Tended Privacy Policy

1.Introduction

1.1Polar Bearers Ltd (“Tended”, “we”, “us”) is a corporation incorporated on July 21, 2026 under the Business Corporations Act (Ontario), with Ontario Corporation Number 1001683816 and registered office at [Ontario registered office address], Canada. Polar Bearers Ltd is registered as a money services business (MSB) with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) under registration number [MXXXXXXXX]. Polar Bearers Ltd is the controller of your personal data under this Privacy Policy.

1.2Your privacy is important to us. We are committed to protecting the privacy, confidentiality, and security of the personal data we hold by complying with applicable requirements under the current laws and regulations. We are also committed to ensuring that all our employees, service providers, and agents comply with these obligations. This policy explains how we handle personal data within our organization, including how we process the personal data of users of our website and on the Tended platform https://tended.com (the “Tended Services”).

1.3Before providing you with our products and services or collecting your personal data, we always refer to this Privacy Policy. Therefore, by using the Tended Services, providing personal data, and/or using any of our products or services, you agree that:

1.3.1you understand and accept our personal data processing practices as described in this Privacy Policy, as updated from time to time; and

1.3.2if you have provided personal data to us regarding any other person, you:

1.3.2.1have the right to provide those data,

1.3.2.2have provided a copy of this privacy policy, as updated from time to time, to the person whose personal data you share with us and that person has accepted the terms of this privacy policy,

1.3.2.3can provide written and signed proof that you have the right to provide the personal data of a third party and that that person (if necessary) has agreed to share their data with us and that such third party accepts our privacy policy, as updated from time to time, terms.

2.How we collect personal data

2.1We collect personal data about you in the following ways:

2.1.1you provide your personal data to us yourself (for example, by registering for a Tended Account or our newsletter on the website; submitting a query, a request, or a (job) application to us; responding to our surveys; using our products and services).

2.1.2your personal data is provided to us by third parties who are authorized to disclose that information to us.

2.1.3we collect your data from public sources (for example, by examining public blockchains; from public records; from your public profile on social networks).

2.1.4we collect your personal data by automatic means (for example, tracking your use of our websites and mobile applications). Also, see below in our Cookie Policy how we use cookies and other similar technologies on our website.

2.2When we collect personal data from you, we usually do so ourselves. However, in some cases we may collect personal data from a third party, such as through your representatives, contractors who provide services to us, or third parties who refer you to us because they believe you may be interested in our products or services.

3.Type of personal data we collect

3.1For the legal basis and purposes described in section 4, we will collect and process the following types of your personal data:

3.1.1Personal identification information, for example:

3.1.1.1full name [first name, any middle names, and first and second surname],

3.1.1.2date of birth,

3.1.1.3gender,

3.1.1.4identification documentation, passport numbers, unsigned ID,

3.1.1.5utility bills,

3.1.1.6nationality,

3.1.1.7signature,

3.1.1.8photographs,

3.1.1.9employer information and job title, and

3.1.1.10tax identification number.

3.1.2contact information, e.g.:

3.1.2.1email address,

3.1.2.2phone number,

3.1.2.3home and work address.

3.1.3financial information, e.g.:

3.1.3.1credit and debit card numbers,

3.1.3.2PANs, IBANs,

3.1.3.3bank account numbers and details,

3.1.3.4pay slips,

3.1.3.5sorting codes and other payment details.

3.1.4communication data including:

3.1.4.1records of our communications with you, including the messages you send us.

3.1.5blockchain-related information, blockchain identifiers, such as:

3.1.5.1blockchain addresses and

3.1.5.2public keys. Because the Tended wallet is non-custodial, we never collect or store your private keys or recovery phrase.

3.1.6transaction information, transactions you make on our platform, including:

3.1.6.1the recipient's name,

3.1.6.2the transaction amount, and

3.1.6.3the timestamp.

3.1.7login and account usage data, including:

3.1.7.1emails and passwords you create when signing up for a Tended Account,

3.1.7.2details of any product or service we provide you,

3.1.7.3survey responses,

3.1.7.4information provided to our support team,

3.1.7.5public posts on social media,

3.1.7.6authentication data,

3.1.7.7security questions,

3.1.7.8user ID,

3.1.7.9click data and other data collected through cookies and similar technologies.

3.1.8online identifiers, including:

3.1.8.1geolocation,

3.1.8.2IP address,

3.1.8.3browser fingerprint,

3.1.8.4browser and operating system name and version.

3.1.9Other information that may be present in the documentation we may ask you to provide for the purpose of verifying your identity.

4.Purposes and legal basis for processing personal data

4.1We process your personal data based on your consent, in accordance with applicable legal requirements, and based on our legitimate interests.

