LITTLEBIRD FULL PRIVACY NOTICE

LittleBird (littlebird.mx) is operated by ALTRNTV, S.A., a company domiciled in Panama City, Republic of Panama (the "Company").

This Full Privacy Notice (the "Notice") explains how the Company processes the personal data of the persons who use LittleBird (each, the "User"), as the data subjects of that data, in accordance with the personal data protection laws that apply.

The Company is the controller of the processing of the User's personal data.

The Company collects the following data that the User provides:

• The email address and/or telephone number with which they log in.
• The username they choose and their profile photo, if they upload one. Other users can see them.
• Information about the origin of their funds, if requested.
• Messages, complaints, disputes and support requests that they send, with the evidence they attach.

The Company also collects the following data, which is generated when the User uses LittleBird:

• The address of their wallet and the addresses of the wallets from which they receive, or to which they send, stablecoins.
• Their orders, positions, transactions and payouts.
• Data on their deposits and withdrawals in legal tender currency: name of the holder, details of the account of origin or destination (such as the CLABE and the bank), currencies, amounts, dates and reference numbers of each transfer.
• Type of device and browser, IP address and approximate location, which are used to confirm that LittleBird is available in the place where the User is.
• Usage logs and cookie data (see section 4).

In addition, the Company receives the following data from third parties:

• From the payment providers: the result of the User's identity verification and the status of their deposits and withdrawals in legal tender currency.
• From the verification providers: whether the User appears on sanctions lists or lists of politically exposed persons.
• From the wallet provider: the address of the User's wallet and their login method.
• From public blockchains: the transaction history of the User's wallet, which is public.

The User's transactions, positions, deposits, withdrawals and bank details are financial or asset data. Through the box that the User checks when registering, the Company requests the User's express consent to process this data.

The Company does not collect sensitive personal data. The official identification and the photographs used to verify the User's identity are collected by the payment providers, under their own privacy notices.

LittleBird uses essential cookies, which keep the session open, confirm the location and protect the account. LittleBird does not work without them. It also uses analytics cookies to understand how LittleBird is used and to keep it working well.

If the User accepts it in the cookie notice, LittleBird also uses cookies and similar technologies from advertising platforms, such as social networks and search engines, to measure the Company's advertising campaigns. The User may change their mind at any time: block or delete the cookies in their browser, use the privacy options of those platforms or write to info@littlebird.mx with the subject "Publicidad".

The User may also block or delete cookies in their browser, although some parts of LittleBird could stop working.

The Company uses the User's data for the following primary purposes, which are necessary to provide the service. Without them, the Company cannot give the User an account.

• Create and manage the User's account and wallet, and show the User's username and profile photo to other users.
• Confirm that the User may use LittleBird: age, country of residence, location and sanctions lists.
• Process their deposits and withdrawals with the payment providers and confirm that the account or payment method is in their name.
• Send their orders to the markets in which they trade and show them their positions, outcomes and history.
• Prevent fraud, money laundering and market abuse, and keep LittleBird secure and working properly, including basic usage analytics.
• Comply with the Company's legal obligations, including keeping records and responding to formal requests from authorities.
• Respond to their questions and complaints, and review their disputes, including with automated tools.
• Send them service messages: changes to the Terms and Conditions or to this Notice, security alerts and transaction confirmations.

The Company also uses the User's data for the following secondary purposes, which are optional:

• Analyze how LittleBird is used in order to design new functions and products.
• If the User accepts it, measure the Company's advertising campaigns with browsing data (see section 4).

The User may refuse the secondary purposes at any time by writing to info@littlebird.mx with the subject "Finalidades secundarias". For advertising, the User may also use the options in section 4. Refusing does not affect their account.

The Company uses companies that process data on behalf of the Company (processors) for hosting, databases, wallet infrastructure, email, customer service, analytics, artificial intelligence tools and accounting and legal advice. They only process the data in accordance with the Company's instructions, under contracts that oblige them to protect it. Under the law, sending them data is a disclosure to a processor, not a transfer, and does not require the User's consent.

