Document submitted to the Czech National Bank (CNB) as part of an application for authorisation to provide services related to crypto-assets under Regulation (EU) 2023/1114 (MiCA)

Applicant identification data

Name: Walleexer s.r.o.
Identification number: 17989124
Registered office: Na Perštýně 342/1, Old Town, 110 00, Prague, Czech Republic
Website: https://walleexer.com, https://walleexer.com/en, https://app.holders.io
Contact person: Dr Eugen Marinoff
Phone: +447598989849
Email: eugen.marinoff@walleexer.com, corp@walleexer.com

IČ/identification number: 179 89 124,
registered office: Na Perštýně 342/1, 110 00 Prague, Czech Republic,
kept by the Municipal Court in Prague, Czech Republic, file number C 379759,
Providing services related to virtual assets in accordance to the Czech Trade Licensing Act (Production, trade and services not listed in Annexes 1 to 3 of the Trade Licensing Act), Section 26 of the Czech Digital Finance Act and Article 63 of Regulation (EU) 2023/1114 (MiCA), based on authorization issued by the Czech National Bank (hereinafter the "Company" also "Us"),

1. Introduction

This Commercial Policy defines the principles and procedures by the Company, a registered Virtual Asset Service Provider (VASP) in the Czech Republic, determines pricing, ensures non-discriminatory access, and guarantees full transparency of all fees and rates for its crypto-to-fiat exchange and card payment services (see in detail 1.2.4 GTC). The policy is designed to comply with the Markets in Crypto-Assets Regulation (MiCA), Czech National Bank (CNB) requirements, and the highest standards of fairness, transparency, and consumer protection.

Walleexer s.r.o., a registered Virtual Asset Service Provider (VASP) in the Czech Republic, is dedicated to providing secure, transparent, and cost-effective crypto-to-fiat exchange and card payment services. Our mission is to empower clients with seamless access to the crypto economy while ensuring full compliance with MiCA, CNB requirements, and the highest standards of fairness and transparency.

1.1 Customer (also "You")

A Customer is any legal or natural person who entered into any Contract with us (in detail 2.1.4 GTC), regardless of form. A Customer also includes persons who act as employees of the Customer or otherwise work with the Customer.

As a Customer, You are required to seek consent to the processing of personal data also of Your own customers, employees, collaborators, and other persons (if they are natural persons) whose data is to be used (processed) by us in the performance of the Contract by us, and to keep such consent valid throughout the termination of this Contract. Wherever it speaks of the necessity of consent of natural persons to the processing of personal data in connection with the Contract, You shall procure and keep in force such consent in accordance with this provision. You expressly declare that You hold all such consents in accordance with the legislation and that You comply with the applicable legislation when You provide or disclose such personal data to us.

1.2 INTRODUCTORY PROVISIONS

1. If we refer in any form to the Terms and Conditions when concluding the Contract, we mean these Walleexer s.r.o. General terms and Conditions (the "GTC") or their later versions. The GTC shall also apply to all business relations between us and third parties if this follows directly or indirectly from the nature of a right or obligation under the Contract or from a legal regulation.
2. You agree with us that the Contract is not in any way affected by trade practices. The relevant part of section 545 CC is excluded.
3. These GTC are an integral part of any Contract we enter into together, see in detail 2.1.6 of this GTC. We may agree with you in the Contract on certain provisions that deviate from these GTC, but these GTC will always be part of the Contract even in such a case. Deviating provisions in the Contract take precedence over the universal provisions of the GTC.
4. The Service. We offer you exchange service of Your cryptocurrency for our FIAT currencies allowing you to pay with card in ordinary daily situations see 2.1.4 GTC in detail (the "Service")

1.3 INFORMATION FOR CONSUMERS BEFORE ENTERING INTO PURCHASE CONTRACT AND ANY OTHER CONTRACT WITH US

1. You hereby state that you have read and accept these GTC on our website, at the latest we provide all consumer information in accordance with § 1820 CC:
2. Information about the main characteristics of the goods or services - the whole of Part 2.1 GTC (General Description).
3. Information about Your identity and contacts according to § 1820 (1) (b), (c) and (d) CC.
4. Total price and fee costs and charges pursuant to Art.1820(1)(e) and (j) CC
5. Cost of means of remote communication - we and You each bear our own.
6. Conditions, time limit and procedure for exercising the right to withdraw from the Contract.
7. An indication that the consumer does not have the right to withdraw from the Contract if this is the case, or an indication of the conditions under which the consumer's right to withdraw from the Contract ceases.
8. An indication of the existence of rights arising from defective performance, including, where applicable, the quality guarantee, after-sales service and their conditions.

