Proton Terms and Conditions

1. Terms and Conditions

Effective Date: August 27, 2020

Welcome to WEBAUTH.COM! This is a User Agreement between You (also referred to herein as “Client,” “User,” or “You” or “Customer”) and Metallicus, Inc. with an address at 660 4th St. #107, San Francisco, California 94107 (“we,” “our,” or “us”) provides its services through its website located at https://www.proton.org/ and related mobile applications and products (collectively the “Services” or “Webauth.com”). Before using our Services, please read the Terms of Service (the “Terms” or the “Agreement”) carefully, along with any other policies or notices on Webauth.com’s website or mobile applications, and our Privacy Policy. Together, these materials contain terms, rules, and guidelines related to your use of Webauth.com. "You” and “your” means you, the Webauth.com User or User interchangeably if you register for a user name, use this Website. As with any asset, the value of Digital Assets or Virtual Currency can go up or down and there can be a substantial risk that you lose money buying, selling, holding, or investing in digital currencies. You should carefully consider whether trading or holding Digital Assets is suitable for you in light of your financial condition. Please note that when you accept this Agreement, you are accepting all of the terms and conditions contained herein. Webauth.com provides self-hosted wallet services for Ethereum based blockchains. By creating or importing a wallet, downloading or running our mobile application, or visiting our website, you are agreeing to our Terms, so please read carefully. These terms outline approved uses of Webauth.com, various licenses that we grant to you, and licenses that you grant us. If you have any questions or comments related to this Agreement, please send us a message on our website at support on https://www.proton.org/ and or contact us through Discord, Facebook, Telegram, or Twitter. If you do not agree to this Agreement or any modifications to this Agreement, you should not use our Services.

HOW YOU ACCEPT THIS POLICY

By creating or importing a locally hosted wallet (a “Wallet”), or visiting our website, you acknowledge that you have read, understood, and agreed to these Terms, as well as the accompanying Privacy Policy. We reserve the right to change these Terms at any time. Any such changes with respect to your use of Webauth.com will take effect immediately when posted on our website or on our mobile application. Your continued use of Webauth.com following any such change will signify your acceptance to be bound by the then current Terms. Please check the effective date above to determine if there have been any changes since you have last reviewed these Terms. If you do not agree to this Agreement or any modifications to this Agreement, you should not use Webauth.com. Failure or delay by Webauth.com in enforcing or partially enforcing any provision of these Terms shall not be construed as a waiver of any rights.

ELIGIBILITY

To be eligible to use Webauth.com, you must be at least eighteen (18) years old and be able to form legally binding contracts. If you are using our Services on behalf of a legal entity, you further represent and warrant that: (a) the legal entity is duly organized and validly existing under the applicable laws of the jurisdiction of its organization; and (b) you are duly authorized by such legal entity to act on its behalf. You can only use our Services if permitted under the laws of your jurisdiction. Please make sure that these Terms are in compliance with all laws, rules, and regulations that apply to you. By using Webauth.com, you represent and warrant that you meet all eligibility requirements that we outline in these Terms. We may still refuse to let certain people access or use Webauth.com, however, and we reserve the right to change our eligibility criteria at any time.

THE BLOCKCHAIN SERVICES

Webauth.com is software that (a) generates Wallet addresses and encrypted private keys that you may use to send and receive Ethereum and related cryptographically secured tokens (the “Virtual Currency”); (b) allows users to browse third party decentralized applications ; and (c) facilitates the submission of Virtual Currency transaction data to Ethereum-based blockchains (the “Ethereum Networks”) without requiring you to download or install the associated Ethereum based software to your local device. Wallet Address, Private Key, and Backup Capabilities. An encrypted backup of certain information associated with the Wallet can be stored on your device in Keystore JSON format. The private key is connected to the Wallet address and, together, they can be used to authorize the transfer of Virtual Currency to and from that Wallet address. You are solely responsible for maintaining the security of your private key and any mnemonic (backup) phrase associated with your Wallet. You must keep your Wallet address, mnemonic (backup) phrase, and private key access information secure. Failure to do so may result in the loss of control of Virtual Currency associated with the Wallet. Webauth.com Cannot Assist With Password Retrieval. Webauth.com stores your Wallet address but does not receive or store your Wallet password, encrypted private key, unencrypted private key, or mnemonic (backup) phrase associated with your Wallet. We cannot, therefore, assist you with Wallet password retrieval. We cannot generate a new password for your Wallet if you fail to remember your original password. If you have not safely stored a backup of any Wallet address and private key pairs maintained in your Wallet, you accept and acknowledge that any Virtual Currency you have associated with such a Wallet address will become inaccessible if you do not have your Wallet password. Virtual Currency Transactions. In order to be completed, all proposed Virtual Currency transactions must be confirmed and recorded in the Virtual Currency’s associated public blockchain. Such networks are decentralized, peer-to-peer networks supported by independent third parties, which we do not own, control, or operate. We have no control over the Ethereum Networks and, therefore, cannot and do not ensure that any transaction details that you submit via our Services will be confirmed and processed. By using Webauth.com, you acknowledge and agree that the transaction details you submit may not be completed, or may be substantially delayed, by the Ethereum Networks. Webauth.com Does Not Store or Transmit Virtual Currency. We do not store, send, or receive Virtual Currency. Any transfer that occurs in any Virtual Currency occurs on the Ethereum-based blockchains and not on a network owned by us. We therefore do not guarantee that Webauth.com can affect the transfer of title or right in any Virtual Currency. Accuracy of Information Provided by User. You represent and warrant that any information you provide via the Services is accurate and complete. You accept and acknowledge that we are not responsible for any errors or omissions that you make in connection with any Virtual Currency transaction initiated via the Services. We strongly encourage you to review your transaction details carefully before attempting to transfer a Virtual Currency.

WALLET REGISTRATION AND ACCOUNT INFORMATION

You must either import or create a Wallet in order to use Webauth.com. When you create a Wallet, you will be assigned a private key. You will be prompted to download and save a keystore - your private key encrypted with a password. You will be responsible for maintaining the confidentiality of your private key and keystore and will be fully responsible for any and all activities that occur under your account. You agree to immediately notify us of any unauthorized use of your password, account, or any other breach of security. We will not be liable for any loss or damage arising from your failure to comply with this paragraph. When you create a Wallet, you are strongly advised to take precautions in order to avoid loss of access to and/or control over your Wallet. Suggested measures include, but are not limited to, the following: (a) creating a strong password that you do not use for any other website or online service; (b) using the backup functionality provided by the Wallet or safeguard your private key and mnemonic (backup) phrase on an external hard drive which, all users, especially users who have more than $100,000 USD in assets, are encouraged to do even if they are utilizing the Services’ backup functionality; (c) maintaining the security of your Wallet by protecting the private key and mnemonic (backup) phrase associated with your Wallet by, for example, limiting access to your computer and your Wallet; and (d) promptly notifying us if you discover or otherwise suspect any security breaches related to your Wallet. Push Notifications. You may agree to receive push notifications from Webauth.com that will alert you when Ethereum-based blockchains are congested and when transactions involving your Wallet have been completed. Push notifications can be enabled to display information about Token Launches. If you would like to receive push notifications, you must opt in to the service by accessing “Settings” and enabling “Push Notifications”. Payment and Fees. Webauth.com does not currently charge any fees for any of its Services. However, we reserve the right to do so in the future and, in such case, any applicable fees will be displayed prior to you using any service to which a fee applies. Transactions. Once transaction details have been submitted via the Services, we cannot assist you to cancel or otherwise modify your transaction. Webauth.com has no control over any Ethereum-based blockchain and does not have the ability to facilitate any cancellation or modification requests. You must ensure that you have an adequate balance in your Wallet and/or gas to complete transactions before initiating a transaction. You acknowledge and agree that we will not be liable for any failed transactions due to insufficient funds or gas associated with your Webauth.com account. Taxes. It is your responsibility to determine what, if any, taxes apply to the transactions that you have submitted transaction details for via the Services, and it is your responsibility to report and remit the correct tax to the appropriate tax authority. You agree that we are not responsible for determining whether taxes apply to your Ethereum based transactions or for collecting, reporting, withholding, or remitting any taxes arising from any Virtual Currency related transactions.

