INTRODUCTION

This Privacy Notice, along with our Terms and Conditions, describes how we collect,
process, use, and disclose your personal data that you provide to us while using our website
epn.net.

When you register with EPN, log in, make payments using your wallet, contact support, fill
out any forms on the site, or submit any data through the ticket system, we will collect, use,
and store your data in the same way as described in this Privacy Notice.

DETAILS OF THE DATA CONTROLLER AND DATA

PROTECTION OFFICER
The Data Controller is the company that determines the purpose and means of personal
data processing. The company, located at 11332 Blanshard Street, 800 Yates St Suite,
Victoria, BC V8W 0B6, Canada, is the Data Controller for your data processed while you use
EPN. You may contact our Data Protection Officer by email at Support@epn.net.

WHAT IS PERSONAL DATA?

Personal data is considered any information relating to an identified or identifiable natural
person (data subject), directly or indirectly, by reference to an identifier, such as a name, an
identification number, location data, or an online identifier. In other words, personal data is
any information about you that enables your identification.

The way we collect and use personal data is described in this Privacy Notice.

PERSONAL DATA WE COLLECT AND PROCESS

We obtain certain personal data from you directly:

INFORMATION THAT YOU PROVIDE WHEN YOU SIGN

UP
A. First and last name;

B. Email address;

C. Hashed password;

D. Telegram handle (if provided);

E. Skype ID (if provided).

WHEN YOU VERIFY YOUR ACCOUNT
A. Mobile phone number;

B. Identity document photo/scan and data, such as document type, issuing country, number,
expiry date, MRZ, information embedded into document barcodes (may vary depending on
the document), security features;

C. Facial image data, such as photos of the face (including selfie images) and photo or scan
of the face on the identification document, videos, sound recordings;

D. Biometric data, such as facial features.

WHEN YOU INITIATE OR RECEIVE BANK TRANSFER

A. Proof of address document;

B. Document confirming your citizenship/residence permit;

C. Documents required to prove the source of funds;

D. Details of your bank account, including the account number, sort code, IBAN, comment
on your payment;

E. Payment-related details (amount, currency, time, etc.).

WHEN WE INQUIRE ABOUT YOUR TRANSACTIONS TO

PREVENT FRAUD AND MISUSE OF YOUR ACCOUNT
A. Information required to prove the source of funds (for example, bank statements, verbal
explanations, screenshots);

B. Information needed to indicate the purpose and economic sense of the challenged
transaction;

C. The information you fill out on the questionnaire to show that you are acting of your own
free will and understand what you are doing.

WHEN YOU COMMUNICATE WITH US

A. Your contact email;

B. Content of your communication, messages, and files you attach to your messages;

C. Unique ticket system identifier;

D. Technical data related to your messages (including date, time zone, environment, etc.).
TRANSACTION INFORMATION
A. Details of your wallets, unique identifier in the EPN System;

B. Payments performed within your account, including date, time, amount, currencies,
participants associated with the transaction, messages sent and received with the payment,
merchant information, payment methods used, technical usage data, and geolocation
information;

C. Bank card details that you may connect to your EPN account, such as cardholder name,
expiry date, first 6 and last 4 digits of the card number.

HOW WE USE YOUR PERSONAL DATA

We use your personal data for various purposes, including:

● To provide our services and maintain your account;

● To process transactions and send notices about your transactions;
● To verify your identity and prevent fraud, money laundering, and other illegal
activities;
● To improve our services and customize your experience;
● To communicate with you and respond to your inquiries, feedback, and complaints;
● To comply with legal and regulatory requirements.

SHARING YOUR PERSONAL DATA WITH THIRD

PARTIES
We may share your personal data with third parties in certain circumstances, such as:

● With service providers who help us operate our business and provide our services;
● With law enforcement agencies, regulatory bodies, and other authorities when
required by law or to protect our rights and the rights of others;
● With other users of our services, when necessary to facilitate transactions or resolve
disputes;
● In the event of a merger, acquisition, or sale of our business or assets.

DATA SECURITY
We take appropriate technical and organizational measures to ensure the security of your
personal data, including encryption, access controls, and regular security audits.

YOUR RIGHTS
You have the right to access, correct, delete, or restrict the processing of your personal data.
You also have the right to object to the processing of your personal data, request data
portability, and withdraw your consent at any time.

CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time to reflect changes in our practices or
applicable laws and regulations. We will notify you of any significant changes and update the
"last modified" date at the top of this notice.

CONTACT US
If you have any questions or concerns about this Privacy Notice or our data processing
practices, please contact our Data Protection Officer by email at dpo@epn.net or by mail at
the following address: 11321 Blanshard Street, 800 Yates St Suite, Victoria, BC V8W 0B6,
Canada.

