Policy for the processing and protection of users' personal data

Last revised: October 1, 2025 Pyzhak Exchange Co Ltd. (collectively, "we," "us," or "us") takes privacy and information security very seriously. Protecting the personal data of our Users (hereinafter, "you," "yourself," or "yourselves") is one of our key priorities. This Policy has been developed to protect your rights and freedoms regarding the protection of your Personal Data. It explains the basis, methods, and purposes for which your Personal Data is processed, as well as your choices regarding this Personal Data. This Policy applies to all means by which we collect information. For example, we collect information through in-person conversations and telephone conversations. Please read this Policy carefully to understand how we will handle your Personal Data. If you do not agree with our policy, you may not use our Website. By accessing or using the Website, you agree to the terms of this Policy. This Policy may change from time to time. Your continued use of this Site after we post changes to this Policy is considered acceptance of those changes, so please check this Policy periodically for updates. Introduction This Policy has been developed in accordance with the current legislation of the European Union, the Kingdom of Thailand and the Russian Federation. What concepts do we use in this Policy: Applications (Questions) are forms for collecting your Personal Data, posted on the Website and intended to be completed and submitted electronically through the Website. Applications are presented on the Website in the form of questionnaires containing prompted questions; Button - a graphic element of the Site, highlighted in color and containing an inscription in a contrasting color, indicating a program-related action that will be performed when clicked; Cookies are text files placed on your computer (or other device) when you visit the Website through a web browser. You can find more information about cookies here; Processing of personal data – any of our actions (operations) or a set of actions (operations) performed with the use of automation tools or without the use of such tools with Personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of Personal data; Personal data is any information that directly or indirectly relates to you. Your Personal Data also includes information you provide to us when visiting the Website or Platform, registering and/or logging in to the Website or Platform, using the Website, Platform, Service Packages, or completing an Application. For more detailed information about the composition of Personal Data, please see the section on what Personal Data we collect. User of the information system – our employee who has been granted access to your Personal Data by us; The Website is a collection of texts, graphic elements, designs, images, program code, software, photographs and videos, and other results of our intellectual activity contained on the Internet, including, but not limited to, cloud space, stationary and mobile devices; Services - services provided by us to an unlimited number of persons under the conditions set out on the Site; Platform (Program) – an information resource of the Company (Ex24), located in the Telegram messenger for the provision of Services to Clients. Client – you if you intend to purchase or have already purchased our Services. Service Packages are a collection of several Services that you intend to purchase or have already purchased from us. The Internet is a global system of interconnected computer networks that uses the Internet Protocol suite (TCP/IP) to communicate between networks and devices. What principles of personal data processing do we adhere to? We are guided by the following principles when processing your Personal Data: - Obtaining consent to data processing. We process your personal data only with your consent, which you may revoke at any time. Consent is considered granted upon receipt of your explicit consent, expressed through an active action (e.g., checking a box) upon completing the Application (Questionnaire) on our website and clicking the "Proceed to payment" button or similar button located under the final question prompt in the Application. - Purposeful data processing. We limit the processing of your personal data to specific, predetermined, and legitimate purposes. We do not use your data for purposes incompatible with those for which it was collected. - We process only those Personal Data that are necessary to achieve the stated purposes of processing. - Data accuracy and timeliness. We ensure that your personal data is accurate and current, consistent with the purposes for which it is processed. If the data is incomplete or inaccurate, we take the necessary steps to correct or delete it. - Data Destruction. Your personal data will be destroyed once the purposes for which it was processed have been fulfilled or when its further use is no longer necessary. We strive to ensure the protection and confidentiality of your personal data, guided by these principles and applicable personal data protection laws. If you have any questions regarding the processing of your data, you can always contact us for further information. We do not verify the accuracy of the Personal Data you provide when completing Applications on our Website. We also do not verify that this Personal Data belongs to you; you provide it as your own. We assume that you provide your Personal Data to us in your own interests and have no intention of violating the rights and legitimate interests of others, our rights, or causing them or us damages. To collect, record, systematize, accumulate, store, clarify (update, amend), and retrieve your Personal Data, we use databases located in the Russian Federation. This may be necessary to ensure the effective processing of your