Date of publication: February 01 2023

1. Our principles and the purpose of this Privacy Policy

The company SentX is committed to respecting the privacy of the Users and the secrecy and security of personal data, in accordance with the provisions of the applicable regulations.

Your privacy and the security of your data are our priority. It is part of our DNA and is reflected in the principles that govern our Privacy Policy.

Transparency

We are 100% transparent with you about the data we collect and/or process about you and explain why we use it and for what purposes. We will not treat your data in an unexpected, obscure or abusive way.

Control

You are the only one who can control how your data is used. We provide you with the tools so that you can decide at any time how you want us to treat your data, up to when and how you can access and update your personal information.

Security

We care about ensuring the security, secrecy and confidentiality of your data and personal information. We have carried out the proper analysis and risk assessments according to the best standards of security and privacy, in order to adopt the most demanding and robust security measures on your data to prevent its loss, alteration, misuse or unauthorized access.

These principles are set out in detail in the following sections that make up our Privacy Policy, which we encourage you to read carefully. In it we inform you about everything necessary for you to maintain control over your data as a user of the NFT MarketPlace of SentX Labs SL (hereinafter, the "MarketPlace"), either in the condition of buyer user or in the condition of creator user, or when you interact with us in any way in connection with the MarketPlace (hereinafter, the "User" or the "Users").

Please note that the MarketPlace is an online brokerage platform whose use allows to view, explore, create, edit, publish, unpublish, buy and sell NFT under the operation of the Blockchain technology and network, in accordance with the General Terms and Conditions set forth in the Marketplace (hereinafter, the "General Terms and Conditions"). The Blockchain ecosystem itself implies a decentralization of all the operators involved, such as "miners", "nodes", "Wallet" providers and other Blockchain service providers, which may be actors in the chain or flow of information that travels through Blockchain, generating data, issuing it, receiving it or treating it in any other way, so that each of them can fulfill the specific function that allows the ecosystem to work properly. This poses a great challenge to the privacy of the Users participating and interacting in Blockchain since, although in general it brings numerous advantages to the privacy of the Users (being able to participate in a pseudonymous or anonymous way in an environment with high levels of security), however, due to its intrinsic technical characteristics, the decentralization of the ecosystem prevents a single actor from having full control over Users' data, which could lead to a loss of the control that Users have over their data, as it flows in a complex ecosystem automatically among a large number of actors in the chain.

In the General Conditions you can find all the details about the functioning of the MarketPlace and the use of Blockchain technology within it.

As we have said, through this Privacy Policy, what we intend is to inform you of who we are and how we will treat your data when we act as a MarketPlace brokerage service provider and as part of that Blockchain ecosystem, but we also want you to be aware of all of the above and, especially, that, as we have informed you, there are third parties that may also intervene in the Blockchain ecosystem and process your data, therefore having their own privacy policies, depending on the different roles they hold (data controllers, data processors, etc.), and although we encourage you to read them carefully, we warn that they are alien and independent from us and we cannot assume any responsibility for what is established in them, nor for the actual treatment and handling of your data by these third parties.

2. Who is the data controller?

SentX is responsible for the processing of your data in accordance with what we inform you in this Privacy Policy.

For any questions, requests or complaints regarding the content of this Privacy Policy and our treatment of your data, you can contact us by writing to contact@sentx.io.

3. What data is processed, for what purpose and why do we process the data?

Data we process about you

As a User of the MarketPlace, we process different data about you and for different purposes on appropriate legal bases, either because these purposes are necessary based on the execution of the General Conditions of the MarketPlace, accepted by the User at the time of registration, and which constitute a legal relationship between the User and us, and in respect of which this Privacy Policy is an integral part, either because we pursue legitimate interests duly weighed so that they do not affect your rights and freedoms, and in accordance with these, or because certain legal obligations apply to us that require us to process data about you as a result of your use of the MarketPlace. In any other case, we will request your consent to the processing of your data for a specific purpose duly informed.

