Privacy Notice

1. General Introduction

Welcome to Coin Bridge AG (“Kai”, “We”, “Our”). We are redefining how our customers (“You”) experience digital asset services — starting with our commitment to transparency about the data you share with us.

This Privacy Notice explains the categories of personal data we collect from you, why we collect it, what we do with it, our obligations to you, and how you can exercise your rights under Swiss law.

Coin Bridge AG is a Virtual Asset Service Provider (VASP) incorporated in the Canton of Zug, Switzerland, and regulated under membership of the Association Romande des Intermédiaires Financiers (VQF), a self-regulatory organisation (SRO) recognised by the Swiss Financial Market Supervisory Authority (FINMA). We process your personal data in accordance with the Swiss Federal Act on Data Protection (nFADP; SR 235.1) and applicable Federal Data Protection and Information Commissioner (FDPIC) guidance.

Scope

This Privacy Notice applies to you if:

• You are a Coin Bridge AG customer; or
• You are a prospective Coin Bridge AG customer reviewing our website at kai.xyz or any of our products.

2. Why Does a Crypto Exchange Want My Data?

We understand that sharing personal data is not something anyone does lightly — especially in an industry that often promises greater privacy. So here is the honest explanation.

Coin Bridge AG is a regulated VASP. Our regulator — VQF, acting under the authority of FINMA — has expectations of us, including the duty to know our customers (KYC) and to apply anti-money laundering and counter-terrorist financing controls (AML/CFT) pursuant to the Swiss AMLA (SR 955.0). We also need this data to detect when a fraud event or suspicious activity is occurring on your account.

In some cases, we also collect your data to notify you promptly about changes to our services, new offerings, and important account information.

We want to assure you that we do not collect data blindly or unnecessarily. We collect only the minimum required to deliver our services to you, and we apply industry-leading technical and organisational measures to protect it.

3. The Data We Collect

The table below sets out the categories of personal data we collect, why we collect them, and the applicable Swiss legal basis under the nFADP:

4. What We Do With Your Data

• Account verification – We do not merely collect your data at onboarding; we verify its accuracy before storing it. This is required by Swiss law and helps us flag unauthorised access.
• Service delivery – Without your account information, we would be unable to process your transactions or provide our services to you.
• Marketing updates and communications – To inform you of our latest updates, asset listings and delistings, changes to your account, and requests for information, where you have opted in to receive such communications.
• Compliance with lawful requests – We may receive lawful requests from public authorities, FINMA, VQF, MROS, or SECO relating to your personal data. Where we have validated such a request and confirmed compliance with applicable Swiss law, we may share your data with the requesting authority. For further information, please review our data subject rights section or contact us at privacy@kai.xyz.

5. How Long We Retain Your Data

The length of time we retain your personal data is governed by applicable Swiss law, in particular the AMLA and nFADP:

• KYC and transaction data: retained for a minimum of ten (10) years after the conclusion of our business relationship with you, in accordance with Art. 7 AMLA and VQF record-keeping requirements.
• Marketing data: retained for a maximum of three (3) years after the conclusion of our business relationship, or until you withdraw consent, whichever is earlier.

If you have any further questions about our data retention practices, please contact us at privacy@kai.xyz.

6. Your Rights as a Data Subject

You have rights under the Swiss Federal Act on Data Protection (nFADP; SR 235.1). Your key rights are set out below:

• Right of access – You may request access to the personal data we hold about you and information about how we process it.
• Right to data portability – You may request that we transfer your personal data to a third party, in a structured and machine-readable format, where technically feasible.
• Right to erasure – You may request the deletion of your personal data. Please note that we are legally required to retain your KYC information for a minimum of ten (10) years after the closure of your account, in accordance with Art. 7 AMLA. We cannot erase data subject to mandatory retention obligations.
• Right to rectification – You may request the correction or updating of inaccurate personal data we hold about you, such as a change of name or updated address.
• Right to withdraw consent – Where we process your personal data on the basis of your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to object – You may object to the processing of your personal data where we rely on legitimate interests as our legal basis.
• Right to lodge a complaint – If you have concerns about our data processing practices, please contact us first at privacy@kai.xyz. If your concern is not resolved to your satisfaction, you have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at www.fdpic.ch.