1.4 RIGHTS AND OBLIGATIONS OF THE PARTIES

1. Please note that You are obliged to comply with all Your obligations under the Contract, these GTC, which are an integral part of it, and generally binding legal regulations. Please be aware that we may also suffer harm as a result of Your breach, whereby our goodwill and the reputation of the website may be damaged or other types of non-pecuniary harm or damage may occur. We are therefore entitled to pursue any claims arising from such a situation against You in accordance with the applicable law.
2. You are obliged to act towards us in a decent, honest and good faith manner and to provide all necessary cooperation and information that is required for the proper performance of the Contract. We are obligated to do the same.
3. You are obliged to provide all information correctly and truthfully when using the Website and in all communications with us.

1.5. VII. DEFECTS AND CLAIMS

1. This part of the GTC applies only to the defects and claims arising from using Our card via app provided by a third party. We are not responsible for any defects of services not provided by Us. The essence of this Contract is solely the operation of the card provided by Us and we cannot be held responsible for any error or glitch occurring in an app or any other service provided by a third party. Unless expressly stated otherwise in the individual provisions of this Part of the GTC, it applies to both consumers and other persons. A consumer means any natural person who, outside the scope of their business activity or outside the scope of the independent exercise of their profession, enters into a contract with the entrepreneur or otherwise deals with him.
2. If the Customer loses, provides or does not make safe enough login details and a third person would get access to customer's card and concludes the Contract in customer's name, We are not liable for any damages rising up from such a case and the Customer is still liable for any obligations thus incurred towards Us.
3. You must make a claim for our service under our card service usage Contract without undue delay after you have become aware of the defect, but at the latest within 3 days of such discovery, and at the same time elect the right of defective performance. A proper claim shall include notification of the date on which you became aware of the defect in the Contract.
4. If you are a consumer, you may claim our service (this is a digital content service) from the website usage Contract within 6 months of the date of its provision, and it is you who must prove that the defect in the website service existed from the outset.
5. Complaints about our service can be made by email to our email address or in paper form to our contact address, both as stated in the beginning of the GTC. In the complaint, please provide your identification data, contact details, what you are complaining about and why, provide proof that we have provided the service in question and state how you wish to resolve the complaint. You will receive an acknowledgement of receipt of the complaint by email within 5 working days at the latest. In the acknowledgement of the claim, we will state our identification data, your identification data, your description of the defect, the right you have exercised in respect of the defective performance and the date of the claim, which is the date on which the claim was received by us.
6. If the defect is a material defect (one which the party in breach of the Contract knew or ought to have known at the time of entering into the Contract that if the other party had foreseen the defect, it would not have entered into the Contract), you may require the supply of new or missing services or the rectification of the defect. If the defect is immaterial, you are only entitled to have it remedied.
7. If you are a consumer, you are always entitled to have the defect removed.
8. If it turns out that you knew about the defect before the conclusion of the Contract or caused it yourself, you are not entitled to claim any right from the defective performance on the basis of withdrawal from the Contract, whether you are a consumer or not.
9. We will deal with your claim within 30 days of you making it, unless we agree in writing with you to a longer period. This period will start on the day after the date of the claim (the date of the claim will be stated in the claim confirmation we send you). If the end of this period falls on a Saturday, Sunday or public holiday, the period will end on the next working day. If we do not deal with the claim within this period, you will have the same rights after the expiry of this period as if it were a material defect.
10. A complaint is settled when we inform you by email that it has been settled and how it has been settled. This email message serves as confirmation that the complaint has been settled. We may reject your claim for the following reasons in particular:

10.1. the claim should have been filed with someone else;
10.2. you were aware of the defect you are complaining about when you entered into the Contract or you caused it yourself;
10.3. the defects occurred after 6 months from the conclusion of the Contract;
10.4. the reason for the claim is the failure to meet your subjective expectations.