THIRD PARTY SERVICES AND CONTENT

In no event shall a description or reference to a third party’s product or service (including, but not limited to, providing a description or reference via hyperlink) be construed as an endorsement or promotion of such third party products or services by us. We retain the exclusive right to add to, modify, or cancel the availability of any Third Party Service. You may agree to receive push notifications from Third Party Content providers. In order to receive push notifications, you must opt in to the service. Push notifications will not be automatically enabled on your device for Third Party Content. We do not control, endorse, or adopt any Third Party Content shared through push notifications, and will have no responsibility for Third Party Content including, but not limited to, token availability and/or sales. If, to the extent permitted by Webauth.com, you grant express permission to a third party to access or connect to your Webauth.com account, either through the third party’s product or service or through Webauth.com, you acknowledge that granting permission to a third party to take specific actions on your behalf does not relieve you of any of your responsibilities under this Agreement. You are fully responsible for all acts or omissions of any third party with access to your Webauth.com account.

INTELLECTUAL PROPERTY

Webauth.com was developed under a GPL open source license. Information regarding Webauth.com’s current software can be found at https://github.com/ProtonWallet. Since software development is community-based, it can be accessed, used, and shared, in modified or unmodified form, by anyone. Please be aware that GPL is a copyleft license, which means that any derivative works can only be distributed under the same license terms as the original software. If you have any questions, you should review GNU’s terms and conditions at https:// www.gnu.org/licenses/gpl-3.0.en.html. Webauth.com also contains copyrighted material and trademarks including, but not limited to, text and graphics (the “Content”), which is protected by copyright law, registered and unregistered trademarks, and other intellectual property rights. Unless otherwise provided, we exclusively own the Content. Your use of the Services does not grant you any right, title, or interest in the Content. You agree that you will not copy, transmit, distribute, sell, license, create derivative works from, or, in any other way, exploit any of the Content, in whole or in part.

YOUR USE OF WEBAUTH.COM

As a user of the Services, we grant you a limited, personal, non-commercial, non-exclusive, non-transferable, and revocable license to use Webauth.com. When using our Services, we ask that you follow some basic rules: Don’t Use Our Services to Break the Law. You agree that you will not violate any laws when using our Services. This includes any local, provincial, state, federal, national, or international laws that may apply to you. You agree that you will not use our Services to pay for, support, or otherwise engage in any illegal activities including, but not limited to, illegal gambling, fraud, money laundering, or terrorist activities. If we discover that you have violated this Agreement or other regulatory requirements including, but not limited to, the Bank Secrecy Act, by participating in money laundering or by financing terrorist activities, we will take proportional disciplinary action. You further agree not to encourage or induce any third party to engage in any of the activities prohibited hereunder. Don’t Interfere With Other’s Use of the Services. You agree that you will not use or attempt to use another user’s Wallet without authorization or use our Services in any manner that could interfere, disrupt, negatively affect, or inhibit other users from fully enjoying it. Don’t Try to Harm Our System. You agree not to distribute any virus or other harmful computer code through Webauth.com. You also agree to not take any action that may impose an unreasonable or disproportionately large load on our or any of our third party providers’ infrastructure. Don’t Attempt to Circumvent Our Security. You agree not to bypass, circumvent, or attempt to bypass or circumvent any measures that we may use to prevent or restrict access to the Services including, without limitation, other accounts, computer systems, or networks connected to the Services. Any use of Webauth.com other than as specifically authorized in this Agreement, without our prior written permission, is strictly prohibited and will terminate your license to use Webauth.com.

LIMITATION OF LIABILITY & DISCLAIMER OF WARRANTIES

You understand and agree that we have no control over, and no duty to take any action regarding: Failures, disruptions, errors, or delays in processing Virtual Currency that you may experience while using the Services; The risk of failure of hardware, software, and Internet connections; The risk of malicious software being introduced or found in the software underlying Webauth.com; The risk that third parties may obtain unauthorized access to information stored within your Wallet, including, but not limited to your Wallet address, private key, and mnemonic (backup) phrase; and The risk of unknown vulnerabilities in or unanticipated changes to the Ethereum Networks. You release us from all liability related to any losses, damages, or claims arising from: (a) user error such as forgotten passwords, incorrectly constructed transactions, or mistyped Virtual Currency addresses; (b) server failure or data loss; (c) unauthorized access to the Webauth.com application; (d) bugs or other errors in the Webauth.com software; and (e) any unauthorized third party activities, including, but not limited to, the use of viruses, phishing, brute forcing, or other means of attack against Webauth.com. We make no representations concerning any Third Party Content contained in or accessed through our Services. Any other terms, conditions, warranties, or representations associated with such content, are solely between you and such organizations and/or individuals.

Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL WE OR ANY OF OUR OFFICERS, DIRECTORS, REPRESENTATIVES, AGENTS, SERVANTS, COUNSEL, EMPLOYEES, CONSULTANTS, LAWYERS, AND OTHER PERSONNEL AUTHORIZED TO ACT, ACTING, OR PURPORTING TO ACT ON OUR BEHALF (COLLECTIVELY THE PROTON PARTIES”) BE LIABLE TO YOU UNDER CONTRACT, TORT, STRICT LIABILITY, NEGLIGENCE, OR ANY OTHER LEGAL OR EQUITABLE THEORY, FOR: (A) ANY LOST PROFITS, DATA LOSS, COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR DIRECT, INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, COMPENSATORY, OR CONSEQUENTIAL DAMAGES OF ANY KIND WHATSOEVER RESULTING FROM: (I) YOUR USE OF, OR CONDUCT IN CONNECTION WITH, OUR SERVICES; (II) ANY UNAUTHORIZED USE OF YOUR WALLET ADDRESS AND/OR PRIVATE KEY DUE TO YOUR FAILURE TO MAINTAIN THE CONFIDENTIALITY OF YOUR WALLET; (III) ANY INTERRUPTION OR CESSATION OF TRANSMISSION TO OR FROM THE SERVICES; OR (IV) ANY BUGS, VIRUSES, TROJAN HORSES, OR THE LIKE THAT ARE FOUND IN THE PROTON WALLET SOFTWARE OR THAT MAY BE TRANSMITTED TO OR THROUGH OUR SERVICES BY ANY THIRD PARTY (REGARDLESS OF THE SOURCE OF ORIGINATION), OR (B) ANY DIRECT DAMAGES IN EXCESS OF (IN THE AGGREGATE) OF THE GREATER OF: (I) FEES PAID TO US FOR THE APPLICABLE PRODUCTS; OR (II) $100.00. THESE LIMITATIONS APPLY REGARDLESS OF LEGAL THEORY, WHETHER BASED ON TORT, STRICT LIABILITY, BREACH OF CONTRACT, BREACH OF WARRANTY, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT WE WERE ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

