Privacy Notice

Last modification: 4 August 2026

This Privacy Notice ("Privacy Notice") governs the privacy relations between you ("you", "your") and any holding company, subsidiary or entity belonging to the Propr group of companies ("we" or "Propr"), in regard to how Propr processes and protects your personal data as you use the Propr services (the "Services") provided on Propr's website https://www.propr.xyz/ and its subdomains (the "Website"), and constitutes a legally binding agreement between the parties. Propr encourages you to seek out and read the Privacy Notice to understand how the information that Propr collects about you is used and protected.

Unless stated otherwise herein, references shall be made to the Propr Terms and Conditions, and all the defined terms used in this Privacy Notice, shall have the same meaning as the one given to them in these terms, as the case may be.

1. DEFINITIONS

a) "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control", for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

b) "CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et. Seq, and its implementing regulations, as may be amended from time to time.

c) "Controller" means Propr Limited, a company organized under the laws of the British Virgin Islands, with its registered address at Trinity Chambers, PO Box 4301, Road Town, Tortola, British Virgin Islands, and with company registration number 2211330.

d) The terms "Controller", "Member State", "Processor", "Processing" and "Supervisory Authority" shall have the same meaning as in the GDPR. The terms "Business", "Business Purpose", "Consumer" and "Service Provider" shall have the same meaning as in the CCPA. For the purpose of clarity, within this Privacy Notice, "Controller" shall also mean "Business", and "Processor" shall also mean "Service Provider", to the extent that the CCPA applies. In the same manner, Processor's Sub-processor shall also refer to the concept of Service Provider.

e) "Data Protection Laws" means all applicable and binding privacy and data protection laws and regulations, including those of the European Union, the European Economic Area and Member States, Switzerland, the United Kingdom, Canada, Israel and the United States of America, including the GDPR, the UK GDPR, and the CCPA, applicable to, and in effect at the time of, the Processing of Personal Data hereunder.

f) "Data Subject" means the identified or identifiable person to whom the Personal Data relates.

g) "GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

h) "Personal Data" or "Personal Information" means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with an identified or identifiable natural person.

i) "Sensitive Data" means Personal Data that is protected under a special legislation and requires unique treatment, such as "special categories of data", "sensitive data" or other materially similar terms under applicable Data Protection Laws, which may include any of the following: (a) social security number, tax file number, passport number, driver's license number, or similar identifier (or any portion thereof); (b) financial or credit information, credit or debit card number; (c) information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning a person's health, sex life or sexual orientation, or data relating to criminal convictions and offenses; or (d) Personal Data relating to children.

j) "Standard Contractual Clauses" means (a) in respect of transfers of Personal Data Subject to the GDPR, the Standard Contractual Clauses between controllers and processors, and between processors and processors, as approved by the relevant jurisdiction's authorities (the EU, the UK, Switzerland).

k) "Sub-processor" means any third party that carries out specific Processing activities of Personal Data under Propr's instructions.

l) "UK GDPR" means the Data Protection Act 2018, as well as the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419).

2. PRINCIPLES

2.1. While Processing Personal Data, Propr will respect the following principles:

a) Fairness and Lawfulness - when Processing Personal Data, the individual rights of the Data Subjects must be protected. Personal Data must be collected and processed lawfully, in a fair manner, in good faith and must be proportionate to the objective.
b) Purpose Limitation - Personal Data handled by Propr should be adequate and relevant to the purpose for which they are collected and processed. This requires, in particular, ensuring that the types of Personal Data collected are not excessive for the purpose for which they are collected. Subsequent changes to the purpose are only possible to a limited extent and require substantiation.
c) Transparency - the Data Subjects must be informed of how your Personal Data is being handled. When the Personal Data is collected, the Data Subject must be informed of:
- The existence of the present Privacy Notice
- The identity of the Controller
- The purpose of Personal Data Processing
- Whether the Personal Data is disclosed to Third-parties
d) Accuracy - Personal Data kept on file must be correct and if necessary, kept up to date. Inaccurate or incomplete Personal Data should not be kept on file and deleted.

