Rain Privacy Notice

Rain Trading Limited ("Rain Trading", "we", "our", "us" or the "Company") is committed to providing the highest level of protection regarding the processing of our clients' personal data based on the applicable data protection laws and regulations. This Privacy Notice (the "Notice") describes how we may collect, use, store, disclose or otherwise process personal data.

Please read this Notice carefully. This Notice applies to your personal data and any dispute over privacy.

All capitalised terms are defined within the meaning of the Abu Dhabi Global Market Data Protection Regulations 2021 ("DPR").

The term "personal data" or "personal information" is information that identifies an individual person or where an individual person can be identified. The term "processing" means everything that Rain Trading can do with the data such as collecting it, recording, storing, adjusting, organising, using, disclosing, transferring, or deleting.

Responsibility for data processing and how to contact us

Rain Trading Limited is the Data Controller in accordance with the provisions of the DPR. We are responsible for deciding how we hold and use personal information about you.

Controller identity and contact details:

Rain Trading Limited

Address: Unit 9, 7 Floor, Al Sarab Tower, Abu Dhabi Global Market Square, Al Maryah Island, Abu Dhabi, UAE

Email: dataprivacy@rain.com

Data Protection Officer:

Joseph Dallago, Chief Executive Officer Rain Trading Limited Email: dataprivacy@rain.com

In this notice we disclose to you certain information about how we process your personal data. This includes details on when we are collecting or processing personal information about you, what we do with your information and who your information may be shared with.

If you have any questions about this Notice, including any requests to exercise your legal rights under the DPR, please contact us using the details set out above.

Scope of this notice

This Notice sets out our practices when processing personal data in the context of professional relationships with our clients to whom we provide products and services or enter any transaction. We collect and otherwise process personal data relating to past and existing clients, prospective clients and any other person involved in the business relationship, such as clients' authorised representative, persons holding a power of attorney, guarantors, beneficiaries, board members, beneficial owners, and other individual business contacts (collectively referred to as "you", "your" or "client(s)").

Personal information we hold about you

We collect certain types of personal data while providing virtual asset services to our clients. We may collect personal data directly from individuals through communications and the Company's application forms, and we may receive these in writing or electronically. This information can include, but not be limited to, the information set out below:

• Identity information: includes information such as first name, surname, gender, marital status, age/date of birth, name of partner and children(s), passport number, place of birth, nationality(ies), individual tax ID and country of tax residence and proof of identity such as a copy of your passport or equivalent document when we identify and verify individuals or to meet tax, Anti-Money Laundering ("AML") and other "Know Your Customer" ("KYC") legal and regulatory obligations.

• Contact information: includes information such as billing address, delivery address, email address and telephone number(s).

• Personal information: such as details on your education, profession, employment details, details on source of wealth (origin and how is composed) and source of funds, bank details and/or bank statements, tax details, information to assess whether you might be a politically exposed person or represent a money laundering risk, financial knowledge and understanding, investment experience, risk ability and understanding of your goals and objectives in looking for our services, where applicable.

• Relationship information: includes your preferences in receiving marketing from Rain Trading and our third parties (if applicable) and your communication preferences. This helps us to understand more about how to conduct business with you and what types of products and services may be of interest to our client(s).

• Transactional information: transactional information and metadata based on your use of Rain Trading such as orders, trades, fiat currency account balances, Virtual Asset (including virtual currencies) account balances, transaction history, correspondence submitted by you to us and other content that you generate that relates to your account.

• Your interaction with Rain Trading's platform: such as computer and connection information, page views, keywords searched, IP address, and other statistics on site usage.

• Correspondence: such as ongoing customer support or other correspondence transmitted on Rain.

For limited purposes, such as in the case of undertaking AML and KYC checks, it may be necessary for us to process special categories of personal data. This may include data about criminal convictions and information about your political exposure, where we are authorised to use this information under the DPR. In these circumstances, we will process such personal data only when there is a legal basis we can rely on under the DPR.

Non-personal information we hold about you

We additionally collect non-personal data, including "automatically collected data", "aggregated" or "anonymised" information that informs us how others use the services ("Non-personal Data").