data and the fulfillment of the stated processing purposes. We strive to ensure the security and confidentiality of your personal data and comply with all relevant data protection regulations and laws. If you have any questions or require additional information regarding the processing of your data, please do not hesitate to contact us. We are ready to assist and provide you with the support you need. What information do we collect from you? We collect various data about you and other users in accordance with this Policy and our objectives. This data may include personal information about users, as well as technical and other information related to their activities on our Website. Technical information, such as cookies, helps us identify you and other users. Cookies are text files we use to process data about how users interact with our Website, Platform, and Personal Account. For example, we can learn which pages were visited, how long you or another user spent on a page, or what services were ordered. If you prefer, you can disable cookies in your browser settings. Our Cookie Policy contains more detailed information about how cookies are processed. Technical information also includes information that is automatically transmitted to us through software on your device when you use our Website and Platform. This information includes: - Data about internet activity, such as pages visited, date and time of URL clicks, etc. - Information about the device and browser you use to access the Internet, including IP address and device type. - Data about interactions with advertisements we display outside of our Site, such as number of views, frequency, and view depth. We use third-party software, such as web analytics (Google Analytics) and end-to-end business analytics (Roistat), to obtain additional information about how users interact with our services. The collection of anonymized data using third-party software is determined by the copyright holders of that software. We do not control this process and have no direct influence on the composition and conditions of such anonymized data collection. We process Clients' Personal Data, technical information, and other information for the entire duration of the agreement concluded between them and us. For other users who are not Clients, their Personal Data is processed for the entire duration of their use of our Website and other resources. When using our Website and Platform, third-party software may be used. As a result of such use, your data may be provided and transferred to third parties in an anonymized form. This means that the transferred data cannot be used to identify specific individuals and is kept anonymous. What we do with your personal data The processing of your personal data includes actions such as recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of your personal data. This applies to data for which we require your written consent. By using our Website, Platform, or by completing Applications (Questions), you consent to the processing of your Personal Data. This data may be transferred to third parties within the framework of our agreement with you (if you are a Client or Customer) or for the implementation of affiliate programs with such third parties, even if such data transfer occurs outside the Kingdom of Thailand or the European Union (the location where the personal data is stored) or to the territory of other countries (cross-border transfer). We process your Personal Data with and without the use of automation tools. Please note that your Personal Data is processed by us in the Kingdom of Thailand, to which you give your consent. Our information systems process personal data of the following categories of subjects: - our employees; - our clients; - performers, contractors and other third parties who provide services and/or perform work on our behalf; - participants of the events we organize; - subscribers to our newsletter; - information partners, invited guests and hosts of events held by us. This Policy applies to all processes related to the processing of personal data, including the collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer, anonymization, blocking, deletion, and destruction of data. These processes may be carried out with or without the use of automated tools. By using our Website and Platform, as well as other resources we provide, you express your unconditional consent to our Policy and the terms of our Personal Data Processing. You can also express your consent to this Policy by subscribing to our newsletters or providing us with written consent to our Personal Data Processing. Our Website is not intended for individuals under twenty (20) years of age in the Kingdom of Thailand, or under eighteen (18) years of age in the European Union (depending on jurisdiction), or in the Russian Federation, in accordance with local law. We do not collect information from such individuals. If you are under this age, you should not provide us with any personal information on or through the Website. We do not knowingly collect information from children under thirteen (13) years of age. If we accidentally receive personal information from a child under 13 without parental consent, we will promptly delete that information. If you have reason to believe that we have Personal Data about a child under 13, please contact us at hello@ex24.pro. We use the Personal Data and information you provide solely for the following purposes: - Fulfilment of our obligations to you if you are our Client (Client) and use our Website, Platform, as well as materials and other intellectual resources when receiving our Services. - Establishing and maintaining contact with you. - Sending you informational and other messages to your email address. - Improving the quality of service and modernizing our Website and Platform. - Administration