Privacy Policy

Last Updated: June 6, 2025

Definitions

The following words and expressions used in these Baola Privacy Policy shall have the following meanings:

• Baola El Salvador means NUVO EL SALVADOR, SOCIEDAD ANONIMA DE CAPITAL VARIABLE, a company incorporated and registered in the Republic of El Salvador, registered in the Commercial Registry at number 329 of Book 4900, Tax Identification Number ("NIT") 0623-120824-110-2, with registered address at 85 Avenida Norte #820, Colonia Escalon, 15 Calle Poniente, District of San Salvador, Municipality of San Salvador Centro, Department of San Salvador, authorized to operate as Digital Asset Service Provider as per the license PSAD-0055.
• Cookie means a file containing a string of characters that is sent to the User’s computer or device when the User visits the Platform. Once the User revisits the Platform, the Cookie allows the Platform to recognize the User’s browser. Cookies can store the User’s preferences and other information that helps personalize the Services.
• Personal Data means personally identifiable information relating to an identified or identifiable natural person.
• Policy means this Baola Privacy Policy placed on URL https://baola.app/ and on the Baola mobile application.
• Platform means the digital platform, which is accessed through Baola mobile application.
• Registered User means a natural person, of legal age in accordance with the current legislation of the Argentine Republic, who accepts the Terms and Conditions of services and has registered on the Platform in order to be the account holder on the Platform and to use the Services in accordance with the Terms and Conditions.
• Services means the services offered to Registered Users through the Platform that include purchase, transfer, exchange, and custody of Digital Assets by using the Wallet and issuance and use of Visa virtual cards.
• Terms and Conditions of services means Terms and Conditions of services offered and provided through Baola digital platform, placed on URL https://baola.app/ and on the Baola mobile application.
• User means a natural person, which accesses and/or uses the Platform by any means, and/or interacts through the Platform, and/or or simply browses it, regardless of whether they are Registered User or not.

In order to guarantee the proper functioning of the Platform and Services offered through it, Baola may obtain, collect and/or store information and personal data of Users under the terms described in this Policy.

This Policy provides information about how Baola handles the User’s personal data, the User’s right to privacy and confidentiality of the User’s Personal Data, and how the law protects the User.

1. Scope

The Policy applies to all information that the User provides to Baola and that Baola obtains from the User in accordance with the Policy, whether through the Platform, social media pages, or any other websites or online resources associated with the use and promotion of Baola’s products and services.

USERS ARE NOT REQUIRED TO PROVIDE INFORMATION. ANY INFORMATION PROVIDED BY THE USER MUST BE GIVEN FREELY, EXPRESSLY, AND IN AN INFORMED MANNER. IT IS THEREFORE IMPORTANT THAT USERS READ AND UNDERSTAND THIS POLICY TO BE FULLY AWARE OF THEIR RIGHTS.

Baola will not disclose the information provided to any external organization unless it has obtained the User's prior authorization or is required to do so to provide Baola services or by law or a resolution from a competent authority.

2. User’s Consent

BY ACCEPTING THE POLICY, THE USER, AS THE OWNER OF THEIR PERSONAL INFORMATION, FREELY, EXPRESSLY, AND KNOWINGLY CONSENTS TO THE COLLECTION AND PROCESSING OF THEIR PERSONAL DATA UNDER THE TERMS AND SCOPE SET FORTH HEREIN. THIS CONSENT CONSTITUTES A LEGAL, VALID, AND BINDING AGREEMENT BETWEEN THE USER AND BAOLA.

Baola explicitly requests the User's consent for the collection and processing of their Personal Data, through express acceptance of this Policy by clicking or taking another affirmative action regarding this Policy.

By clicking the “I accept” checkbox during the registration process in the Baola App, the User provides their prior, express, free, and informed consent for the collection, processing, storage, and use of their personal data by Baola, in accordance with this Privacy Policy and the provisions of Law No. 25.326 (Personal Data Protection Law).

The User acknowledges that they have been informed about the purpose of the data processing, the identity and contact details of the data controller, the voluntary or mandatory nature of data provision, their rights of access, rectification, and deletion, and the possible recipients of their data.

3. Types of Data Collected

Baola collects different types of Personal Data through the Platform in order to provide, improve, and secure the Services. Baola collects and processes information about you when you use our Services. The specific Personal Data we collect and process depends on the context of your interactions with Baola, that is, the Services you are using.

By accepting this Policy, the User explicitly consents to the collection and use of their information in accordance with its terms.

