Privacy Policy

At MERJ Exchange Limited ("MERJ," "the Company," or "we"), the safeguarding of your Personal Information is a priority. We are dedicated to upholding the privacy, confidentiality and security of the Personal Information you entrust to us. We encourage you to thoroughly review this Privacy Policy, which contains vital details regarding the handling of your Personal Information.

MERJ owns and operates the online platform accessible at www.merj.exchange (referred to as "our Website").

This Privacy Policy is expressly limited to personally identifiable information collected through our Website by MERJ and its affiliates, which include MERJ Clearing and Settlement Limited and MERJ Depository and Registry Limited. References to "our Website" within this Privacy Policy pertain exclusively to the webpages of www.merj.exchange that are directly linked to this policy.

"Personal Information," as used in this document, denotes any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier.

"Processing" of your Personal Information encompasses all actions related to the handling, collection, protection, and storage of such data.

By outlining our practices, this Privacy Policy clarifies how we collect, process, store, share and protect your Personal Information during your engagement with us, specifically when you:

• Apply to become a Platform Participant of MERJ by completing the "MERJ Platform Participant Agreement" form on our website to create your trading account;
• Apply to serve as a Service Provider for MERJ by submitting the "Member Application Form" or "Sponsor Advisor Application Form" through our website;
• Engage with us in any capacity that establishes you as a MERJ client;
• Utilize our website for information or services; and
• Contact us, whether for media, investor relations, stakeholder outreach, or other communications.

Collectively, we refer to the above points as the "Activities."

Visiting our website does not necessitate the provision of your Personal Information. However, engaging in certain Activities, as specified above, may require such information.

We typically acquire your Personal Information directly from you (for example, through your voluntary engagement in the Activities) or from publicly available sources.

All processing of Personal Information by MERJ shall be conducted on lawful bases as defined under Section 15 of the Seychelles Data Protection Act 2023. Consent obtained from data subjects shall be informed, specific and capable of withdrawal at any time by contacting the MERJ Data Protection Officer. Withdrawal shall not affect prior lawful processing.

Understanding Cookies: Cookies are small files placed on your device that enable us to recognize your browser and capture and remember certain information. They help us understand your preferences based on previous or current site activity, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.

How We Use Cookies:

• Website Functionality: We utilize cookies to enhance website functionality, personalize your online experience, and improve navigation.
• Analytics: Cookies help us analyze user behavior on our website to identify popular areas and improve content delivery.
• Non-Personal Data: Cookies used on our website do not capture your personal identification details.

Your Choices Regarding Cookies:

• Acceptance: By using our website, you consent to our use of cookies.
• Managing Cookies: If you prefer not to accept cookies, you can:
  • Not use our website,
  • Adjust your browser settings to refuse cookies from us,
  • Use your browser's privacy feature (e.g., Incognito, InPrivate, Private Browsing).

MERJ embeds privacy measures into all systems, processes, and services in accordance with Section 35 of the Seychelles Data Protection Act 2023.

We may collect and process various categories of your Personal Information, which typically include:

Purpose of Use: Your Personal Information is utilized exclusively for the following purposes:

• Processing applications related to the Activities you wish to engage in with MERJ
• Enhancing and personalizing your experience on our website
• Continuous improvement of the services provided through our website
• Identity verification and eligibility for services
• Service delivery and relationship management
• Website enhancement based on feedback
• Educational purposes
• Handling complaints and issues
• Marketing and informational communications
• Content personalization to better suit your interests

Personal Information in Business Operations: We use your Personal Information for:

• Legal and regulatory compliance
• Communications with authorities
• Invoicing and financial records
• Business development
• IT security and management

You are afforded specific rights concerning your Personal Information:

We are committed to responding to any requests within one month. To exercise any of these rights, please reach out to us at the contact details listed in the "Contact Us" section below.

Retention:

Personal data shall only be retained for as long as necessary to fulfill the specific purposes outlined in this Privacy Policy and to comply with our legal and regulatory obligations. The criteria used to determine the retention period include:

• The length of time we have an ongoing relationship with you and provide our services to you
• Whether there is a legal obligation to which we are subject
• Whether retention is advisable considering our legal position

Deletion Process:

Once data is no longer needed, the following deletion processes will be initiated:

• Electronic Data: Data stored in electronic format will be securely erased using industry-standard deletion methods
• Physical Records: Any physical documents containing personal data will be securely shredded
• Third-Party Data Processors: We will ensure that any third-party processors enact equivalent measures
• Verification of Deletion: Upon completion, we will conduct checks to verify irretrievable deletion

Security Measures:

• We employ appropriate security measures to safeguard your Personal Information from unauthorized access, loss, misuse, inadvertent disclosure, alteration, and destruction
• Our staff are trained and required to uphold your privacy and we restrict their access to what is necessary for their job functions
• Your data is stored in secure electronic databases, with some possibly managed by third-party data storage providers
• All Personal Information is protected through a range of security processes

• Transfers: Personal Information may be transferred in business transactions like mergers or acquisitions
• Subsidiaries and Affiliates: We may share your data with subsidiaries and affiliates, who will be bound to honor this Privacy Policy
• Legal Obligations: We may disclose Personal Information when (i) legally required, (ii) to protect or defend our rights or property, or (iii) to protect us against legal liability