11. If you are a consumer, you have the right to be reimbursed for the costs of making a claim, namely the costs reasonably incurred, which are understood to be the lowest possible costs. You must request reimbursement of these costs without undue delay, but at the latest within one month of the end of the period for making a claim.
12. Any amount to be refunded or otherwise discharged by us, will be sent to your bank account, which you specify in the complaint, unless we expressly agree otherwise.
13. Withdrawal from the Contract by the consumer

13.1. By agreeing to these GTC upon conclusion of the Contract you are giving us an explicit request that you do not wish to exercise your right to retain the 14-day period for withdrawal from the Contract without giving a reason, where this decision means that by concluding the Contract, your right to withdraw from the Contract without giving a reason ceases, since by concluding the Contract, the service is fully provided.
13.2. We hereby expressly point out to you that after concluding the Contract, you are not entitled to withdraw from the Contract within 14 days without giving a reason.

1.6 DISPUTE RESOLUTION

1. The Contract and any disputes arising out of or in connection with this Contract shall be finally settled by the ordinary courts of the Czech Republic in accordance with the laws of the Czech Republic.
2. The Contract shall be governed by Czech law.

2.1. Description of the process

The Company enables card payments at merchants, the card is issued by a cooperating company with the appropriate license. The prerequisite for functionality is that the customer has his wallet, especially non-custodial (the wallet creator is not its administrator, i.e. non-custodial) registered in one of the applications for their management, which is commonly offered by the creator of such a wallet as an interface for its management. The customer connects the wallet with the payment card issuer, the payment service provider and (as a separate entity) with the Company performing the exchange. Such a connection is approved only if the customer complies with AML standards. The principle of the Company's activities is therefore to enable everyday card payments by exchanging cryptocurrency for ordinary funds. At the moment of payment by card at the terminal, the cryptocurrency exchange from the paying customer's wallet to the currency in which the payment is made will automatically take place, this is the task of the Company. The payment is settled by a cooperating payment service provider with the appropriate license to the merchant's bank account. The Company is only a link in the chain and together with other service providers provides a comprehensive service. The non-custodial wallet provider, the payment card issuer and the payment service provider are separate entities.

Users can exchange supported cryptocurrencies (TON, SOL, ETH, USDC) for EUR via smart contract and partner exchanges (now supported OKX, Kraken, Cryptology), the exchange is automated after payment. The prerequisite of receiving Company services is a connection to a wallet that contains the cryptocurrency.

2.2. Service provision process

Client registration is carried out exclusively online mostly via the web platform of cooperative non-custodial wallets or on the official Walleexer s.r.o. website (app.holders.io, wallexeer.com; hereinafter the "web"). Walleexer itself does not operate its own mobile application. Instead, it uses integration with external non-custodial wallets integration allowing the registration, namely:

• Tonhub - a popular non-custodial wallet for the TON blockchain where You the users have full control over Your private keys,
• Tonkeeper - another of the main wallets in the TON ecosystem

After successfully verifying their identity through Sumsub and accepting the terms and conditions of the company and partners (these inquiries must be addressed only to them), You can link crypto assets from one of supported wallets to the Company exchange service in the app of wallet.

An overview of movements and transaction history is available to the client directly in the user interface of the Company web platform. Here, they can see a detailed history of all his transactions at any time, including movements on the smart contract (recorded on the blockchain). Each transaction is linked to a specific blockchain address, which can also be verified via a public blockchain explorer.

Fees and exchange rates for Service are always transparently displayed to the client before confirming each transaction on the Company web platform. The user sees the current exchange rate obtained in real time from partner exchanges (OKX, Kraken) and all fees associated with the transaction. Only after agreeing to these terms and conditions does the client confirm the transaction (see 2.1.4.2.).

This architecture ensures that users have full control over their crypto assets, while the Company only provides exchange services and payment card integration without managing users' private keys itself.

2.3 Excluded jurisdictions – Services will not be provided to You, if You are from this jurisdiction

• FATF grey list countries (Iran, North Korea).
• Tax havens according to the EU blacklist.
• Jurisdictions with inadequate AML/CFT framework.

Jurisdictional exclusions are based on AML/CFT risk assessments, international sanctions, and legal constraints. The list of restricted jurisdictions is reviewed quarterly.

