1. Controller, Contact Details and Scope

1.1 The controller responsible for processing personal data is FinanceFarm AG, Hofackerstrasse 40B, 4132 Muttenz, Switzerland, Business Identification Number (UID) CHE-280.030.894 (“FinanceFarm”). Data protection enquiries may be sent by email to info@financefarm.com or to the postal address stated above.

1.2 This Privacy Policy applies to www.financefarm.com, the Platform, mobile and web-based Applications, Dashboards, communications and support, and the preparation and performance of service and purchase transactions, including enabled blockchain, NFT, Wallet and Rebuyer functions. It also covers lawfully processed data of prospective customers, representatives and external Rebuyers without a User Account.

1.3 It provides information on processing under the Swiss Federal Act on Data Protection (“FADP”) and, where applicable in terms of subject matter and territorial scope, under the European Union General Data Protection Regulation (“GDPR”).

1.4 This Privacy Policy is an information notice and does not constitute consent to unspecified or unrestricted processing. Consent is obtained separately where required.

1.5 The General Terms and Conditions – Overall Service dated 7 October 2026 (“Overall Service GTC”; https://www.financefarm.com/terms-and-conditions) and the Terms of Use dated 7 October 2026 (https://www.financefarm.com/terms-of-use) govern services, use of the Platform and contractual relationships. This Privacy Policy provides separate information on the processing of personal data. Acceptance of a contract, registration and continued use do not constitute blanket consent to processing or advertising.

1.6 FinanceFarm’s official email communications use exclusively functional, individual and automated sending addresses operated by FinanceFarm with the domain suffix @financefarm.com. The designated contact for data protection enquiries is info@financefarm.com or the postal address in Clause 1.1. Other declarations should use the recipient address designated for the relevant purpose or the validly agreed channel; an internal support or sending address does not thereby become a general address for service.

1.7 A domain suffix or displayed sender alone establishes neither authenticity nor authority to represent FinanceFarm. Doubtful messages, changed payment details and unusual instructions should be checked through a previously verified contact. FinanceFarm does not request passwords, private Wallet keys or seed phrases by email.

1.8 For individual services or processing activities, any necessary specific supplementary information is made accessible before the relevant collection or at the time required by law. This includes, in particular, the service providers actually used, recipient countries and safeguards, and the specific cookie and blockchain processing. Such information supplements this Policy and does not replace any required consent.

2. Definitions and Principles

2.1 “Personal data” means any information relating to an identified or identifiable natural person. “Processing” includes, in particular, collection, recording, storage, use, comparison, disclosure, archiving and erasure.

2.2 FinanceFarm processes personal data lawfully, in good faith, transparently, proportionately and for specified purposes, and with due regard to appropriate data security.

2.3 FinanceFarm does not sell personal data. Personal data are disclosed only for the purposes described in this Privacy Policy or on an applicable legal basis.

3. Categories of Personal Data Processed

3.1 Basic and contact data: name, form of address, date of birth, nationality, residential or business address, email address, telephone number, language, company, position and authority to represent.

3.2 Account and authentication data: user name, encrypted or hashed credentials, multi-factor authentication data, login times, security status and account settings.

3.3 Identity and verification data: identity documents, proof of address, photographs, video or liveness recordings, information on representation, beneficial ownership and origin, verification status and related correspondence necessary for the specific process. Information on source of funds or wealth, sanctions and PEP indicators and relevant media information is processed only to the extent necessary and legally permissible for a justified risk-based enquiry or an actually applicable statutory duty; the special statutory requirements in Clause 6.3 remain reserved.

3.4 Asset and provenance data: information concerning ownership, origin, previous owners, authenticity, condition, repairs, restorations, transport, storage, insurance, expert reports, images and other documents submitted. These documents may contain third-party personal data.

3.5 Contract, Transaction and payment data: Opportunity, physical Asset or separate digital edition, Original Asset percentage interest or number of Fractions, price, contract, document and GTC version, signature and confirmation events, Transaction references, bank details, payment reference, settlement, storage, insurance, Collateral Schedule, collateral status and allocation, and option, transfer, performance and termination status. Original Asset, digital and collateral positions remain separately allocated, including in a combined checkout.

3.6 Contract, Transaction and payment data also include Reservation and cancellation events, reserved percentage interests, an interest in acquiring the entire Asset, commencement and expiry of periods, Object Acceptance and collection releases, collection and risk-transfer records, and the calculation and allocation of the one-off storage and insurance fee.

3.7 Communication and support data: emails, contact forms, support tickets, chat and assistance requests, telephone notes, attachments and feedback. Where automated or AI-assisted tools are used, processing may also cover the inputs submitted to them, responses and necessary account or Transaction references. The specific service is identified before input; unnecessary identity, bank or other confidential data should not be entered in free-text fields.

