Streamex Privacy Notice

Introduction

Streamex Corporation, GLDY ServiceCo, LLC, Streamex, Ltd., and their respective affiliates (together, "Streamex," "we," "us," or "our"), recognize the importance of protecting your privacy. This Privacy Notice explains how we collect, use, share, and protect personal information when you visit our websites and portals (the "Sites"), request information, submit an indication of interest, complete AML/KYC and accredited investor verification, are whitelisted to participate, subscribe for or transfer GLDY tokens, receive token dividends, request redemptions, or otherwise use our applications, products, and services (together, the "Services").

This Privacy Notice applies to the processing of personal information by Streamex in connection with the Services. It does not apply to our employees or job applicants, or to information processed by third parties for their own purposes. Our Sites may link to third party websites; their privacy practices are governed by their own notices.

If you provide personal information about another individual, you are responsible for obtaining any consent required by applicable law before sharing that information with us.

Who we are and roles

• Streamex Corporation, a Delaware corporation, operates the public Sites and investor portal and manages investor relations and onboarding.
• Streamex, Ltd., a Cayman Islands exempt company (the "SPV"), issues GLDY tokens and maintains the official register of members through its appointed administrator (the "Administrator").
• GLDY ServiceCo, LLC, a Delaware limited liability company (the "Servicer"), which provides day to day services to the SPV and may receive information necessary to perform those services.

Depending on your interaction with us, Streamex Corporation, GLDY ServiceCo, LLC, Streamex, Ltd., and/or certain of their service providers may act as independent or joint controllers of your personal information under applicable laws for their respective activities described in this Privacy Notice.

Information we collect

We collect the following categories of personal information, depending on how you interact with us and the Services. The examples below are illustrative and not exhaustive.

• Account, identity, and contact information. Includes, for example, your name, email address, phone number, mailing address, country of residence, date of birth, and similar identifiers.
• Compliance and eligibility information. Includes information and documents used for AML/KYC and sanctions screening and to verify accredited investor status and other eligibility requirements (e.g., identity documents, proofs of address, sanctions/PEP/adverse media results, accreditation attestations or documentation, and our eligibility decisions).
• Wallet and blockchain linkage. Includes wallet addresses you provide for whitelisting, whitelisting status, and blockchain transaction identifiers associated with whitelisted wallets. Public blockchains are open ledgers that third parties may analyze; we do not control public blockchains.
• Subscription, transaction, and holdings information.Includes subscription materials, token balances and movements, dividend and redemption records, and entries on the official register maintained by the Administrator.
• Technical and usage information. Includes IP address, device and browser information, settings, referring URLs, pages viewed, timestamps, and similar telemetry from the Sites and investor portal, as well as cookies and similar technologies (see Cookies and tracking).
• Communications and preferences. Includes inquiries, support tickets, meeting notes, communications with us, and your preferences (e.g., marketing choices).
• Inferences and risk indicators. Includes internal assessments and vendor provided risk indicators used to help detect fraud, financial crime, or ineligibility, consistent with applicable law.

We collect information directly from you, automatically through the Sites and Services, and from service providers and other sources as permitted by law (e.g., verification vendors, sanctions screening vendors, wallet analytics providers, the Administrator, affiliates, or public sources). We may combine information collected from different sources for the purposes described in this Notice.

How we use personal information

We use personal information for the following purposes, and where applicable for the following legal bases:

• Onboarding and contract performance: to respond to requests, register your interest in our Services, verify eligibility (including accredited investor status worldwide), complete AML/KYC and sanctions screening, whitelist wallets, process subscriptions, administer token dividends and redemptions, maintain the official register, and provide the Services.
• Legal and regulatory obligations: to comply with AML, counter terrorist financing, sanctions, securities, tax, and other regulatory requirements and to respond to lawful requests from authorities.
• Security, fraud prevention, and compliance: to secure our Sites and Services, monitor for fraud and abuse, enforce our terms, and protect our rights and the rights of others.
• Service improvement and operations: to operate, maintain, and improve the Services, including analytics on a de identified or aggregated basis.
• Marketing and communications: to send permitted notices about our Services and events. Where required by law, we will obtain your consent or provide opt out mechanisms.

We may de identify or aggregate information and use it for any lawful purpose to the extent permitted by applicable law. We do not sell personal information.

Automated decisions

We use automated tools to help assess sanctions, AML, fraud risks, and eligibility for whitelisting. In certain jurisdictions, you may have the right to request human review of certain automated decisions or to object to automated processing, subject to legal limitations.

Cookies and tracking

We use essential cookies to operate the Sites and may, where required by law and with your consent, use analytics cookies to understand and improve Site usage. You can manage your preferences through our cookie banner or browser settings. In certain jurisdictions, we may recognize browser based Global Privacy Control signals for covered opt outs. Our Sites do not respond to "Do Not Track" signals.

