Privacy Policy – Liquid Avatar Operations

1. Purpose
Our Privacy Policy explains how Liquid Avatar Technologies Inc., Liquid Avatar Operations Inc. and Oasis Digital Studios Limited (“LIQUID AVATAR” or the “Companies”) their subsidiaries, affiliate companies and the digital on-boarding, Know-Your-Customer (KYC) and Anti-Money Laundering (AML) companies that LIQUID AVATAR works with collect, use, store and disclose your personal information. It also describes the choices available to you concerning the use of, your access to, and how to update and correct your personal information. For residents of the State of California, please see Section 16 of this policy for the related information on the California Consumer Protection Act 2018.

2. Scope
This Privacy Policy applies to personal information that LIQUID AVATAR collects when you use or access the Companies’ web and mobile applications and other Services offered by LIQUID AVATAR that mention this policy (collectively referred to as “Services”) including sites such as, but not limited to:
www.liquidavatartechnologies.com
www.liquidavatar.com
www.liquidavataroperations.com
www.oasisdigitalstudios.com
www.liquidshopz.com
www.lqidcard.com

“Personal Information” is defined as any information about an identifiable individual.

Personal information will be handled by LIQUID AVATAR in accordance with the EU General Data Protection Regulation and the UK GDPR (collectively “GDPR”), the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and this Privacy Policy.

3. Consent
When you sign up for a user account, LIQUID AVATAR will ask you to provide the necessary personal information required under the lawful basis of performance of a contract in order for LIQUID AVATAR to provide you with the Services. Such information will include specific personal information including ID documentation, and a “selfie” picture of yourself. Additional documentation in the form of a utility bill or bank statement may be required. In the event that you no longer wish to receive the Services from LIQUID AVATAR and you provide LIQUID AVATAR with notice that you no longer wish to receive the Services, LIQUID AVATAR will at that time delete all personal information relating to you and used to provide you with the Services.

4. Security
LIQUID AVATAR takes commercially reasonable measures to help safeguard your personal information from loss, disclosure, alteration, misuse and unauthorized access, theft and destruction. This includes, when required or appropriate and feasible, obtaining written assurances from third parties that may access your data that they will protect the data with adequate safeguards. The internet is not 100% secure. LIQUID AVATAR has no control over the security protocols for internet networks that may be used by you. LIQUID AVATAR cannot guarantee the absolute security of your information that you choose to transmit over the internet and we do not accept liability for unintentional disclosure. LIQUID AVATAR is not responsible for the security of information that you transmit to us over networks that the Companies do not control, including the internet and wireless networks.

If you have any questions about the security of your personal information, please contact us at support@liquidavatar.com

5. CollectionofInformation
LIQUID AVATAR collects the following types of information:

Information that you provide to LIQUID AVATAR directly to deliver Services requested

When you use the Services to register an account with LIQUID AVATAR, the Companies will collect your email address. When you use the Services to verify your identity through LIQUID AVATAR, the Companies will collect information such as ID Documents (passport, driver’s license, ID card, etc…), document type, scan of the document, country, “selfie” photo, account ID, legal name, national ID number, gender, date of birth, mailing address, IP address, user name, blockchain address, email, local storage, user display settings, Google authenticators, audit logs, and device camera. When you use the Services to verify your identity, LIQUID AVATAR may collect information such as Social Insurance Number, credit records, telephone number, IP Address and utility bills.

Facial Biometric Identity Verification

Facial biometric identity verification is accomplished by comparing two or more captured images of faces. The biometric identifiers used to complete this assessment are taken from the images that you submit.

We will also use your selfie image to complete an age estimation. This is to ensure that the age information you provide to us is accurate. This age estimation is done via Facelytics by Wasaa, a third-party service provider, however LIQUID AVATAR only sends the selfie image out for estimation with no other personal information attached. We receive back the age estimation, and the third party service provider permanently deletes the image.

Information we may collect from Third Parties

LIQUID AVATAR may collect information about you from other sources, including third parties that help the Companies verify your eligibility for LIQUID AVATAR Services. This information may be combined with personal information that has been collected about you under this Privacy Policy. Please note that the information LIQUID AVATAR may receive from these third parties is governed by the privacy settings, policies, and/or procedures of the third parties.

6. Marketing
Users will be asked upon signing up for LIQUID AVATAR Services if they would like to receive marketing information on our various products. Such marketing messages may be delivered to those users who choose to opt-in via personal contact such as email, SMS or by text message. Users may change their preferences to withdraw their consent to receive these personal messages at any time.