INFORMATION FROM YOUR DEVICE

● A. Tabs: Permission is needed to determine when a user is in the Facebook
advertising cabinet (https://facebook.com/) and display the corresponding buttons
within the extension.
● B. Storage: Access to storage is needed to use browser-level caching and save
general data used in various components of the extension (e.g., token).
● C. Cookies: Access to cookies is necessary to automatically authorize a user if they
are logged in on the EPN.NET platform (https://app.epn.net/). Only the cookie token
from this platform is read.
● D. Scripting: Permission is needed to directly and automatically insert card data in
the Facebook advertising cabinet (https://facebook.com/).
● E. Host permissions: Permission is needed so that the extension can read and
interact with cookies and tabs on EPN.NET (https://app.epn.net/) and Facebook
(https://facebook.com/) resources.

REMOTE CODE EXECUTION

● Remote code: The extension uses a separate script, which is located inside the
extension and is responsible for ensuring that the user's card data can be
automatically inserted into the appropriate fields in the Facebook advertising account
(https://facebook.com/) for quick and convenient payment for an advertising
campaign. This functionality streamlines the user experience and minimizes the time
spent on manual data entry.

INFORMATION WE MAY RECEIVE FROM THIRD

PARTIES
 ● Information from payment systems (Visa, Mastercard, UnionPay), payment service
providers;
● Information received from card schemes, card program managers;
● Information from public authorities and law enforcement agencies;
● Information received via public sources (for example, company registers and
enhanced due diligence services).

LEGAL BASIS AND USE OF YOUR PERSONAL DATA

We only process your personal data where a lawful basis exists. We may rely on the
following:

● Performance of a contract we enter with you;

● Our legal obligation;
● Our legitimate interests, taking into consideration your rights, interests, and
expectations;
● Your consent.

A) Performance of a contract we enter with you

We process your personal data to provide you with EPN services based on the Terms and
Conditions that you accept when you sign up in our system.

We collect your data to set up and administer your EPN account.

Moreover, we also process your data to ensure secure access to your EPN account when
we send you a one-time password or other access codes.

We use your data to process transactions you make with your EPN account, such as
transferring funds, making payments, adding money to a wallet, or withdrawing funds.

We process your data when you obtain an IBAN. To achieve this, we share data with third
parties who provide such services.

We may send you important information about the system, login confirmation, suspicious
authorization attempts and completed transactions notifications, as well as provide technical
and customer support.

We process personal data to assist you in resolving issues related to the use of EPN when
you contact customer support via ticket, email, or phone.

B) Our legal obligation

We process your personal data to comply with our legal obligations, in particular the
requirements of anti-money laundering and terrorist financing legislation, to verify and
confirm your identity as part of the KYC procedure.

When you request an IBAN or initiate a bank transfer, we also send your data to the
providers of these services to meet AML requirements and follow KYC rules.
We may use your data to assist any law enforcement authority with their investigation or
disclose data required by a court order as we may be obliged by law.

C) Our legitimate interests

We may use anonymized and aggregated data to analyze how customers use our services
and evaluate the quality and convenience of our product, site operation, and functionality.

Likewise, we may also use your data to notify you about changes to our policies or new
features of EPN.

We take a risk-based approach to assess both the profile of users and the transactions they
make, as well as to detect and prevent fraudulent and other illegal activities. We collect, use,
and store personal data for these purposes.

When you contact the support service, we keep a record of the conversation. We do this to
improve the quality of our services and products, protect our interests in case of disputes,
evaluate the quality of the work of the support staff, and train them.

D) Your consent

You may opt in to receive emails about our products and services, and allow us to measure
the performance of marketing emails and analyze product use. You may withdraw your
consent at any time.

To verify your account, we ask you to go through the liveness test to make sure that you are
a living person and the documents submitted really belong to you. To achieve this, you will
need to turn on the camera and turn your head so that the neural network can analyze the
individual features of your face. Such analysis constitutes the processing of a special
category of personal data and can only be carried out based on your consent.

The term of the consent is limited to the achievement of the purpose of the liveness check,
so the data processing is terminated immediately once it is completed. The data collection
and processing are carried out by a third party, acting as a data processor on our behalf. You
can read more about this in the “Disclosure of personal data to third parties” section.

AUTOMATED DECISION-MAKING
We use an automated risk assessment system to analyze the risk profile of users and
ongoing transactions to prevent illegal and fraudulent activities. However, any significant
decisions that may impact you will be taken by our employees based on a manual review.

COOKIES AND BROWSER PERMISSIONS

● Tabs: Permission is needed to determine when the user is in the Facebook Ads
Manager (https://facebook.com/) and display the corresponding buttons within the
extension.
 ● Storage: Access to storage is needed to use browser-level caching and save general
data used in various components of the extension (e.g., the token).
● Cookies: Access to cookies is necessary to automatically authorize the user if they
are logged in on the EPN.NET platform (https://app.epn.net/). Only the cookie token
from this platform is read.
● Scripting: Permission is required to directly and automatically insert card data in the
Facebook Ads Manager (https://facebook.com/).
● Host permissions: Permission is needed for the extension to be able to read and
interact with cookies and tabs on EPN.NET resources (https://app.epn.net/) and
Facebook (https://facebook.com/).

