Privacy Policy

Bitblock Markets

Last revised: 2026-06-28 (DRAFT — pending legal review)

Notice. This document is a working draft prepared for legal review. It is not yet in force. Please consult your engaged counsel before publishing.

1. Introduction

Bitblock Markets [legal entity name], a company registered in the United Arab Emirates under registration number [number] ("Bitblock Markets", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Bitblock Markets investment platform (the "Platform"), and your rights in relation to that data.

This Policy applies to:

• Clients and prospective Clients who register an account on the Platform
• Visitors to our website who do not register an account
• Individuals who interact with us by email, telephone, or through any other channel

For the purposes of applicable data-protection law, Bitblock Markets is the data controller of your personal data. Where we engage third parties to process data on our behalf (for example, our hosting provider), those parties act as our data processors under written agreements.

2. Personal data we collect

We collect personal data in three ways: information you provide to us directly, information we collect automatically when you use the Platform, and information we receive from third parties.

2.1 Information you provide

• Account information — full name, email address, telephone number, date of birth, nationality, country of residence, residential address, and a referral code (where you signed up via someone else's link)
• Identity-verification (KYC) information — a copy of your national identity card (front and back), passport, or other government-issued ID; a recent selfie photograph used for biometric matching; the ID document number; and any supporting source-of-funds documentation we may request
• Investor agreement documents — the signed PDF of your Investor Agreement and the validator output that confirmed its integrity
• Payout details — your cryptocurrency wallet address and network, M-Pesa name and phone number, bank account number, account name, SWIFT code, and bank name (whichever payout method you elect)
• Investment data — your capital allocation across asset classes, deposit history, and earnings history
• Communications — correspondence you exchange with our support, compliance, or operations teams, in writing or by phone

2.2 Information we collect automatically

• Usage data — pages visited on the Platform, actions taken, timestamps, the IP address you connected from, device type, operating system, browser type and version, and similar log information collected via our hosting infrastructure
• Authentication data — session tokens, two-factor authentication factors, login timestamps, and IP-address history for account-security monitoring
• Cookies and similar technologies — see Section 11

2.3 Information we receive from third parties

• Payment-processor data — payment status, deposit address, amount actually paid, transaction hash, and exchange-rate information from our cryptocurrency payment processor (currently NOWPayments, and any successor or additional processor we engage)
• KYC-vendor data — where we use an automated identity-verification provider, the data passed back to confirm or reject the documents you submitted (the Platform currently performs manual review by our compliance team)
• Referral linkage — where you signed up using another Client's referral code, we associate your account with the referring Client for the purposes of administering the referral programme

3. How we use your personal data and our legal basis

We process your personal data only where we have a lawful basis to do so. Our purposes and bases are summarised below.

We do not use your personal data for marketing communications, advertising, or profiling without your explicit, freely-given consent.

4. Sharing your personal data

We share your personal data only with the categories of recipient listed below, and only to the extent strictly necessary for the relevant purpose.

• Payment processors and crypto-payment service providers (currently NOWPayments) — to generate deposit addresses, monitor on-chain transactions, and reconcile payments
• Identity-verification providers — where we use an automated KYC vendor, your submitted documents and the verification result are shared with that vendor under contract. The Platform currently performs KYC manually by our compliance team; we will update this Policy if and when we transition to a third-party provider.
• Hosting and infrastructure providers — Vercel, Inc. (web application hosting), Supabase, Inc. (database, authentication, and document storage), and our email provider once configured. Each acts as our processor under a written data-processing agreement.
• Professional advisers — our lawyers, auditors, accountants, and tax advisers, where strictly necessary for the operation of the firm and bound by professional confidentiality
• Regulators and law-enforcement authorities — where we are legally compelled to disclose under the laws of the United Arab Emirates, the Republic of Kenya, or another jurisdiction with valid jurisdiction over us
• Successors in interest — in the event of a merger, acquisition, reorganisation, or asset sale, your personal data may be transferred as part of the underlying transaction subject to confidentiality undertakings and notice to you

We do not sell, rent, or otherwise commercialise your personal data.

5. International data transfers

Bitblock Markets is headquartered in the United Arab Emirates with operating teams in the Republic of Kenya. Some of our infrastructure providers process data in the United States, the European Union, or other regions. As a result, your personal data may be transferred across borders for the purposes set out in this Policy.

Where we transfer personal data outside your country of residence, we ensure that an adequate level of protection is provided through one or more of the following safeguards:

• A written data-processing agreement with the recipient incorporating internationally-recognised standard contractual clauses
• A formal assessment of the destination jurisdiction's data-protection regime
• Where neither of the above is sufficient, your explicit prior consent to the transfer

Where you have specific questions about the international transfer of your personal data, please contact us at privacy@bitblockmarkets.com.