Warranty Disclaimer

WEBAUTH.COM IS PROVIDED "AS IS" AND WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, RELATING TO THE SERVICES AND UNDERLYING SOFTWARE OR ANY CONTENT ON THE SERVICES, WHETHER PROVIDED OR OWNED BY US OR BY ANY THIRD PARTY, INCLUDING WITHOUT LIMITATION, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, FREEDOM FROM COMPUTER VIRUS, AND ANY IMPLIED WARRANTIES ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE IN TRADE, ALL OF WHICH ARE EXPRESSLY DISCLAIMED. IN ADDITION, WE DO NOT REPRESENT OR WARRANT THAT THE CONTENT ACCESSIBLE VIA THE SERVICES IS ACCURATE, COMPLETE, AVAILABLE, CURRENT, FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS, OR THAT THE RESULTS OF USING THE SERVICES WILL MEET YOUR REQUIREMENTS. SOME STATES DO NOT ALLOW THE DISCLAIMER OF IMPLIED WARRANTIES, SO THE FOREGOING DISCLAIMERS MAY NOT APPLY TO YOU. THIS PARAGRAPH GIVES YOU SPECIFIC LEGAL RIGHTS AND YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE.

INDEMNITY

To the extent permitted by applicable law, you agree to defend, indemnify, and hold harmless PROTON from and against any and all claims, damages, obligations, losses, liabilities, costs or debt, and expenses (including, but not limited to, attorney’s fees) arising from: (a) your use of and access to the Services; (b) any feedback or submissions you provide to us concerning Webauth.com; (c) your violation of any term of this Agreement; or (d) your violation of any law, rule, or regulation, or the rights of any third party.

TIME LIMITATION ON CLAIMS

You agree that any claim you may have arising out of or related to your relationship with us must be filed within one year after such claim arises, otherwise, your claim in permanently barred.

GOVERNING LAW

No matter where you’re located, the laws of the State of Delaware will govern these Terms and the parties’ relationship as if you signed these Terms in Delaware, without regard to Delaware’s conflicts of laws rules. If any provisions of these Terms are inconsistent with any applicable law, those provisions will be superseded or modified only to the extent such provisions are inconsistent. The parties agree to submit to the federal or state courts in San Francisco County, California, in the United States of America for exclusive jurisdiction of any dispute arising out of or related to your use of the Services or your breach of these Terms. You waive any objection based on lack of personal jurisdiction, place of residence, improper venue, or forum non conveniens in any such action.

TERMINATION

In the event of termination concerning your license to use Webauth.com, your obligations under this Agreement will still continue. Your access to the funds in your Wallet after termination will depend on your access to your backup of your Wallet address and private key.

DISCONTINUANCE OF SERVICES

We may, in our sole discretion and without cost to you, with or without prior notice, and at any time, modify or discontinue, temporarily or permanently, any portion of our Services. You are solely responsible for storing outside of the Services a backup of any Wallet address and private key pair that you maintain in your Wallet. Maintaining an external backup of any Wallet address and private key pairs associated with your Wallet will allow you to access the Ethereum Networks upon which your Wallet is secured. Such a backup will allow the user to fully restore their Wallet at any time without cost or loss of the user’s Virtual Currency. If you do not maintain a backup of your Wallet data outside of the Services, you will be not be able to access the Virtual Currency associated with your Wallet. Webauth.com shall not be held responsible or liable for any loss of Virtual Currency in the event that we discontinue or depreciate the Services.

NO WAIVER

Our failure to exercise or delay in exercising any right, power, or privilege under this Agreement shall not operate as a waiver; nor shall any single or partial exercise of any right, power, or privilege preclude any other or further exercise thereof.

SEVERABILITY

If it turns out that any part of this Agreement is invalid, void, or for any reason unenforceable, that term will be deemed severable and limited or eliminated to the minimum extent necessary. The limitation or elimination of the term will not affect any other terms.

ARBITRATION & WAIVER OF CLASS ACTION.

THESE TERMS INCLUDE AN AGREEMENT TO RESOLVE DISPUTES BY ARBITRATION ON AN INDIVIDUAL BASIS AND THUS PROHIBIT CLASS ACTION CLAIMS. If you do not agree to these Terms (including all applicable Additional Agreements), please do not click the “I accept” box or use any of the Services or create an Account. The parties agree to arbitrate any dispute arising from this Agreement or your use of the Services on an individual basis. ARBITRATION PREVENTS YOU FROM SUING IN COURT OR FROM HAVING A JURY TRIAL. THE PARTIES HEREBY EXPRESSLY WAIVE TRIAL BY JURY. The parties agree that: (a) any arbitration will occur in San Francisco, California; and (b) the arbitration will be conducted confidentially by a single arbitrator in accordance with the rules of American Arbitration Association for arbitration of consumer-related disputes, in the English language, and with limited discovery. At your request, hearings may be conducted in person or by telephone and the arbitrator may provide for submitting and determining motions on briefs, without oral hearings. Other than class procedures and remedies discussed below, the arbitrator has the authority to grant any remedy that would otherwise be available to a court or other tribunal. THE PREVAILING PARTY IN ANY ACTION OR PROCEEDING TO ENFORCE THESE TERMS SHALL BE ENTITLED TO COSTS AND ATTORNEYS' FEES. THE ARBITRAL DECISION MAY BE ENFORCED IN ANY COURT. WHETHER THE DISPUTE IS HEARD IN ARBITRATION OR IN COURT, YOU AND WEBAUTH.COM WILL NOT COMMENCE AGAINST THE OTHER A CLASS ACTION, CLASS ARBITRATION, OR REPRESENTATIVE ACTION OR PROCEEDING.

FORCE MAJEURE

We shall not be held liable for any delays, failure in performance, or interruptions of service which result directly or indirectly from any cause or condition beyond our reasonable control, including but not limited to: any delay or failure due to any act of God, act of civil or military authorities, act of terrorism, civil disturbance, war, strike or other labor dispute, fire, interruption in telecommunications or Internet services or network provider services, failure of equipment and/or software, other catastrophe, or any other occurrence which is beyond our reasonable control and shall not affect the validity and enforceability of any remaining provisions.

ASSIGNMENT

You agree that we may assign any of our rights and/or transfer, sub contract, or delegate any of our obligations under these Terms. Your agreement to these Terms is personal to you and you may not transfer or assign it to any third party.

ENTIRE AGREEMENT

This Agreement sets forth the entire understanding and agreement as to the subject matter hereof and supersedes any and all prior discussions, agreements, and understandings of any kind (including, without limitation, any prior versions of this Agreement) and every nature between us. Except as provided for above, any modification to this Agreement must be in writing and must be signed by both parties.

QUESTIONS OR COMMENTS

We welcome comments, questions, concerns, or suggestions. Please send us a message on our contact page at https://www.proton.org/ or via Discord, Facebook, Telegram, or Twitter.