3. PRIVACY BY DESIGN

3.1. Propr will, both at the time of the determination of the means for Processing and at the time of the Processing itself, implement appropriate technical and organizational measures in order to meet the requirements of the applicable Data Protection Laws, and protect your rights.

3.2. Propr will implement appropriate technical and organizational measures for ensuring that, by default, only Personal Data which are necessary for each specific purpose of the Processing are processed. This obligation applies to the amount of Personal Data Propr collects, the extent of the Processing, the period of storage and accessibility.

4. COLLECTED DATA

4.1. Propr may collect the following types of Personal Data when you visit the Website, use the Services, and when you interact and communicate with Propr through any media or channel.

a) Service Use Data

Login information
Account settings
Value of your demo capital and account currency
Data about the simulated transactions you have completed (such as the type of financial instrument, time of opening and closing the position, amount of investment, profit and loss)
Wallet address

b) Device Data that Propr collects automatically

Operating system
Browser events and version
Device ID
Current URL
Initial referrer and referring domain
Information about computer and internet connection, including IP address, operating system, screen height, and width
Other details including traffic data and location data

c) Data you provide to Propr

Records of communication between you and our company
Details of any claims

d) AML/KYC Data

To comply with our internal compliance frameworks and prevent fraud, identity verification services are performed by our third-party partner, Onfido (now Entrust).
When you undergo verification, you provide your identification documents and biometric data directly to Entrust. Propr Limited does not store, access, or host your raw identity documents or biometric templates on our internal servers.
Entrust processes your data securely in accordance with its own privacy policy. More information is available at the Entrust Identity Verification Services Product Privacy Notice.

e) Payments Data

First Name & Last Name
Address Line
State
City
ZIP

4.2. Propr does not collect Sensitive Data, nor are Propr's Services directed to persons under the age of eighteen (18), and Propr does not knowingly collect or process the Personal Data of such persons.

5. PURPOSES AND LEGAL BASIS

5.1. The following table describes the various purposes for which Propr collects and Processes Personal Data. Please note that not all of the uses below will be relevant to everyone.

Purpose	Description	Legal basis
Providing Propr's Services	Performing Propr's contract with you for the provision of Propr's Services and to satisfy Propr's obligations under the applicable terms and conditions	Necessary for the performance of a contract or Propr's legitimate interest to provide and administer Propr's services
Improving Propr's Services	Developing, optimizing, and improving the performance of the Services	Legitimate interest to develop services and ensure that the services are performing in line with users' expectations
Providing Propr's Website	Operating and administering Propr's Websites and to provide you with the content you access and request	Legitimate interest in providing online content to Propr's users and prospective users regarding Propr's service offering and related information
Improving Propr's Website	Analyzing overall trends and helping us improve the user experience on Propr's Website	Legitimate interest in providing a relevant and well-functioning website for the benefit of Propr's website visitors
Promoting the security of Propr's Website and Services	Tracking use of Propr's Website and Services, and verifying and investigating any suspicious activity	Legitimate interest in promoting the safety and security of Propr's websites and services, and in protecting Propr's rights and the rights of others
Displaying personalized advertisements and content	Conducting market research, advertising, providing personalized information about us on and off Propr's Website and to provide other personalized content based upon your activities and interests	Legitimate interest in advertising Propr's products and services or, where necessary, to the extent users have provided their prior consent
Sending communications	Sending marketing information	Legitimate interest in conducting direct marketing or where users have provided prior consent
Aggregating data	Aggregating data for statistical, research, Website and Service improvement and other purposes. Aggregated data cannot lead to your identification	Legitimate interest in minimizing the amount of Personal Data processed as part of the noted processing activity
Complying with legal obligations	Cooperating with public and government authorities, courts or regulators in accordance with Propr's legal obligations	Legal obligation or Propr's legitimate interest in protecting against misuse or abuse of Propr's websites or services, complying with judicial proceedings, court orders or legal processes, responding to lawful requests, or for auditing purposes

6. SECURITY AND RETENTION

6.1. Your Personal Data is securely hosted on a cloud server based in the European Economic Area (the "EEA"). Propr uses the services of AWS (S3). The latter maintains a comprehensive set of compliance certifications and attestations, including but not limited to ISO 27001, 27017, 27018, NIST 800, PCI DSS, and SOC 1, 2, and 3 reports. More information is available in the AWS Privacy Notice.

