MTB

FINANCIAL LTD

MTB FINANCIAL LTD

PRIVACY POLICY

MTB App · MTB Card and MTB Wallet · Version 2.0

1. INTRODUCTION AND ACCOUNTABILITY

This Privacy Policy explains how MTB Financial Ltd (MTB, we, us), a corporation incorporated under the Business Corporations Act (Alberta), registered office 191 Ordze Ave, Sherwood Park, Alberta, Canada T8B 1M6, collects, uses, discloses and protects personal information in connection with the MTB mobile application, the MTB website (mtbfinancialgroup.com), the MTB Card and the MTB Wallet (together, the App).

MTB is accountable for personal information under its control in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA). Our Privacy Officer is responsible for compliance with this Policy and can be reached at info@mtbfinancialgroup.com. Because our clients reside outside Canada and the United States, we also honour the rights described in Section 11 for every user, and we apply the data-protection law of the countries where our users are located where it is stricter.

2. PRIVACY BY DESIGN: A SELF-CUSTODIAL WALLET

The MTB Wallet is a self-custodial wallet, made available under licence from Nemi Holdings Inc. Your wallet is controlled exclusively by you through a passkey stored on your device (unlocked with your biometrics or PIN) and a recovery password that only you know. The App does not use a seed or recovery phrase. We operate the wallet through a specialised wallet-infrastructure provider, but neither we nor that provider can access, move or recover your funds without your authorisation.

The MTB Card is different: it is a prepaid card program that is subject to identity verification (KYC) by law and by our issuing-bank and custodial partners before activation. Section 3 sets out which data is collected for which service.

3. PERSONAL INFORMATION WE COLLECT

Account data (all users). Full name, email address, phone number and date of birth. We use your date of birth to confirm that you are at least 18. If you sign in with Google or Apple, we receive your name and email from that provider, never your password. New accounts go through an internal activation review to prevent spam, fraudulent sign-ups and abuse; for wallet-only use this review is not an identity verification.

Identity-verification data (MTB Card and custodial-trust funding). Nationality, residential address, tax residency, government-ID images and data, selfie or liveness check, source-of-funds and source-of-wealth information, and sanctions and politically-exposed-person screening results.

Card and transaction data (MTB Card). Tokenised card number, card status, loads, purchases, ATM withdrawals, balances, merchant and transaction location, disputes, and funding instructions from an MTB custodial-trust, wealth-liquidation or inheritance-distribution account.

Wallet data. Public wallet addresses you create, transaction hashes, amounts and timestamps. This data is recorded on public blockchains, is public by nature and is not created or controlled by us.

Device and technical data. Device type and identifiers, operating system, App version, language, IP address and the approximate location derived from it, usage, diagnostic and crash data, push-notification token, and whether biometric login is enabled (the biometric itself never leaves your device).

Support data. Your name, email and message content when you contact us.

Identity data for email deletion requests. If you request deletion by email because you no longer have access to the App, we collect your full name, the registered email and a photo of a government-issued ID solely to verify your identity. The document is reviewed by our compliance team, is never shared with or stored in our wallet infrastructure, and is deleted once verification is complete.

What we do not collect. Your device passkey, your recovery password, or the contents of your wallet beyond what is publicly recorded on the blockchain. We do not access your contacts, photos or files except what you select to upload, and we use the camera only to capture identification documents or scan QR codes.

Third-party services. If you use a fiat on-ramp, off-ramp, swap or other third-party feature from the App, that provider collects and processes your KYC and transaction data as an independent organisation under its own privacy policy. We may receive limited confirmation data, such as that verification succeeded or a transaction reference.

4. PURPOSES AND CONSENT

We collect, use and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and we obtain your consent except where PIPEDA or PIPA permits otherwise. We use personal information to:

• provide, maintain and support the App, the MTB Card and the MTB Wallet;

• review and activate new accounts to prevent spam, fraudulent sign-ups and abuse;

• verify identity and screen for sanctions, fraud and money-laundering risk where required by law or by our issuing-bank, card-network and custodial partners;

• secure the App and prevent, detect and investigate fraud, abuse and security incidents;

• comply with legal obligations, including anti-money-laundering, counter-terrorist-financing, sanctions screening and transaction monitoring;

• respond to support requests and complaints;

• analyse and improve the App; and

• send service, security and legal notices. Marketing messages are sent only with your express consent, in accordance with Canada’s Anti-Spam Legislation, and you can withdraw that consent at any time.

Where the law of your country requires a legal basis, we rely on performance of our agreement with you, compliance with a legal obligation, our legitimate interest in the security and integrity of the App balanced against your rights, and your consent where required, which you may withdraw at any time.

5. TRANSACTION MONITORING AND SANCTIONS SCREENING

Wallet addresses and transactions that interact with our infrastructure and with third-party services may be screened and risk-scored using blockchain-analytics tools (Know Your Transaction, KYT). This uses on-chain data only and involves no access to your keys or funds. MTB Card transactions are monitored by MTB and its issuing-bank partner. Where a sanctions match or high-risk indicator arises, we may restrict access to the App, the Card or third-party services and, where legally required, report to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) or other competent authorities, which we may do without notice to you.

Screening may involve automated analysis. It does not produce a decision that deprives you of custody of your digital assets, which always remain under your control. Where an automated decision significantly affects you, including a decision not to activate your account, you may request human review and contest the decision.