2.4. The Contract and the moment of conclusion of the Contract

1. The exchange through purchase. The object of the Purchase Contract (the "Contract") You enter into with Us pursuant to the provisions of Section 2079 of the CC is to enable You to pay with the card we provided and is issued by a cooperating company with the appropriate license. This process purpose is to exchange Your cryptocurrency for our FIAT currencies allowing you to pay with card in ordinary daily situations.
2. Contract conclusion. The Contract is concluded through the app provided by a third party (usually the non-custodial wallet and its extensions) by accepting the trade conditions displayed including the administration fee. The trade condition means the offer exchanging Your crypto asset for Our FIAT money (most often EURO). The Contract is concluded at the moment You click to agree with trade conditions and from this moment the Contract becomes valid and effective immediately. During the Contract conclusion you also agree with these Terms and conditions. At this moment You become the Customer of ours. The contract will not be concluded until you comply with our AML and KYC procedures (see 2.4.5 GTC).
3. Every exchange forms a separate Contract. Every time you decide to exchange Your crypto for our FIAT forms a separate Contract according to the previous article. You shall apply for your possible complaints only to your specific Contract.
4. Remote communication only. You consent to the use of only remote means of communication in the conclusion and performance of the Contract. You shall bear the costs incurred by You in the use of remote means of communication in connection with the conclusion of the Contract (in particular the costs of the internet connection). We, in turn, shall bear our own costs of concluding the Contract.
5. AML and KYC as prerequisite of Contract conclusion. We are obliged to fulfill the AML and KYC so they are prerequisite of Contract conclusion, if such obligation rises. Until you comply with or if you fail to comply with AML and KYC procedures of identification and control, the contract will not be concluded.

2.5. The Administration Fee

The Service is subject to administrative fee in the amount shown at the moment of Contract conclusion.

Transparency. Fees and exchange rates for Service are always transparently displayed to the client before confirming each transaction at the moment of Contract conclusion in the app or on the web platform. The user sees the current exchange rate obtained in real time from partner exchanges and all fees associated with the transaction. Only after agreeing to these terms and conditions does the client confirm the transaction.

• The fee is at least 1,5 % of the purchase amount agreed between Us and You.
• The percentage can be subject to change by our decision with the current fee displayed to You before concluding the Contract.
• Fees are calculated based on real-time exchange spreads, liquidity conditions, and administrative costs. Fee components include network fees, partner charges (e.g., PSP margin), and operational overheads.

2.6 Influence of Volume and Market Volatility

At any given time Walleexer reserves the right to temporarily pause trading. You will be notified via in-app alerts at the moment of intended Contract conclusion (2.4 GTC), ensuring protection from rapid market swings, hacker attack or other reasons. This is for customer protection and security reasons.

2.7. Dirty crypto

We do address and transaction screening therefore we automatically check whether cryptocurrency addresses or transactions are associated with sanctioned persons, darknet markets, scams, mixers, or other risky entities. If so, we are allowed to not conclude a Contract with you or to withdraw an already concluded contract as this is considered a substantial breach of our Contract.

3 Access

3.1 Criteria for Service Access

• KYC/AML: All Customers must successfully complete KYC/AML onboarding via Sumsub, including identity verification, PEP check, stated in Part 2.1 of this document.
• Eligibility: Customers must be at least 18 years old, not subject to sanctions or high-risk jurisdiction restrictions, and not previously banned for policy violations.
• Minimum/Maximum Limits: Transaction and account limits are applied equally to all Customers based on objective risk and compliance criteria.
• No Preference: No Customers receives preferential pricing, access, or service based on nationality, gender, age, race, religion, political opinion, or other irrelevant factors.

We reserve the right to refuse to provide our business activity if the Customer does not meet our criteria stated in this Section or if there is a risk of doing so or harm to our reputation.

KYC/AML: Customers must complete identity verification and PEP checks via Sumsub, typically within 24–48 hours. Source of funds assessments are conducted only for high-risk transactions, as determined by our AML officer.