The User acknowledges that failing to provide the requested information, or providing inaccurate or incomplete information, may prevent Baola from delivering the requested Services or may significantly limit Baola’s ability to do so.

Below are the types of personal data we collect and use in accordance with the applicable laws of Argentina and El Salvador, including but not limited to:

a. The Login Data:

Baola automatically collects certain information when the User visits the Platform or accesses the Services through any device (hereinafter referred to as "Login Data").

• The User’s computer or mobile device's Internet Protocol (IP) address,
• Browser type and version,
• Operating system and mobile device version,
• Pages visited on the Platform,
• Date, time, and duration of visits,
• Unique device identifiers, and
• Other diagnostic data used to analyze and improve the Services.

b. Information the User provides to us:

• Login credentials used for authentication,
• Identification data such as name, surname, date of birth, and citizenship,
• Contact details including address, email, and phone number,
• Information regarding professional activity and marital status,
• Identification documents, photos, video and audio recordings,
• Bank account and crypto wallet details,
• Transaction participants,
• Content from communications via phone, email, or online,
• Data from surveys, promotions, and social media interactions,
• Uploaded photo (if any),
• Supporting documentation and address confirmation,
• Politically Exposed Person (PEP) declarations.

c. Information we collect from the User or generate about the User:

• Details from identification documents,
• Information on Baola card, transactions, and payment data,
• Website interaction data,
• Technical device and browser data,
• Stored device content with permission,
• Location data using GPS and IP,
• Cookie and tracking data,
• Risk rating, screening, and due diligence results,
• Regulatory compliance data.

d. Information we receive from other providers:

• Profile and behavioral data,
• Analytics and technical data,
• Demographic and transaction data,
• Verification and identity data.

e. Identification Data

Baola may request the User to provide certain Personal Data during registration and service use. This includes, but is not limited to:

• Full name, gender, marital status, date of birth,
• Voice and image for biometric verification,
• Contact information, occupation, and industry details,
• Bank and PEP declarations with supporting documents,
• Proof of address and source of funds documentation.

Information may be verified through third-party services like Persona and ComplyAdvantage. Inaccurate data may result in account restrictions or suspension. Users are required to periodically update their information for continued access to Services.

Baola does not process special categories of data such as racial or ethnic origin, health status, or religious/philosophical beliefs.

Users may refuse to provide Personal Data. See the User Rights section for more information.

4. Processing of Personal Data and Login Data

Baola processes Personal Data and Usage Data provided by the User with the User’s express consent, granted by accepting this Policy, for the purposes of identification, authentication, administration, and commercial management purposes. In some cases, processing may be carried out in accordance with the exceptions to consent specifically provided under the applicable regulations.

The collected Personal Data may be used for the following purposes:

• Enabling User interactions on the Platform;
• Allowing the User to receive and contract Services;
• Verifying the User’s identity and authenticity;
• Initiating, facilitating, processing, and executing transactions on the Platform;
• Communicating with Users regarding their account or any Services they use;
• Conducting creditworthiness assessments, KYC procedures, and other due diligence checks to ensure compliance with AML/CTF regulations;
• Verifying the accuracy of the User's information;
• Assessing the User’s eligibility for the Services;
• Ensuring the security of the User's identification and access;
• Detecting, preventing, and mitigating fraudulent or illegal activities, potential threats, abuse, and system errors;
• Complying with AML/CTF regulations, KYC obligations, information-sharing requirements, and any legal or regulatory obligations imposed by competent authorities;
• Informing the User of updates to the Services, operational changes, or legal obligations via the Platform or other communication channels;
• Sending newsletters, marketing materials, or promotional content related to the User’s operations (Users may opt out of these communications at any time by clicking the unsubscribe link or adjusting their preferences);
• Profiling and automated processing of User data to assess personal attributes such as creditworthiness, interests, preferences, behaviors, or location for customized recommendations, segmentation, and targeted marketing within the Platform.

The User authorizes Baola to report transactions conducted on the Platform and disclose necessary information to financial institutions or competent authorities when required for AML/CTF compliance procedures.

5. How and why we process your personal data

We use your personal data for the following purposes and based on the corresponding legal basis:

• Processing is necessary to fulfill our contractual and pre-contractual obligations. These actions are only taken when requested by you. For example, in order to provide you with the Baola services according to the General Terms & Conditions.
• Processing is based on your consent.
• Processing is necessary for compliance with a legal obligation. In some cases, we have a legal responsibility to collect and store your personal information in accordance with money-laundering laws or other applicable legislation in Argentina and El Salvador.

