Mandala Finance Privacy Notice

1. Who we are and what this notice covers

MANDALA CHAIN INC., a corporation incorporated under the laws of the Republic of Panama, wholly owned by Mandala Chain Foundation (“Mandala,” “we,” “us” or “our”), operates the Mandala Finance websites and application at mandala.finance and app.mandala.finance (the “Interface”).

We decide why and how personal data is processed for the Interface. We are the responsable del tratamiento under Panama Law No. 81 of 2019 and the controller where the EU General Data Protection Regulation (“GDPR”), UK GDPR or another law uses that term. We treat a wallet address and associated activity as personal data where they relate to an identified or reasonably identifiable natural person.

This notice covers the Interface and our off-chain records. It does not govern your wallet, a public blockchain, or an independent third-party protocol, website or service. Those parties apply their own privacy terms.

You can contact us about privacy by a private message to the Mandala team through the official Mandala channels: Discord (https://discord.gg/MwUQgQZgxm), X (https://x.com/MandalaChain) or Telegram (https://t.me/mandalachain). Ask for a private channel before sharing any personal details.

EEA representative: None appointed. We rely on the exemption in Article 27(2)(a) of the GDPR: our processing is occasional, does not include large-scale processing of special-category or criminal-offence data, and is unlikely to result in a risk to individuals. The Interface has no user accounts and does not ask for a name or email address.

UK representative: None appointed. We rely on the exemption in Article 27(2)(a) of the UK GDPR: our processing is occasional, does not include large-scale processing of special-category or criminal-offence data, and is unlikely to result in a risk to individuals. The Interface has no user accounts and does not ask for a name or email address.

2. Corporate and data-protection roles

Mandala Chain Inc.: Interface controller

Mandala Chain Inc. is the sole operator and contracting party for the Interface. It determines the Interface’s data purposes, data fields, vendors, access permissions, security measures, retention periods and responses to rights requests and incidents.

Development and infrastructure service provider: processor

We use a development and infrastructure-administration service provider located in Hong Kong. It may also assist with support and the execution of our marketing instructions. It accesses or processes Interface personal data only to provide contracted services on our documented instructions, subject to confidentiality, security, subprocessor, rights-assistance, incident, deletion/return, audit and international-transfer terms. It may not use Interface personal data for its own advertising, product development or other independent purposes and does not become the controller, Interface operator or fee beneficiary merely because its personnel or wallets perform administrative functions.

We maintain a current register of material service providers and will provide further information about recipients where applicable law requires it. You may request that information using the contact details in Section 15.

Mandala Chain Foundation: separate KPG controller only

Mandala Chain Foundation (the “Foundation”) owns Mandala Chain Inc. and is the issuer and treasury administrator of KPG. Ownership alone does not make the Foundation a controller or joint controller of general Interface data. The Foundation does not receive general quote/build diagnostics, Terms-acceptance records, support files or screening records merely because it is our shareholder.

Where the Foundation collects KPG-specific information directly from you, or independently determines why and how KPG-specific records are processed, it acts as a separate controller for those records under its own privacy notice, available through its official website at https://mandalachain.io. We disclose non-public personal data to the Foundation only where the disclosure is described at collection, necessary for a KPG activity you request, made with valid consent where required, or otherwise authorised or required by law. The Foundation’s access to public blockchain information does not give it access to our off-chain records.

3. The short version

You do not create a conventional Mandala account. We do not ordinarily ask for your name, postal address, telephone number, government identifier or payment-card details merely to quote or build a swap. We may request proportionate identity or compliance information if law, sanctions or access review, a privacy-rights request, support, a complaint, or a future approved issuer feature requires it.

We process a connected public wallet address and limited quote and transaction-build diagnostics so the Interface works and failures can be measured and fixed. Current active diagnostic records are automatically deleted after 90 days. We keep a separate minimal record of your acceptance of the Terms. We use an IP address briefly for rate limiting and may process IP-derived location and wallet-risk information for security, sanctions and access controls. Infrastructure providers may create security or access logs as described below.

The current Interface does not use advertising trackers, does not use product-analytics trackers and does not set cookies. It uses limited local browser storage for the purposes described in Section 4E. If those facts change, we will update this notice and obtain any consent required before using non-essential tracking or storage.

A public blockchain is different from our database. A transaction authorised through your wallet may become a permanent public record that we cannot edit or erase.