All users of our applications or users who log into our services online will be informed of offers available to them within the app or websites. Notifications of such offerings during use of the services are not subject to change via preference settings.

7. CookiePolicy
A cookie is a small text file that is placed and stored on your computer, mobile or other devices by webpages that you visit. The Cookies collect information in an anonymous form, including the number of visitors to the webpage, how the visitor found the webpage and recent webpages visited. All cookies used by LIQUID AVATAR are in accordance with current regulations.

Before Cookies are placed on your device, you will be shown a pop-up requesting your consent to LIQUID AVATAR’s use of Cookies. Your consent enables LIQUID AVATAR to provide the best possible service to you.

If you do not consent to the use of Cookies certain features of the LIQUID AVATAR Service may not function as intended. You are also able to delete Cookies from your device at any time.

LIQUID AVATAR uses cookies for language selection and other semi persistent settings for visitors who are not signed in. LIQUID AVATAR uses an encrypted session cookie for signed in users to identify who is signed in. Any other information in the encrypted session cookie is only available to read by our servers and should be treated as server data. It could include temporary messages or errors while using the app.

LIQUID AVATAR may also use any of the following categories of Cookies. 1. Essential Cookies

The Cookies are strictly necessary for the LIQUID AVATAR websites to function. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. These Cookies do not store any personally identifiable information.

Analytics Cookies
These Cookies track information about visits to the websites so that we can make improvements and report performance. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these Cookies collect is aggregated and anonymous.
Functional or Preference Cookies
These Cookies enable the websites to provide enhanced functionality and personalisation. They are used to remember information you have entered or choices you make (i.e. username or language) on the LIQUID AVATAR websites. They may be set by LIQUID AVATAR or by third party providers whose services we have added to our pages.

8. UseofInformation
LIQUID AVATAR may use the information collected from you for the following purposes:

LIQUID AVATAR may use personal information to provide products, Services or information requested by you. Examples include: to manage your individual information and account, help you efficiently access your information after you sign in, allow access to certain functionalities and features of the Companies’ Services, and respond to your inquiries.

LIQUID AVATAR may use personal information for the following administrative purposes:

Verify your identity
Process applications and transactions
Validate your identity with third parties of your choosing and upon your direction
Transfer your information that you choose to share with third parties upon yourdirection
Measure interest in LIQUID AVATAR’s Services
Develop new products and Services or improve existing products and Services
Monitor metrics such as total number of visitors, traffic, and demographic patternsapplicable to the Services
Send you Service-related emails (i.e., account verification, changes or updates tofeatures of the Service, technical and security notice)
Compliance with legal obligations and regulatory requirements (i.e., respond to legalprocess or request for information issued by government authorities)
Prevent potentially prohibited or illegal activities
Enforce LIQUID AVATAR Terms and Conditions

9. SharingofInformation
LIQUID AVATAR will not rent, share, transfer or sell your information to third parties without your consent or as agreed for the purposes of delivering the services as noted in this Privacy Policy.

LIQUID AVATAR may disclose information the Companies collect in the following circumstances or as otherwise described in this Privacy Policy:

With Vendors and Service Providers
LIQUID AVATAR may disclose your information to third party service providers that perform services on behalf of the Companies, such as web-hosting companies, analytics providers and information technology providers. LIQUID AVATAR entrusts personal information to the following types of service providers:

Service Providers, such as vendors, consultants, IT and related services who perform certain services on behalf of LIQUID AVATAR, in which case we enter into a contract that describes the purpose of processing and requires the recipient to not use it for any purpose except performing the contract
Third party application analytics organizations who may record via the app: Screens visited, Interaction patterns (such as screen actions, gestures: taps, scrolls) and Device details (Type, Version, Model, Operating System)
Our affiliates, as needed to operate our business and provide services
Customer service activities
Fraud prevention
Providers of services you have requestedLIQUID AVATAR has contracts with service providers that forbid them from using or disclosing personal information except as necessary to execute the contracted services on behalf of the Companies or to fulfil legal obligations.
In the event you choose to apply for a LQID Card, the issuing bank will ask you for additional information that is necessary in order to approve you for a card. Any information provided to Community Federal Savings Bank will be subject to the bank privacy policy. Any use by you of the LQID Card will also fall under the terms and conditions and privacy policies of Community Federal Savings Bank.