2. Privacy Policy

Effective Date: August 27, 2020

This Privacy Policy describes how Metallicus Inc. https://www.proton.org/ and Metal,” "us," "Metal” or “our”) collects, uses, stores, shares, and protects your Personal Information whenever you participate in, download, view, or use our websites (including, without limitation, the site, metalx.com, “Site”), any of our services, including, without limitation, the Proton services, or any mobile application offered by us, any pages, features or content that Proton have offered or sponsored by us, any of our application programming interfaces (“API”) or any third party applications relying on such API (collectively, the “Services”). By downloading, using, or participating in the Services, you consent to the data practices prescribed in this Privacy Policy. As specified in further detail below, Proton may periodically change this Privacy Policy. It is your responsibility to review this Privacy Policy frequently and Proton encourages you to visit this page often. By accessing and using our Services, you signify acceptance to the terms of this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described below. If you do not agree with or you are not comfortable with any aspect of this Privacy Policy, you should immediately discontinue access or use of our Services. Please take a moment to read this Privacy Policy carefully. If you have any questions about this Policy, please submit your request via https://www.proton.org/ and Where Proton requires your consent to process your personal information, Proton will ask for your consent to the collection, use, and disclosure of your personal information as described further below. Proton may provide additional "just-in-time" disclosures or information about the data processing practices of specific Services. These notices may supplement or clarify our privacy practices or may provide you with additional choices about how Proton process your data.

CHANGES TO THIS PRIVACY POLICY Proton may modify this Privacy Policy from time to time which will be indicated by changing the date at the top of this page. If Proton makes any material changes, Proton will notify you by email (sent to the email address specified in your account), by means of a notice on our Services prior to the change becoming effective, or as otherwise required by law. Proton operates entities around the world (collectively “Proton”, “Metal”, “us” and “our”), in order to provide Services to our customers. The above table describes which entity (or entities) you are contracting with: The Proton operating entity you contract with determines the means and purposes of processing your personal information in relation to the Services provided to you (typically referred to as a “data controller”). You may be asked to provide personal information anytime you are in contact with any Proton companies. The Proton companies may share your personal information with each other and use it consistent with this Privacy Policy. They may also combine it with other information to provide and improve our products, services, and content (additional details below). For example, even if you do not reside in the United States (the “US”), your information may be shared with Metal Financial Services, Inc. (U.S.) which provides global support for all Services including technical infrastructure, product development, security, compliance, fraud prevention, and customer support.

COLLECTION OF INFORMATION Information You Provide To Us Proton collects Personal Information you provide directly or indirectly to us. This includes information you provide to us, information which is collected about you automatically, and information Proton obtains from third parties. “Personal Information” means information about you that is personally identifiable or from which you can be identified together with other information (e.g., your name, address, email address or phone number). Personal Information does not include information that is de-identified, aggregated, or that cannot be reasonably linked with an identifiable individual. For example, Proton collects Personal Information about you when you create an account to use one of our Services, download or use our mobile applications, complete a transaction on our website or mobile applications, fill out a form through our websites or mobile applications, respond to surveys from us, enter into a sweepstakes, contest or other promotion that Proton makes available to you, post messages to our forums or otherwise communicate with us. The type of Personal Information Proton collects varies, depending upon which Services you access, participate in or are using. The types of Personal Information Proton may collect are as follows: • Personal Identification information, such as your full name, mailing address, telephone number, date of birth, nationality, gender, signature, utility bills and email address. • Financial information, such as bank account numbers, credit card numbers and virtual currency account information, transaction history, trading data and or tax identification. • Government identification numbers, such as your social security number or a state-issued identification number. Government issued identity document such as Passport, Driver's License, National Identity Card, State ID Card, Tax ID number, passport number, driver's license details, national identity card details, visa information, and/or any other information deemed necessary to comply with our legal obligations under financial or anti-money laundering laws. • Biographic or demographic information, such as your date of birth, gender, occupation, employment status and any other Personal Information you choose to provide about yourself. • Transaction Information: Information about the transactions you make on our Services, such as the name of the recipient, your name, the amount, and/or timestamp. • Employment Information: Office location, job title, and/or description of role. • Correspondence: Survey responses, information provided to our support team or user research team.

Information Proton Collects From Other Sources Proton may also obtain information from other sources as permitted or required by law and combine that with Personal Information Proton collects through the Services. For example, Proton may collect nonpublic Personal Information about you from third parties, including identity verification services. Proton obtains financial transaction history through a vendor (including a user’s bank account or credit card account transaction history) as necessary to implement certain Services. Proton may also obtain Personal Information when Proton acquires a business or assets from another company. • Public Databases, Credit Bureaus & ID Verification Partners: Proton obtains information about you from public databases and ID verification partners for purposes of verifying your identity in accordance with applicable law. ID verification partners like Trulioo, Inc. use a combination of government records and publicly available information about you to verify your identity. Such information may include your name, address, job role, public employment profile, credit history, status on any sanctions lists maintained by public authorities, and other relevant data. Proton obtains such information to comply with our legal obligations, such as anti-money laundering laws. In some cases, Proton may process additional data about you to ensure our Services are not used fraudulently or for other illicit activities. In such instances, processing is necessary for us to continue to perform our contractual obligations with you and others. • Blockchain Data: Proton may analyze public blockchain data to ensure parties utilizing our Services are not engaged in illegal or prohibited activity under our Terms, and to analyze transaction trends for research and development purposes. • Joint Marketing Partners & Resellers: For example, unless prohibited by applicable law, joint marketing partners or resellers may share information about you with us so that Proton can better understand which of our Services may be of interest to you. • Advertising Networks & Analytics Providers: Proton works with these providers to provide us with de-identified information about how you found our Sites and how you interact with the Sites and Services. This information may be collected prior to account creation - for more information on how you can manage collection of this data, please see our Cookie Policy below.

Information Proton Collects Automatically Proton receives and stores certain types of information automatically, such as whenever you interact with the Site or use the Services. This information helps us address customer support issues, improve the performance of our Site and applications, provide you with a streamlined and personalized experience, and fraud prevention by detecting unauthorized access. Information collected automatically includes: When you download, access or use the Services, Proton automatically collects Personal Information as follows: • Transaction information: Proton collects information about the transaction you complete via the Services. • Location information: Proton may collect precise geolocation/tracking information from your mobile device when you access or use our mobile applications or other Sites including at the country and state level. Proton will also collect your personal IP addresses, browser fingerprint browser name and version and operating system. Proton also collects user location information when you access certain services on our websites, such as or our Proton services. • Device and log information: Proton collects information about the computer or mobile device you use in connection with the Services, including device type and identifiers, mobile network information, type of operating system, and the type of browser used. Proton also logs information about your use of the Services, including access times, pages viewed, IP address, other standard web log data, and the page visited before and after navigating to our websites. This may include authentication data, security questions, click-stream data, public social networking posts, and other data collected via cookies and similar technologies. See infra. Device event information (such as crashes, system activity and hardware settings, browser type, browser language, the date and time of your request and referral URL); how your device interacts with our Sites and Services, including pages accessed and links clicked.