3.2 Prevention of Discrimination

• The Company's internal policies and automated systems are designed to prevent and detect any form of discrimination.
• Regular staff training and compliance reviews are conducted.
• Any Customer who believes they have been subject to discriminatory treatment may file a complaint through the established procedure (see Section 3.4).
• Access to our services is granted on a fair, objective, and non-discriminatory basis. We do not differentiate based on nationality, place of residence, or other unjustified criteria unless required by AML/CFT legislation or international sanctions

3.3 Complaint Resolution Procedures

• Only Customers may submit complaints via the app, website, or email.
• All complaints are reviewed by the compliance team within 21 business days. Customer complaint procedure applies.
• If a complaint relates to discrimination, it is escalated to senior management and, if unresolved, may be referred to the Czech Trade Inspection Authority or the CNB, if needed. If a complaint is not resolved satisfactorily, customers may escalate it to our internal compliance officer. Consumers also have the right to file complaints with the Czech National Bank or to use the Alternative Dispute Resolution (ADR) scheme via the Czech Trade Inspection Authority.

For inquiries, contact compliance@walleexer.com, with responses provided within 48 hours. Support is available in English, Czech, and French to serve our diverse EU client base.

4. Transparency of Fees and Rates

4.1 Principle of Transparency

The Company ensures full transparency of all fees, commissions, and exchange rates. Customers have access to all relevant information before Concluding the Contract therefore before confirming any transaction.

4.2 Method and Timing of Information Disclosure

• Fee Schedule: All fees and rates are published on the website, in the mobile app, and within the Terms of Use.
• Format: All information is presented in a clear, user-friendly, and comparable format.
• Updates: Fee schedules and rates are reviewed at least quarterly and updated as needed. Customers are notified of any changes at least 30 days in advance via the app and website.

Fees are calculated based on real-time exchange spreads, liquidity conditions, and administrative costs. Fee components include network fees, partner charges (e.g., PSP margin), and operational overheads.

4.3 Information Accessibility

• Customers can access current and historical fee and rate information at any time via the app or website.
• Upon request, Customers may receive a written summary of all fees and rates applied to their account.
• Any information served based on this Contract in written means by any electronic means, especially in the app or e-mail. Both parties agree on such communication.

5. Regulatory Principles: Non-Discrimination and Investor Protection

5.1 General Compliance

• The Company acts honestly, fairly, and professionally in the best interests of its customers, in line with MiCA, CNB, and ESMA standards.
• All marketing, disclosures, and client communications are clear, accurate, and not misleading.
• The company maintains robust internal controls, risk management, and conflict-of-interest policies.

5.2 Investor Protection

• Customers are informed of all risks related to crypto-asset transactions, custody, and market volatility.
• Walleexer does not provide investment advice and encourages customers to seek independent professional advice.
• The company maintains adequate capital reserves and insurance, as required by MiCA.
• Customers may be categorized by transaction volume, risk exposure, and compliance history. Enhanced due diligence and tailored disclosures may apply to high-risk or high-volume profiles in line with MiCA and AMLD5 obligations.

5.3 Regular Policy Evaluation

• This GTC is reviewed usually annually, and whenever there are material changes in regulation, market conditions, or the company's business model. Parties agreed no notification on change is required. The GTC at the moment of Contract conclusion applies.
• All GTC Updates are approved by senior management and communicated to customers 30 days in advance, per MiCA legislation Article 48.
• The Company may consult customers and relevant stakeholders during major updates to ensure responsiveness to market and client needs

6. Final Provisions

• This GTC is published on the Company website and is available to all Customers and regulators for free of charge. It is clear, simple, and in intelligible manner in accordance with Article 59 of MiCA.
• For questions or further information, customers may contact compliance@walleexer.com.

Walleexer s.r.o. is committed to upholding the highest standards of transparency, fairness, and regulatory compliance in all aspects of its commercial operations.

PERSONAL DATA PROCESSING POLICY AND PRINCIPLES OF USE OF THE WEBSITE AND CONTRACT INFORMATION CONCLUDED BY Walleexer s.r.o ("GDPR")

operated by Walleexer s.r.o (CID: 17989124) with registered office at Na Perštýně 342/1, Staré Město, 110 00 Praha 1, represented by EUGEN ANISEI, executive director
email: welcome@walleexer.com

WHO WE ARE AND WHAT THIS GDPR POLICY IS FOR

This website walleexer.com is operated by Walleexer s.r.o. (IČ/CID: 17989124) with registered office at Na Perštýně 342/1, Staré Město, 110 00 Praha 1, Czech republic, represented by EUGEN ANISEI, born on 5. 9. 1996, held at the Municipal Court in Prague under file no. C 379759 (hereinafter referred to as "We", "Us" or the "Company").