4.2In some cases, primarily but not limited to anti-money laundering laws and regulations and in order to combat fraud, the law may require us to collect certain types of personal data about you.

4.3We will collect your personal data on the following legal bases and for the following purposes as explained in detail below:

4.3.1Processing based on law: taking measures before entering into an agreement with you, e.g., identifying you, your source of wealth, and proof of address to ensure that your identity has not been misused by third parties and that you are eligible to use Tended's services and products as prescribed by law and Tended's Terms of Use and any other relevant agreements or terms set by Tended from time to time.

4.3.2Processing necessary to perform our agreement with you: processing your personal data to comply with the agreement(s) signed between you and us. We mainly process your personal data to provide you with our products and services according to the agreement we have concluded with you. This also includes providing customer support and communicating with you in other ways regarding the Website or our products and services. Without this information, we may not be able to offer you our products or services or all the functions and features offered by our products or services or respond to inquiries or requests that you send us.

4.3.3Processing based on your consent: we may also process your personal data based on your consent for other purposes such as processing for direct marketing purposes, including sending you our newsletter.

4.3.4Processing based on our legitimate interest. We process the data received from your use of Tended's services, for example, information about how you navigate and use our website to improve the user experience while using the website and products and services. Improving our website, products, and services includes conducting market analysis and research, education and training programs for our staff, and business activity planning and forecasting and other internal business processes. The legal basis for this is our legitimate business interest in improving Tended's services and the user experience and our business as a result. Considering the nature of the data and that we use it in an aggregated manner, your interests or fundamental rights and freedoms do not override our legitimate interest.

4.3.5We may also process your personal data to safeguard our rights, for example, to establish, exercise and defend legal claims, debt collection. The legal basis for this is our legitimate interest in protecting our legal rights and ensuring compliance with the agreement concluded between us. In such a case, your interests or fundamental rights and freedoms do not override our legitimate interests.

4.4When processing is based on consent, you may withdraw your consent at any time by clicking the ‘unsubscribe’ link at the end of each email. Please note that withdrawing consent does not affect the legality of processing based on consent before it was withdrawn. For specifications on how we use your personal data for direct marketing purposes, see section 5 below.

4.5To the extent required by the applicable data protection regulation, you have the right to object to the processing of your personal data, which is based on legitimate interest. See also section 8 below.

4.6Withdrawing consent does not affect the legality of the processing of your personal data according to the applicable legal requirements, mainly the applicable AML laws and regulations. Tended is obligated to store and process your personal data under the applicable anti-money laundering laws and regulations regardless of your consent.

5.Direct marketing and profiling for marketing purposes

5.1If you have given us your consent to provide you with materials about our products or services and those of our partners, we may use your personal data for direct marketing purposes from time to time. We may send you materials and offers that we believe would be of interest to you.

5.2You can opt out of receiving marketing communications from us at any time by clicking the ‘unsubscribe’ link at the end of each email or by contacting us at hello@tended.com.

5.3To find out which offers would interest you; we create your profile based on the following information:

5.3.1Identification information, such as your name and date of birth.

5.3.2Contact information, such as your postal address and email address.

5.3.3Product and service portfolio information and demographic data that we maintain from time to time.

5.4We may use your personal data to market the following products and/or services to you:

5.4.1Buying and selling digital assets through our on-ramp and off-ramp services;

5.4.2The Tended non-custodial wallet; and

5.4.3Savings plans and other digital asset-related products or services.

6.Persons to whom we disclose personal data

6.1We only share your personal data when we have a valid reason to do so, namely, to provide our services and products to you and when we are legally permitted to do so.

6.2Data processors. We use carefully selected service providers (processors) to process your personal data. We only use service providers who offer sufficient guarantees to implement appropriate technical and organizational security measures to protect your personal data. We have concluded adequate data processing agreements with service providers and will remain responsible for their actions with respect to the processing of your personal data.

6.3The data processors we use include the following: email service providers, website analytics service providers, identity verification providers, on-ramp and off-ramp partners, liquidity providers, and data hosting service providers. If you need more detailed information about the data processors we use (for example, their names and location), please contact us using the contact details below.

6.4Third parties. In some circumstances, we also share your personal data with third parties who act as independent data controllers with respect to your personal data. We only share your personal data with third parties if stipulated here, if required by applicable law (for example, when we are obligated to share personal data with authorities), or with your consent.

6.5We may also need to share your personal data with third parties in connection with our need to protect our legal rights (for example, lawyers and debt collection agencies). The legal basis for this is our legitimate interest in protecting our legal rights and ensuring compliance with the agreement. In such cases, your interests or fundamental rights and freedoms do not override our legitimate interests.