Non-personal Data includes, but is not limited to: (i) device properties, including, but not limited to, type, IP address, Media Access Control ("MAC") address and unique device identifier or other persistent or non-persistent device identifier ("Device ID"); (ii) device software platform, operating system, type of Internet browser, and firmware; (iii) mobile phone carrier; (iv) web browsing patterns, including websites visited; (v) geographical data such as zip code, area code, and other non-precise location information; (vi) the way in which you use the services, including frequency and duration of usage; and (vii) other Non-personal Data as reasonably required by us to enhance the services.

We use cookies, tags, web beacons, local shared objects, files, tools and programmes to obtain the foregoing information for use in our records, to store your preferences, and improve our advertising. You can disable cookies in your web browser at any time, but some functionality of our Site may be impaired if you disable cookies. In order to collect such Non-personal Data, we may use tools or third-party analytical software to automatically collect and use such Non-personal Data.

What happens if personal data is not provided

In certain circumstances where an individual does not provide personal data which is required, we will not be able to provide the products and services under our contract with clients or may not be able to comply with a legal obligation imposed on Rain Trading. Where we need to collect personal data by law, or under the terms of a contract and you fail to provide this information when requested, we may not be able to perform the contract we have or are trying to enter with you. In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case, at the time.

Where we collect your personal data from

This Notice applies when we collect individuals' personal data directly from the individual or when we collect it from any other third parties. You can provide your personal data directly to us by filling in our account opening forms for various services and products, through meetings with the Rain Trading team, or by communicating with us by post, telephone, e-mail, chat or using other means. We may collect personal data provided by your company or an intermediary, from your agents, advisers, intermediaries and custodians of your assets or from third party sources, which may include third party referrals, verification processes such as due diligence checks, social media such as Facebook, Twitter, Instagram, LinkedIn or other public internet sites, information stored in databases provided by third-party screening providers (such as but not limited to Worldcheck and other similar providers) and credit reference agencies, government agencies or even financial institutions.

We also process personal data that we obtain from publicly accessible sources (such as but not limited to press, sanction lists, internet searches) or that is legitimately transferred to us by third parties (e.g. exchanges and other similar entities) for KYC and AML/CFT or other financial crime compliance purposes.

Purpose of processing your data and legal basis

We must have a legal basis to process your personal data in accordance with the DPR. In most cases, we will use your personal data in the following circumstances:

Where we need to fulfil our contractual obligations with you — Data is processed to provide financial services in accordance with the legal agreements with our clients. This also includes carrying out pre-contractual measures that occur as part of a request from you or from an interested party. The purposes of data processing are primarily in compliance with the specific product or service and can include needed assessments and advice, as well as carrying out transactions and services to you such as virtual asset trading and custody. You can find further details about our contractual obligations with you, and the related purposes of data processing, in the Rain Trading User Agreement and other related documentation.

Where we need to comply with legal and regulatory obligations — Rain Trading as a regulated Company is subject to several legal and regulatory requirements applicable in Abu Dhabi Global Market. The purposes of processing include identity checks, fraud and money laundering prevention, and fulfilling compliance reporting obligations under applicable regulations.

When pursuing our legitimate interests and those of third parties — A legitimate interest will apply only where we consider that it is not outweighed by an individual's interests or rights, which require protection of their personal data. We have determined that our legitimate interests include the following activities:

• Compliance with applicable regulatory standards

• Recording telephone lines and monitoring communications to comply with law

• Conducting internal and external audits for the legitimate purposes of managing our business

• Rain Trading accounting purposes

• Receiving professional advice to protect our business

• Prevention and detection of financial crime and fraud

• Evaluating, bringing, or defending legal claims

• Managing our business and other risks as may be required to operate as an effective, efficient, and financially prudent Company

As a result of your consent — If we decide to process personal data on a basis not covered by any of the above legal justifications, we will rely on your consent as the lawful basis. If you have granted us consent to process your personal data for certain purposes, the processing is carried out on the basis of your consent. Consent given to Rain Trading can be withdrawn at any time and does not affect the legality of data processed prior to withdrawal. Further details regarding how to contact us are listed in the contact section above.

Purposes for which we will use your personal data

We have outlined below a description of the key purposes for which we need to use your personal data, and the applicable lawful basis for processing your data. Please contact us if you need further details about the specific legal basis we are relying on to process your personal data.