6.2. In addition, Propr applies industry standards and adequate technical and organizational measures, in accordance with applicable laws, to ensure that your data is kept secure.

6.3. In the event of a Personal Data breach, Propr shall without undue delay, and where feasible, not later than 72 hours after having become aware of it, notify the breach to the competent Supervisory Authority, unless said breach is unlikely to result in a risk to your rights and freedoms. If the breach is likely to result in a high risk to your rights and freedoms, the Company shall communicate this breach to the affected you, if it is feasible, without undue delay.

6.4. The Company will store your Personal Data for as long as necessary to satisfy the purposes for which your Personal Data was collected or to comply with applicable legal requirements. Your information might be retained for a period based on the contract you have with us, in accordance with relevant industry standards or guidelines, and in accordance with Propr's legitimate business interests, including prevention of promotion abuse and similar activities. Propr might further retain information for business practices based on Propr's legitimate interest such as product and service improvement, fraud prevention, record-keeping, in the event of complaint or enforcing Propr's legal rights.

7. PROCESSORS

7.1. Propr may disclose Personal Data that Propr collects, or you provide:

a) To Propr's Affiliates.
b) To Processors and Sub-processors, including but not limited to contractors, Service Providers, and other third parties Propr uses to support its business and who are bound by contractual obligations to keep Personal Data confidential and use it only for the purposes for which Propr discloses it to them, including but not limited to payment settlement providers like Paysagi.

7.2. Propr may share your Personal Data to any other relevant third parties, in particular if Propr is requested to do so to comply with a court order or law enforcement authorities request, or if Propr find it necessary, as determined in Propr's sole discretion, to investigate, prevent or take action regarding illegal activities, to defend its interest or as otherwise required or permitted by law.

7.3. Unless otherwise stated, the Processors who receive data from Propr are prohibited to use this Personal Data beyond what is necessary to provide the product or service to you, directly or by participating in Propr's activities.

8. TRANSFERS

8.1. When transferring Personal Data, Propr is committed to ensuring that the data importer maintains materially similar security measures for storage and Processing of Personal Data as Propr do. Your Personal Data may be processed, stored and transferred to third parties in the manner and amount as provided in this Privacy Notice, the contract(s) concluded between you and us, and consents you give to us from time to time.

8.2. Personal Data may be transferred from EU Member States and Norway, Iceland, and Liechtenstein (EEA), Switzerland, and the United Kingdom ("UK") to countries that offer an adequate level of data protection under or pursuant to the adequacy decisions published by the relevant authorities of the EEA, Switzerland, and/or the UK as relevant ("Adequacy Decisions"), as applicable, without any further safeguard being necessary.

8.3. If the Processing of Personal Data by Processor includes a transfer (either directly or via onward transfer) to other countries that have not been subject to a relevant Adequacy Decision, and such transfers are not performed through an alternative compliance mechanism recognized by Data Protection Laws (as may be adopted by Processor in its own discretion), the terms set forth in the applicable Standard Contractual Clauses (EU, UK, Swiss, other) shall apply.

9. DIRECT MARKETING

9.1. Subject to the applicable Data Protection Laws, Propr may from time to time send direct marketing materials promoting its Services and/or activities to its users who have subscribed for updates.

9.2. You may, at any time, opt-out of such communications by utilizing the marketing preferences center provided with each direct marketing communication. You may also opt-out of direct marketing by communicating your preferences to Propr at [email protected].