COOKIES & LOCAL STORAGE Metal may use cookies, pixel tags, web beacons, and other tracking technologies to collect information about you when you interact with the Services, including information about your browsing or navigation behavior on the Services. Cookies are small data files sent from our web servers to your computer or mobile device that enable us to, for example, capture how you arrived at the Services, when you return, which pages or features on the Services you use or visit, and to recognize that you are already logged on when Proton receives a page request from your browser. You can modify your browser settings to decline cookies or notify you when a cookie is set. However, if you choose to decline cookies, you may not be able to use certain interactive features of our website. You can always go back and delete cookies from your browser, however, this means that any settings or preferences controlled by those cookies will also be deleted and you may need to recreate them. For more information, see www.allaboutcookies.org. When you access or use the Services, Proton may use industry-wide technologies such as “cookies” or similar technologies, which stores certain information on your computer (“Local Storage”) and which will allow us to enable automatic activation of certain features, and make your experience with our Services much more convenient and effortless. The cookies used by the Service are created per session, do not include any information about you other than your session key (removed as your session ends (usually after 24 hours)) and the ability to login again quickly (automatically removed usually after two years, unless manually removed on an earlier occasion). It is easy to prohibit the Local Storage. Most browsers will allow you to erase cookies from your computer’s hard drive, block acceptance of cookies, or receive a warning before a cookie is stored. However, if you block or erase cookies your online experience may be limited. OTHER THAN THE STANDARD COOKIES MENTIONED ABOVE, PLEASE NOTICE THAT PROTON MAY ALSO MAKE USE OF E-TAGS WHICH WILL ENABLE US TO IDENTIFY USER BEHAVIORS. SUCH E-TAGS CAN ONLY BE REMOVED BY US AFTER RECEIVING A REQUEST FROM YOU IN WRITING IN THE MATTER. Proton may also use certain third-party cookies. This is a different kind of cookie, stored on your computer by a third party, rather than by us. This kind of cookie is read-only (and not altered by us) each time you use the Service and when you visit certain websites or applications that use similar cookies.

ANONYMIZED AND AGGREGATED DATA Anonymization is a data processing technique that removes or modifies personal information so that it cannot be associated with a specific individual. Except for this section, none of the other provisions of this Privacy Policy applies to anonymized or aggregated customer data (i.e. information about our customers that Proton combines together so that it no longer identifies or references an individual customer). Proton may use anonymized or aggregate customer data for any business purpose, including to better understand customer needs and behaviors, improve our products and services, conduct business intelligence and marketing, and detect security threats. Proton may perform our own analytics on anonymized data or enable analytics provided by third parties. Types of data Proton may anonymize includes transaction data, click-stream data, performance metrics, and fraud indicators.

USE OF YOUR PERSONAL INFORMATION Proton may disclose any Personal Information Proton collects about you, whether you are a current or former customer, user of or participant in the Services, including nonpublic Personal Information and any other information Proton collects to all companies affiliated with Metal, and with nonaffiliated third parties, which include non-financial companies, such as email service providers, identity and fraud verification services, and others, such as other users of our Services with which you engage in transactions. Proton may make such disclosures: Proton uses your Personal Information as follows: • Provide the Services, customer support, and conduct promotions (including sweepstakes and contests) for loss prevention and anti-fraud purposes. • Process transactions, send notices about your transactions, and maintain accurate records of transactions (including location data). • Manage your account(s) and send technical notices, updates, security alerts, and support and administrative messages. • Resolve disputes, collect fees, and troubleshoot problems. • Prevent potentially prohibited or illegal activities, comply with U.S. and international financial regulations, and enforce our user agreements and policies. • Personalize, measure, and improve the Services. • Deliver our marketing and promotional offers via email. • Link or combine your Personal Information with information Proton obtains from others to help understand your needs and provide you with better service.

Proton uses your Personal Information for the following key purposes: TO CONTACT OUR CONSUMERS: subject to applicable law, Proton or our third-party service and business providers may send you communications. Such communications are designed to make your experience of our Services more efficient and may include, but are not limited to: notifications about our Services and other communications (including important news that could affect your relationship with us), communications about promotions and our mobile application features. Where required under applicable data privacy laws, Proton will not send you marketing communications without your prior consent. LEGAL PURPOSES: Proton may use and share Personal Information for legal purposes, including financial, regulatory, tax, and other legal obligations, and to respond to governmental or regulatory requests or subpoenas or for litigation purposes. Our Services are subject to laws and regulations requiring us to collect, use, and store your personal information in certain ways. For example, Proton must identify and verify customers using our Services in order to comply with anti-money laundering laws across jurisdictions. This includes collection and storage of your photo identification and any biometric information if applicable. In addition, Proton uses third parties to verify your identity by comparing the personal information you provide against third-party databases and public records. When you seek to link a bank account to your Proton Account, Proton may require you to provide additional information which Proton may use in collaboration with service providers acting on our behalf to verify your identity or address, and/ or to manage risk as required under applicable law. If you do not provide personal information required by law, Proton will have to close your account immediately. FOR OUR LEGITIMATE BUSINESS INTERESTS AND THOSE OF A THIRD PARTY: Proton may use your Personal Information to manage our legal, regulatory, financial and business requirements, including obtaining legal advice, in the course of disputes and litigation, internal and/or regulatory investigations. FOR OUR BUSINESS PURPOSES: Proton may use your Personal Information to help us efficiently operate the Services, to count and recognize visitors to our Services, to enable certain features on or in our Services, and for other purposes related to managing our business Proton handles sensitive information, such as your identification and financial data, so it is very important for us and our customers that Proton actively monitor, investigate, prevent, and mitigate any potentially prohibited or illegal activities, enforce our agreements with third parties, and/or prevent and detect violations of our posted user agreement or agreements for other services. In addition, Proton may need to collect fees based on your use of our Services. Proton collects information about your account usage and closely monitor your interactions with our Services. Proton may use any of your personal information collected for these purposes. The consequences of not processing your personal information for such purposes is the termination of your account. For example, when you want to store cryptocurrency on our platform, Proton requires certain information such as your identification, contact information, and payment information. Proton cannot provide you with Services without such information. FOR FRAUD PROTECTION AND DETECTION: Proton processes your personal information in order to help detect, prevent, and mitigate fraud and abuse of our Services and to protects you against account compromise or funds loss related to such fraud. FOR COMMUNICATION WITH OUR CONSUMERS: Proton sends administrative or account-related information to you to keep you updated about our Services, informs you of relevant security issues or updates, or provides other transaction-related information. Without such communications, you may not be aware of important developments relating to your account that may affect how you can use our Services. You may not opt-out of receiving critical service communications, such as emails or mobile notifications sent for legal or security purposes. TO PROVIDE CUSTOMER SUPPORT: Proton processes your personal information when you contact us to resolve any questions, disputes, collect fees, or to troubleshoot problems. Without processing your personal information for such purposes, Proton cannot respond to your support questions and ensure your uninterrupted use of the Services. FOR QUALITY CONTROL: Proton processes your personal information for quality control and staff training to make sure Proton continue to provide you with accurate information. If Proton does not process personal information for quality control purposes, you may experience issues on the Services such as inaccurate transaction records or other interruptions. FOR CYBERSECURITY: Proton processes your personal information in order to enhance security, monitor and verify identity or Service access, combat spam or other malware or security risks and to comply with applicable security laws and regulations. The threat landscape on the internet is constantly evolving, which makes it more important than ever that Proton have accurate and up-to-date information about your use of our Services. Without processing your personal information, Proton may not be able to ensure the security of our Services. FOR RESEARCH AND DEVELOPMENT: Proton processes your personal information to better understand the way you use and interact with Metal X's Services. In addition, Proton uses such information to customise, measure, and improve Proton's Services and the content and layout of our website and applications, and to develop new services. Without such processing, Proton cannot ensure your continued enjoyment of our Services. TO IMPROVE THE CONSUMER EXPERIENCE Proton processes your personal information to provide a personalized experience and implement the preferences you request. For example, you may choose to provide us with access to certain personal information stored by third parties. Without such processing, Proton may not be able to ensure your continued enjoyment of part or all of our Services. IN THE CASE OF CORPORATE ACQUISITIONS, MERGERS, OR TRANSACTIONS Proton may process any information regarding your account and use of our Services as is necessary in the context of corporate acquisitions, mergers, or other corporate transactions. You have the option of closing your account if you do not wish to have your personal information processed for such purposes. TO PROMOTE MARKETING Based on your communication preferences, Proton may send you marketing communications (e.g. emails or mobile notifications) to inform you about our events or our partner events; to deliver targeted marketing; and to provide you with promotional offers. Our marketing will be conducted in accordance with your advertising marketing preferences and as permitted by applicable law. DIRECT MARKETING: Direct marketing includes any communications to you that are only based on advertising or promoting our products and Services. Proton will only contact you by electronic means (email or SMS) based on our legitimate interests, as permitted by applicable law, or with your consent. To the extent Proton can rely on legitimate interest under the applicable law, Proton will only send you information about our Services that are similar to those which were the subject of a previous sale or negotiations of a sale to you. If you are a new customer, Proton will contact you by electronic means for marketing purposes only if you have consented to such communication. If you do not want us to send you marketing communications, submit an OPT-OUT written request via https://www.proton.org/ and You may raise such objection with regard to initial or further processing for purposes of direct marketing, at any time and free of charge. Direct marketing includes any communications to you that are only based on advertising or promoting our products and services. THIRD PARTY MARKETING: Proton will obtain your express consent before Proton shares your personal information with any third parties for marketing purposes. FOR ANY OTHER PURPOSES Subject to applicable law, Proton may use your Personal Information for additional purposes in connection with the Services, where you have provided your prior consent.