To exercise any of the rights set out in this notice, please submit a Data Subject Access Request (DSAR) by contacting our Data Protection Officer at privacy@kai.xyz or via the request form available on our website at kai.xyz.

7. Blockchain Analytics and Automated Processing

• Coin Bridge AG utilises advanced compliance tools — including Chainalysis for blockchain analytics and Sumsub for identity verification — for functions such as onboarding, transaction monitoring, and risk management. These tools automate data processing at scale. We ensure they are regularly tuned to avoid disproportionate impact on our customers.
• All automated decisions are subject to human oversight in the decision-making process to manage the risk of error, misdiagnosis, or false positives. You may request that any automated decision affecting you be reviewed by a member of our Compliance team.
• Please keep your wallet addresses and passwords secure. While wallet addresses are pseudonymous, de-anonymisation is possible in some circumstances. Coin Bridge AG applies organisational and technical measures to protect your data. We ask that you assist us by adopting safe practices with your private information.

8. With Whom May We Share Your Data?

We may share your personal data with the following categories of recipients, only to the extent necessary and in accordance with applicable Swiss law:

• Third parties expressly authorised by yourself;
• Internally with Coin Bridge AG staff who have a genuine need to access the data;
• Identity verification and screening service providers (including Sumsub and Chainalysis);
• Sub-processors who provide operational or technical services to Coin Bridge AG;
• Professional advisors and external consultants bound by non-disclosure agreements or professional duties of confidentiality; and
• Competent Swiss authorities, including MROS, SECO, FINMA, VQF, or cantonal prosecution authorities, where required or permitted by applicable law.

Where we transfer personal data outside Switzerland, we do so only in accordance with Art. 16 nFADP — either to countries recognised by the Swiss Federal Council as providing an adequate level of data protection, or under appropriate safeguards such as standard contractual clauses approved by the FDPIC.

9. Age Requirement and Child Protection

• Coin Bridge AG’s services are reserved exclusively for adults aged 18 years and above. If you are below 18 years of age, we are unable to provide our services to you at this time.
• If you believe we have incorrectly assessed your age, please contact our Data Protection Officer at privacy@kai.xyz. By using our services, you represent to Coin Bridge AG that you are an adult and fulfil all eligibility requirements set out in our Terms of Service.

10. Account Deletion and Erasure

We value all our customers. However, if you wish to close your account, we have made provision for that. Please note the following important information about our account deletion process:

Deletion is Permanent

Following your deletion request, there is a short withdrawal window during which you may change your mind. Once that window closes, your deleted data is permanently removed from active systems and is no longer accessible to you.

We May Decline Your Deletion Request

In certain cases, Coin Bridge AG may be unable to fulfil a deletion request, including:

• To comply with a legal rule, regulatory requirement, or supervisory obligation;
• Where there is a pending court order or lawful law enforcement request relating to your account;
• Where we have reasonable grounds for suspicion in relation to your request or account; or
• In pursuit of a legitimate public or regulatory interest.

We May Retain Certain Data After Account Closure

Even following account closure, certain categories of personal data may be retained, including:

• Where we are required by applicable law to retain the data (including mandatory AMLA retention periods);
• Where we have received a lawful request from MROS, FINMA, VQF, or a law enforcement authority relating to the data;
• Where there is a court order requiring preservation of personal data; or
• Such other circumstances as we may communicate to you on a case-by-case basis.

11. Contact Us

If you have any questions about this Privacy Notice, our data protection compliance programme, or wish to exercise your rights as a data subject, please contact us via any of the following:

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at www.fdpic.ch if you are not satisfied with our response to your enquiry or complaint.