10. THIRD PARTY LINKS

10.1. The Website may contain links which direct you to third party websites. Propr rejects any liability relating to the privacy rules in force on said third party websites, the collection and use of your Personal Data by the latter and relating to the contents of said websites (whether the links are hypertext links or deep-links).

10.2. Furthermore, you acknowledge and agree that using Propr's Website could imply downloading other applications such as, for example, Metamask. Under no circumstances shall Propr be liable for the utilization of these other applications, especially in regards to your Data protection rules.

11. YOUR RIGHTS

11.1. As Data Subjects, you shall have one or more of the following data subject rights with respect to the Personal Data that Propr Processes.

a) Access - you have a right to access your Personal Data, including receiving a copy and to obtain certain information about the Propr's processing activities.
b) Rectification - the GDPR grants you the right to correct inaccurate Personal Data and/or complete incomplete Personal Data.
c) Deletion - you have the right to request erasure of Personal Data (the right to be forgotten). Propr shall take reasonable steps to inform any other Processors also processing the data.
d) Restrict processing - you have the right to restrict processing of Personal Data, under certain circumstances.
e) Portability - you have the right to data portability to:
- receive a copy of the Personal Data in a structured, commonly used and machine-readable format;
- transmit the Personal Data to another data controller (including directly by another data controller where possible).
f) Object to processing - you have the right to object to processing for profiling, direct marketing, and statistical, scientific, or historical research purposes.
g) Object to automated decision making - you have the right to not be subject to automated decision making, including profiling, which has legal or other significant effects on you.
h) Withdraw consent - you may, at any time, withdraw your consent to Propr's processing when the processing is based solely on your consent.

11.2. These rights can be exercised by writing to Propr at [email protected]. Upon receipt of your requests at the contact details provided below, Propr shall reply without undue delay and within the applicable statutory deadlines. If the request is submitted by a person other than you, without providing evidence that the request is legitimately made on your behalf, the request will be rejected.

11.3. Any request to exercise rights is free of charge unless your request is unfounded or excessive (e.g. if you have already requested such Personal Data multiple times in the last twelve months or if the request generates an extremely high workload). In such a case, Propr may charge you a reasonable request fee according to applicable Data Protection Laws.

11.4. Propr may refuse, restrict or defer the provision of Personal Data where it has the right to do so, for example if fulfilling the request will adversely affect the rights and freedoms of others.

11.5. Please note that any request with regards to Personal Data which is publicly available should be submitted directly to the third-party supplier of such data.

12. CHANGES

12.1. Propr reserves the right to make any changes to this Privacy Notice at any time, as Propr deems necessary or desirable. If Propr makes any material changes restricting or affecting in any way your rights, Propr may notify you on the Website and, when possible, by email, prior to the change becoming effective.

12.2. Your continued use of the Website after any such changes or after explicitly accepting the new Privacy Notice upon using the Website shall constitute your consent to such changes. If you do not agree to any given modifications to this Privacy Notice, you should stop using the Website.

13. JURISDICTION AND GOVERNING LAW

13.1. This Privacy Notice and any questions relating thereto shall be governed by the laws of the British Virgin Islands, to the exclusion of any rules of conflict resulting from private international law.

13.2. Any dispute relating to this Privacy Notice must exclusively be brought before the courts of the British Virgin Islands.

14. CONTACT AND COMPLAINTS

14.1. We value your opinion, and if you have any comments or questions about this Privacy Notice, Propr's handling of your Personal Data, a possible Personal Data Breach, or want to exercise your rights, please contact us at the addresses below and Propr will treat your requests or complaints confidentially.

Email: [email protected]
Address: Trinity Chambers, PO Box 4301, Road Town, Tortola, British Virgin Islands

14.2. In addition, you can contact Propr's GDPR Art. 27 EU Representative and Art. 37 Data Protection Officer:

Name: Stefan Belchev
Contact: [email protected]

14.3. If you feel your Personal Data has been mishandled or if Propr has failed to meet your expectations, you are encouraged to contact Propr but you are entitled to complain directly to the relevant Supervisory Authority.