HOW WE KEEP YOUR DATA SECURE - EPN

We are committed to ensuring that your personal data is protected. We take a variety of
security and organizational measures to ensure the safety of your data when you enter it on
the site or otherwise provide it to us.

Furthermore, we use data encryption techniques and authentication procedures to prevent

unauthorized access to our system and your data. Only authorized employees are granted
physical access to the premises where data is processed and stored. The premises are
being monitored.

All supplied sensitive information is transmitted via Secure Socket Layer (SSL) technology.
Card payment information encryption is compliant with PCI DSS.

We authorize access to your personal data only for those employees who need it based on
their job requirements (for example, customer support staff). All employees who access
personal data are bound by a non-disclosure agreement. We implement continual training
for our employees in regard to ensuring the security and confidentiality of personal data.

We continuously improve our security procedures to comply with the best industry standards
and maintain a high level of personal data protection.

We recommend you also adhere to some simple rules that will help ensure your safety.
Never use the same password for multiple accounts on different sites and always use a
strong password with mixed case letters, numbers, and symbols. Do not tell anyone your
EPN wallet password. Please remember that our employees never ask for user passwords.
If someone pretending to be an EPN employee asks you for your password or other login
information, do not give it to them and notify us immediately by email at Support@epn.net.

HOW LONG WE KEEP YOUR DATA

Your personal data will be retained as long as necessary for the specific purpose for which it
was collected.
The data we collect for AML compliance and anti-fraud purposes will be kept for 5 years
after you close the account. All data will be deleted when the statutory retention period is
over and the purposes of using the collected information are achieved.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

To provide our services, we may need to share your information with third parties.

CROSS BORDER TRANSFER OF DATA

Some of our partners and employees may be located outside Canada and the European
Economic Area (EEA), so we may transfer data to third countries. Such a transfer may only
take place if appropriate guarantees are in place to ensure an adequate level of protection of
the rights of the personal data subjects. Our partners and providers are required to provide
an adequate level of data protection in accordance with the terms of the contract we enter
into with them.

LINKS TO OTHER WEBSITES

Our website may contain external links to third-party resources, such as the services of our
partners. We can't control how third parties use your information for their purposes, so
please review the Privacy Policies of these websites.

YOUR RIGHTS
You have the right to exercise control over the way in which your personal data is processed:

● Right to be informed. You are entitled to know how and why we process personal
data. Therefore, we publish this Privacy notice and are always ready to answer any
of your questions.
● Right of access. You can ask us to confirm whether we are processing your personal
data. You can ask for detailed information about how we collect, process, use, store
and share your data.
● Right to rectification. We strive to maintain the integrity of the data we store and keep
it up to date. Therefore, you can always ask us to clarify and correct outdated or
inaccurate information.
● Right to erasure/Right to «be forgotten». You may request to delete your personal
data. However, if we are required by law to still retain it, then the right to erasure will
not apply to such processing.
● Restrict and object to processing. You may restrict or object to the processing of your
personal data.
● Right to data portability. You can ask us to transfer your data to another entity
providing similar services, if it is technically possible to do so and unless it is not
restricted by law. The data will be transmitted in a structured, commonly used, and
machine-readable format.
 ● Right to withdraw consent. Where the processing is based on your consent, you may
withdraw it at any time by changing your account settings or by sending an e-mail to
Support@epn.net. You can opt out of receiving materials from us electronically by
clicking the «unsubscribe» link in e-mails.
● Right to complain. You may lodge a complaint if you feel like your rights have been
violated. Please refer to the following section for further details.

We will reply to your request within 30 days once we receive it. If we expect that responding
to you would take longer, we will let you know.

You may exercise your rights described above by sending an e-mail to Support@epn.net.
Before we provide you with any confidential information, we must ensure that you are indeed
the person you claim to be. For example, we will ask you to send a request from the mail
associated with your EPN account, or in rare cases to pass SumSub verification.

However, if the requests are manifestly unfounded or excessive, in particular because of

their repetitive character, we may charge a reasonable fee considering the administrative
costs of providing the information or communication or taking the action requested.

Kindly note that there may be legal reasons when we will not be able to fulfill your request.

FILING A COMPLAINT
If you believe that your rights have been violated, you may file a complaint with the Office of
the Privacy Commissioner of Canada. You may also file a complaint with the supervisory
authority in your country of residence, place of work, or place of the alleged violation. If you
are in the EU, you can find the relevant supervisory authority on the European Data
Protection Board Website.

CHANGES TO OUR PRIVACY NOTICE

We may update our Privacy notice from time to time. In case of significant changes, we may
notify you of them by e-mail.

CONTACT
You are welcome to send your questions and comments regarding our Privacy notice to our
Data Protection Officer at Support@epn.net.