4. Personal data we process and why

A. Interface requests and diagnostic records

When you connect a wallet, request a quote or ask the Interface to build a transaction, we may process and record:

• your public wallet address;
• the blockchain or network and relevant token addresses;
• input token, output token and input amount;
• the quote or build phase, quote or route identifier and source or provider;
• whether the quote or build succeeded and, if not, a failure reason or technical error;
• limited technical metadata needed to diagnose the request; and
• date and time.

These are quote and transaction-build outcomes. A successful record does not prove that you signed, broadcast or completed a blockchain transaction. Confirmed transactions can instead be observed on the public blockchain.

We receive this information from your use of the Interface, service providers used to construct a quote or transaction, and public blockchain data. We use it to provide requested functionality; operate, test, secure and troubleshoot the Interface; measure aggregate failure rates; prevent abuse; respond to support and legal issues; and establish or defend legal claims.

B. IP address, security and rate limiting

Our application uses an IP address as a short-lived rate-limit key to prevent one source from overwhelming the service. In the current design, that key expires after approximately 60 seconds and is not a field in the swap-diagnostics database.

Our hosting, network, security, CDN/WAF, development-infrastructure and RPC providers may separately process IP addresses, device or browser information, request metadata and event times in access, abuse-prevention or security logs. Those records are retained for up to 90 days on a rolling basis, or the shorter period our providers keep them and are not used by us for advertising.

C. Sanctions, location and access-control information

We screen connected wallet addresses against sanctions lists and process the resulting matches, risk indicators, screening results and review records to comply with sanctions and other laws, prevent evasion and protect the Interface. We do not currently block access by location. If we introduce location controls, we will also process an IP-derived country or region for that purpose and update this notice. An initial automated result may prevent an Interface request. You may ask for human review by a private message to the Mandala team through the official Mandala channels: Discord (https://discord.gg/MwUQgQZgxm), X (https://x.com/MandalaChain) or Telegram (https://t.me/mandalachain). Ask for a private channel before sharing any personal details, except where law restricts what we can disclose or do.

We retain screening and review records for 5 years from the screening event or from the end of any review it triggered, based on applicable legal recordkeeping periods, the need to demonstrate compliance and the period in which a claim may arise.

D. Identity and compliance records

Where reasonably required for sanctions, access, fraud, legal or approved issuer-onboarding checks, we may ask for or obtain a name, date of birth, address, nationality or residence, government-identifier details, occupation, tax residence, corporate-registration documents, and information about directors, controllers, beneficial owners, source of funds or relevant wallets and transactions. We do not ordinarily require a copy or image of an identity document. If one is genuinely required, we will explain the applicable basis, collect only what is proportionate and offer an alternative method where law requires one.

We collect this information from you or your authorised representative and may compare it with sanctions and public records or information returned by a compliance provider. We use it only to conduct and document the relevant check, comply with law, prevent fraud or evasion, decide whether a feature may be provided, respond to regulators, and establish or defend legal claims. We retain it for 5 years after the relevant relationship or review ends, unless a longer period is required for a live investigation, claim or legal hold.

E. Information kept in your browser

The Interface currently uses local browser storage for your theme, the accepted-Terms version, imported-token selections and, only if you ask us to save it, an unfinished launch draft. Those values ordinarily remain on your device unless you later submit information through the Interface. They remain until the Interface or you delete them, or you clear your browser data. Your browser provider may apply its own synchronisation settings.

Local storage is not used here as an advertising or analytics tracker. Laws governing storage on a device can apply to technologies other than cookies. Where required, we use local storage only when it is strictly necessary to provide a service you requested, when you expressly request the feature, or after obtaining consent.

F. Communications and rights requests

If you contact us, make a privacy-rights request or become involved in a complaint, we process the information you provide, the contact details used, our correspondence and verification records. We use it to respond, keep an audit trail, comply with law and establish or defend claims. We retain it for 3 years after the matter closes, unless a longer period is required for a live matter or legal hold.

G. Terms-acceptance records

When you accept or re-accept the Terms, we keep a minimal record comprising the connected wallet address, the Terms version, the signed acceptance message and its signature, the chain ID of the connected network, and the UTC time of acceptance. We use this record to administer versions and establish the agreement and its terms. It is separate from the 90-day quote/build diagnostics and is retained for 7 years from the later of your acceptance or your wallet’s last transaction through the Interface.

H. Future launchpad data

The launchpad is currently closed. We do not currently invite or approve issuers through the Interface. Before any launchpad opens, we will update this notice and the relevant collection notices to describe the actual issuer, beneficial-owner, token, offering, compliance, content, support and payment data required; the recipients and international transfers; the applicable legal grounds; and specific retention periods. Separate Issuer Terms will also apply.