The Company shares data with the following independent third parties:

• Payment providers: to process the User's deposits and withdrawals in legal tender currency and so that the payment providers can comply with their own customer identification and anti-money laundering obligations. It does not require the User's consent, because it is necessary to perform the contract with the User and the law requires it.
• Third-party prediction market platforms: the User's orders, signed by their wallet, go to the platform and to the blockchain. It does not require the User's consent, because it is necessary to perform the contract with the User.
• Competent authorities (for example, tax and financial intelligence authorities, and courts): when the law or an order of an authority requires it. It does not require the User's consent, because the law requires it.
• The Company's legal and professional advisers: to exercise or defend the Company's rights in judicial proceedings. It does not require the User's consent, because it is necessary to exercise or defend a right in judicial proceedings.
• Advertising platforms (for example, social networks and search engines): to measure the Company's campaigns with browsing data collected by the advertising platforms' cookies. It requires the User's consent: it is only made if the User accepts it in the cookie notice, and the User may change their mind at any time (see section 4).

The Company does not sell personal data. The only transfer that requires the User's consent is that of browsing data to advertising platforms, and it is only made if the User accepts it. If the Company wants to make another one, it will ask for the User's consent beforehand.

The processors and the third parties referred to in section 6 may store or process the data outside the country where the User lives, for example in the United States, Panama or the European Union. They must protect it as described in this Notice.

LittleBird is not for persons under 18 years of age or for those who are not of legal age in the place where they live. If the Company learns that it collected data from a minor, it deletes it.

The Company uses administrative, technical and physical security measures, such as encryption in transit, access controls and multi-factor authentication for its team.

The User has the right to:

• Access their personal data and know how it is used.
• Rectify it if it is incorrect or incomplete.
• Cancel it, that is, request that it be deleted. It is first blocked and then deleted, except for the data that the law requires to be kept.
• Object to its use for certain purposes, including decisions made solely through automated processing that affect them.

To exercise these rights, the User must write to info@littlebird.mx with the subject "Mis datos" and include:

• their name and an email address or domicile where the response can be sent to them;
• a copy of an official identification or, if someone requests it on their behalf, that person's identification and the document proving that they represent the User;
• the right they wish to exercise and a clear description of the data concerned (not necessary for access requests); and
• any information that helps locate their data, such as their wallet address or the email with which they log in.

The Company responds within 20 business days. If the request is granted, the Company carries it out within the 15 business days following its response. Each deadline may be extended only once, for the same period, when there is a justified cause, and the Company will tell the User why. Exercising these rights is free of charge. The User only pays, where applicable, the cost of copies or shipping.

These rights have the following limits:

• The Company cannot modify or delete data recorded on a public blockchain. No one can.
• The law requires the Company to keep certain records of the User's account and transactions for a period after their account is closed. During that time, those records are blocked from any other use.
• In other cases in which the law allows a request to be denied, the Company will explain why.

The User may revoke their consent at any time by writing to info@littlebird.mx with the subject "Revocar consentimiento". The revocation has no effect on what was done before. If the User revokes their consent for a primary purpose, the Company may have to close their account, because the Company cannot provide LittleBird to the User without that processing. The Company responds within the same deadlines as the requests in section 10.

The User may request that their data no longer be used for the secondary purposes (see section 5), and may manage cookies as explained in section 4.

The Company keeps the data while the User's account is open. After the account is closed, the Company keeps the records of the User's account and transactions for the period required by law, and then deletes or anonymizes them.

The Company will publish any new version at littlebird.mx with its date. If the Company wants to use the data for a new purpose, it will request the User's consent beforehand.

The Company's Privacy team handles all requests regarding personal data at info@littlebird.mx. If the User believes that their rights were violated, the Company asks them to contact it first so that it can be resolved. The User may also go to the personal data protection authority of their country.