This Privacy Statement describes how we will treat your personal information in relation to the services provided by The Place S.A. de C.V. (“The Place”), and is an integral part of the Terms and Conditions for using the platform (sites and apps). Therefore, your voluntary, specific, informed, and unequivocal consent to the terms of this Privacy Statement, which applies to all services and personal data processing operations (carried out by The Place, its controlled entities, controlling entities, and/or affiliates), is an essential requirement to operate on or through the platform.

We have drafted and organized this Privacy Statement in a simple and accessible manner precisely so that you can understand how we use your personal data. Here are some of the most important terms used here that you should know:

- PERSONAL DATA: Any information relating to an identified or identifiable natural person (e.g. name, surname, facial image, address, email, ID document, location data, IP address, cookie data, phone number, etc.).

- DATA SUBJECT: You. The natural person to whom the personal data pertains.

- CONSENT: The free, informed, and unequivocal manifestation by which you accept the processing of your personal data for a specific purpose.

- PROCESSING: Any operation performed with personal data. For example, collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation, modification, communication, transfer, dissemination, or extraction.

DATA CONTROLLER

The Place is a company incorporated in the Republic of El Salvador as a provider of Bitcoin services and intermediation in the purchase, sale, and custody of crypto assets, and will be responsible for the processing carried out on your personal data.

Your privacy is very important to us, and we aim for the trust you place in The Place to translate into security to operate throughout our entire ecosystem. Therefore, it is very important that you bear in mind that, by registering on our platform, you will be providing certain personal information that The Place will process and share with all the companies that participate in the provision of our services and make its operation possible.

You must accept these conditions beforehand to complete your registration and use the platform. If you do not agree, or have any doubts about their scope, please do not continue with the registration; we invite you to write to us at DPO@LEMON.ME so that we can improve.

WHAT TYPES OF PERSONAL DATA DO WE PROCESS

We collect personal information to provide you with our services and continuously improve them. The main source of information will be you, when registering and then when using the platform, but we also collect data from other reliable sources.

Therefore, if you provide us with false or inaccurate information, we will not be able to provide our services. Please note that The Place may suspend or disable any user who violates, in any way, this Privacy Statement.

DATA PROVIDED DURING REGISTRATION:

- IDENTIFICATION AND CONTACT DATA: name and surname, gender, postal, telephone and email address, residential address, nationality, date of birth, language, ID document.

- SOCIOECONOMIC DATA: employment, professional or occupational activity, tax and fiscal data.

- BIOMETRIC DATA: facial pattern.

DATA PROVIDED DURING PLATFORM USE:

- CONTRACTING DATA: products and services contracted, holder status, information about investments made and their evolution.

- BASIC FINANCIAL DATA: current and historical balances of your products and services, and movements in your accounts, including the type of operation, the parties, the amount, and the concept.

- COMMUNICATIONS DATA MAINTAINED WITH YOU: obtained from chats, emails, calls or equivalent means that have you as an interested party.

- BROWSING DATA ON OUR PLATFORM: time and date of access, browsing history and content clicks, device ID, IP address, and whether you have accepted the use of cookies.

- LOCATION DATA: location of the businesses where you make purchases with your card and geolocation data of your mobile device, if you have authorized it in the settings.

DATA OBTAINED FROM DATA ANALYSIS:

- DATA OBTAINED FROM EXECUTION OF STATISTICAL MODELS: we apply various statistical models to our customers' data to combat fraud, deduce consumption habits or preferences, comply with our regulatory obligations, and manage our products and services.

- RISK ASSESSMENT DATA: to provide you with some of our products, we will first deduce your ability to pay, applying statistical models calculated on your data.

DATA OBTAINED FROM PUBLIC OR EXTERNAL ACCESS SOURCES:

- DATA OBTAINED FROM CREDIT INFORMATION SYSTEMS: result of the query to the most recognized systems in the market, which provide information about debts, financial solvency, and credit (debtor, creditor, and debt).

- DATA OBTAINED FROM PUBLIC ORGANIZATIONS: result of the query to public access systems, which provide information about debts.

- DATA RELATED TO INTERNATIONAL SANCTIONS: data of individuals included in laws, regulations, guidelines, resolutions, programs, or restrictive measures in the field of international economic-financial sanctions imposed by the United Nations, European Union, United Kingdom, and United States, among others.

- DEMOGRAPHIC DATA: statistical data associated with geographical areas, age groups, and/or activity sectors, which we will link to your personal information.

- DATA ON PUBLIC OFFICES AND/OR CORPORATE LINKS: result of the query to the most recognized information systems in the market, which we will use to complement the information about your activity.

- SOCIAL MEDIA DATA: from the platforms that you link and/or authorize to consult.

WHAT DO WE USE YOUR PERSONAL DATA FOR

We will only process the personal data necessary according to the conditions and purposes explained here. The collection of all this information allows us to identify you, validate your information, facilitate contact with other users, manage our services, provide support, offer you a better experience, increase the security of our platform, and comply with current regulations, among other matters, but it will only be applicable if it has sufficient legal basis.

POSSIBLE LEGAL BASES FOR PROCESSING:

- PRIOR CONSENT. If we have your prior consent, from registration we will use your personal data to develop a commercial profile that will allow us to offer you, in particular, our services and promotions. Additionally, we will use technical means that use biometrics to verify your identity.

- CONTRACT EXECUTION. We will use your personal data to formalize and/or maintain existing contractual relationships with you, including processing your requests or mandates, pre-contractual negotiations, and the establishment of measures to ensure compliance with the obligations you have with us.

- COMPLIANCE WITH LEGAL OBLIGATION. We will use your personal data if they are necessary to comply with an enforceable legal obligation. Please note that, in addition to the regulations specific to the sector and activity, other rules related to: Prevention of Money Laundering and Financing of Terrorism, general informative regimes, tax collection regimes, and requirements of administrative and/or judicial authorities, among others, also apply here.

- LEGITIMATE INTEREST. We will use your personal data if they are necessary for the satisfaction of legitimate interests pursued by The Place or by a third party, provided that your fundamental interests, rights, and/or freedoms do not prevail.

POSSIBLE PURPOSES OF PROCESSING:

- Verify your identity

- Demonstrate your consent

- Perform credit analysis

- Identify and prevent potential fraud

- Identify and prevent potential threats to the platform's security

- Perform advertising and/or promotional contacts

- Comply with anti-money laundering and terrorism financing regulations

- Meet judicial or administrative requirements

- Customize and improve services

- Analyze your behavior

In any case, please note that if we make decisions based solely and exclusively on automated processing (i.e., without the participation of a person) that could have legal effects on you, or that could significantly affect you (for example, by denying a product), we will inform you about it and provide you with the right to human intervention, to express your point of view, and to challenge the decision.

WHAT ARE COOKIES AND WHAT DO WE DO WITH THEM

Cookies are small text files that the sites and apps you use send to your device (through the browser) to identify you. They allow remembering certain information about your visit and make subsequent visits easier. They serve, for example, to remember your language, your time zone, and the products you have viewed, among other things. In fact, sometimes cookies could also serve so that you do not have to enter your password so frequently during a session.

For us, these technologies are very important. They allow us to recognize you as a user, get to know your habits and behaviors, and even improve our services.

And while the lemon.me site is accessible without the need for cookies to be activated, you should be aware that their deactivation could limit the use of certain services or prevent their correct operation as certain functions will not be able to be executed.

We invite you to read our “Cookies Policy” (which is located at the bottom of the site), where you can understand what cookies are, why we implement them, and how you can manage them.

WITH WHOM WE SHARE YOUR PERSONAL DATA

The Place does not market or will market your personal data in any way. Therefore, we detail below the companies and entities with which we could share your data to offer our services properly:

- The Place. They are the companies that are part of the corporate group, operating under the same policies, whether controlled, controlling, and/or affiliated with The Place.

- PROVIDERS. They are third parties that we hire to act on behalf of The Place and provide their services following our instructions in accordance with this Privacy Statement.

- COMMERCIAL ALLIES. They are third parties with whom we have some type of relationship to offer services and promotions. In these cases, The Place ensures that these companies comply with the regulations on the protection of personal data by imposing specific contractual clauses.

- LINKED USERS. They are users registered on the platform, and the sole purpose of sharing information is the transaction they propose to carry out (both parties will know of the other, at the time of conducting the transaction, the full name and account details).

- COMPETENT AUTHORITIES. In response to formal requests in the exercise of their functions, we may share information, for example, with tax authorities, control bodies, national or local justice, etc.

Furthermore, we reserve the right to disclose your information to other users, entities, and/or authorities when there are sufficient grounds to consider that your activity was suspicious and/or there is a reasonable presumption that other people could be harmed.

For any other case, before sharing your personal information, we will ask for your prior and express consent, unless there is a sufficient rule or order allowing otherwise.

HOW WE MAKE INTERNATIONAL TRANSFERS OF PERSONAL DATA

The services we provide, by their nature, require servers and cloud services, so it may happen that some of the personal data we collect is stored or processed in countries different from the original one.

In cases where the receiving country does not have an adequate level of personal data protection according to current law, we will implement additional technical and/or organizational security measures to guarantee the protection of your personal data, and we will require the service provider, if applicable, to also implement them (or complement them with others).

These guarantees may consist of resorting to binding corporate rules, to standard clauses adopted by a supervisory authority, or to contractual clauses authorized by a supervisory authority. They must ensure compliance with data protection regulations and the availability of enforceable rights and effective legal remedies for data subjects.

WHAT ARE YOUR RIGHTS AS A DATA SUBJECT

At The Place, your privacy is one of our greatest concerns. We will try to be as transparent as possible in the processing of your personal data, and therefore, from the moment you entrust us with your information, you will have the following rights:

- ACCESS. You will have the right to request access to your personal data, as well as to know any information related to the conditions of their processing.

- RECTIFICATION. You will have the right to request the rectification of your personal data when they turn out to be inaccurate, incomplete, or not up to date.

- ERASURE. You will have the right to request the erasure of your personal data, so that they are not processed by The Place, unless it could cause harm to the rights or legitimate interests of The Place or third parties, or when there is a legal obligation to keep them.

- OBJECTION. You will have the right to object to the processing of your data, or against a specific purpose, when you have not given consent and/or its processing is not legitimate or justified according to current law.

To exercise any of these rights, and even to exercise any others that you consider to be linked to them, you can write to us at DPO@LEMON.ME and we will immediately process your request and inform you of the results within the period established by current law.

ABOUT OPERATIONS CARRIED OUT ON BLOCKCHAIN

Blockchain technology functions as a shared and immutable ledger that facilitates the process of recording transactions and tracking assets (both tangible and intangible). Virtually anything of value can be tracked and traded on a blockchain network, reducing the risk and costs for all involved parties.

Due to its nature, this technology generates a continuously growing list of data records, called blocks. Each block includes a cryptographic hash of the previous block, a timestamp, and other data related to the transaction. Its immutability is one of the most prominent characteristics: It is not possible to add, delete, or modify the information stored in a block without causing a change in the value of the hash used as a link in the following block. No participant can change or falsify a transaction once recorded in the shared ledger. If a transaction record includes an error, a new transaction must be added to reverse the error, but both transactions will be visible.

If you still have doubts about this, we invite you to our WIKI, where we will be publishing guides and resources to learn more about cryptocurrencies and smart contracts.

The best-known success case regarding blockchain is Bitcoin. The first cryptocurrency based on blockchain technology uses its characteristics to offer a business model without intermediation, that is, without any type of central regulatory entity. Of course, Bitcoin is not the only cryptocurrency that exists; there are many more, each with its own characteristics, some implemented on existing blockchain networks and others created from scratch. Blockchain technology is one of the main elements of our platform in relation to transactions with crypto assets, tokens, and other digital representations of value.

Regarding this Privacy Statement, keep in mind that, by its nature, it will not be possible for you to modify or correct any transaction made on the blockchain, in or through The Place's platform, nor will you able to delete any of the personal data that the blockchain requires you to provide for that transaction.

In general, when you carry out a transaction with crypto assets, the following personal information will be written on its respective blockchain:

- Source wallet address.

- Destination wallet address.

- Transaction amount.

- Time and date of the transaction.

As we explained above, once the transaction is confirmed, all this information will no longer be in our power, and we will not be able to help you exercise your rights over it. Each block is chronologically linked with its predecessor and its subsequent one, inseparably. Once the data has been registered in a block, it is practically impossible to alter and/or delete it.

This feature of blockchain could affect your ability to exercise some of your rights as the data subject, such as the right to erasure or rectification. While there are some smart contracts that could block certain personal information from third parties, the truth is that the data will still be there and cannot be eliminated.

In summary, if you want to ensure that your rights are not in any way affected, do not carry out transactions on the blockchain, as certain prerogatives will not be fully available or will not be fully exercisable. Blockchains, in general, are publicly available, and any personal data published on them will be public knowledge.

USE OF ARTIFICIAL INTELLIGENCE

1. It may happen that in some cases, we use artificial intelligence for data processing.

2. We currently have a section called Ágora in the application, where users can learn in real time about the exchanges that are taking place (information available in the Terms and Conditions). To protect the privacy and security of the users, personal data, such as names, avatars of users, and the values of the exchanges, are confidential and will not be shown.

The service offers the possibility to leave a message. As explained at https://help.lemon.me/es/, messages with offensive, violent, racist, xenophobic, homophobic, pornographic content, or content that does not respect good manners will not be accepted. To ensure compliance with the terms and conditions, we may use artificial intelligence tools provided by sub-processors, which will be used to identify, analyze, and assess the content of the messages.

For this reason, we recommend that you do not share personal data in the messages and respect the terms and conditions of use of Ágora. For more information, you can visit https://help.lemon.me/es/.

HOW LONG WE STORE YOUR PERSONAL DATA

The Place will keep your personal data as long as they are necessary to achieve the purposes for which they were collected, to comply with regulatory or legal requirements, or during the period of prescription of possible legal or contractual responsibilities, or could cause harm to the rights or legitimate interests