With Law Enforcement or Government Authorities
LIQUID AVATAR may disclose information as may be permitted or required by laws of any jurisdiction that may apply to the Companies, as provided for under contract, or as LIQUID AVATAR deems reasonably necessary to provide legal services. In these

circumstances, the Companies take reasonable efforts to notify you prior to disclosing information that may reasonably identify you, unless prior notice is prohibited by applicable law or is not possible or reasonable in the circumstances.

Change of Control
If LIQUID AVATAR sells or otherwise transfers part or the whole of LIQUID AVATAR or the Companies’ assets to another organization (i.e., in the course of a transaction like a merger, acquisition, bankruptcy, dissolution, liquidation), then your information may be sold or transferred as part of such a transaction as permitted by law and/or contract. The buyer or transferee will have to honour the commitments LIQUID AVATAR has made in this Privacy Policy.

10.
LIQUID AVATAR uses Amazon Web Services (AWS) to store your information in order to provide it with the highest level of protection, however AWS does not necessarily have servers inside every jurisdiction. By accepting this Privacy Policy, you provide your explicit permission to store your information on systems outside your jurisdiction only when they are not available inside your jurisdiction and to transfer that data to your jurisdiction when systems become available to do so.

11.Transfer of Data

Storage of your personal information

LIQUID AVATAR takes all reasonable steps to ensure that the data we collect under this privacy statement is processed according to the provisions of this statement and the requirements of applicable law wherever the data is located. LIQUID AVATAR operates throughout the world and although we try to store your information within your own country, this isn’t always possible and we may transfer personal data from your country to the European Economic Area or the United Kingdom (UK) and to other countries, which have been determined by the European Commission to have an adequate level of data protection. Some of these data transfers may include a transfer between LIQUID AVATAR entities, to third party suppliers and to cloud based storage providers.

Any transfer we make is done using a variety of legal mechanisms, including contracts, to help ensure your rights and equivalent protections travel with your data. We want to ensure that data is stored and transferred in a way which is secure. We will therefore only transfer data outside of the European Economic Area or EEA (i.e. the Member

States of the European Union, together with Norway, Iceland and Liechtenstein) and the UK where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your data.
Ways in which we safeguard your data include, but are not limited to:

a. Through the use of a transfer agreement which includes the current standard contractual clauses put in place by the European Commission for the transfer of personal data;

b. For any transfer of data to a US based entity, we require that entity to sign up to Standard Contractual Clauses with Supplementary measures as ratified by the EU and UK to safeguard data;

Other circumstances under which your data could be transferred include when it is necessary for the conclusion or performance of a contract between ourselves and a third party and the transfer is in your interest for the purposes of the contract and where you have consented to the data transfer.

12.Individual’s Data Rights
We respect the rights and freedoms of individuals and as such we would like to make you aware of the following:
You have the right to:

Request access to your data
Request rectification of your data where there are errors or inaccuracies or thedata is not current
Request that the data we hold is removed entirely from our systems (the right tohave data removed is only applicable where it does not conflict with our legal and regulatory requirements to keep certain records according to the data retention period)
Request us to restrict processing of your data
Object to our processing of your data
Request your data in a format that is commonly used/accepted
Send your data to another controller
Withdraw consent already provided – at any timeYou also have the right to complain to us. To lodge a complaint or to exercise any of your rights listed above, please contact us at support@liquidavatar.com and direct your email to the attention of the Data Protection Officer.
In the EU or the UK, you also have the right to lodge a complaint with a supervisory authority.

13.Third Party Services and Content
The third party vendors with which LIQUID AVATAR shares your personal information are contractually required by the Companies to keep this information confidential and may generally not use such information for any purpose other than to help the Companies provide solutions to LIQUID AVATAR customers.

LIQUID AVATAR’s Services may include integrated content or links to content provided by third parties. This Privacy Policy does not address the privacy, security, or other practice of the third parties that provide such content.

LIQUID AVATAR may use third party service providers to collect personal information on its behalf. These third party service providers may be located in countries where the privacy laws provide different levels of protection for personal information. If you would like more information about LIQUID AVATAR’s use of these service providers, please contact us at support@liquidavatar.com

14.Retention

Due to the nature of LIQUID AVATAR’s business personal data will be kept for as long as LIQUID AVATAR provides services to the user. LIQUID AVATAR provides “Always On” ID Verification, KYC and AML screening and verification. As such, we require user information such as full names, residential address, government identification and proof of current address to be provided. LIQUID AVATAR must ensure that KYC and AML screening is “Always ON” in order to be kept up to date and therefore must retain personal information for as long as LIQUID AVATAR continues to provide services to the user.