6.6We may disclose your personal data to an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, asset sale, or similar transaction, as well as in the event of insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets. The legal basis for this is our legitimate interest in exercising our right to do business. In such cases, we ensure that your rights and conditions as a data subject are not diminished, in which case your interests or fundamental rights and freedoms do not override our legitimate interests.

6.7Furthermore, we may share your personal data with other third parties to meet our legal obligations (for example, auditors, national regulators, or other authorities). The legal basis for such sharing is compliance with our legal obligations and legal requirements.

6.8In addition, we will share your data with your representatives, advisors, and other third parties with whom you have contacted in connection with our services and products or whom you have authorized to interact with us on your behalf. Please note that we consider such authorization as your consent and, therefore, your request for such activity must be submitted to us in writing.

6.9We will not sell your personal data to any third party.

6.10Tended is based in Canada, so personal data of users in the European Economic Area (EEA) is transferred to Canada, which the European Commission has recognized as providing an adequate level of protection for organizations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Some of our service providers are located outside the EEA, for example in the United States. Where we transfer your personal data outside the EEA, we make sure it stays protected: we transfer it only to countries the European Commission has found to provide an adequate level of protection, to recipients certified under the EU-U.S. Data Privacy Framework, or under the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards using the contact details below.

7.Security and data retention

7.1We take appropriate technical and organizational security measures to protect your personal data, taking into consideration (i) the state of the art, (ii) costs of implementation, (iii) nature, scope, context and purposes of processing, and (iv) risks presented to you.

7.2We retain your personal data for as long as necessary for the purposes for which they were collected, if necessary to safeguard our rights, or if required by applicable law. We may retain your personal data for several years after the end of our relationship if necessary to safeguard our rights or required by applicable law. If your personal data are processed for several different purposes, the longest retention period will apply.

7.3In general, we store your personal data as follows:

7.3.1information about legal transactions between us is retained as long as the agreement between us is valid and for a period of 10 years from when a claim expires, unless otherwise provided by law, occasionally asking you to update your personal data.

7.3.2billing information is retained for 7 years from the end of the financial year in which the information was provided to us.

7.3.3cookie information is retained for the periods set out in section 13.3 of our Cookie Policy below.

7.3.4all other data are retained for 5 years.

8.Access, correction and your other rights

8.1To the extent required by applicable data protection regulations, you have all the rights of a data subject regarding your personal data. These rights include the following:

8.1.1request access to your personal data.

8.1.2obtain a copy of your personal data.

8.1.3rectify inaccurate or incomplete personal data.

8.1.4erase personal data.

8.1.5restrict the processing of personal data.

8.1.6portability of personal data.

8.1.7object to the processing of personal data that is based on legitimate interest and personal data processed for direct marketing purposes.

8.2Please note that your rights as a data subject are not absolute and are subject to considerations permissible under applicable law.

8.3To exercise your rights, please contact us at the contact information below. Please note that you may already exercise some rights (e.g., review and update your personal data) by logging into your account.

8.4To protect the integrity and security of the information we hold, we may ask you to follow a defined access procedure, which may include steps to verify your identity.

8.5In certain cases, wherever permitted by applicable law, we may charge you an administrative fee for providing access to the information you have requested, but we will inform you of this before proceeding.

8.6There may be cases where we cannot provide you with the information you request, such as when it would interfere with the privacy of others or result in a breach of confidentiality. In such cases, we will inform you why we are unable to comply with your request.

9.Complaints

9.1We strive to meet the highest standards for protecting your privacy. However, if you are concerned about the way we are handling your personal data and believe we have breached any applicable privacy law or other relevant obligation, please contact our Data Protection Officer (DPO) using the contact information below. We will log your question or complaint and refer it to our DPO for further investigation. We will address the matter as soon as we can and keep you informed about the progress of our investigation.

9.2In addition to the above, you also have the right to file a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca), with the data protection authority in the EU or EEA member state where you live or work, or with the court.

10.Changes to this policy

We may make changes to this policy from time to time to consider changes in our standard practices and procedures or when necessary to comply with new applicable laws, regulations, case law, and guidance issued by competent authorities. If the changes are significant to you, we will notify you via email and through a pop-up notice on the website. The latest version of this policy will always be available on our website.

11.Governing Law

The processing of your personal data is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, including PIPEDA. If you are in the European Union or the European Economic Area, the EU General Data Protection Regulation (GDPR) also applies to the processing of your personal data.

12.Contact Information

If you would like more information from us on privacy matters or wish to exercise your rights as a data subject, please contact our Data Protection Officer at privacy@tended.com or write to us at Polar Bearers Ltd, [Ontario registered office address], Canada.