You can contact us via email welcome@walleexer.com or via the website form on our website. Our contact address for delivery of documents is Na Perštýně 342/1, Staré Město, 110 00 Praha 1 ("contact address").

This GDPR Policy defines and specifies our and your basic rights and obligations in the area of the protection of your personal data as a Visitor and rights and obligations in other matters when using our website, whether you are a Visitor or a Customer directly, in particular on the website walleexer.com, your or your use of web interfaces owned by a third party and on our internal systems (collectively, the "website").

By visiting the website, providing your consent by ticking the relevant button, forwarding such consent to us or, where applicable, sending us an enquiry or question via or out of the website, using the website or our other services, you confirm that you have read, agree to and wish to be bound by this GDPR Policy.

1. GLOSSARY OF TERMS

1.1. We

Wherever we refer to "us" in these GDPR Policy, we mean our Company technically ensuring the operation of the website walleexer.com, where the category of "us" also includes our employees and cooperating third parties.

1.2. Contact address

By contact address, we mean our address for the delivery of documents or inquiries from you, e.g. requests for information about the handling of personal data. You can find it at the beginning of this GDPR Policy.

1.3. Website

Website is an umbrella term for our web interfaces, in particular the website walleexer.com, and web interfaces owned by you or used by a third party (meaning in particular internal facility management systems owned by another provider, etc.).

1.4. Visitor

A Visitor is any natural or legal person who visits our website or contacts us in any other way. By filling out the relevant form on the website, you become a Customer.

1.5. Customer

A Customer is any legal or natural person who has filled in the relevant form on our website or entered into any Contract with us, regardless of form. A Customer is also a person using card provided by us in app provided by a third party. A Customer also includes persons who act as employees of the Customer or otherwise work with the Customer.

As a Customer, you are required to seek consent to the processing of personal data also of your own customers, employees, collaborators, and other persons (if they are natural persons) whose data is to be used (processed) by us in the transmission of information to a third party and other performance by us related thereto, and to keep such consent valid throughout the term of this agreement. Wherever it speaks of the necessity of consent of natural persons to the processing of personal data in connection with the contract, you shall procure and keep in force such consent in accordance with this paragraph. You expressly declare that you hold all such consents in accordance with the legislation and that you comply with the applicable legislation when you provide or disclose such personal data to us.

2. PERSONAL DATA AND USE OF THE WEBSITE

The information and any obligations set out herein apply to both the Visitor and the Customer.

Please note that you are obliged to provide all information correctly and truthfully when using the website or concluding contract with us. If you make an enquiry or any other contact with us, you are obliged to provide truthful personal details, to state whether you are a person acting as an agent or another person is acting on your behalf, or to state that there has been a change in your personal details, which you are obliged to update without delay. We consider the information you have provided to be correct and up-to-date.

Please also note that the website may not be available around the clock, in particular, due to necessary maintenance of our hardware and software equipment or necessary maintenance of hardware and software equipment of third parties.

We are not responsible for any loss to you directly or indirectly related to the loss or corruption of your data, whether you are a Visitor, Customer, individual, or legal entity.

3. PROTECTION OF VISITOR'S PERSONAL DATA

This section of the GDPR Policy tells you how we treat your personal data or the personal data of any other person whose personal data you have provided or otherwise disclosed to us, pending completion of the relevant forms within our website and thus enter into a website usage Contract with us.

You affirm that the personal information you have provided is accurate and that you have been advised that this is a voluntary provision of personal information.

3.1. On what legal basis do we process your personal data

The protection of your personal data is provided to you as a natural person by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 EC (GDPR), Act No. 101/2000 Coll., on the protection of personal data, as amended, and other legislation and our internal security.

