documents
• Proof of address or residency
• Selfie or video verification
• Sanctions and PEP screening results
• Source of funds or source of wealth information (where required)

(iv) Support and communications

• Customer support communications
• Emails, chat history and service requests
• Call recordings (where applicable)
• Logs or screenshots voluntarily provided for troubleshooting or security

(v) Preferences and settings

• Language and notification preferences
• Marketing preferences

Custodial note: CryptoBazar does not request users to share private keys or recovery phrases directly. However, as a custodial service provider, CryptoBazar or appointed custody infrastructure providers administer cryptographic access mechanisms necessary to safeguard and process transactions involving custodial assets, in accordance with applicable law and security standards.

B. Data we collect automatically

When you use the Platform, we may collect:

• Device and technical data (device type, OS, browser, app version)
• Network data (IP address, approximate location inferred from IP where permitted)
• Usage data (pages visited, session activity, feature usage)
• Security and fraud-prevention data (authentication events, suspicious activity indicators)
• Cookies and similar technologies (see Section 7)

C. Data obtained from third parties and public sources

Where permitted by law and necessary, we may obtain personal data from:

• Identity verification and AML/KYC providers
• Sanctions, PEP and adverse media databases
• Blockchain analytics providers analysing public blockchain data
• Payment or banking partners (where fiat services are used)
• Corporate and public registries

4. Why do we process personal data and what legal bases apply?

We process personal data only where a lawful basis exists under applicable data protection laws. Depending on the context, this may include:

• Contract / service necessity – to provide Services and manage custodial accounts
• Legal obligation – AML/CTF compliance, recordkeeping and reporting
• Legitimate interests – security, fraud prevention, service improvement and operational integrity
• Consent – marketing communications and non-essential cookies where required

We process personal data to:

• Create and administer custodial accounts
• Safeguard and process transactions involving custodial digital assets
• Perform KYC/AML checks and ongoing monitoring
• Provide customer support
• Secure the Platform and prevent fraud
• Comply with legal and regulatory obligations

Failure to provide required data may result in restricted or unavailable Services.

5. Automated decisions, profiling and AI-assisted processing

We may use automated and AI-assisted tools to help detect fraud, protect custodial accounts, perform compliance screening and ensure platform security. Where appropriate or required by applicable law, we apply safeguards, provide transparency and enable human review.

6. Can children use CryptoBazar Services?

CryptoBazar Services are intended only for individuals aged 18 or older. We do not knowingly collect personal data from minors and will take appropriate action if such data is identified.

7. Cookies and similar technologies

We use cookies and similar technologies to support the operation and security of a custodial digital asset platform, including to:

• authenticate users and protect custodial accounts
• maintain secure sessions
• remember preferences
• analyse usage and improve performance
• measure marketing effectiveness where permitted

Certain cookies are strictly necessary for security and cannot be disabled without affecting core Services. You may manage non-essential cookies through browser or platform settings.

8. How and why we share personal data

We may share personal data with:

• Service providers (processors): hosting, infrastructure, custody technology, AML/KYC, security and analytics vendors
• Independent controllers: banks, payment institutions, compliance service providers, or third-party platforms you choose to connect to
• Custody infrastructure providers: supporting CryptoBazar’s custodial services under contractual and regulatory safeguards
• Authorities: where required by law or to protect legal rights
• Business partners: in the event of mergers, acquisitions or restructuring

9. International transfers

CryptoBazar is based in Erbil, Kurdistan Region of Iraq (KRG). In connection with custodial services, security operations and the use of international service providers, your personal data may be processed in or transferred to jurisdictions outside Iraq/KRG.

Where required, we implement appropriate safeguards designed to protect personal data during cross-border transfers, including contractual, organisational and technical measures, consistent with applicable legal requirements and recognised security standards.

10. Contact information

If you have questions or concerns about this Privacy Notice or wish to exercise your rights, please contact:

CryptoBazar

Erbil, Kurdistan Region of Iraq (KRG)

Email: [email protected]