Quixo AG Klosbachstrasse 103 8032 Zurich Switzerland Quixo AG acts as data controller for personal data processed in connection with the Services.

This Privacy Policy applies to: Private clients (natural persons), and Business clients, including their representatives, beneficial owners, and authorized users. It applies to personal data collected: Through the website and applications, During onboarding and ongoing monitoring, Through communications and service usage.

Depending on the relationship and legal requirements, Quixo may process the following categories of personal data: 3.1 Identification and Contact Data Name, date of birth, nationality Residential or business address Email address and telephone number 3.2 Verification and Compliance Data Identity verification data collected for KYX purposes Corporate information, beneficial ownership data, and authorization details Source of funds and transactional context information Ongoing monitoring and compliance-related data 3.3 Technical and Usage Data IP address Device and browser information Log files and usage metadata Cookie and analytics data 3.4 Communication Data Correspondence with Quixo Support requests and operational communications 3.5 Counterparty and Beneficiary Data When payments are sent or received, Quixo processes personal data of payment counterparties (such as name, IBAN or account details, and payment references). This data is obtained from the client instructing the payment or through the payment networks and partner financial institutions involved, and is processed solely to execute payments and to comply with legal obligations.

Quixo processes personal data strictly for the following purposes: Provision and operation of the Services Identity verification and compliance with Swiss AML regulations Ongoing monitoring and risk management Transactional and operational communications Legal and regulatory obligations Website security, functionality, and analytics Marketing communications where permitted by law Personal data is not processed for automated decision-making within the meaning of applicable data protection law.

Personal data is processed on one or more of the following legal bases: Performance of a contract or pre-contractual measures Compliance with legal and regulatory obligations Legitimate interests of Quixo, including security, risk management, and service integrity Consent, where required under applicable law

Core platform data is hosted on cloud infrastructure provided by Render (Render Services, Inc.) in the European Union (Frankfurt, Germany). Identity verification and KYX data is processed and stored by Sum and Substance Ltd (Sumsub) on its own infrastructure. Quixo does not control or operate the infrastructure of external service providers but ensures that such providers are subject to appropriate contractual and technical safeguards.

Personal data may be disclosed only where necessary and permissible, including to: Identity verification and compliance service providers (Sum and Substance Ltd — Sumsub) Technical infrastructure and hosting providers (Render Services, Inc.) Email delivery providers (Twilio SendGrid) Error monitoring providers (Functional Software, Inc. — Sentry) Analytics providers (Google), only where you have consented Licensed third-party financial institutions in the United Kingdom and Lithuania involved in payment execution Authorities or regulators where legally required Quixo does not sell personal data.

Quixo uses strictly necessary cookies for session authentication and security. These are required for the Services to function. Google Analytics is used to analyze usage of the Services only if you consent. Analytics is disabled by default; you can accept or decline it in the consent notice shown in the app and change your choice at any time in Settings. Analytics data is not used for advertising. You may additionally manage cookies through your browser settings. Disabling strictly necessary cookies may affect certain functionalities of the Services.

Quixo currently sends transactional and service-related communications only (for example, registration, security, and payment notifications). Quixo does not send marketing communications and does not solicit clients; the Services are provided on a reverse-solicitation basis. Should marketing communications be introduced in the future, they will be sent only where legally permitted, and you will be able to opt out at any time through the mechanisms provided in such messages.

Personal data is retained only for as long as required to: Fulfill contractual and operational purposes, and Comply with applicable legal and regulatory obligations under Swiss law.

Quixo implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or misuse, taking into account regulatory requirements and industry standards.

Data subjects have the rights provided under Swiss data protection law (and, where applicable, the GDPR), including the right to: Request access to personal data, Request correction of inaccurate data, Request deletion where legally permissible, Receive a copy of personal data they provided in a commonly used, machine-readable format (data portability), and Object to certain processing activities. To exercise these rights, contact support@nudl.io from your registered email address. Requests are assessed in accordance with applicable legal obligations, including mandatory retention and compliance requirements, and answered within the statutory deadlines.

Where personal data is processed outside Switzerland or the EU/EEA, Quixo ensures that appropriate safeguards are in place in accordance with Swiss data protection requirements, such as transfers to countries with an adequate level of data protection or the use of recognized standard contractual clauses.

Quixo may update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes. The current version is published on the website and becomes effective upon publication.

This Privacy Policy is governed by Swiss law. The exclusive place of jurisdiction is Zurich, Switzerland, unless mandatory law provides otherwise.