DISCLOSURE OF YOUR PERSONAL INFORMATION Proton takes care to allow your personal information to be accessed only by those who require access to perform their tasks and duties, and to share only with third parties who have a legitimate purpose for accessing it. Proton will never sell or rent your personal information to third parties without your explicit consent. Proton will only share your information in the following circumstances:

UNITED STATES Proton will not use your personal information for purposes other than those purposes Proton has disclosed to you, without your permission. From time to time, and as required under the applicable law, Proton may request your permission to allow us to share your personal information with third parties. You may opt out of having your personal information shared with third parties, or allowing us to use your personal information for any purpose that is incompatible with the purposes for which Proton originally collected it or subsequently obtained your authorization. If you choose to so limit the use of your personal information, certain features or Proton Services may not be available to you. EEA DATA SUBJECTS Legal Bases for Processing your Information For individuals who are located in the European Economic Area, United Kingdom or Switzerland (collectively “EEA Residents”) at the time their personal data is collected, Proton relies on legal bases for processing your information under Article 6 of the EU General Data Protection Regulation (“GDPR”). Proton generally only processes your data where Proton is legally required to, where processing is necessary to perform any contracts Proton entered with you (or to take steps at your request prior to entering into a contract with you), for our legitimate interests to operate our business or to protect Proton' s or your, property, rights, or safety, or where Proton has obtained your consent to do so. Below is a list of the purposes described in our policy with the corresponding legal bases for processing. If Proton is under any other duty to disclose or share your information to comply with our legal obligations. See below. The following chart summarizes how Proton uses the categories of personal information Proton collects from consumers: • With third party identity verification services in order to prevent fraud. This allows Proton to confirm your identity by comparing the information you provide us to public records and other third-party databases. These service providers may create derivative data based on your personal information that can be used solely in connection with the provision of identity verification and fraud prevention services such as Trulioo Inc. For example: • With institutions with which Proton partners to process transactions you have authorized. • With service providers under contract who help with parts of our business operations. Our contracts require these service providers to only use your information in connection with the services they perform for us and prohibit them from selling your information to anyone else. Examples of the types of service providers Proton may share personal information with (other than those mentioned above) include: ◦ Cloud storage ◦ Data analytics ◦ Customer support ◦ Information Technology ◦ Security ◦ Payment processing ◦ Transaction monitoring ◦ Document repository services ◦ Internet (e.g. ISPs) ◦ Marketing ◦ Network infrastructure • With our professional advisors who provide banking, legal, compliance, insurance, accounting, or other consulting services in order to complete third party financial, technical, compliance and legal audits of our operations or otherwise comply with our legal obligations. • With law enforcement, officials, or other third parties when Proton is compelled to do so by a subpoena, court order, or similar legal procedure, or when Proton believes in good faith that the disclosure of personal information is necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of our User Agreement or any other applicable policies. If you establish a Proton Account indirectly on a third party website or via a third party application, any information that you enter on that website or application (and not directly on a Proton website) will be shared with the owner of the third party website or application and your information will be subject to their privacy policies.

THIRD-PARTY SITES AND SERVICES If you authorize one or more third-party applications to access your MetalX Services, then information you have provided to Proton may be shared with those third parties. A connection you authorize or enable be your Proton account and a non-Proton account, payment instrument, or platform is considered an “account connection.” Unless you provide further authorization, these third parties are not allowed to use this information for any purpose other than to facilitate your transactions using Proton Services. Please note that third parties you interact with may have their own privacy policies, and Proton is not responsible for their operations. Information collected by third parties, which may include such things as contact details or location data, is governed by their privacy practices. Proton encourage you to learn about the privacy practices of those third parties. Example of account connections include: Information that Proton shares with a third-party based on an account connection will be used and disclosed in accordance with the third-party's privacy practices. Please review the privacy notice of any third-party that will gain access to your personal information.

WHY PROTON SHARES PERSONAL INFORMATION WITH OTHER PARTIES Proton takes care to allow your personal information to be accessed only by those who require access to perform their tasks and duties, and to share only with third parties who have a legitimate purpose for accessing it. Proton will never sell or rent your personal information to third parties without your explicit consent. Proton will only share your information in the following circumstances: With third party identity verification services in order to prevent fraud. This allows Proton to confirm your identity by comparing the information you provide us to public records and other third-party databases. These service providers may create derivative data based on your personal information that can be used solely in connection with the provision of identity verification and fraud prevention services. As described in the Proton Terms of Service at https://www.metalx.com/terms-of-service in connection with the Services, and Proton also work with one or more virtual currency exchange partners. You agree to your Personal Information and financial information being transferred, processed, or stored by these third parties as necessary for provision of the Services. Other than in connection with a merger, sale of Metal’s assets, financing or acquisition, Proton will not sell or rent any of your Personal Information to third parties for their own marketing purposes. Please note that third parties that support our customer identification and anti-fraud controls may retain and use Personal Information about you to perform services on our behalf and to improve their services. By using any of the Services, you consent to the retention and use of such information by these providers to improve their services. Proton may also share aggregated or de-identified information with our affiliated companies or nonaffiliated third parties, which cannot reasonably be used to identify you. The Personal Information that Proton collects from you may be transferred to, and stored at, a destination outside your country of residence. Proton uses reasonable technical and organizational security measures to protect your Personal Information when it is transferred or shared to us or our affiliates or our third-party recipients.