The data we process about you is as follows:

• Basic, identifying, contact and/or professional data: name and surname, User name, image and/or avatar chosen, email, telephone, and any other basic or identifying information, completed in the User profile.
• MarketPlace access credentials and identifiers assigned to the User.
• Statistical data of use and interactions of the User with the MarketPlace.
• Data relating to the device and/or connection with which the MarketPlace is accessed: IP address, geolocation, and other connection metadata, as well as information that we may have obtained through the use of cookies and similar technologies (SDKs, pixels, tags, beacons, etc.).
• Data of the transactions and operations carried out in the MarketPlace between Users, as well as billing data to User Creators.
• Metadata relating to NFTs and Smart Contracts, as well as those data that are entered by the Originator User when creating an NFT or collection, including any personal data embedded in the underlying asset of the NFT.
• Public Blockchain address(es) and Wallet that is used by the User to participate in the MarketPlace.
• Data published in Blockchain associated with such public addresses, only for some specific fraud investigation purposes.
• Data related to queries, support, complaints and/or suggestions.
• Data provided in surveys and User tests that we may conduct, in particular, information related to satisfaction with the MarketPlace.
• Data relating to NFT reports made by Users.

Part of this data may be visualized in the MarketPlace by the rest of the users, to the extent necessary to access the different functionalities of the MarketPlace, or to allow the Users to interact with each other and to close the transactions of the NFT, provided that this is strictly necessary for this purpose and in full compliance with the general principles of processing contained in the applicable regulations.

Origin and origin of your data

In general, we obtain this data either directly from you, when you complete the registration form in the MarketPlace, complete the User profile, make a query, complaint or suggestion, or contact us by any means and provide us with the data that are required or are voluntary, or we can generate or capture them automatically during registration, during the process of creating a User or during the use of the MarketPlace itself in response to the operational functioning and/or functionalities existing at any given time.

In this case, all the information you provide as a User must be truthful and accurate. For these purposes, the User guarantees the authenticity of all the data provided as a consequence of the completion of the corresponding forms. The User shall be the only responsible for the false or inaccurate statements made, and for the damages caused to SentX Labs SL, or to third parties, due to the information provided.

In case of provision of false data or data that do not correspond to the account holder, SentX Labs SL reserves the right to cancel the User's account and/or to adopt the measures it deems appropriate for the best defense of its interests and rights, or those of affected third parties that may be concerned as a result of the foregoing.

SentX Labs SL reserves the right to verify the information provided by the User by any means that may be appropriate for the purposes of control and/or verification that may correspond, according to the state of the art at any given time and what is most appropriate for the protection of the interests and rights of the parties involved.

In other cases, we may also obtain data from third parties with whom, as a User, you have a relationship, and those third parties have reached agreements with SentX Labs SL so that you can become a User, so they provide us with your basic and strictly necessary data so that you can or we can register you and access the MarketPlace (for example, creator companies that sign an agreement with SentX Labs SL to be part of the MarketPlace and designate a contact person who will be a creator User in the MarketPlace).

If the User provides personal data of third parties through the functionalities that, if any, are available in the MarketPlace, the User shall be obliged to inform them of such treatment as detailed in this Privacy Policy and that their data will be provided to SentX Labs SL for this purpose, responding exclusively and fully in case of any breach in this regard, being exempt SentX Labs SL from any liability in this area.

On the other hand, SentX Labs SL may obtain information associated with the public address of the User's Wallet that is published in Blockchain, for the purposes of prevention and/or investigation of fraudulent or illicit activities in the MarketPlace.

Likewise, due to the operation of Blockchain itself, we may obtain data or metadata related to the NFT, Smart Contracts or your Wallet, by other parties or entities involved in such ecosystem, in order to ensure that transactions can be carried out correctly as requested by Users.

Purposes we pursue and reasons we have for processing your data

The purposes for which we treat your data as a User are the following:

• Provision of the service and all available functionalities, operation, administration, support and maintenance of the MarketPlace: based on the execution of the General Conditions of the MarketPlace, we will process your data for the purpose of providing the service to you as a User of the MarketPlace, allowing you to enjoy all the functionalities available at all times, operate and maintain it so that the MarketPlace works correctly and securely, or, where appropriate, withdraw or block your access to the service, which includes allowing us to check the requirements demanded of the User, your compliance with the General Conditions of the MarketPlace, proceed or facilitate the registration of the User and, where appropriate, the updating of your data, your access and use of the MarketPlace at any time, among other similar purposes in execution and compliance with all the points incorporated in the General Conditions of the MarketPlace, all while maintaining the condition of User and not requesting cancellation.
• Conducting surveys, User tests and other research activities: based on our legitimate interest to maintain and improve the quality of the service and the User experience, we may contact you to collect information regarding your satisfaction or opinion in relation to the MarketPlace, the service provided and its functionalities, as long as you have not objected to such legitimate interest.
• Maintenance of the activity and security of the MarketPlace, avoidance of information security breaches and possible breaches: based on our legitimate interest, as owner and responsible for the MarketPlace, in ensuring the availability and security of the MarketPlace for all Users, and in accordance with the General Conditions of the MarketPlace, the legal notices and other relevant notices of use, as well as with the provisions of our Cookies Policy and the cybersecurity regulations applicable to SentX Labs SL (Royal Decree Law 12/2018, Royal Decree-Law 7/2022 on 5G security, etc.), we will process your data in order to maintain active and manage the security of the MarketPlace, protect it against security incidents and malicious attacks that it may suffer and, in general, enable free and continuous access to the MarketPlace in a secure manner by all Users.
• Internal management and response to claims, demands, complaints and litigation related to the MarketPlace: based on our legitimate interest associated with the right to effective judicial protection that protects us, we may process your data to manage, respond and intervene as an interested party or similar in administrative or judicial proceedings, when they, in any way, are related to you or refer to you in the corresponding condition. This purpose also applies to the processing of data through the functionality "report NFT" that, if applicable, is used by the User, so that SentX Labs SL can investigate the claims or reports sent through this channel for the best defense of the rights and interests concerned, as well as, if necessary, take the actions it deems appropriate in light of the provisions of the General Conditions of the MarketPlace for this purpose and in the applicable regulations.
• Management of billing, accounting and taxation of the MarketPlace: based on compliance with the legal obligations imposed on us in terms of billing and accounting, we are obliged to process your data for the proper management of billing, accounting and taxation, which includes collecting or declaring your data in the invoices, in the accounting books that we keep or in the statements that for tax purposes may be required by the applicable regulations in this area.
• Retention of data on transactions, identification of Users and other procedures derived from the regulations on prevention of money laundering and financing of terrorism: we have a legitimate interest in acting with due diligence and proactivity in compliance with the aforementioned regulations, so we will treat your data for the purpose of being able to identify you properly and keep them together with the history of the transactions made, always with the aim of, if necessary, to make this information available to the competent authorities that may require it.
• Prevention and investigation of fraud and/or illicit activities: based on the legitimate interest we have to prevent and investigate fraud within the MarketPlace, SentX Labs SL may process personal data of the Users in order to set up automatic alerts that indicate a potential fraud and/or illicit activity for the purpose of being further investigated by SentX Labs SL. During such investigation process, and if strictly necessary, SentX Labs SL may also combine such data with other data published in Blockchain, allowing us to perform a better investigation and evaluation of the specific case, in order to make decisions regarding the establishment and implementation of those control measures and mitigation of the risks detected at any given time.
• Compliance with applicable regulations and response to requests and official requests made by the authorities: in general, as any actor providing information society services and responsible for data processing, various legal obligations apply to us, including obligations in terms of consumer affairs, data protection and security, services and digital markets, as well as in terms of mandatory collaboration with the competent authorities, including law enforcement agencies. Based on the foregoing, we may need to process your data in order to comply with such obligations, for example, to respond to data protection rights exercises that we receive, or to respond to legitimate requests or requests notified to us that require, for example, that we provide some information about you.
• Attention and response to contracting requests, doubts, queries, suggestions and any other type of contact received: based on our legitimate interest in managing and providing an effective response to the request or other type of contact made by a User of the MarketPlace, as well as to the extent necessary for the execution of pre-contractual measures at the request of the User aimed at the acceptance of the General Conditions of the MarketPlace or the signing with SentX Labs SL of an agreement to participate in the MarketPlace, we may process the data of the person who contacts us to provide an effective response based on the contact made, to respond to the suggestion to correct or improve the MarketPlace service in the sense raised or, where appropriate, to inform about the commercial conditions of the MarketPlace and to enter into a contractual relationship for that purpose.
• Statistical analysis of the MarketPlace: based on our legitimate interest to measure the quality of service of the MarketPlace, as well as to know how it is used by the Users, we may perform appropriate statistical analysis with MarketPlace usage data in order to: (1) measure the quality of service and, in case of degradation, take the necessary measures to prevent and/or remedy such degradation; and (2) make better business decisions regarding the future evolution of the MarketPlace, as well as improvements or evolutionary corrections that, if necessary, must be made to offer an adequate experience.

4. How long is the data retained?

In general, we will retain your data for the time necessary to fulfill each purpose described in each processing activity and to determine any liability that may arise from such purpose and/or processing.

Once the indicated retention periods are exceeded, we will proceed to block your personal data during the period of limitation of legal actions and, after that period, we will proceed to its definitive deletion according to the applicable regulations, and/or to its anonymization in a secure way by SentX Labs SL.

In the event that we proceed to the deletion of your data as provided in this Privacy Policy, please note that such process will take place on the databases and storage systems controlled by SentX Labs SL. However, due to the very nature of the Blockchain network explained, certain data related to the transactions carried out in such network and that, in no case will be able to identify you directly, will remain permanently registered in its nodes and, on which, SentX Labs SL does not have the capacity to proceed to its deletion.

5. Who is the recipient of the data and are there any international data transfers?

Third parties that may access, receive and process your data

In general, in order to provide the service and perform the processing purposes described above, we may make use of authorized subcontractors acting on behalf of SentX Labs SL as processors (e.g. internet service and software development providers, data hosting and technical support providers, e-mail providers, general service providers and providers of digital or physical security services, etc.) and contractually subject to our instructions, only to the extent strictly necessary for the provision of the services contracted with them and for the period of time strictly necessary for this purpose.

On the other hand, we inform you that, to the extent that your use of the MarketPlace will enable your participation in Blockchain and the intermediation with other MarketPlace Users with whom you close NFT transactions, your data may be shared both with the other actors that, necessarily, intervene in the Blockchain chain and that have a relevant role in the transactions carried out to create the NFTs, and transfer them (mainly, the different nodes that intervene in the Blockchain network, and that validate and make copies of the record in which each transaction is recorded in such chain or the different operators of the Wallet), as well as with the Users with whom you interact and close transactions directly, with our intermediation, as we explain in detail in the General Conditions of the MarketPlace.

For clarity: (1) through the following link you will be able to access information from the nodes of the Blockchain network of Hedera Hashgraph (although SentX is not responsible for the veracity or updating of such content as it is a third party unrelated to SentX Labs SL); and (2) the Wallet operator used in the MarketPlace and with which information could be shared, as used by the User, is indicated in the General Terms and Conditions.

It is necessary to clarify that your personal data incorporated in the transactions that have to take place in the Blockchain network to offer the functionalities of the MarketPlace, will be communicated to the nodes of the Blockchain network for the sole purpose of providing such functionalities. However, once such transactions have been registered in the network, they will remain there immutably and will be publicly accessible by third parties, without SentX Labs SL being responsible for the processing that, if any, is subsequently carried out by the node itself or such third parties.

In addition, in the event that there is an obligation or legal requirement that so provides, we may communicate your data to the competent public administrations in accordance with such obligation or legal requirement and, where appropriate, also to other bodies such as State Security Forces and Corps and judicial bodies.

International transfers of your data

Finally, you should be aware that when authorized subcontractors acting for and on behalf of SentX Labs SL or when the aforementioned potential recipients are located or process your data outside the European Economic Area, we will be carrying out an international transfer of your data, in accordance with the provisions of the data protection regulations.

In general, we avoid making international transfers and your data are processed within the European Economic Area, but sometimes we cannot avoid it or it is strictly necessary for you to benefit from the use of the MarketPlace and all its features described in the General Conditions. In addition, in the event that we do transfer your data internationally, we assure you that we will take the necessary organizational, technical and contractual measures to ensure the protection and security of your data, such as, for example, signing with the authorized subcontractor or third party transferee of the European Commission's Standard Contractual Clauses, carrying out impact assessments on the international transfer in question to assess the risk and take measures to mitigate it, encryption of data in transit or at rest, pseudonymization of data subject to international transfer, best efforts to ensure that you have the possibility to claim damages directly against the authorized subcontractor or the recipient of your data in a third country, etc.

In any case, we are at your disposal in the mail of exercise of rights informed in section 6 of this Policy, and through which you can obtain more information about the guarantees and measures applied and provided in the applicable regulations.

6. What rights do you have as a data subject?

Your rights

As a User, the data protection regulations grant you some rights over your data that, as applicable, you may exercise against SentX Labs SL. Below, we detail what they are and how you can exercise them.

In addition, we inform you that on the website of the Spanish Data Protection Agency (www.aepd.es) you can find more information about the characteristics of these rights and download templates to exercise each of them, although it is not necessary to use any template to exercise a right before us.

Right to withdraw the consent given

It is your right to withdraw the consent given for the processing of your data for the purposes that are legitimized on that basis, at any time and in an easy way.

Right of access

It is your right to ask us for details of the data we hold about you and how we process it, and to obtain a copy of it.

Right of rectification

It is your right to obtain the rectification of your inaccurate or erroneous data, as well as to complete incomplete data.

Right to suppression

It is your right to request deletion or suppression of your data and information in certain circumstances. However, please note that there are certain occasions when we are legally entitled to continue to retain and process your data, for example, to comply with a legal obligation to retain data.

Right of limitation

This is your right to restrict or limit the processing of your information in certain circumstances. For example, if you apply for deletion of data, but, instead of deleting it, you would prefer that we block it and process it only for record-keeping purposes because you will need it later to file a complaint. Again, please note that there may be times when we are legally entitled to refuse your request for restriction.

Right of opposition

It is your right to object to the processing of your data for a specific purpose, in certain circumstances provided for by law and related to your personal situation.

Right to portability

It is your right to ask us to receive your personal data in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another data controller, provided that we process your data by automated means.

Right not to be subject to automated individual decisions

It is your right to ask us not to subject you, in certain circumstances, to a decision based solely on automated processing of your data, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Means of exercising them and response deadlines

In general, you may exercise these rights at any time and free of charge by contacting SentX Labs SL at contact@sentx.io. Likewise, in general, mechanisms for the automated cancellation of communications and other options for the withdrawal of consent and opposition will be made available to the User.

For this purpose, it is important to take into account that, when you exercise a right, in some cases you must clearly specify which one you are exercising and provide a copy of a document proving your identity. It is also necessary to indicate that some of the data processing is carried out by SentX Labs SL in a way that does not require the direct identification of the Users, without SentX Labs SL being obliged to obtain and/or process additional information to verify said User for the purpose of allowing him/her to exercise his/her data protection rights.

In the event that a User exercises a data protection right and, due to the reasons indicated, SentX is not in a position to identify him/her in order to attend to the request, it will inform him/her to that effect if possible. Such request shall be suspended until the User provides additional information that allows identifying him/her.

Any exercise of rights will be answered within a maximum period of one month, and this period may be extended by two months if we need it in a reasoned manner, taking into account the complexity of the request and the number of requests.

Finally, in the event that you do not agree with the way in which we treat your data by SentX Labs SL, you will have the right to file a complaint with the national supervisory authority, by contacting the Spanish Data Protection Agency (AEPD), whose contact details are as follows:

            Spanish Data Protection Agency

            C/ Jorge Juan, 6 -

            28001 Madrid www.aepd.es

We recommend that before filing any complaint or claim before the Spanish Data Protection Agency (AEPD), you contact our Data Protection Delegate in order to analyze the specific situation and try, if necessary, to find an effective and amicable solution. Apart from the above, if you wish, you can also refer to the AEPD.

7. Anonymization

SentX Labs SL may anonymize the personal data that are lawfully collected and processed for the purposes of the processing indicated in this Privacy Policy, applying both technical and organizational measures required by law to prevent both direct and indirect re-identification risks.

8. Further Processing of Data and Changes to the Privacy Policy

SentX Labs SL reserves the right to update this Privacy Policy at any time. Such update will be made public by SentX Labs SL, in any case, with the legally required notice prior to its entry into force.

In addition, it will be communicated directly to the User in the event that it affects his rights or freedoms or when, for example, the inclusion of a new processing activity would require the User's consent or modifies the scope of the legitimate interest that enables the processing.

9. Microsoft Clarity Integration

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement (https://privacy.microsoft.com/en-us/privacystatement)