Fulfil contractual obligations

Rain Trading needs to process your personal data because it is required for the performance of a contractual relationship where you are one of the parties in the legal agreement, or to take steps at your request prior to entering a contract. As such, we will use your personal data for:

• Onboarding you as a prospect or new client, verifying your identity, carrying out client due diligence, undertaking searches, looking for references or information and if required, making other enquiries if we consider necessary

• Providing you with our services agreed between both parties in the Agreement which might be amended from time to time

• Facilitating smooth running of the business through communication with clients about our products and services

• Fulfilling certain requirements such as but not limited to a transaction initiated by a client, to manage wire transfers, fees and charges

• Dealing with any complaints or any feedback you might have to Rain Trading

• Any other purpose for which you provide Rain Trading with your personal data

Comply with legal and regulatory obligations

We need to process your personal data for our compliance and legal obligations that the Company is subject to. As such, we will use your personal data for:

• Onboarding you as a prospect or new client, verifying your identity, carrying out client due diligence, undertaking searches, looking for references or information and if required, making other enquiries if we consider necessary

• Performing checks and making decisions whether to onboard or not a client

• Facilitating smooth running of the business through communication with clients about our products and services

• Undertaking financial crime mitigation measures such as but not limited to verification of identity and checking transactions for AML purposes

• Meeting compliance obligations that apply to the Company for regulatory reporting purposes or if required by any regulatory, monetary, tax or fiscal authorities as well as any competent court or legal authority empowered to do so

• Meeting legal and regulatory requirements such as but not limited to prevention of money-laundering, financing of terrorism, fraud, tax evasion, bribery and corruption or any other crimes punishable under the applicable law

• Maintaining database management and business records of products, services and other transactions

• Conducting audits for the legitimate purposes of the business and to meet regulatory requirements; accounting purposes

• Addressing and resolving issues and complaints internally and to enhance our services

Legitimate interests

Rain Trading needs to process your personal data because it is necessary for our legitimate interests, or sometimes where it is necessary for the legitimate interests of another person. As such, we will use your personal data for:

• Facilitating smooth running of the business through communication with clients about our products and services

• Fulfilling certain requirements such as but not limited to a transaction initiated by a client, to manage wire transfers, fees and charges

• Managing our relationship with you, including but not limited to the development of the relationship, carrying out any marketing activities, making suggestions and recommendations to you about products or services that may be of interest to you

• Managing how we work with other companies and service providers that provide services to us and our clients

• Undertaking financial crime mitigation measures such as but not limited to verification of identity and checking transactions for AML purposes

• Meeting compliance obligations that apply to us for regulatory reporting purposes

• Enforcing or defending the rights of our employees

• Maintaining database management and business records of products, services and other transactions; conducting audits for the legitimate purposes of the business and to meet regulatory requirements; accounting purposes

• Conducting internal product analysis and market research in order to develop and improve our products and services

• Addressing and resolving issues and complaints internally and to enhance our services

Who receives your personal data

We will disclose personal data of individuals where it is necessary to fulfil the specified purposes outlined above. We require third parties to respect the security of your personal data and to treat it in accordance with the DPR. We may transfer and disclose your personal data with a range of parties which may include:

External recipients of data

We will transfer personal data about you while conducting our usual business, or as part of meeting our legal, regulatory or market practice requirements to the following external recipients:

• To public authorities such as tax authorities, supervisory authorities, regulatory authorities, and other government agencies, security, or police authorities as part of our regulatory reporting requirements

• To other third-party agencies and suppliers in order to carry out AML/CFT/KYC/PEP/fraud checks and comply with legal obligations

• To other third-party companies in order to meet our contractual obligations, market practices and compliance standards in connection with transactions and the services that we provide you with (such as banks, brokers, exchanges, clearing houses, trade repositories, processing units and third-party custodians, issuers, authorities, and their representatives)

• To third parties who have introduced you to us such as financial service providers, your agents, advisers, and intermediaries in order to process the personal data for the purposes as set out in this Notice

• To third parties who work on our behalf to service or maintain client accounts and relationships, such as administrators and custody providers including those external to Rain Trading

• To Rain Trading subsidiaries, affiliates and parent companies where required to facilitate our services to you

To service providers and agents

We will transfer your personal data to service providers and agents appointed by us for the purposes outlined in the Notice, subject to maintaining confidentiality, which may include:

• Third parties who manage our physical premises

• Third parties who service or maintain our business contact database and those who support our website

• Third parties providing services to Rain Trading such as our professional advisers (e.g. auditors, lawyers, accountants, or public relations advisers)

• Third parties who process data on our behalf as part of our outsourcing arrangements including IT service providers and data storage providers

How secure is your information with third-party service providers

All third-party service providers that handle our data are required to take appropriate technical and organisational measures to protect your personal information. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Virtual assets are not anonymous

Virtual Assets are not truly anonymous. Virtual Assets and IP addresses are published on a decentralised network ledger or blockchain. Such information may be correlated with information we and others may have, even if others were not involved in a blockchain transaction. This means that others may be able to see the balance or transaction history of any Virtual Assets using tools or third-party analytical software. Rain Trading uses blockchain analytics as a tool to protect its services from being used for illegal or prohibited uses as listed in our user agreement and for research and development purposes.