How we share personal information

We share personal information as reasonably necessary to operate the Services and comply with law:

• Service providers and processors. We engage companies that help us operate the Sites and Services (for example, administrators, onboarding and verification providers, AML/KYC and sanctions screening providers, wallet/blockchain analytics, cloud hosting and IT, communications and customer support, and auditors and other professional advisers). We endeavor to use contractual and other measures designed to limit their use of personal information to our instructions and to require appropriate safeguards.
• Program partners and intermediaries. We may share information with entities that support GLDY program operations, such as the Servicer, the Administrator, Monetary Metals & Co. and related program partners, and, where applicable, registered broker dealers, alternative trading systems, custodians, and payment or digital asset processors.
• Affiliates. We may share information within the Streamex group for purposes consistent with this Notice.
• Legal, compliance, and safety. We may disclose information to regulators, law enforcement, courts, or other third parties as required or permitted by law, including to protect rights and safety, to enforce our terms, or in connection with claims and disputes.
• Corporate transactions. We may disclose information in connection with a merger, acquisition, reorganization, or other corporate transaction.

We do not authorize our service providers or partners to use personal information for their own marketing. We do not sell personal information.

International transfers

We operate globally. Your personal information may be transferred to and processed in countries that may not provide the same level of data protection as your home jurisdiction and where it may be subject access by authorities under the laws of those countries, including the United States and the Cayman Islands. Where required, we use appropriate safeguards (such as standard contractual clauses) and conduct transfer risk assessments.

Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Notice, including to comply with legal, regulatory, accounting, or reporting requirements, to resolve disputes, and to enforce agreements. Retention periods vary based on the type of information and context. We apply criteria such as:

• the nature and sensitivity of the information;
• the purposes for which it is processed;
• legal, regulatory, and recordkeeping requirements (e.g., AML/KYC and sanctions records must be kept for legally required periods after a relationship ends);
• operational needs and the existence of disputes or investigations.

By way of example (subject to change), AML/KYC and sanctions records are retained for legally required periods; tokenholder register and corporate records are maintained as required by corporate law; and web logs/analytics data are kept for shorter operational periods aligned to your cookie preferences. Copies of information may persist in backups for a limited time, and we may retain certain information to comply with legal obligations or to establish, exercise, or defend legal claims.

Security

We endeavor to use administrative, technical, and organizational measures designed to protect personal information, which may include encryption in transit and at rest, access controls, monitoring and logging, and periodic testing. No system is completely secure. If we become aware of a data incident affecting your personal information, we will notify you in accordance with applicable law.

You are responsible for maintaining the confidentiality of your account credentials and for securing your wallets and devices.

Your choices and rights

Depending on your location and subject to legal limits, you may have rights to:

• Access, correct, or delete personal information;
• Obtain a copy (portability) of certain information you provided to us;
• Object to or restrict certain processing, or withdraw consent for non essential cookies;
• Opt out of certain data disclosures deemed a "sale," "share," or "targeted advertising" under applicable U.S. state laws.
• Further information about transfers of personal information outside of your jurisdiction.

Some rights are limited by law. For example, we may retain AML/KYC and register records as required by law, and we may deny deletion requests where retention is legally required or necessary to establish, exercise, or defend legal claims. We will not discriminate against you for exercising your rights.

To exercise rights or submit questions, contact us at privacy@streamex.com (see Contact us below). We may request information to verify your identity and authority.

Children's privacy

Our Services are intended for individuals who have reached the legal age of majority in their jurisdiction. We do not knowingly collect personal information from children under 13 (or the age of digital consent where higher). If you believe a child has provided personal information to us, please contact us and we will take appropriate steps to delete such information.

Blockchain transparency

Transactions in GLDY tokens may be recorded on public blockchains. Public blockchains are distributed ledgers intended to immutably record transactions across a network of systems. Many blockchains are open to forensic analysis that can lead to deanonymization and the unintentional revelation of personal information, especially when on chain activity is linked to off chain identity. You should not include personal information in free text or memo fields used in blockchain transactions.

Third party websites and services

Our Sites may link to third party websites or services with different privacy practices. This Privacy Notice does not apply to those sites or services. We encourage you to review their privacy notices.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The "Last updated" date indicates the effective date. Material changes will be posted on our Sites and, where required, we will obtain your consent. Your continued use of the Services after an update indicates your acknowledgment of the updated Notice.

Contact us

If you have questions, requests, or complaints about this Privacy Notice or our privacy practices, please contact:

Privacy Team
Streamex
Email: privacy@streamex.com

If you are located in the EU/UK or Cayman Islands, you may have the right to lodge a complaint with your local supervisory authority.