This Privacy Policy (“Policy”) describes how TRUEZONE Inc. (“TRUEZONE,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with the platform. This Policy is applicable to Customers who collect personal information from their Applicants through TRUEZONE’s services.

1. Scope and Applicability This Policy applies to personal information collected by our Customers from their Applicants, which includes individuals whose information is processed in connection with the use of TRUEZONE’s platform. This Policy is applicable to all Customers, regardless of their geographical location, including but not limited to those in the EU, California, and other states in the United States. This ensures a comprehensive understanding of data processing practices for all users.

In addition, this Policy considers applicable regulations in various jurisdictions, including but not limited to:

European Union (GDPR): Governs the collection, processing, and storage of personal data of individuals in the EU, providing them with specific rights over their data. United Kingdom (UK GDPR): Governs the collection, processing, and storage of personal data of individuals in the UK, providing them with specific rights over their data. California Consumer Privacy Act (CCPA): Governs the collection and use of personal information of California residents. Virginia Consumer Data Protection Act (VCDPA): Establishes rights and responsibilities regarding personal data for Virginia residents. Colorado Privacy Act (CPA): Provides privacy rights to residents of Colorado regarding their personal data. Connecticut Data Privacy Act (CTDPA): Grants Connecticut residents rights over their personal data and establishes obligations for data controllers. New York Privacy Act (NYPA): Aims to provide comprehensive data privacy rights to New York residents.

2. Definitions Customer: The legal entity or individual that utilizes TRUEZONE’s services and collects personal information from Applicants. Applicant: Any individual whose personal information is collected by a Customer. Personal Information: Any data that relates to an identified or identifiable individual, including but not limited to names, contact information, identification numbers, and other sensitive data. Platform: https://truekyc.io/

3. Data Collection and Use TRUEZONE does not collect personal information directly from Applicants. Instead, Customers collect their Applicants’ personal information by using the platform, including but not limited to:

• Name, Surname
• Address
• Phone number
• Email
• National ID
• Driving License
• Student ID
• Other information and documentation requested by the Customer

TRUEZONE’s platform assists Customers in collecting and managing Applicants’ KYC (Know Your Customer), KYB (Know Your Business), and transaction monitoring services.

4. Purpose of Processing The personal information collected may be used for the following purposes: (i) To facilitate the KYC and KYB processes. (ii) To verify the identity of Applicants. (iii) To comply with legal obligations. (iv) To improve the TRUEZONE platform and user experience.

5. Legal Basis for Processing TRUEZONE processes personal information based on:

EU (GDPR): The necessity for the performance of a contract with the Data Subject: This is relevant when processing is necessary to fulfill contractual obligations. Compliance with legal obligations: TRUEZONE may process personal information to comply with applicable laws and regulations. Consent for processing sensitive data: Where applicable, TRUEZONE obtains consent for processing any sensitive personal data.

UK (UK GDPR): Contractual Necessity: Processing is necessary for the performance of a contract with the Data Subject. Legal Compliance: TRUEZONE may process personal information to comply with legal obligations. Consent: For any sensitive data, consent is obtained when required.

US (CCPA): TRUEZONE does not sell personal information and processes data as necessary to provide services to Customers.

Virginia (VCDPA): Contractual Necessity: For performance under a contract. Legal Compliance: To comply with applicable laws. Consent: For sensitive personal data when necessary.

Colorado (CPA): Contractual Necessity: Necessary for the performance of a contract. Legal Compliance: To comply with legal obligations. Consent: Required for processing sensitive personal data.

Connecticut (CTDPA): Contractual Necessity: For fulfilling contractual obligations. Legal Compliance: To adhere to legal requirements. Consent: Where applicable, particularly for sensitive data.

6. Third-Party Data Processors TRUEZONE utilizes third-party processors located in the EU or/and the US for data storage, processing and payments. These third-party service providers may have access to personal information as necessary to perform their functions, and TRUEZONE ensures that they comply with applicable data protection laws and regulations. The use of these services is governed by agreements that require them to maintain the confidentiality and security of personal information.

6.1.List of Data Processors Cloud Service Provider: Google Cloud EMEA, incorporated under the laws of Ireland, with offices at 70 Sir John Rogerson’s Quay, D02 R296, Dublin, Ireland SMS & Email Verification: Twilio Ireland Limited, incorporated under the laws of Ireland, with offices at 25-28 North Wall Quay, Dublin 1, Ireland Payment Processing: Stripe Inc., incorporated under the laws of Delaware, USA.

7. Rights of Data Subjects Applicants have the following rights regarding their personal information;

7.1.Under the GDPR (EU Residents): Right to Access: The right to request confirmation of whether personal data is being processed and to access that data. Right to Rectification: The right to request correction of inaccurate or incomplete personal data. Right to Erasure: The right to request deletion of personal data under certain circumstances. Right to Restrict Processing: The right to request the restriction of processing personal data. Right to Data Portability: The right to receive personal data in a structured, commonly used, and machine-readable format. Right to Object: The right to object to the processing of personal data based on legitimate interests.

7.2. Under the CCPA (California Residents): Right to Know: The right to request information about the personal data collected, used, disclosed, or sold. Right to Delete: The right to request the deletion of personal information held by the business. Right to Non-Discrimination: The right to not be discriminated against for exercising their rights under the CCPA. Right to Opt-Out: The right to opt-out of the sale of personal information.

7.3. Under the VCDPA (Virginia Residents): Right to Access: The right to confirm whether personal data is being processed and to access that data. Right to Correct: The right to correct inaccuracies in personal data. Right to Delete: The right to delete personal data provided by or concerning the consumer. Right to Data Portability: The right to obtain a copy of personal data in a usable format. Right to Opt-Out: The right to opt-out of the processing of personal data for targeted advertising and certain other purposes.

7.4.Under the CPA (Colorado Residents): Right to Access: The right to know if personal data is being processed. Right to Correct: The right to correct inaccuracies. Right to Delete: The right to delete personal data. Right to Data Portability: The right to obtain personal data in a portable format. Right to Opt-Out: The right to opt-out of the sale of personal data.

7.5.Under the CTDPA (Connecticut Residents): Right to Access: The right to know what personal data is being processed. Right to Correction: The right to correct personal data. Right to Deletion: The right to delete personal data. Right to Data Portability: The right to obtain personal data in a format that is easy to transfer. Right to Opt-Out: The right to opt-out of the processing of personal data for targeted advertising.

7.6.Under the UK GDPR(UK Residents): Right to Access: The right to request access to personal data. Right to Rectification: The right to correct inaccurate personal data. Right to Erasure: The right to request deletion of personal data. Right to Restrict Processing: The right to limit processing of personal data. Right to Data Portability: The right to obtain personal data in a structured format. Right to Object: The right to object to processing based on legitimate interests.

Please note that TRUEZONE does not directly handle requests from Applicants. Instead, all requests regarding personal information are routed through the respective Customers, who are responsible for addressing these inquiries.

8. Data Security TRUEZONE implements appropriate technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, and destruction. We utilize encryption, access controls, and regular security audits and assessments to ensure the integrity and confidentiality of personal information.

9. Changes to This Policy TRUEZONE reserves the right to update this Policy at any time. Changes will be effective immediately upon posting on our website. We encourage you to review this Policy periodically for updates.

10. Contact Information For any questions or concerns regarding this Policy, please contact us at: Email: legal@truezone.com Registered Address: 1111B S Governors Ave, Suite 20696 Dover, DE 19904, USA