Customer Service interactions result in the capture of certain information such as names and email addresses. Upon completion of a customer service ticket, such information will be kept on file by the Companies for 30 days and then deleted, with the exception of tickets for Liquidshopz. All customer personally identifying information from Liquidshopz tickets will be deleted 30 days after the ticket has been completely resolved. Other, non- identifying information will be retained by the Companies to allow for the on-going evaluation of Liquidshopz merchant issues and responses.

15.Updates or Changes to LIQUID AVATAR Policies
LIQUID AVATAR may modify or update this Privacy Policy from time to time, so please review it periodically. If the Companies make any material changes in the way it collects, uses, and/or shares the personal information that you have provided, the Companies will notify you by posting notice of the changes in a clear manner. Your continued use of LIQUID AVATAR’s Services after any modification to this Privacy Policy will constitute your acceptance of such modification.

16.Your Choices and Rights
Subject to local law, you may have certain rights regarding information that LIQUID AVATAR has collected and that is related to you. Please contact LIQUID AVATAR to update or correct your information if it changes or if you believe that any information that we have collected about you is inaccurate or out of date. You can also ask to see what personal information LIQUID AVATAR retains about you, and to erase your personal information. If you would like to exercise the rights you may have, please contact us at support@liquidavatar.com.

Although LIQUID AVATAR strives to provide individuals with access to their personal information, there may be instances where LIQUID AVATAR may not provide access, including but not limited to: where the information would put another individual’s privacy at risk, where the access would reveal confidential commercial information, or the requested information contains legal privilege. If LIQUID AVATAR determines that access should be limited in any specific instance, the Companies will provide an explanation of why that assessment has been made and a contact point for any further concerns.

17.Children’s Privacy
LIQUID AVATAR does not knowingly collect or solicit any information from anyone under the age of 13, or from a minor in a jurisdiction where parental / guardian consent for the collection of information is required until the age of majority in that jurisdiction, or knowingly allow such persons to register for the Service. The Service and its content are not directed at children under the age of 13. In the event that LIQUID AVATAR learns that the Companies have collected personal information from a child under the age of 13 without parental consent, or from a minor in a jurisdiction where parental / guardian consent for the collection of information is required until the age of majority in that jurisdiction, LIQUID AVATAR will delete that information as quickly as possible. If you believe that LIQUID AVATAR might have any information from or about a child that requires parental or guardian consent, please contact LIQUID AVATAR.

In some cases our services may be utilised by governmental bodies for the purposes of facilitating student identification for government approved education. In all such cases, parental / guardian consent will be required for the collection of personal information for participating minors.

16.California Consumer Protection Act of 2018

This section of the privacy policy and notice for California residents applies solely to visitors, users, and individuals, who reside in the State of California (“consumers” or “you”).

We have adopted this notice to comply with the California Consumer Privacy Act of 2018 (CCPA).

The terms “business,” “business purpose”, “personal information”, “processing”, and “service provider” have the meanings giving to them in the CCPA.

Liquid Avatar Technologies Inc. and all affiliates and subsidiaries, (collectively “LIQUID AVATAR” “we” or “us”) may collect and use consumer personal information for its commercial and business purposes and related operational purposes. With respect to these activities, LIQUID AVATAR may have direct responsibilities as a business subject to the CCPA. For example, for certain activities related to direct interaction with consumers who

have a direct relationship with LIQUID AVATAR, interacting with prospective/current clients, marketing, websites/web applications use, engaging vendors, and interacting with visitors/users of our websites. In these cases, this privacy policy is applicable.

LIQUID AVATAR also collects information in its capacity as a service provider to our clients, providing ID verifications, KYC/AML (“Know Your Customer” and “Anti-Money Laundering”) services and other related financial services. In that case, LIQUID AVATAR receives personal information directly from individual customers and in some cases, from our clients where we have no direct relationship with the individuals whose personal information we process, and information is provided to us solely for the business purpose of providing those services.

Categories of Personal Information We Collect
The specific personal information that we collect, use, and disclose relating to a California resident covered by the CCPA will vary based on the level of ID verification processed, however, LIQUID AVATAR never sells or discloses your personal information to third parties.

We have collected and used for business purposes, personal information relating to California residents covered by this policy which may include: