Privacy Notice for Data Protection Act (Privacy Notice)

Alpha Global Reserve Limited (the "Token Issuer", "we", "us", "our")

The British Virgin Islands Data Protection Act, (Revised) (DPA) governs the use of Personal Data (as defined in the DPA) by the Token Issuer. We recognise the importance of protecting the privacy of token holders and hereby accordingly, in accordance with the DPA, set out our privacy policy in relation to Personal Data in this Privacy Notice. Any terminology and capitalised terms used in this Privacy Notice bear the meanings as prescribed in the DPA unless the context requires otherwise. The Token Issuer may amend this Privacy Notice at any time and for any reason. The updated version will be available on our website homepage at xaua.alphatoken.com. You should check the Privacy Notice regularly for changes.

DATA CONTROLLER

The Token Issuer is the Data Controller and is responsible for ensuring that it uses your Personal Data in compliance with the DPA. The Token Issuer, as Data Controller, has appointed AlphaToken Technology (HK) Limited ("AlphaToken"), and may appoint any of the Token Issuer's and/or AlphaToken's affiliates, agents, delegates or sub-contractors, as Data Processor(s).

TYPES OF PERSONAL DATA

The Token Issuer and the Data Processors may Process the following types of Personal Data:

• (a) Personal Data provided by you to the Token Issuer including: your name, address, contact information, birthdate, gender, nationality, photograph, signature, occupational history, job title, income, assets, other financial information, bank details, investment history, tax residency, and tax identification information including Sensitive Personal Data.
• (b) Personal Data collected or generated by the Token Issuer including: information related to your emails (and related data), correspondence and website usage data.
• (c) Personal Data obtained by the Token Issuer from other sources, including: know your client (Know Your Client) (KYC) / client due diligence procedures (anti-money laundering (AML), counter-terrorist financing (CTF), counter proliferation financing ("CPF"), sanctions, politically exposed persons), tax purposes such as the crypto asset reporting framework, regulatory, securities and tax requirements, information from public websites, public sources of information (bankruptcy registers, credit reference agencies), publicly accessible directories, and information received from your advisers or intermediaries.

LAWFUL PURPOSES AND PROCESSING PRINCIPLES

Lawful Purposes

Personal Data provided by you, collected or generated by the Token Issuer, or obtained by the Token Issuer from other sources in relation to your tokens will be held, disclosed, and Processed by the Token Issuer and the Data Processors for the following purposes:

• (a) Performance of a contract including:
  • (i) Where you obtain tokens, your Personal Data will be Processed in accordance with our terms. Such Processing may be undertaken prior to entering into a contract at your request;
  • (ii) Where the Token Issuer accepts your application to receive tokens the Token Issuer will Process your Personal Data;
  • (iii) Where you redeem your tokens and/or take physical delivery of gold, your Personal Data will be Processed in accordance with this Privacy Notice and/or the terms and conditions in relation to any token issuance.
• (b) Compliance with a legal obligation including where it is necessary to comply with any applicable current or future legal, regulatory, or tax requirements imposed on the Token Issuer, the Token Issuer and/or any third party service provider will Process your Personal Data in accordance with legal obligations under company law, tax law, AML, CTF, CPF and sanctions requirements and the Token Issuer may be legally restricted from disclosing to you that such Processing is undertaken.
• (c) Legitimate interests, including:
  • (i) Carrying out the ordinary or reasonable business activities of the Token Issuer, or other activities referred to in this Privacy Notice;
  • (ii) Ensuring compliance with all legal and regulatory obligations and industry standards, and preventing fraud; and
  • (iii) Disclosing information to third parties as provided for in this Privacy Notice.

Marketing

We will use your Personal Data for marketing activities. You have the right to prevent processing for the purposes of direct marketing. If you do not opt-out of direct marketing at or before the time we collect your Personal Data, but you later decide that you no longer wish to receive direct marketing, you may ask us to cease any further direct marketing by contacting the Data Controller.

Processing Principles

The Token Issuer will abide by the following data protection principles when Processing Personal Data:

• (a) Your Personal Data, supplied will be Processed fairly.
• (b) Your Personal Data will not be further Processed in any manner incompatible with the purpose or purposes for which it was collected and Processed.
• (c) Your Personal Data will be adequate, relevant, and not excessive in relation to the purpose or purposes for which the Token Issuer collects or Processes your Personal Data.
• (d) Your Personal Data will be accurate and, where necessary, kept up to date.
• (e) The Token Issuer will not keep your Personal Data for longer than is necessary to satisfy the purpose or purposes for which your Personal Data was collected or Processed.
• (f) The Token Issuer will Process your Personal Data in accordance with the rights of Data Subjects under the DPA.
• (g) The Token Issuer will ensure that appropriate technical and organizational measures are taken to safeguard against unauthorized or unlawful Processing of your Personal Data and against accidental loss or destruction of, or damage to, your Personal Data. (Note: Corrected a scanning error where "(8)" appeared instead of "(g)" in the source text).

PERSONAL DATA RECIPIENTS

The Token Issuer may disclose your Personal Data to the following recipients:

• (a) The Token Issuer's affiliates and third-party service providers, including Data Processors;
• (b) The Token Issuer's professional advisers, auditors, IT, and other service providers; and
• (c) Competent authorities (including tax authorities), regulators, courts, law enforcement agencies, and other regulatory entities as required by applicable law, or as requested by such entities, Token Issuer's affiliates, or third-party service providers for internal investigation and reporting purposes.

In relation to any other third parties, we will only disclose your information in the following circumstances:

• (a) Where you have given your consent;
• (b) Where we are required to do so by law or enforceable request by a regulatory body;
• (c) Where it is necessary for the purpose of, or in connection with legal proceedings or in order to exercise or defend legal rights; or
• (d) If we transfer management or control of the Token Issuer.

INTERNATIONAL TRANSFERS

Personal Data will not be transferred outside of the Virgin Islands unless the transfer is:

• (a) made with your consent;
• (b) made in accordance with this Privacy Notice; or
• (c) made on terms ensuring adequate safeguards for the individual(s).

PERSONAL DATA RETENTION

How long the Token Issuer holds your Personal Data for will vary. The retention period will be determined by various criteria, including the purposes for which the Token Issuer is using it (as it will need to be kept for as long as is necessary for any of those purposes) and legal obligations (as laws or regulations may set a minimum period for which the Token Issuer has to keep your Personal Data).

YOUR RIGHTS UNDER THE DPA

Under the DPA, you have the following rights in relation to how we Process your Personal Data:

• (a) The right to request access - you may obtain confirmation from us as to whether or not your Personal Data is being Processed and, where that is the case, access to your Personal Data;
• (b) The right to rectification and erasure - you have the right to obtain rectification of inaccurate Personal Data we hold concerning you and to obtain the erasure of your Personal Data in certain circumstances;
• (c) The right to restrict Processing or to object to Processing - you may require us to restrict the Processing we carry out on your Personal Data in certain circumstances or to object to us Processing your Personal Data;
• (d) The right to withdraw consent - where you have provided your consent to us Processing your Personal Data, you have the right to withdraw your consent at any time. You may exercise this right by contacting the Token Issuer; and
• (e) The right to access, to correct, or to enquire about the Personal Data held by us should be addressed to the Data Protection Officer (support@alphatoken.com); and
• (f) The right to submit a complaint regarded the Token Issuer should be addressed to the Data Protection Officer (support@alphatoken.com).

For further information regarding your Personal Data rights, please obtain independent legal advice.

FAILURE TO PROVIDE PERSONAL DATA

Your Personal Data is required in order for us to issue / redeem tokens and enable us to comply with the legal, regulatory, and tax requirements. If you fail to provide the requested Personal Data, we will not be able to issue / redeem your tokens.

ACKNOWLEDGEMENT AND CONSENT

I acknowledge I have read and understand the contents of this Privacy Notice relating to Alpha Global Reserve Limited, together with any Data Processor and/or any affiliates or any person who has obtained such data and/or the Data Controller considers appropriate. By ticking the box below, I signify my consent for Data Controller and/or Data Processor to use my Personal Data on the terms and purposes set out in this Privacy Notice.

• [ ] I agree to Data Controller's and/or Data Processor's use of my Personal Data for the purposes set out in this Privacy Notice.
• [ ] I agree to the use of my Personal Data for direct marketing we may, from time to time, use your Personal Data for direct marketing of products and services (including reward/loyalty/privilege programs) provided by us, our affiliates, and business partners in accordance with the Privacy Notice, from which we may derive revenue.