6. DISCLOSURE

We disclose personal information only to:

• service providers acting on our behalf under contract: cloud hosting, wallet infrastructure (Nemi Holdings Inc.), analytics and crash reporting, blockchain analytics, identity verification, and customer-support tools;

• the issuing bank, program bank, card processor and Mastercard, to issue and operate the MTB Card;

• our custodial-trust and distribution partners, to hold and move client funds used to fund the MTB Card;

• third-party service providers you choose to use, which act as independent organisations;

• regulators, law-enforcement and courts where required by law, including FINTRAC; and

• professional advisers, auditors, or a successor in a merger, acquisition or reorganisation, under confidentiality.

We do not sell personal information and do not use it for third-party advertising.

7. INTERNATIONAL TRANSFERS

MTB operates from Canada. Our service providers and partners process information in Canada, the United States and other countries where they operate, and information stored outside Canada may be accessible to the authorities of those countries under their laws. We use written agreements, access controls and encryption to provide a comparable level of protection and assess each provider before engaging it. For users in countries with transfer restrictions, we rely on recognised safeguards such as adequacy, contractual clauses or your consent.

8. BLOCKCHAIN DATA IS PUBLIC AND PERMANENT

Transactions you make are recorded on public blockchains that we do not control. On-chain data is public, immutable and generally cannot be modified or deleted, including by us. This limits our ability to satisfy certain requests, such as erasure, for data already recorded on-chain.

9. RETENTION

We keep personal information only as long as necessary for the purposes in this Policy and to meet legal obligations. When you delete your account, your account record, wallet credentials, card access and session data are permanently removed from our operating systems. As a company subject to Canadian anti-money-laundering law and to the requirements of our banking and card-network partners, we retain a compliance record, containing your name, email, phone number, date of birth, identity-verification file, card transaction history, blockchain transaction and transfer history, and wallet identifiers, for a minimum of five (5) years from the date of deletion. This record is accessible only to our compliance team for regulatory purposes and is not accessible from the App. Support communications and technical logs are kept for up to 24 months.

10. SECURITY

We protect personal information with encryption in transit and at rest, tokenisation of card numbers, multi-factor and biometric authentication, device binding, role-based access controls, logging and regular security testing. No system is completely secure. You remain responsible for securing your device, your credentials and your recovery password, which we never hold and cannot recover. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and the Office of the Information and Privacy Commissioner of Alberta as required by PIPA.

11. YOUR RIGHTS AND HOW TO EXERCISE THEM

You may: access the personal information we hold about you and learn how it has been used and disclosed; correct inaccurate or incomplete information; withdraw consent to optional uses such as marketing or precise location, without affecting services that do not depend on it; delete your account and request erasure of information we are not required to retain; obtain a copy of information you provided in a portable format; object to or restrict certain processing and not be subject to certain automated decisions where the law of your country provides this; and complain to us or to a supervisory authority. To exercise any right, contact info@mtbfinancialgroup.com. We respond within 30 days and may need to verify your identity first. To delete your account, use Settings › Account › Delete account in the App or see our Account deletion page at mtbfinancialgroup.com/account-deletion.

AUTHORITY

LAW

Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376)

Personal Information Protection and Electronic Documents Act (PIPEDA)

Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca)

Personal Information Protection Act (Alberta)

Agencia de Acceso a la Información Pública (AAIP), Argentina

Ley 25.326 de Protección de los Datos Personales

The data-protection authority of your country of residence

Applicable local law

12. CHILDREN

The App is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from minors; if we learn we have, we delete it.

13. COOKIES AND ANALYTICS

Our website uses strictly necessary cookies and, with your consent, analytics cookies, which you can manage through the consent tool on the website or your browser settings. The App uses a small number of crash-reporting and aggregated-usage analytics tools that do not track you across other companies’ apps or websites for advertising.

14. CHANGES TO THIS POLICY

We may update this Policy. We will publish the updated version with a new effective date and, for material changes, notify you in the App at least 21 days before they take effect.

15. CONTACT

Privacy Officer, MTB Financial Ltd · 191 Ordze Ave, Sherwood Park, Alberta, Canada T8B 1M6 · info@mtbfinancialgroup.com · www.mtbfinancialgroup.com

ANNEX — APP STORE DATA DISCLOSURES

Mapping used to complete Apple’s App Privacy labels and Google Play’s Data safety form so the store disclosures and this Policy say the same thing.

DATA TYPE

COLLECTED

LINKED TO YOU

USED FOR TRACKING

PURPOSE

Name, email, phone, date of birth

Yes

Yes

No

App functionality, compliance

Government ID, selfie / liveness (Card users; email deletion requests)

Yes

Yes

No

Identity verification

Financial info (card transactions, balances)

Yes

Yes

No

App functionality

Crypto wallet public addresses

Yes

Yes

No

App functionality

Passkey / recovery password

No

—

—

Stored on device only

Coarse location (IP-derived)

Yes

Yes

No

Fraud and sanctions screening

Device ID, IP, diagnostics, crash logs

Yes

Yes

No

Security, analytics

Contacts, browsing history, health, advertising ID

No

—

—

—

Data is encrypted in transit. Users can request deletion in-app and by email; some data is retained after deletion as required by Canadian anti-money-laundering law.