I. Data we do not use for advertising

We do not sell personal data, disclose it for cross-context behavioural advertising or use it to build advertising profiles. We do not use advertising or product-analytics trackers on the current Interface.

5. Purposes, legal grounds and whether information is required

Panama Law No. 81 permits processing on grounds that include informed consent, necessity to perform a contractual obligation to the data subject, compliance with a legal obligation, and authorisation by a special law or regulation. Its implementing framework also recognises legitimate interests in circumstances where the person’s rights and interests do not prevail. Where the GDPR or UK GDPR applies, we rely on the corresponding grounds identified below. We do not treat this notice as consent to every use.

Where we ask for consent, it is voluntary and may be withdrawn prospectively without affecting earlier lawful processing. Where we rely on legitimate interests, you may request information about the balancing assessment and object where applicable.

6. Public blockchain data

Public blockchains record wallet addresses, token transfers, smart-contract interactions and transaction details. They are globally accessible and may be permanent. Other people can combine that information with information from exchanges, wallets, analytics providers and public sources.

The Interface helps construct a transaction. You decide whether to authorise it through your wallet; the Interface, your wallet or an RPC provider may then broadcast it. Once the network confirms it, Mandala generally cannot cancel, reverse, conceal, correct or delete the blockchain record.

Privacy rights you exercise against us apply to personal data in systems we control. They do not make us able to alter an independent public blockchain. We will nevertheless consider any legally required and technically reasonable step concerning our own copies, indexes and displays.

7. Who receives personal data

We disclose only the information reasonably needed for the relevant purpose. Recipient categories and current examples include:

• our Hong Kong development and infrastructure-administration processor, which may access server requests, diagnostic rows, infrastructure accounts, IP addresses and logs solely to provide contracted services on our instructions;
• hosting, database, cache and security providers, currently including Railway, which operate infrastructure and may process server requests, database rows, IP addresses and logs;
• blockchain node and RPC providers, currently including Alchemy and public RPC endpoints, which receive chain queries or transactions and may receive wallet, transaction and network information;
• wallet-connection providers, currently including WalletConnect where selected, and your chosen wallet, which facilitate connection, presentation and signing;
• liquidity, quote and protocol sources, currently including Mandala-native contracts, Uniswap V2/V3, SushiSwap V2 and PancakeSwap V3, which receive or expose token, amount, route, wallet or transaction information as technically required;
• market-data and token-content providers, currently including GeckoTerminal, CoinGecko and third-party token-image hosts, from which our server or your browser may request market data or images;
• block explorers, such as Etherscan, when you choose to follow an explorer link;
• sanctions, fraud, identity-verification and blockchain-analysis providers, selected for the stated compliance purpose, which process wallet, transaction, IP-derived location, identity/compliance and risk information for the purposes in Sections 4C and 4D;
• professional advisers and auditors under duties of confidence; and
• courts, regulators, law-enforcement bodies and other persons where disclosure is required by law or reasonably necessary to protect rights, safety and the integrity of the Interface.

Some recipients act only as our processors or custodians under contract. Others independently determine how they use information and are separate controllers or responsible persons. Their notices govern that independent use. Naming a category or example does not mean that the recipient receives every category of data on every request.

The Foundation receives non-public personal data only in the KPG-specific circumstances described in Section 2 and then acts as a separate controller, not our processor. It may, like anyone, observe public blockchain data.

8. International processing and transfers

We are based in Panama. Our principal development and infrastructure-administration processor is in Hong Kong, and other providers and public blockchain participants operate in the United States, the EEA and other locations. Personal data may therefore be processed in countries whose privacy laws differ from those where you live.

For the transfer to our Hong Kong processor, we rely on the conditions permitted by Article 33 of Panama Law No. 81 of 2019, in particular that the transfer is necessary to provide the Interface you request, and we require that processor to act only on our instructions and to keep the data confidential and secure. For other cross-border recipients, we document and apply the relevant condition under Panama law before transfer and require the applicable level of protection.

Where the GDPR applies to a restricted transfer, we use an adequacy decision, the European Commission’s standard contractual clauses with any appropriate supplementary measures, or another lawful mechanism. Where the UK GDPR applies, we use the UK International Data Transfer Agreement, the UK Addendum to the EU clauses, an adequacy regulation or another lawful mechanism. Contact us for information about a safeguard relevant to your data where you are entitled to it.

Public blockchain transmission is inherently global. Validators, nodes and users in many countries may receive and replicate a transaction, and we cannot confine or later retrieve that public record.