PROTECTION OF INFORMATION Although no data processing and transmission can be guaranteed to be 100% secure, Proton takes reasonable steps to protect all Personal Information. Proton uses industry-standard encryption technology to safeguard the account registration process and sign-up information. Other security safeguards include, but are not limited to, data encryption, firewalls, and physical access controls to building and files. Proton understands how important your privacy is, which is why Proton maintains (and contractually requires third parties it shares your information with to maintain) appropriate physical, technical and administrative safeguards to protect the security and confidentiality of the personal information you entrust to us. Proton may store and process all or part of your personal and transactional information, including certain payment information, such as your encrypted bank account and/or routing numbers, in the US and elsewhere in the world where our facilities or our service providers are located. Proton protects your personal information by maintaining physical, electronic, and procedural safeguards in compliance with the applicable laws and regulations. For example, Proton uses computer safeguards such as firewalls and data encryption, Proton enforces physical access controls to our buildings and files, and Proton authorizes access to personal information only for those employees who require it to fulfill their job responsibilities. However, Proton cannot guarantee that loss, misuse, unauthorized acquisition, or alteration of your data will not occur. Please recognize that you play a vital role in protecting your own personal information. When registering with our Services, it is important to choose a password of sufficient length and complexity, to not reveal this password to any third parties, and to immediately notify us if you become aware of any unauthorized access to or use of your account. Furthermore, Proton cannot ensure or warrant the security or confidentiality of information you transmit to us or receive from us by Internet or wireless connection, including email, phone, or SMS, since Proton has no way of protecting that information once it leaves and until it reaches us. If you have reason to believe that your data is no longer secure, please contact us using the contact information provided in this Privacy Policy.

DELETION OF PERSONAL INFORMATION If for any reason you wish to delete your Personal Information stored with us, please send us an e-mail to: https://www.proton.org/ and and Proton will make reasonable efforts to delete any such Personal Information in accordance with any applicable privacy laws and consistent with reasonable recordkeeping practices. Proton may need to retain certain Personal Information for business records purposes, or for tax, or other legal requirements, or otherwise as permitted under applicable data privacy laws. Before honoring a request for deletion, Proton may need to request information from you to verify your identity. Proton will retain your Personal Information for a minimum of five years or as necessary to comply with our legal obligations or to resolve disputes. Proton will also maintain copies of your information to the extent retained as part of our standard backup/archive process. In addition, these procedures will not remove any of your information that you provided to other users or third parties, or that third parties collected from websites or services linked to our Services.

RETENTION OF PERSONAL INFORMATION Proton stores your personal information securely throughout the life of your Proton Account. Proton will only retain your personal information for as long as necessary to fulfil the purposes for which Proton collected it, including for the purposes of satisfying any legal, accounting, or reporting obligations or to resolve disputes. While retention requirements vary by jurisdiction, information about our typical retention periods for different aspects of your personal information are described below. • Personal information collected to comply with our legal obligations under financial or anti-money laundering laws may be retained after account closure for as long as required under such laws. • Contact Information such as your name, email address and telephone number for marketing purposes is retained on an ongoing basis until you unsubscribe. Thereafter, Proton will add your details to our suppression list to ensure Proton does not inadvertently market to you. • Content that you post on our website such as support desk comments, photographs, videos, blog posts, and other content may be kept after you close your account for audit and crime prevention purposes (e.g. to prevent a known fraudulent actor from opening a new account). • Information collected via technical means such as cookies, webpage counters and other analytics tools is kept for a period of up to one year from expiry of the cookie.

ACCESS AND OBJECTION TO PROCESSING Under applicable data privacy laws, you may have rights to request access to your Personal Information or to object to processing or request that the Personal Information you have provided to us is sent to another organization. If you would like exercise these legal rights, please contact us at https://www.proton.org/ and Proton will need enough information to ascertain your identity as well as the nature of your request. Proton will aim to respond to your request within one calendar month of receipt of the request. Where Proton was unable to do so within the calendar month, Proton will notify you of the soonest practicable time within which Proton can respond to your request. There are certain exemptions and restrictions of these rights under the applicable data privacy laws that enable personal information to be retained, processed, or withheld from access and Proton will inform you of these if applicable.

CALIFORNIA PRIVACY RIGHTS California law permits customers who are California residents to request certain information about our disclosure of personal information during the prior calendar year to third parties for their own direct marketing purposes. However, Proton does not sell or rent your Personal Information to any third party for their own marketing. For questions, please contact us at https://www.proton.org/ and Effective January 1, 2020, pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), California residents have certain rights in relation to their personal information, subject to limited exceptions. Any terms defined in the CCPA have the same meaning when used in this California Privacy Rights section. You may inquire about our collection, sale and disclosure of your personal information by visiting https://www.proton.org/ and California residents have the right to opt-out of the sale of their personal information by visiting https://www.proton.org/ and Specifically, if you are a California resident, you have the right to request information from us regarding whether Proton shares certain categories of your personal information with third parties for the third parties' direct marketing purposes. To the extent Proton shares your personal information in this way, you may receive the following specific information: • (a) the categories of information Proton disclosed to third parties for the third parties' direct marketing purposes during the preceding calendar year; and • (b) the names and addresses of third parties that received such information, or if the nature of their business cannot be determined from the name, then examples of the products or services marketed. • For personal information collected by us during the preceding 12 months that is not otherwise subject to an exception, California residents have the right to access and delete their personal information. Proton will not discriminate against those who exercise their rights. Specifically, if you exercise your rights, Proton will not deny you services, charge you different prices for services or provide you a different level or quality of services. • To the extent Proton sells your personal information to third parties, you also have the right to request that Proton disclose to you: (i) the categories of your personal information that Proton sold, and (ii) the categories of third parties to whom your personal information was sold. You have the right to direct us not to sell your personal information. Proton does not sell your personal information in its ordinary course of business and will never sell your personal information to third parties without your explicit consent. Should Proton engage in any of the activities listed in this section, your ability to exercise these rights will be made available to you by contacting us via https://www.proton.org/ and so that Proton may consider your request. If you are a California resident, you may designate an authorized agent to make a request to access or a request to delete on your behalf. Proton will respond to your authorized agent's request if they submit proof that they are registered with the California Secretary of State to be able to act on your behalf, or submit evidence you have provided them with power of attorney pursuant to California Probate Code section 4000 to 4465. Proton may deny requests from authorized agents who do not submit proof that they have been authorized by you to act on their behalf or are unable to verify their identity.