Cookies

We may use cookies and similar technologies on our website. Cookies are text files that store small amounts of information, which your computer stores when you visit a website. When you return to the website or visit a website and mobile apps (if applicable) that use the same cookies, they recognise these cookies and therefore your device. We use cookies to do many different jobs, like letting you navigate between pages efficiently, remembering your preferences and generally improving your online experience. They can also help ensure that the ads you see online are more relevant to you and your interests.

We do not link the information we store in cookies to any personal data you submit while on Rain Trading. We use both session ID cookies and persistent cookies. A session ID cookie expires when you close your browser. A persistent cookie remains on your hard drive for an extended period of time. You can remove persistent cookies by following directions provided in your Internet browser's "help" directory. If you reject cookies, you may still use Rain Trading, but your ability to use some areas of Rain Trading will be limited.

Transfer and processing of personal data

When sharing your personal data with third parties as set in this Notice, some of the recipients may be based outside the Abu Dhabi Global Market so the processing of your personal data will involve a transfer of data outside the Abu Dhabi Global Market. When we share information with organisations in another jurisdiction, we will ensure they agree to apply adequate levels of protection for personal data as we do under the DPR. If they are not in a jurisdiction that the Commissioner of Data Protection regards as having adequate levels of protection for personal data, we will put in place appropriate safeguards (such as contractual commitments) to ensure that your data is adequately protected.

We will only transfer data that we have legal basis to process. Your personal data will only be transferred outside the Abu Dhabi Global Market on one of the following bases:

• The jurisdiction where we send the personal data is providing an adequate level of protection for personal data

• The Commissioner of Data Protection has granted a permit or written authorisation for the transfer and Rain Trading applies adequate safeguards with respect to the protection of this personal data

• You have explicitly consented to the proposed transfer

• The transfer is necessary for the performance of a contract between you and us or the implementation of pre-contractual measures taken in response to your request

• The transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party

• The transfer is necessary or legally required on grounds important in the interests of the Abu Dhabi Global Market, or for the establishment, exercise, or defence of legal claims

• The transfer is necessary in order to protect your vital interests

• The transfer is necessary to uphold our legitimate interests recognised in the international financial markets, provided that such is pursued in accordance with international financial standards and except where such interests are overridden by your legitimate interests relating to your particular situation

• The transfer is necessary to comply with any regulatory requirements including but not limited to auditing, accounting, Anti-Money Laundering or Counter Terrorist Financing obligations or the prevention or detection of any crime that apply to us

Marketing communications

Subject to the DPR and other applicable laws and regulations, we may from time to time send direct marketing materials promoting services, products, facilities, or activities to you using information collected from you. We are committed to providing you with choices regarding your personal data used for marketing. If you receive marketing directly from us, you can opt out of, or object to receiving marketing by contacting your relationship manager or emailing us at dataprivacy@rain.com.

Additionally, we will ensure that any outside companies assisting us in marketing our products and services, or with whom we have marketing agreements (if applicable), are under contractual obligations to protect confidentiality of personal data, and to use it only to provide the services we have asked them to perform.

How long we will store personal data for

Rain Trading maintains reasonable procedures to help ensure that personal data is reliable for its intended use, accurate, complete and current. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data. We will retain the personal data of individuals covered by this Notice for as long as required to fulfil the purposes for which the data was collected including for the purposes of satisfying any legal, accounting, or reporting requirements, in accordance with the applicable laws and regulations in the Abu Dhabi Global Market. In general terms, this will mean that personal data will be kept for the duration of our relationship with the individual and the period required by tax, company and financial services laws and regulations. We are required to retain data for up to five (5) years for the purposes of compliance with applicable regulations.

We may retain necessary personal data for up to five (5) years from the termination of our relationship with you to exercise our legal rights in the event of a complaint or prospective litigation in respect of our relationship with you.