9. Retention

We apply the periods below and then delete or anonymise the record unless law requires longer retention or it is needed for a live dispute, security incident, investigation or legal hold.

A 90-day deletion from the active database does not mean that the same row disappears instantly from every protected backup. Backup copies are isolated from ordinary use and expire under the stated rotation period.

10. Your privacy rights

Your rights depend on the law that applies. They may include rights to:

• ask whether we hold personal data about you and obtain access or a copy;
• correct inaccurate, irrelevant, incomplete, outdated, false or impertinent data;
• request cancellation, deletion or restriction;
• object to particular processing;
• receive qualifying data in a portable form;
• withdraw consent where processing is based on consent, without affecting earlier lawful processing;
• request human review of a qualifying automated decision; and
• complain to a privacy regulator.

To make a request, send a private message to the Mandala team through the official Mandala channels: Discord (https://discord.gg/MwUQgQZgxm), X (https://x.com/MandalaChain) or Telegram (https://t.me/mandalachain). Ask for a private channel before sharing any personal details, and identify the records concerned. Include a wallet address only if your request concerns wallet-linked records. Never send a seed phrase, private key or wallet recovery phrase. We will never ask for one.

For a request concerning wallet-linked records, we ordinarily ask you to sign a no-cost message with the relevant wallet. We use a random, one-use, short-expiry challenge that identifies the Mandala domain and purpose of the request. We support EIP-1271 or another appropriate method for contract wallets where reasonably practicable. A signature proves present control of a key; it does not establish civil identity, beneficial ownership or exclusive entitlement to every record.

For support correspondence, email records, IP or access logs, or other records not linked to a wallet, we use a proportionate method suited to those records, such as control of the contact channel and details only the requester is reasonably expected to know. We may use another proportionate method where a wallet is custodial, delegated, shared, a smart contract, unavailable or compromised, and we may withhold another person’s data. We request only the verification reasonably necessary and retain the verification result rather than a raw signature or identity document unless the raw material is genuinely needed.

Under Panama Law No. 81, the maximum response period is generally 10 business days for access, cancellation and portability; rectification must be carried out within no more than 5 business days; and a valid objection takes effect immediately unless compelling legitimate grounds or the establishment, exercise or defence of legal claims permits continued processing. We respond even if we do not hold responsive data. If EEA or UK law applies, the ordinary response period is one month, subject to a lawful extension. We follow a shorter period where another applicable law requires one.

You may complain to Panama’s Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) through its available complaint channels. If another privacy law applies, you may also complain to the competent regulator where you live or work. We welcome the opportunity to address the issue first, but you do not have to contact us before exercising a statutory complaint right.

Requests concerning records controlled separately by the Foundation must be directed using the contact details in the Foundation’s KPG privacy notice.

11. Automated processing

Quote routing and rate limiting are automated. Sanctions and access-control screening may also produce an initial automated restriction, for which Section 4C describes the available review route. You choose whether to authorise a blockchain transaction.

We do not otherwise use the personal data described here to make a solely automated decision that produces adverse legal effects or a similarly significant detriment. If that changes, we will update this notice and implement the required notice, legal basis, human review and other safeguards before the new processing begins.

12. Children

The Interface is for people who are at least 18 years old and have reached the legal age of majority where they live. It is not directed to children. If you believe a child has provided personal data through the Interface, contact us through the official Mandala channels: Discord (https://discord.gg/MwUQgQZgxm), X (https://x.com/MandalaChain) or Telegram (https://t.me/mandalachain).

13. Security and incidents

We use technical and organisational measures designed for the nature and amount of data we hold, including access restrictions, transport encryption, credential controls, monitoring, processor commitments and deletion routines. No internet or blockchain system is completely secure. You are responsible for the security of your wallet, device, recovery phrase and private keys; we will never ask you to disclose a recovery phrase or private key.

We maintain incident-response procedures and will notify affected people and competent authorities of a personal-data breach where and within the time required by applicable law.

14. Changes to this notice

We may update this notice to reflect changes in the Interface, providers, law or our practices. We will change the “Last updated” date and give prominent in-Interface notice before a material change takes effect where required. A privacy notice normally does not require contractual acceptance. If a new use requires consent, we will request that consent separately before the use begins.

15. Contact

MANDALA CHAIN INC.

Republic of Panama

Privacy and general contact: the official Mandala channels: Discord (https://discord.gg/MwUQgQZgxm), X (https://x.com/MandalaChain) or Telegram (https://t.me/mandalachain).