CROSS BORDER TRANSFERS To facilitate our global operations, MetalX may transfer, store, and process your information within our family of companies, partners, and service providers based throughout the world, including, the UK, the US, Estonia, the Philippines and possibly other countries. Proton contractually obligates recipients of your personal information to agree to at least the same level of privacy safeguards as required under applicable data protection laws. By communicating electronically with Proton, you acknowledge and agree to your personal information being processed in this way. If you have a complaint about our privacy practices and our collection, use or disclosure of personal information please submit your request via https://www.proton.org/ and

DATA TRANSFERRED OUT OF THE EU Transferred to METAL FINANCIAL SERVICES Inc. AND TO METAL FINANCIAL SERVICES, OU (ESTONIA) under EU-US Privacy Shield Proton is committed to subjecting all personal information received from European Union (EU) member countries, in reliance on the Privacy Shield Framework, to the Framework's applicable Principles. To learn more about the Privacy Shield Framework, visit the U.S. Department of Commerce's Privacy Shield List at https://www.privacyshield.gov. Metal Financial Services, OU , Estonia (“Proton”) with its principal place of business at Harju maakond, Tallinn, Lasnamae Iinnaosa, Peterburi tee 47. 11415 is responsible for the processing of personal information it receives under the Privacy Shield Framework and subsequently transfers to a third party acting as an agent on its behalf. Before Proton shares your information with any third party that is not also certified under the EU-US Privacy Shield Framework, Metal Financial Services, OU , Estonia (“Proton”) will enter into a written agreement that the third party provides at least the same level of privacy safeguard as required under those Frameworks, and assures the same level of protection for the personal information as required under applicable data protection laws. European data subjects with inquiries or complaints relating to our Privacy Shield certifications should first contact Proton via https://www.proton.org/. If Proton is unable to resolve your complaint or dispute, you may refer your complaint to our designated independent dispute resolution mechanism, the International Centre for Dispute Resolution ("ICDR"), operated by the American Arbitration Association ("AAA"). For more information and to file a complaint, you may contact the International Centre for Dispute Resolution by phone at +1.212.484.4181, or by visiting the website https://go.adr.org/privacyshield.html. If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-ntroduction.

OTHER TRANSFERS Proton uses approved Model Contractual Clauses for the international transfer of personal information collected in the EEA and Switzerland, or requires that any third party located in the US receiving your personal information is certified under the EU-US and/or the Swiss-US Privacy Shield Frameworks and require that the third party agree to at least the same level of privacy safeguards as required under applicable data protection laws.

YOUR PRIVACY RIGHTS Depending on applicable law where you reside, you may be able to assert certain rights related to your personal information identified below. If any of the rights listed below are not provided under law for your operating entity or jurisdiction, Proton has absolute discretion in providing you with those rights. Your rights to personal information are not absolute. Depending upon the applicable law, access may be denied: (a) when denial of access is required or authorized by law; (b) when granting access would have a negative impact on another's privacy; (c) to protect our rights and properties; (d) where the request is frivolous or vexatious, or for other reasons. • Access and portability. You may request that Proton provide you a copy of your personal information held by us. This information will be provided without undue delay subject to a potential fee associated with gathering of the information (as permitted by law), unless such provision adversely affects the rights and freedoms of others. In certain circumstances, you may request to receive your personal information in a structured, commonly used and machine-readable format, and to have us transfer your personal information directly to another data controller. • Rectification of incomplete or inaccurate personal information. You may request us to rectify or update any of your personal information held by Proton that is inaccurate. You may do this at any time by logging in to your account. • Erasure. You may request to erase your personal information, subject to applicable law. If you close your Proton Account, Proton will mark your account in our database as "Closed," but will keep certain account information, including your request to erase, in our database for a period of time as described above. This is necessary to deter fraud, by ensuring that persons who try to commit fraud will not be able to avoid detection simply by closing their account and opening a new account, and to comply with Proton's compliance and legal obligations. However, if you close your account, your personal information will not be used by us for any further purposes, nor shared with third parties, except as necessary to prevent fraud and assist law enforcement, as required by law or regulatory agencies, or in accordance with this Privacy Policy. • Withdraw consent. To the extent the processing of your personal information is based on your consent, you may withdraw your consent at any time. Your withdrawal will not affect the lawfulness of Proton's processing based on consent before your withdrawal. • Restriction of processing. In some jurisdictions, applicable law may give you the right to restrict or object to us processing your personal information under certain circumstances. Proton may continue to process your personal information if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law. • Automated individual decision-making, including profiling. Proton relies on automated tools to help determine whether a transaction or a customer account presents a fraud or legal risk. In some jurisdictions, you have the right not to be subject to a decision based solely on automated processing of your personal information, including profiling, which produces legal or similarly significant effects on you, save for the exceptions applicable under relevant data protection laws.

HOW TO MAKE A PRIVACY REQUEST You can make privacy rights requests relating to your personal information by contacting us via https://www.proton.org/ and Proton strongly encourages you to make any individual rights requests because it ensures that you have been authenticated already (based on the KYC information you have provided to open your account and by providing the necessary login credentials and multi-factor authentication to access the account). Otherwise, when Proton receives an individual rights request via other intake methods, Proton may take steps to verify your identity before complying with the request to protect your privacy and security.

MINORS UNDER THE AGE OF 18 To use the Services, you must be of the age of majority and, at the very least, over the age of 18. In addition, to participate in a promotion, you must be eligible under the Official Rules of that promotion. Proton does not knowingly collect Personal Information from persons under the age of 18 and does not wish to do so. Proton reserves the right to request proof of age at any stage so that Proton can verify that persons who have not reached the age of majority or are under the age 18 are not using the Services, including participating in promotions. In the event that it comes to our knowledge that a person under the age of 18 or who has not reached the age of majority in that person’s state of residence is using the Services, Proton will prohibit and block such user from accessing the Services and will make all efforts to promptly delete any Personal Information. If a user submitting personal information is suspected of being younger than 18 years of age, Proton will require the user to close his or her account and will not allow the individual to continue using our Services. Proton will also take steps to delete the information as soon as possible. Please notify us if you know of any individuals under the age of 18 using our Services so Proton can take action to prevent access to our Services.

REFERRALS/LINKS Our websites or mobile applications may contain links to third-party websites that may offer information of interest. This Privacy Policy does not apply to those websites, and Proton recommends reviewing those websites’ privacy policies individually. Our Services may contain products and services of third parties, so when you use the third party products or accept third party services, they may be able to obtain your personal information. Please read the privacy policies of these third party companies, as their policies govern their collection and use of your personal information.

RIGHT TO LODGE COMPLAINTS Proton is transparent about the ways in which Proton collects and uses Personal Information, and welcome your questions and concerns. If you have any concern or complaint about the way Proton handles your Personal Information, please contact us as described below. To the extent you believe Proton has not addressed your concerns or otherwise choose to do so, you have the right to lodge a complaint with a supervisory authority in the country where you reside and/or the United States. You may contact the US Federal Trade Commission regarding your concerns. For more information, please see https://www.ftc.gov/faq/consumer-protection/submit-consumercomplaint-ftc. If you believe that Proton has infringed your rights, Proton encourages you to first submit a request via https://www.proton.org/. so that Proton can try to resolve the issue or dispute informally. If that does not resolve your issue, you may contact the Proton Data Protection Officer If you wish to complain about the handling of your Personal Information outside of Proton you may, under applicable data privacy laws, have the right to raise a complaint with the supervisory authority in your country of residence. IF YOU RESIDE IN THE EU, you can file a complaint with the International Centre for Dispute Resolution by phone at +1.212.484.4181, or by visiting the website http://info.adr.org/safeharbor, or your relevant data protection authority. IN THE UK, the relevant data protection authority is Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, casework@ico.org.uk. IN IRELAND, the relevant data protection authority is the Data Protection Commission, Canal House, Station Road, Portarlington, R32 AP23 Co. Laois; phone: +353 (0761) 104 800; LoCall: 1890 25 22 31; Fax: +353 57 868 4757; email: info@dataprotection.ie

HAVE ANY QUESTIONS? If you have any questions or concerns regarding this Privacy Policy, please contact us at.. https://www.proton.org/ and If you have any concerns regarding how Proton is handling your Personal Information, please contact us at https://www.proton.org/ and Proton will strive to deal with your concerns promptly.