of justice in case of request from authorized bodies. - Implementation of affiliate programs with third parties. - Compliance with legal requirements. - Notifying you about the services we provide and the procedure for their provision. - Conducting analysis of the results you have achieved when using our services. - Contacting you to clarify your intention to purchase our Services, information about which is provided on the Site. - Concluding an agreement with you for the provision of our Services, including issuing invoices for payment, sending notifications and information related to the provision of Services. - Processing your requests and applications received by us. - Developing and adjusting our marketing policy to suit your preferences, depending on your location and position. We strive to use your Personal Data only for the purposes specified in this section and within the limits of the law in order to ensure the protection of your privacy and data security. We assume that you provide accurate and up-to-date information and provide you with the opportunity to update or correct your data at any time. We take reasonable steps to maintain the accuracy of your personal data. Here is a list of your Personal Data that we process: - Last name, first name, patronymic; - Email address; - Contact phone number; - Messaging accounts; - Links to profiles (pages) on social networks; - Additional information that you provide to us through the Website, Platform, Application Form, and in the process of providing Services within the Service Packages. This information allows us to contact you, provide you with our services, and improve our service and meet your needs. We process this information in compliance with applicable personal data protection laws and with your consent, including where required. We always strive to ensure the security and confidentiality of your personal data and use it only for the purposes specified in this Policy. Our rights regarding the Personal Data you provide We reserve the right to conduct statistical and research studies based on your anonymized Personal Data. We may also share this research with third parties for targeted advertising. By submitting an Application on the Website, you consent to the transfer, processing, storage, and other operations with your Personal Data, including such research and receiving targeted advertising. However, you may revoke this consent at any time by contacting us at the address provided on the Website: hello@ex24.pro. We may provide information about you to law enforcement agencies or other government agencies in response to legal proceedings or investigations, pursuant to a court order, an enforceable request, or as part of our cooperation in accordance with applicable law. We may share information about you with third parties to detect and prevent fraudulent activity, troubleshoot technical issues, or resolve security problems. We may provide access to your Personal Data to other users of the Site and Platform, online and offline events, if such transfer is necessary to fulfill our obligations to other users or you under concluded agreements, including in an anonymized form. We may establish requirements for mandatory information (Personal Data) that you must provide to use the Website and Platform. However, if certain information is not marked as mandatory, its provision or disclosure is at your discretion. We retain your Personal Data only for the period necessary to achieve the purposes for which we process it. The retention period for Personal Data may be established by law or stipulated by your consent. After the expiration of the retention period, your Personal Data will be destroyed or anonymized. In accordance with the processing purposes and legal requirements, we may transfer Personal Data to the following categories of third parties: - our subsidiaries and companies within our group of companies; - our external contractors and companies with which we have concluded contracts; - state and other bodies in accordance with the requirements of the law. The transfer of Personal Data to the territory of foreign countries that do not ensure an adequate level of protection of your rights (countries that have not signed the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ETS No. 108) may only be carried out with your consent and/or for the performance of an agreement and/or in accordance with legal requirements. For transfers of Personal Data received from the European Union to third parties in countries that do not provide an adequate level of protection for Personal Data under the GDPR, contracts containing Standard Contractual Clauses (SCCs) adopted by the European Commission or a competent authority and approved by the European Commission are concluded with the relevant third parties to ensure that your rights and freedoms are respected. To obtain information about the list of third parties to whom your Personal Data is transferred and copies of the standard contractual clauses used in such agreements, please contact us. We are obligated to provide this information upon your request. What rights do you have regarding the Personal Data you share with us? Please review the rights below: When you post information about yourself on our Website, Platform, or in an Application (Questionnaire), you may make it publicly available. Please understand that such information may be found by search engines, which may entail the risk of disclosure of personal, family, and other confidential information. You have the right to delete or modify the information you have provided at any time. You can do this by completing the necessary steps on our Website or Platform, or if this is not possible, by contacting us by email at hello@ex24.pro. However, please note that in some cases, we may continue to use your Personal Data where permitted