3.2. Scope of personal data processed by us

We collect and process your personal data to the following extent:

• name and surname
• IP address
• the type of device on which you use the website
• the geographical location of the device on which you use the website,

and other data collected and processed by Google, which you can read more about here: https://policies.google.com/privacy?hl=cs#infocollect. During the process of visiting the website, it is expected that you also leave other data., but these are not personal data in the sense of the current legislation and are therefore not included in the list. The list is not exhaustive and on the assumption that you would also provide us with other personal data suitable or necessary for us to establish contact with the us through the website or app provided by a third party, which may lead to the negotiation of exchange of cryptocurrencies with FIAT currencies, you give us permission to use this personal data and process in terms of these conditions.

If, in exceptional circumstances, you provide us with personal data that is classified as particularly sensitive under GDPR legal standards (e.g. ethnicity, religion, or health), we are only required to process such sensitive personal data in accordance with the relevant legislation and these conditions.

If we have obtained such personal data from you about other person than you, for example about your customer, employee, or collaborator (who are natural persons), you expressly declare that you have obtained and have the valid consent of such persons to process such personal data, including particularly sensitive personal data. If the consent given by such person expires, you are obliged to inform us of this fact within 7 days of its occurrence.

3.3. For how long we process and store your personal data and in what form

Your personal data referred to in section 3.2 will only be processed for as long as is strictly necessary and subject to any other legal obligations and in order to ensure the quality of our services, for a maximum of 5 years for marketing purposes and for 10 years for accounting, tax and record-keeping purposes. Personal data will be processed in electronic form in an automated manner or exceptionally in paper form in a non-automated manner.

We use internal regulations, physical, hardware, and software security to protect your personal data, and the protection of personal data is part of the employment obligations of employees and persons working with us.

3.4. Your rights in relation to the processing of personal data

You have the following rights in relation to our processing of your personal data:

3.4.1. The right of access to personal data

This right means that you can request information from us at any time about whether or not we are processing personal data relating to you. If we do process such data, you have the right to request information about the purposes for which, to what extent, and in what way we process such personal data, and you may request a copy of such data.

3.4.2. Right to rectification of inaccurate and completion of incomplete personal data

This right means that you can ask us to correct or complete your personal data at any time. We will carry out such a request without undue delay, subject of course to our current technical capabilities.

3.4.3. Right to erasure

This right means that if you request it, we will delete your personal data if: (i) it is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no longer any overriding legitimate grounds for processing your personal data, (iv) a legal obligation to process under European Union or national law has ceased, (v) you withdraw your consent to the processing of your personal data and there are no longer any grounds for processing it.

3.4.4. Right to restriction of processing of personal data

This right means that you can ask us to restrict the processing of your personal data. In such a case, we will make the personal data unavailable, temporarily delete or store it, or carry out other processing operations to ensure the proper exercise of this exercised right.

3.4.5. Right to data portability

This right means that you can ask us at any time to transfer personal data relating to you which are processed by automated means, on the basis of consent or contract, to a third party. If the exercise of this right would adversely affect the rights of others, we may not be able to comply with such a request.

3.4.6. Right to object

This right means that you can object to the processing of your personal data on the grounds of legitimate interest or for the purposes of marketing activities. If you object to processing for the purposes of marketing activities, we will stop processing your personal data. If you object to processing on the grounds of legitimate interest, we will first evaluate such objection and inform you of its resolution. If the objection is upheld, we will stop processing your personal data, but we may not be able to comply with such an objection.

3.4.7. Right to lodge a complaint about the processing of personal data

In the event of your dissatisfaction with the processing of your request and the exercise of your right, you have the right to lodge a complaint with the supervisory authority - the Office for Personal Data Protection, website: www.uoou.cz, tel: 234 665 111.

3.4.8. The right to withdraw consent to the processing of personal data to the extent that it has been granted

You may withdraw your consent at any time without giving any reason by writing to our contact address, or by using our email address listed in the introduction to this GDPR Policy.

Please note that our activities are bound by legislation imposing many obligations on us. Please note that we may significantly restrict or deny the exercise of any of the above rights with reference to legal obligations.

In the case of manifestly unfounded, unreasonable, or repeated requests, we may charge a reasonable administrative fee for the exercise of the right in question or refuse such a request in accordance with the law.

3.5. For what purposes we process your personal data

3.5.1. Fulfilling the contractual relationship with us and our legal obligations

You expressly agree that we process and transfer your personal data in particular in connection with the obligation to fulfil our contractual relationship with Us. Usually via the website, entered data, documents, and personal data are transferred to Us for the purpose of negotiating with you and enabling the conclusion of Purchase Agreement, so company necessarily needs to know this information. Furthermore, we process information due to accounting and tax legislation, regulations governing archiving and record keeping, or in connection with other legal regulations.