6. Information Shared with Third Parties

Baola may disclose the User's Personal Data to third parties only as described in the Policy. Such data may be shared with:

• Companies of the group, subsidiaries and affiliated entities for the purposes outlined in this Policy.
• External service providers engaged by Baola to facilitate its operations and service delivery. These include, but are not limited to, critical services providers such as, those used for video onboarding and identity verification, screening, scoring and KYT purposes, cloud storage providers, financial institutions, insurance providers, legal and financial advisors, and marketing service providers, suppliers who provide Baola with IT, payment and delivery services, customer service communications services providers, etc. Any such third parties will be bound by confidentiality agreements to ensure compliance with data protection standards.
• Regulatory authorities, courts, and law enforcement agencies, when required by law, a legal process, or governmental request. Baola may also disclose data to protect its legal rights, defend against claims, or safeguard the security and interests of Users and third parties.
• Payment processors and financial institutions involved in processing transactions conducted on the Platform, including participants of the User’s transactions and other Users, as necessary.
• Third parties involved in corporate transactions, such as mergers, acquisitions, or the sale of all or a substantial portion of Baola’s assets. If Personal Data is transferred in connection with such a transaction, reasonable efforts will be made to ensure that the acquiring entity uses the data in accordance with this Policy.
• Entities assisting in fraud prevention and security enforcement, to detect, investigate, prevent, or mitigate fraudulent or unauthorized activities on the Platform.

In all cases, Baola will require third parties to uphold confidentiality obligations regarding the Personal Data they access and ensure compliance with applicable data protection regulations through legally binding agreements.

7. International Transfer of Personal Data

By accepting this Privacy Policy, the User provides their explicit, prior, free, and informed consent for Baola to transfer their Personal Data to countries outside the jurisdiction in which the data was originally collected, Argentina.

Such transfers may be necessary to fulfill the Services requested by the User, in accordance with the General Terms and Conditions. The User acknowledges and accepts that some of these countries, including but not limited to the United States of America and El Salvador, are not recognized by the Argentine data protection authority (AAIP) as providing an adequate level of protection.

In these cases, Baola ensures that all transfers are carried out in strict compliance with the applicable laws, using appropriate safeguards, which may include:

• Standard contractual clauses,
• Regulatory compliance mechanisms,
• Robust technical and organizational security measures,
• Information security protocols.

All international data transfers are properly documented, justified, and performed only for specific, legitimate, and clearly defined purposes, such as service delivery to the User.

Baola also transfers data, where applicable, to jurisdictions recognized by Argentina as having an adequate level of protection, such as Member States of the European Union, the United Kingdom.

The User has the right to refuse the international transfer of their data. For more details, please refer to the User Rights section below.

8. Security of Personal Data

Baola employs industry-standard security measures to safeguard Personal Data from unauthorized access, loss, alteration, or disclosure. These measures include:

• A dedicated security team to monitor data protection and conduct vulnerability assessments;
• Continuous monitoring and updates to security protocols, including both automated and manual controls;
• Implementation of sufficient technical, administrative, and organizational security measures to ensure compliance with applicable data protection regulations.

However, despite these measures, absolute security cannot be guaranteed. The User acknowledges and accepts the inherent risks of transmitting information over the internet. Baola is not responsible for unauthorized access resulting from security breaches beyond its reasonable control, including unlawful interceptions, hacking, or unauthorized third-party use of stolen data.

9. Retention of Personal Data

Baola retains the User’s Personal Data for:

• as long as it is necessary for the purpose or purposes for which it was intended;
• for as long as required or permitted by law taking into consideration the statutory limitation period.

The User acknowledges that:

• Baola may retain certain data as necessary to comply with legal obligations, resolve disputes, or enforce agreements.

10. Links to Third-Party Websites

The Platform may contain links to third-party websites for the User’s convenience. These external websites may have their own privacy policies, terms of use, and data processing practices. Baola strongly recommends that Users review the privacy policies of any third-party websites they visit.

Baola assumes no responsibility for the content, security, or data practices of third-party websites, nor for the consequences of their use. Users access such websites at their own risk.

11. Users' Rights

Users may exercise their rights regarding their Personal Data by contacting Baola Customer Support Services at [email protected] or [email protected]. Baola will respond to such requests within five (5) calendar days, free of charge.

All communications and responses to data subject requests, including any refusals, will be properly documented and securely stored in accordance with applicable legal requirements.