by law. - You have the right to request confirmation that we are processing your personal information. If processing does occur, you have the right to access your personal data, as well as receive information about the purposes of processing, the categories of data processed, the actions taken with it, the recipients and guarantees for transferring data to third parties, the processing timeframes, the sources of data, and the use of automated processing. You also have the right to receive a list of the personal data being processed. If we rely on your consent to process your Personal Data, you have the right to withdraw your consent at any time. Each consent you provide to us specifies the procedure for withdrawing consent. If you wish to withdraw any consent you have provided to us, you may use the procedure specified in such consent. - You have the right to request correction of your personal data if you discover errors or inaccuracies. To do this, you may amend your personal information, taking into account the purposes for which it is being processed. You also have the right to request restriction of processing of all or part of your Personal Data in the following cases: - If you believe that the data contains inaccuracies, we will temporarily limit processing to confirm its accuracy. - If you discover that your data is being processed unlawfully and prefer to restrict its use instead of deleting it. - If we no longer need your Personal Data, but you may need it to protect your rights in legal claims, lawsuits or proceedings. If you object to the processing of your data, we will temporarily restrict its processing to determine whether our legitimate grounds for this processing outweigh your grounds for objection. You may request that your Personal Data be deleted from our systems and/or other material sources if one of the following conditions is met: - Your Personal Data is no longer necessary for the purposes for which it was collected. - You withdraw your consent to the processing of data, and there are no other legal grounds for their processing. - You object to the processing of your data and we have no legal grounds for further processing of your data. - The data processing is illegal. Data deletion is required to comply with our legal obligation under statutory requirements. If, at the time your Personal Data was collected, you were a minor under 16 years of age (or another age in accordance with the applicable laws of your country), and the data was not obtained with the consent of your legal representative for the provision of services online. Additional details can be found in the section on what we do with your Personal Data. You have the right to request a list of your Personal Data, which we have provided for processing, in a structured, commonly used, and machine-readable format. You may also instruct us to transfer this list to a third party, if we have the technical capability to do so. It is important to note that if we transfer your Personal Data to a third party in this way, we are not responsible for any actions that such third party may subsequently perform with your Personal Data. You have the right to object to the processing of some or all of your personal data if the processing is carried out for the purposes specified when you provided it to us. However, there are cases where our legitimate grounds for processing may outweigh your interests, rights, and freedoms, or where the processing is necessary to establish or defend legal claims. - You have the right to request that we restrict the processing of your Personal Data for the purposes of marketing activities. If we in any way violate your rights in the area of personal data processing, you have the right to lodge a complaint with the supervisory authority responsible for data control and protection. We are committed to respecting your rights and ensuring the secure and responsible processing of your personal data. If you have any questions or requests regarding this matter, please contact us at hello@ex24.pro. We are always ready to assist you. When we begin processing your personal data. The duration of your consent to the processing of personal data We begin processing your personal data immediately after receiving your consent. This processing continues until your consent expires or you revoke it. Your consent to the Processing of personal data begins to operate from the moment we receive your consent when completing the Application on the Website or otherwise explicitly and is valid for 3 years. If you decide to revoke your consent to the processing of your Personal Data, you can do so at any time. To do so, please send a personal request to us at hello@ex24.pro. Once we receive your request, the processing of your Personal Data will be immediately ceased, and all your Personal Data will be destroyed. What about privacy? We undertake to maintain the confidentiality of your Personal Data and not disclose it to third parties without your consent, except where such disclosure is required by applicable law. Protecting your personal data To ensure the security of the personal data you provide, we take necessary and sufficient legal, organizational, and technical measures. This allows us to protect your data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, and other unauthorized actions by third parties. To do this, we restrict access to your information to other users of the Site and Platform, our employees and partners, except in cases where the provision of such information is necessary to fulfill our obligations to you or as required by law. We also guarantee that the information you provide, including Personal Data, will not be combined with third-party statistical data. We use your information only for internal statistics and do not disclose it to third parties, except as specified in our