3.5.2. Providing news, tips and marketing offers

We process your personal data for the purpose of sending you news, tips, and marketing communications about the products and services we provide based on your consent.

Once you have given your consent, we will be able to contact you by email, telephone, or other means of long-distance communication to provide you with valuable information about new services, products, and other items of interest.

If you give us this consent, you acknowledge that the provision of this consent is voluntary and that you may withdraw your consent at any time by writing to the contact address or email address listed in the beginning of this GDPR Policy.

3.5.3. Protection of our legitimate interests

On the basis of legitimate interest, we may also process your personal data for the purposes of possible dispute resolution or the enforcement of our legal claims.

3.6. How you can exercise your rights

The exercise of all your rights under the GDPR Policy is subject to submitting a request via the Request form, which can be found here https://walleexer.com/

Please note that our activities are bound by legislation imposing many obligations on us, in particular accounting and tax obligations. With reference to legal obligations, the exercise of your rights may be refused or denied by us.

Please submit requests and objections electronically by email to our email address or by post to the contact address and mark it GDPR. We will process your request without undue delay, within a maximum of 1 month. In exceptional cases, in particular, due to the complexity of your request, we are entitled to extend this period by a further 2 months. We will inform you of any such extension and the reasons for it.

4. GOOGLE ANALYTICS, COOKIES AND BAN ON AUTOMATIC DATA DOWNLOADS

We use a data analysis service, in particular Google Analytics, Google Search Console, Microsoft Clarity, and cookies, to record the Visitors and other persons and to personalise the content of the Website.

By providing your consent by ticking the relevant button on our website, you agree to the storage of cookies and their analysis. You can withdraw your consent at any time by following the procedure for withdrawing consent to the processing of personal data (sections 3.4.8. and 3.6. of these GDPR principles). However, please note that some features of our website may not function properly in this case, and you will miss out on the perfect experience we have prepared for you.

You agree to our prohibition of automatic scanning and/or downloading of data from our website, in particular crawling. In the event that you are guilty of automatically scanning and/or downloading data from our website, you agree to pay us a fine of CZK 20,000 for each such breach. Please note that by paying the fine, we remain entitled to claim damages from you for such breach.

5. COPYRIGHT PROTECTION

The content of our website, the text and all available materials (text, photographs, images, logos, etc.) including those in related print media (promotional flyers, advertising, etc.), and the content of the website software are protected by our copyright and may be protected by other rights of others.

Please note that the content may not be altered, copied, reproduced, distributed, or used by any third party for any purpose without our written consent.

6. IN CONCLUSION

6.1. What else should you know?

Please note that we may unilaterally change or amend the wording of this GDPR Policy at any time. Our mutual rights and obligations shall always be governed by the version of the GDPR under which it is effective. The GDPR Policy shall come into force and effect on the date of publication on our website.

Please be aware that if you violate the rights of third parties when using a service or information from the website, we are not responsible for this, but you are. If we are thus required to compensate them for damages or other harm, or other similar compensation, we are fully entitled to subsequently recover this compensation from the person who committed the infringement, including all related claims, in particular legal costs.

We would like to draw your attention to the prohibition of any interference with the technical or factual character of the website. We ask you to notify us of any malfunction of the website or any external attack on the website, which is manifested in particular by the display of content unrelated to the substance of our services, in particular the display of pornographic content.

Please note that we are not responsible for advertising or any other form of promotion carried out by any third party through the website and we are not responsible for the content of communications exchanged between you and other Visitors and Customers in certain parts of the website, social media or the Customer systems and reserve the right to remove any communication that contains any information that may be deemed unlawful, offensive or otherwise unacceptable, at our sole discretion.

We also reserve the right to change or remove any part of the website at any time without notice.

6.2. Didn't find the answer you were looking for?

If you have not found what you wanted to know here or in the related legislation, please do not hesitate to contact us directly via the email mentioned at the beginning of this GDPR Policy, we will be happy to answer everything for you.

These GDPR principles come into force and effect on July 1, 2025.

Walleexer s.r.o.