PRIVACY POLICY

Effective date: 20 September 2026

1. Who we are

The coinmama.com website and the Coinmama Wallet mobile application (together, the “Services”) are operated by New Bit Ventures Ltd. (“Coinmama”, “we”, “us” or “our”), a subsidiary of Wellfield Technologies, Inc., 666 Burrard St Ste 2500, Vancouver, British Columbia V6C 2X8, Canada. The Coinmama Wallet mobile application (“CM Wallet”) is published and developed by Enovista Limited, Block B, Floor 6, Flat 603, 1 Agias Zonis & Thessalonikis, Limassol 3026, Cyprus, an affiliate of Wellfield Technologies, Inc. Enovista Limited does not process any wallet, device or other Personal Information; it acts solely as the developer and publisher of the CM Wallet.

Coinmama is the controller of the Personal Information described in this Policy, except where this Policy states that a Third-Party Service Provider acts as an independent controller.

This Privacy Policy forms part of our Terms of Use (https://www.coinmama.com/terms). Capitalised terms not defined here have the meanings given in the Terms of Use. “Personal Information” means information that identifies you or could reasonably be used to identify you, such as your e-mail address or wallet address.

2. Our Third-Party Service Providers

Purchases and sales of Crypto Assets through the Services are carried out by independent, licensed Third-Party Service Providers – currently Paybis (PAYBIS POLAND SP. Z O.O., KRS 0001041711, and PAYBIS USA LTD, Delaware file no. 5967173) and Banxa (Banxa Holdings Inc. and its licensed affiliates). When you register for a transaction, verify your identity or transact, the Third-Party Service Provider collects and processes your Personal Information directly, as an independent controller, for customer onboarding, identity verification (KYC/CDD), anti-money-laundering and sanctions screening, and transaction fulfilment. Coinmama does not perform these functions and does not receive your identity documents or biometric data.

Each Third-Party Service Provider handles Personal Information under its own privacy policy, which is presented to you before you proceed with that provider. Where a Third-Party Service Provider processes Personal Information on our instructions (for example, to report transaction status back to us), it acts as our processor under contract.

3. What information we collect and why

To the extent we collect Personal Information, it consists of the following:

1. Account and contact data – your e-mail address, which is required to open and operate your account and to reply to your queries.
2. Transaction data – the amount, asset, date, status and reference of Third-Party Transactions initiated through the Services, as reported to us by the Third-Party Service Provider, and any coupon or Promotion applied. Required to display your history, operate Promotions and meet our legal obligations.
3. Wallet data – public wallet addresses generated or imported in the CM Wallet, and the on-chain transaction data associated with them (which is public by nature). The CM Wallet is non-custodial and MPC-based: you control your assets, and Coinmama never has access to them.
4. Device and usage data – IP address, approximate geolocation derived from it, device identifiers, operating system, browser type, app version, crash logs and how you navigate the Services. Used for security, fraud prevention, enforcing our location restrictions, system administration and aggregate analytics.
5. Communications – the content of messages you send to our support team.

Providing an e-mail address is required to use the Services; you are not obliged to provide it, but without it we cannot open an account. Identity documents, biometric data (facial image comparison), date of birth, address and banking details are collected by the Third-Party Service Provider, not by Coinmama; see section 2.

To the extent we keep it, we process Personal Information to provide and secure the Services, to comply with law and regulatory requests, to operate Promotions, to send you marketing communications (which you can opt out of – see section 8), to analyse and improve the Services, and to establish, exercise or defend legal claims. We do not use Personal Information for any purpose incompatible with the purpose for which it was provided.

4. Sources of information

To the extent we collect Personal Information, it is from you directly, from your device, from the Third-Party Service Provider that handles your transaction, from third-party identity providers you choose to log in with, and from public blockchains.

5. Who we share information with

We share Personal Information only as needed and as permitted by law with:

1. Third-Party Service Providers (Paybis, Banxa), to initiate and complete Third-Party Transactions and Promotions;
2. our affiliate Wellfield Technologies, Inc.;
3. service providers acting on our instructions – hosting, analytics, customer-support tooling, e-mail delivery and security vendors – bound by contract to use it only for our purposes;
4. law-enforcement, regulatory or tax authorities, courts and our professional advisers, where required by law or to protect our rights;
5. a purchaser or successor in the event of a merger, sale of assets, financing or reorganisation, subject to this Policy.

We do not sell Personal Information.

6. International transfers

Coinmama operates globally. Our affiliates, service providers and Third-Party Service Providers are located in the European Union, the United Kingdom, Canada, the United States and other countries. If Personal Information under our control is transferred outside the country in which it was collected, we rely on adequacy decisions, standard contractual clauses or other lawful transfer mechanisms. Transfers of data processed by a Third-Party Service Provider as independent controller are governed by that provider’s own safeguards.

7. How long we keep information

We keep Personal Information for as long as your account is active and thereafter for as long as necessary to comply with our legal, regulatory, accounting and record-keeping obligations and to resolve disputes. Transaction and account records are retained for at least five (5) years after your account is closed. Device and usage data used for analytics is retained in aggregate or pseudonymised form. Identity documents and biometric data are retained by the Third-Party Service Provider under its own retention policy and applicable anti-money-laundering law (generally at least five years after the end of the business relationship).

8. Marketing

With your consent, or where otherwise permitted by law, we may send you information about our products, features and Promotions by e-mail or in-app notification. You can opt out at any time through the unsubscribe link in any marketing message, in the app settings, or by e-mailing privacy@coinmama.com. We will continue to send you service-related messages (for example, security alerts or changes to our terms) that are not marketing.

9. Your rights

Subject to applicable law, you have the right to access the Personal Information we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. To exercise any right, e-mail privacy@coinmama.com. We will respond within the period required by law and may ask you to verify your identity first. Requests relating to data held by a Third-Party Service Provider will be forwarded to that provider, or you may contact it directly.

We honour these requests except where retaining or continuing to process the information is required by law, such as anti-money-laundering record-keeping, if applicable.

10. Security

We use technical and organisational measures appropriate to the risk – including encryption in transit, access controls, logging and periodic review – to protect Personal Information under our control against loss, misuse, unauthorised access, alteration or destruction. Only authorised personnel bound by confidentiality obligations have access to it. No system is fully secure; you are responsible for keeping your login credentials, device and CM Wallet recovery material safe and must not share them with anyone.

11. Minors

The Services are intended for persons aged 18 or over. We do not knowingly collect Personal Information from anyone under 18. If you believe a minor has provided us with Personal Information, contact privacy@coinmama.com and we will delete it.

12. Cookies and similar technologies

coinmama.com uses cookies and similar technologies for (a) strictly necessary purposes – security, session management and remembering your preferences; and (b) analytics and performance, through third-party analytics providers that receive pseudonymous usage data and provide us with aggregate reports. Where required by law, we ask for your consent before setting non-essential cookies, and you can change your choice at any time through the cookie settings on the site or your browser settings. The CM Wallet app does not use cookies but uses equivalent device identifiers for crash reporting and analytics, which you can limit through your device settings.

13. Third-party links

The Services may contain links to third-party websites and to the Third-Party Service Providers’ platforms. This Policy does not apply to those sites; please review their privacy policies.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, notify you by e-mail or in-app notice before the change takes effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

15. Contact

Privacy questions and requests: privacy@coinmama.com. General support: support@coinmama.com.