Policy. It's important to note that we do not sell or transfer your information to specific third parties. Such information may only be transferred in the event of a partial or complete reorganization of our company. We take technical and organizational measures to enable you to access and edit your Personal Data if necessary. If we discover that your Personal Data is being processed unlawfully, whether by us or by someone acting on our behalf, we are obligated to immediately cease such unlawful processing. If the lawful processing ceases to exist, we are obligated to destroy your Personal Data. We undertake all these measures in accordance with the law and our obligations to you. To protect your personal data, we take the following measures: - We ensure the safety of personal data carriers. - We carry out identification and authentication of all users of our information system (Site) and access objects. - We determine the list of persons who are granted access to your Personal Data as part of their job responsibilities. - We appoint a person responsible for ensuring the security of personal data in the information system. - We apply antivirus protection to the information system containing personal data. - We conduct periodic checks of the terms of personal data processing. - We organize training for users of our information system (Website) through briefings, especially for those who have permanent or temporary access to your Personal Data. Please pay attention to the following points: The Website and Platform are not publicly accessible sources of Personal Data. However, certain actions by you or other users may result in your Personal Data becoming accessible to an unspecified group of people, and you consent to this. We may send newsletters and promotional materials to the email address and phone number you provide on the Website, Platform, or when filling out the Application. You consent to such sending; however, you also have the right to unsubscribe from such newsletters or marketing communications. - We are not responsible for the use of your Personal Data by third parties with whom you interact when using the Site and Platform. If you have reason to believe that your interaction with us is no longer secure, for example, if you suspect that the security of your account has been compromised or your login information is no longer secure, please notify us immediately. To do this, you can send a message to hello@ex24.pro. We take such messages very seriously and respond promptly to any suspicions or concerns regarding the security of your Personal Data and accounts. Our specialists will take the necessary steps to verify the situation and ensure the security of your data. Your security and the protection of your personal information are our priority, and we do everything possible to ensure its safety and security. Cookie Notice Our Website uses cookies. Please note that cookies are considered Personal Data, as they contain personal information. We collect and store the IP address, domain name, browser type, and operating system used on your device when visiting our Website. This information is collected in an anonymized form and used to compile traffic statistics. We analyze this information to promptly identify and resolve technical issues with our Website. Cookies allow us to improve your experience on the Website by providing you with more convenient features and personalized content. However, please remember that you can change your browser settings at any time to refuse cookies or receive notifications when they are sent. We value your privacy and strive to ensure maximum protection of your data. For more information about how we use cookies, please see our Cookie Policy. If you have any questions or require additional information, please contact us at hello@ex24.pro. Important information for residents of EU and EEA countries If you are a resident of the European Union (European Economic Area), you have certain data protection rights under the General Data Protection Regulation 2016/679 (GDPR). The GDPR applies to these Terms. To find out what Personal Data we store about you, request deletion, or exercise other rights provided for in this section, you can send a request to hello@ex24.pro. You have the following rights to protect your Personal Data: - The right to access, update, or delete your Personal Data. You may request access to your Personal Data, update information, or delete your data in accordance with this section. - The right to rectification. If your Personal Data is incomplete or inaccurate, you have the right to have it rectified. - Right to object. You may object to our processing of your personal data. - Right to restriction. You may request that we restrict the processing of your personal data. - The right to data portability. You have the right to receive a copy of the personal data we hold about you in a structured, machine-readable, and commonly used format. - The right to withdraw consent. You may withdraw your consent to the processing of your personal data at any time. We will no longer be entitled to continue processing your personal data based on your previously provided consent. - The right not to be subject to automated decision-making, including profiling. This right allows you to avoid being subject to automated decision-making that could significantly affect you. - The right to lodge a complaint with a European Union supervisory authority (or the supervisory authority in your country). If you believe that we have violated your rights regarding the collection and use of your data, you have the right to lodge a complaint with the data protection authority in your country. We are committed to complying with the GDPR and respecting your data protection rights by enabling you to exercise these rights in relation to your Personal Data. In accordance with this Policy and this section, you agree that we have the right to request verification of your identity before responding to requests related to the exercise of your rights. This may be necessary to ensure the security and protection of your data, as well as to prevent unauthorized access to your personal information. The provisions of this section of the Policy apply solely to you if you are a citizen of the European Union (European Economic Area) and take precedence over (and supersede) the provisions of other sections of this Policy in the event of any conflict. Important information for citizens of the Russian Federation If you are a citizen of the Russian Federation, these provisions apply to you regardless of your current location or residency status in another country. The processing of your Personal Data is governed by both Russian Federation law, in particular Federal Law No. 152-FZ of July 27, 2006, "On Personal Data" (hereinafter referred to as the "Law"), and applicable local laws in your location. Database operator and localization The operator that organizes and processes your Personal Data is Pyzhak Exchange Co Ltd. In accordance with the localization requirement (Part 5 of Article 18 of the Law), we confirm that the collection, recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of your Personal Data are carried out using databases located in the Russian Federation. Grounds and purposes of data processing We process your Personal Data on the following legal grounds: Your consent, which you provide to us by actively participating in the Website (e.g., by checking a box). Such consent is specific, informed, and conscious. Performance of a contract to which you are a party (for example, when purchasing our Services). Compliance with the requirements of the legislation of the Russian Federation. The purposes of processing your data correspond to the purposes specified in the main part of this Policy. Your rights as a subject of Personal Data In accordance with the Law, you have the following rights: Right of access to information: You may request and receive information regarding the processing of your Personal Data. The right to rectification, blocking and destruction: You have the right to request that we rectify, block or destroy your Personal Data if it is incomplete, outdated, inaccurate or unlawfully obtained. Right to withdraw consent: You may withdraw your consent to the processing of your Personal Data at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to its receipt. Right to appeal: If you believe that we have violated your rights, you have the right to appeal our actions to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court. Cross-border data transfer We may transfer your Personal Data cross-border to foreign countries. Such transfers are carried out in compliance with all legal requirements and subject to adequate protection of your rights. 5. Contact information for inquiries To exercise your rights, revoke consent, or direct any questions related to the processing of your Personal Data, please contact us by email at: hello@ex24.pro. Important information for residents of the Kingdom of Thailand We are the data controller of your Personal Data and are responsible for the processing of Personal Data that falls under the Personal Data Protection Act BE2562 (“PDPA”) in Thailand. To exercise their rights under the PDPA, the Client may contact us at hello@ex24.pro, clearly stating which right is being exercised and in relation to which personal data. The Company may maintain a record of requests to resolve any issues that arise. The Client's rights are not absolute and may be limited in accordance with the PDPA, of which we will notify you with the reasons. The request will be processed within one month of its receipt, but this period may be extended to three months by notifying the Client via the email address provided in their request. If the request is refused or processed late, the Client may file a complaint with the Personal Data Protection Committee of Thailand (PDPC) and take legal action. The Client has the right to request access, correction, deletion, restriction, objection to processing, and portability of their personal data in accordance with the PDPA. The client also has the right to receive the personal data provided to us in a readable format and transfer it to another controller. Where technically feasible, we will transfer the data directly to the specified controller. Final Provisions We reserve the right to amend this Policy. You should review the current Policy each time you access our Services (Service Packages), Website, or Platform. The new version of the Policy takes effect from the moment it is posted on the Website. If you continue to use our Services/Service Packages, the Website, or the Platform after the new version of the Policy is published, this means you fully accept the updated Policy and its terms. If you do not agree with the terms of the Policy, please do not continue to use our Services/Service Packages, Website, or Platform. If the Company merges with another company or organization, regardless of form, or is partially or fully acquired by such a company or organization, such company or organization will have access to all of your Personal Data held by the Company. Without prejudice to the right to update this Policy, such company or organization will be bound by this Policy. Our contact information: Pyzhak Exchange Co Ltd., Address: 7/14 Pasak Koktanod Road, Cherng Talay Sub-District, Thalang District, Phuket Province, Thailand 83110, DPO email: hello@ex24.pro. Elimination of contradictions In the event that an agreement between you and us contains provisions regarding the use of your Personal Data, the provisions of the Policy and this agreement shall apply to the extent that they do not conflict with the Policy.