6. How long we keep your personal data

We retain your personal data for the periods necessary to fulfil the purposes set out in this Policy and to meet our legal, accounting, and regulatory obligations. In general:

• Account and identity-verification information — retained for the duration of your relationship with the Platform plus a tail period of five (5) to seven (7) years following the closure of your account or the termination of your final Investor Agreement, in accordance with anti-money-laundering record-keeping obligations under UAE Federal Decree-Law No. 20 of 2018 and the Kenya Proceeds of Crime and Anti-Money Laundering Act, 2009.
• Transaction records (deposits, distributions, withdrawals, referral bonuses) — retained for at least seven (7) years following the transaction date.
• Communications — retained for two (2) years after closure of the matter to which they relate, except where retention is required by law or regulation for longer.
• Cookies and session data — retained for the period set out in Section 11.

When the retention period ends, your personal data is securely deleted or anonymised so that it can no longer be associated with you.

7. Data security

We implement technical and organisational measures appropriate to the nature of the personal data we process and the risks associated with our activities. These include:

• Transport-layer security (HTTPS) for all communications between your device and the Platform
• Encryption at rest for sensitive data including the KYC document store
• Role-based access controls and row-level security in our databases, with a strict principle-of-least-privilege approach for our staff
• Mandatory two-factor authentication for administrative accounts
• Step-up password authentication on sensitive Client operations (such as changing payout details or requesting a withdrawal)
• A documented incident-response and breach-notification procedure
• Periodic review of authentication logs and abnormal-activity monitoring
• Background checks for staff with access to personal data

No internet-facing service can be guaranteed perfectly secure. Should a personal-data breach materially affect your rights and freedoms, we will notify you, and the relevant supervisory authority, in accordance with applicable law and within the prescribed timeframes (72 hours where applicable).

8. Your rights

Subject to the requirements and exceptions of the applicable data-protection law, you have the following rights in respect of your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — request that we correct inaccurate or incomplete information
• Erasure — request the deletion of your personal data where the legal basis for processing no longer applies (subject to any record-keeping obligations referenced in Section 6)
• Restriction — request that we limit our use of your personal data while a complaint or correction is being addressed
• Objection — object to our processing where the legal basis is our legitimate interest
• Portability — receive a structured, commonly-used, machine-readable copy of the data you have provided to us, and have it transferred to another controller where technically feasible
• Withdraw consent — at any time where consent is the legal basis for processing, without affecting the lawfulness of processing prior to withdrawal
• Lodge a complaint — with the relevant supervisory authority (see Section 13)

To exercise any of these rights, please contact our Data Protection Officer at privacy@bitblockmarkets.com. We will respond within thirty (30) days of receiving a verified request. We may need to verify your identity before acting on a request.

9. Children

The Platform is intended for individuals aged eighteen (18) years or older. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us at privacy@bitblockmarkets.com and we will take steps to delete the information.

10. Automated decision-making

We do not currently engage in fully automated decision-making that produces legal effects or similarly significant effects on you without human review. KYC outcomes that affect your ability to access the Platform are reviewed by a member of our compliance team before becoming final, and our automated contract-validation step is followed by manual admin approval. If we introduce any new automated decision-making process, we will update this Policy and notify you in advance.

11. Cookies and similar technologies

The Platform uses a small number of strictly necessary cookies and similar technologies to:

• Authenticate your session and keep you signed in
• Remember your theme preference (light or dark)
• Protect the Platform against cross-site-request-forgery and similar attacks

We do not currently use marketing cookies or third-party analytics. Should this change, a cookie-consent banner will be presented in accordance with applicable law and you will be able to manage your preferences before any non-essential cookie is set.

Session cookies are deleted when you close your browser. Persistent preference cookies are kept for up to twelve (12) months from your last visit.

12. Changes to this Policy

We may amend this Privacy Policy from time to time. Material changes will be notified to you by email and via in-platform notification. The "Last revised" date at the top of this Policy indicates the most recent update. We encourage you to review this Policy periodically.

If you do not accept a material amendment, you may terminate your Investor Agreement in accordance with the Terms of Service.

13. Contact and supervisory authorities

For any questions about this Policy, our processing of your personal data, or to exercise the rights set out in Section 8, please contact our Data Protection Officer:

Bitblock Markets — Data Protection Officer

Email: privacy@bitblockmarkets.com

Registered office: [Dubai address — to be confirmed]

Regional office (Kenya): [Nairobi address — to be confirmed]

You also have the right to lodge a complaint with the supervisory authority in your country of residence. The most likely authorities for our Client base are:

• Office of the Data Protection Commissioner — Republic of Kenya

Website: https://www.odpc.go.ke/

• UAE Data Office (under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data)

Website: https://uaedata.ae/

By creating an account on the Platform, you confirm that you have read and understood this Privacy Policy.