When it is no longer necessary to retain your personal data, we will securely delete it, subject to applicable law and regulations.

Except for retention periods as set out herein, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

If you request that we stop sending you marketing materials, we will continue to keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.

If you make a data subject request, we will retain the minimum required amount of data in order to keep a record of your request and the action we took to resolve it.

In certain circumstances, personal data may need to be retained for a longer period where extended retention periods are required by law and in order to establish, exercise or defend our legal rights.

Your rights

Individuals are granted certain rights in relation to their personal data which will apply in certain instances. If you would like to exercise, or discuss, any of these rights, please submit your request to dataprivacy@rain.com and provide sufficient information to allow us to understand the scope of the request. Under certain circumstances set out in the DPR you have the right to:

• Request Access: You are entitled to ask Rain Trading whether we are processing your personal data and, if we are, you can request access to your personal data. This enables you to receive a copy of the personal data we hold about you and certain other information about it.

• Request Correction: You are entitled to request that any incomplete or inaccurate personal data we hold about you be corrected.

• Request Erasure: You are entitled to ask Rain Trading to delete or remove personal data in certain circumstances. However, we may not always be able to comply with your request for erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Objection: Where we are processing personal data based on legitimate interests you may challenge this. However, we may be entitled to continue processing personal data based on our legitimate interests or where this is relevant to legal claims. You also have the right to object where we are processing personal data for direct marketing purposes.

• Restriction: You are entitled to ask Rain Trading to restrict the processing of your personal data, for example if you want us to establish its accuracy or the reason for processing it.

• Automated Decisions: You are entitled to contest any automated decision made about you where this has a legal or similarly significant effect and to require such decision to be reviewed manually in certain instances.

• Non-discrimination: You will not be discriminated against for exercising your rights under the DPR.

• Consent: If our processing is based on consent, you can withdraw your consent at any time by contacting dataprivacy@rain.com. This will not affect the lawfulness of processing based on consent before such withdrawal.

• Contact Supervisory Authority: We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the Office of the Commissioner of Data Protection in Abu Dhabi Global Market via email to data.protection@adgm.com.

If Rain Trading is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on Rain Trading of any change in ownership or uses of your personal data, as well as any choices you may have regarding your personal identifiable information.

If your personal data or other account information on file for you changes, or if you no longer desire our services, you may contact Rain Trading at dataprivacy@rain.com.

For more information about your privacy rights, please visit the website of the Office of the Data Protection Commissioner in ADGM: https://www.adgm.com/operating-in-adgm/office-of-data-protection/overview

Closing an account

Upon your request and provided that you do not have an outstanding balance due on your account, we will close your account as soon as reasonably possible, based on your account activity and in accordance with applicable laws and regulations and the terms of our User Agreement. Upon your account closure Rain Trading retains your personal data as described in this Notice.

Security

We follow generally accepted physical, electronic, and procedural safeguards consistent with the type of personal data or non-personal data that we collect, process and maintain. We use various technical and organisational security measures to protect the information we collect, as appropriate to the type of information, including encryption, firewalls, and access controls. We also limit access to this information to authorised employees and contractors who need to know that information in order to operate, develop or improve the services. No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee its absolute security. If you have any questions about security on our services, please contact us at dataprivacy@rain.com.

Changes to the notice

A copy of this Notice can be requested from us using the contact details available above. We may modify or update this Notice from time to time. Where changes to this Notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you advance notice.

Contact us

If you have any questions about our Privacy Notice, you may contact us at dataprivacy@rain.com. Please be aware that any unsolicited information or communications you submit to us will not be considered confidential or proprietary and we will not have any obligations with respect to such under this Privacy Notice.

Children's privacy

Rain Trading does not knowingly solicit data from or market to children under the age of 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us using the details in the "Contact Us" section above. Rain Trading will delete such information from our files within a reasonable time.

Disputes and legal proceedings

We regularly review our compliance with this Privacy Notice. If we receive a formal written complaint from you, we will attempt to contact you directly to address any of your concerns. We will cooperate with the appropriate governmental authorities to resolve any complaints regarding the collection, use, transfer or disclosure of information that cannot be amicably resolved between you and Rain Trading. The services are governed by the laws of the Abu Dhabi Global Market. Any dispute, controversy or claim arising out of or relating to this Privacy Notice or the breach, termination or validity thereof shall be finally settled pursuant to the terms of the User Agreement.