Institutional Investor & Regulatory Edition | Effective Date: May 2025

Introduction & Commitment to Data Privacy

At Bitiloc Technologies LLC ("Bitiloc", "we", "our", "us"), privacy protection and data governance are not only operational responsibilities but foundational pillars of our global compliance infrastructure. Operating across multiple regulated jurisdictions, we are fully committed to safeguarding personal data through industry-leading privacy practices, regulatory adherence, and operational transparency.

This Privacy Policy explains how we collect, process, store, share, and protect your personal information, while clarifying your data protection rights under applicable global privacy laws, including but not limited to GDPR (EU), CCPA (California), DIFC DP Law (Dubai), PIPEDA (Canada), and international financial regulatory standards.

Scope of Application

This Privacy Policy applies to all personal data collected through:

• Bitiloc's web platform

• Mobile applications

• Communication channels (email, phone, chat, support)

• Third-party integrated services (KYC, payments, analytics)

By accessing or utilizing Bitiloc's services, you acknowledge and consent to the processing of your personal information as outlined herein.

1. Information We Collect

Bitiloc collects only the minimum necessary personal data required to deliver its regulated services while complying with local and international regulatory frameworks.

Personal data collected may include but is not limited to:

• Account Information: Full name, date of birth, nationality, email address, phone number, login credentials, and government-issued identification for KYC/AML compliance.

• Financial Transaction Data: Deposit records, withdrawal records, linked wallet addresses, bank account information, transaction history, and payment verification.

• Usage Data: Device identifiers (IP address, browser, OS), login timestamps, geographic access location, and platform interaction logs.

• Communication Records: Customer support interactions, inquiries, uploaded documentation, chat logs, and phone recordings (where applicable).

• Referral Data: Tracking codes, referral sources, and affiliate program participation logs.

2. Legal Basis for Data Collection

Bitiloc collects and processes personal information under various lawful bases, including:

• Contractual necessity to provide investment services.

• Regulatory obligations for AML, KYC, taxation, and financial reporting.

• Legitimate business interests for platform security, fraud detection, and performance optimization.

• User consent for marketing communications or optional features.

• Compliance with national and cross-border legal frameworks.

3. How We Use Your Information

Bitiloc may utilize personal information for multiple legitimate business purposes, including:

• Provision, delivery, and optimization of platform services.

• Accurate execution and reconciliation of financial transactions.

• Personalization of user experience via AI-driven account profiling.

• Ongoing customer support, dispute resolution, and technical assistance.

• AML, KYC, counter-terrorist financing, and sanctions list compliance.

• Monitoring of system security, fraud prevention, and cybersecurity defense.

• Compliance with applicable international regulations, legal obligations, tax reporting, and audit requirements.

4. Automated Processing & Profiling

In certain jurisdictions, Bitiloc may utilize algorithmic processing (profiling) for:

• Enhanced fraud detection.

• Transaction anomaly analysis.

• Risk scoring for customer account activity.

• Ongoing compliance monitoring.

Such profiling is fully automated and governed by internal risk management and audit frameworks, ensuring fairness, non-discrimination, and human oversight.

5. Cookies & Tracking Technologies

Bitiloc uses various tracking technologies to improve functionality and service quality:

• Session Cookies: Maintain session continuity and secure access.

• Analytical Cookies: Aggregate site usage metrics and platform performance insights.

• Targeting Cookies: Personalize marketing, promotions, and content relevance.

• Security Cookies: Strengthen platform defenses against unauthorized access.

Users may configure cookie preferences via browser settings. Restricting certain cookies may limit platform features and security layers.

6. Server Log Files

Bitiloc automatically logs technical metadata for:

• Security monitoring and DDoS mitigation.

• Incident response and forensic analysis.

• System performance diagnostics and platform optimization.

• Audit trail integrity for regulatory reporting.

Data elements may include IP addresses, ISP information, device types, timestamps, and referring pages.

7. Third-Party Processors & Data Transfers

Bitiloc may engage verified third-party processors solely for operational support purposes, such as:

• Regulated payment gateways.

• Licensed KYC/AML compliance vendors.

• Hosting providers.

• Data analytics platforms.

• Fraud detection engines.

• Cloud-based infrastructure partners.

All third-party relationships are contractually governed by strict data processing agreements (DPAs), ensuring full compliance with applicable international privacy frameworks. Data transfers outside your jurisdiction are safeguarded via Standard Contractual Clauses (SCCs) or equivalent legal mechanisms.

Bitiloc does not monetize, rent, or sell personal data to third parties for marketing or commercial resale purposes.

8. International Data Transfers

Due to our multinational infrastructure, personal data may be transferred internationally across regulated jurisdictions.
Bitiloc applies:

• GDPR-compliant transfer protocols.

• Adequacy decisions where applicable.

• Binding Corporate Rules (BCRs) across affiliated global entities.

• Encryption of all transferred data both in transit and at rest.

9. Data Retention & Deletion

Bitiloc retains personal data only as long as necessary for:

• Ongoing service delivery.

• Regulatory compliance (including financial reporting, tax obligations, and AML audits).

• Dispute resolution or litigation defense.

• Operational risk management.

Upon termination of accounts or legal retention periods, data is securely anonymized or permanently deleted in accordance with industry standards.

10. User Data Protection Rights

Under various global privacy laws, users maintain certain enforceable rights:

• Access: Obtain copies of personal data held.

• Rectification: Request correction of inaccurate information.

• Erasure ("Right to be Forgotten"): Request deletion under applicable conditions.

• Restriction: Limit specific data processing activities.

• Data Portability: Receive transferable copies of data.

• Objection: Object to data processing for marketing or certain profiling operations.

Users may submit all data rights requests to: info@bitiloc.com
Requests will be processed in accordance with jurisdictional legal timeframes.

11. California Consumer Privacy Act (CCPA) Rights

For California residents, Bitiloc adheres to CCPA mandates:

• Disclosure of collected personal information categories and sources.

• Right to request data deletion under allowable exemptions.

• Right to opt-out of future personal data sale (Bitiloc does not engage in such sales).

• Non-discrimination for exercising privacy rights.

All CCPA inquiries may be directed to: info@bitiloc.com

12. Children's Privacy Policy

Bitiloc services are not intended for individuals under the age of 18.
Bitiloc does not knowingly collect or process personal information from minors.
In the event of inadvertent collection, data will be immediately deleted upon discovery or parental request.

13. Consent & Use Agreement

By utilizing Bitiloc’s services, you explicitly consent to data collection, processing, and international transfer as described in this Privacy Policy. Continued usage of the platform signifies ongoing consent and acknowledgment of our data governance practices.

14. Policy Updates & Amendments

Bitiloc reserves the right to amend this Privacy Policy periodically to:

• Reflect changes in law, regulation, or compliance standards.

• Integrate evolving operational practices or technology updates.

• Improve transparency or provide additional disclosure.

All updates will be published on our website, with clearly marked effective dates. Continued use following updates constitutes acceptance of modified terms.

15. Regulatory Cooperation & Supervisory Authority

Bitiloc cooperates fully with global regulators and supervisory data protection authorities.
Where applicable, users may submit complaints to:

• National supervisory bodies (GDPR jurisdictions)

• The California Attorney General (CCPA)

• DIFC Data Protection Authority (Dubai)

• Relevant home jurisdiction regulators

16. Contact Information for Privacy Inquiries

For all privacy-related questions, requests, or complaints:

📧 Email: info@bitiloc.com
🌐 Website: https://bitiloc.com