Users have the following rights under this Privacy Policy and in accordance with Law No. 25,326 of Argentina. Users are entitled to the following rights under this Policy:

a) The Right to Be Informed:

Users have the right to be clearly and accessibly informed about the existence of personal data files, their purposes, and the identity of the data controller. This information is made available in this Privacy Policy and within the Baola application. Baola may provide further clarification if needed to ensure full understanding.

Information will only be provided after Baola verifies the identity of the data subject.

b) The Right of Access:

Users have the right to request and obtain information about their Personal Data held by Baola, including:

• Whether their data exists in Baola’s files or databases
• What specific data is held about them
• The sources and methods used to collect it
• The purposes for which it was collected
• The intended destination or use of the data
• Whether the data file is registered in accordance with Law No. 25,326

Baola will provide access to such data within 10 calendar days, free of charge.

If the request concerns a deceased person’s data, their universal heirs may exercise this right.

The right of access may only be exercised free of charge once every six (6) months, unless a legitimate interest is demonstrated.

c) The Right of Rectification and Update:

Users may request that Baola correct or update their Personal Data if it is found to be inaccurate, incomplete, or outdated. Baola will carry out the necessary rectification or update within five (5) calendar days from receipt of the request or identification of the issue.

d) The Right of Data Deletion:

Users may request the deletion of their Personal Data when:

• It is no longer needed for the purpose for which it was collected
• It is inaccurate or incomplete

However, Baola may be legally obligated to retain certain data. In such cases, Baola will take all reasonable measures to protect the User’s identity, and anonymize or pseudonymize the data, once it is allowed in accordance with the applicable legislation.

If data has been transferred to another entity, Baola will notify that entity of the deletion within the legally established timeframe.

Baola may deny access, rectification, or deletion in certain cases, such as where the protection of national defense, public order, public safety, or the rights and interests of third parties would be put at risk or in case the deletion is not possible due to data retention obligation according to the regulatory obligation. Furthermore, requests may be denied if they interfere with ongoing judicial or administrative investigations.

Baola will ensure that the handling of personal data is in line with all applicable laws, including respecting the right to rectification, update, and deletion in all cases where applicable.

All decisions related to data subject rights will be reasoned and, when required, notified to the data subject.

e) Right to Withdraw Consent:

Users have the right to withdraw their consent to the processing of their Personal Data at any time, provided that the legal basis for such processing is consent.

However, if the data processing is based on a different legal basis, such as:

• A contractual obligation between the User and Baola (e.g., for the provision of services), or
• A legal obligation imposed on Baola (e.g., regulatory compliance, AML/CTF laws),

then withdrawal of consent will not be applicable or may limit or prevent the User’s ability to continue using Baola's services. Baola will clearly identify the legal basis for each processing activity upon request, and inform the User whether the right to withdraw consent applies in a specific case.

12. Cookies

The Platform uses Cookies to enhance the User experience.

By accessing the Platform without disabling these technologies, the User agrees to receive a more personalized browsing experience and authorizes the storage of the information outlined in this Policy.

Users can configure their browser settings to disable, reject, or be notified of Cookies. Because browser settings vary, Users should refer to their browser’s instructions to adjust Cookie preferences accordingly.

However, disabling Cookies may impact certain features and Services, potentially reducing functionality.

Baola uses Cookies to:

• Improve Platform functionality and User experience.
• Provide personalized content and marketing.
• Analyze User behavior and preferences to optimize Services.
• Remember login details for future visits.

Users who wish to restrict or remove Cookies should adjust their browser settings or use available Cookie management tools.

13. Modification of the Policy

Baola reserves the right to modify the Policy at any time and with immediate effect. Baola will notify Users about the modification, and the User must provide their consent for the processing of their personal data in accordance with the changes implemented by Baola.

If the User does not agree with the changes implemented, they must refrain from using the Platform.

14. Contact Information

If the User is concerned about the privacy and/or security of the information provided to Baola, the User may contact Baola directly via the email addresses [email protected] or [email protected].

15. Notifications and Applicable Legislation

The notifications made to Users by Baola will be valid and the User expressly accepts that they may at the sole discretion of Baola:

• Be addressed to the email address registered by the User on the Platform;
• Be directed to the User's account on the Platform;
• Be posted on the Platform (made available to the User).

The Policy shall be governed and construed in accordance with current Argentine regulations. Any dispute that may arise out of the Policy, must be addressed to and resolved by the relevant court of the Argentine Republic.