3.8 Technical and usage data: IP address, device, operating system, browser, Application version, device identifier, language, time zone, pages viewed, clicks, session data, error, performance and security logs, and cookie and consent status.

3.9 Marketing and Rebuyer contact data: company and contact-person details, preferred contact, language, direct-buyer role, recorded Asset interests, artist or brand and model, budget, currency and trading region, source and last update of the information, newsletter registration, campaign attribution, and consent, withdrawal and suppression records. Unknown information is not treated as confirmed interests or willingness to buy.

3.10 Special categories of personal data and other sensitive personal data are processed only where necessary for a specific verification, legally permissible and appropriately protected. Biometric data are processed for unique identification or matching only where this is legally permissible and necessary for the relevant identification process.

3.11 Where information is designated as mandatory on the Platform or in a Transaction process, it is required for registration, identification, verification, steps prior to entering into a contract, performance of a contract or compliance with legal obligations. Without the required information, FinanceFarm may in particular be unable to open or maintain an account, conduct a review, make an offer, conclude or perform a contract, process a payment or disbursement, or release an Asset.

3.12 Wallet and blockchain data: payment and receiving addresses, network and chain ID, token or contract reference, transaction hash, amount, charges, confirmations, and issuance, transfer and performance events. These also include necessary evidence of Wallet control and current entitlement, and recovery and succession documents. FinanceFarm does not request private Wallet keys or seed phrases; they must not be submitted.

3.13 Rebuyer process data: profile matching, sanitised Asset information, offer reference and version, personalised salutation, language, stated sale price, PDF version and integrity value, recipient address, dispatch, error and response events, counteroffers and contract status. Evidenced dispatch information is distinguished from assumptions about delivery or the recipient having read a message.

3.14 Administration and evidence data: account contents and documents reviewed for a specific reason, including necessary stored drafts, technical and Transaction logs, lawful comparison results, case-specific copies and extracts, preservation and change records, and information on the reason, purpose, authorised persons, time, scope, interventions and disclosures under Clauses 7.7 to 7.11.

4. Sources of Personal Data

4.1 FinanceFarm obtains personal data directly from data subjects, their representatives, employers or contractual counterparties.

4.2 Further data may come from lawfully engaged identification, payment, registry, verification, appraisal, logistics, storage, insurance and auction services and permissible public sources. Rebuyer contacts may come, in particular, from FinanceFarm’s business relationships, contact enquiries, lawfully received referrals and professional directories; Transaction checks may use publicly accessible blockchain information. Public availability or a database entry alone permits neither unrestricted reuse nor advertising emails.

4.3 Where a User provides third-party personal data, the User confirms that the User is authorised to do so and has adequately informed the data subject, unless a statutory exception applies.

4.4 Irrespective of the obligations of the person providing the personal data, FinanceFarm complies with its own duty to inform the data subject within the statutory periods unless an exception under applicable data protection law applies.

5. Purposes of Processing

5.1 Operation, security and further development of the Website, Platform, accounts, Dashboards, interfaces, support and communication functions.

5.2 Registration, identification, verification of authority to represent, prevention of misuse, and risk-based checks concerning ownership, origin, sanctions and plausibility.

5.3 Recording and reviewing physical Assets and separate Digital Image Assets, preparing analyses and offers, and preparing, concluding and performing purchase, co-ownership, Digital Fraction, physical safekeeping, option, pledge, Collateral and termination agreements. Processing documents the rights actually agreed; a data or NFT allocation does not, by itself, create title or a pledge.

5.4 Allocation and reconciliation of payments, settlement, documentation of possession and rights, insurance, physical safekeeping, transport, marketing and enforcement of rights.

5.5 Compliance with actually applicable statutory retention, information, reporting, tax, security and cooperation duties, and handling lawful orders issued by public authorities and courts. Other disclosures to public authorities require a separately assessed permissible basis; Clauses 7.10 and 8.2.7 apply to enquiries concerning suspected offences.

5.6 Analysis of use, performance and errors, improvement of the user experience, development of new functions and internal quality control.

5.7 Sending Transaction-related and security-related communications and handling requested offers and responses. Advertising communications to Rebuyers and newsletters require the consent required under applicable law or a specifically permissible exception. Advertising messages identify the sender and provide a simple, free means of opting out. Acceptance of GTC or Terms of Use, a User Account and a matching interest profile do not constitute consent to advertising.

5.8 FinanceFarm processes account, contact and event data to provide legally relevant and Transaction communications in the User Account and document provision, availability, status and time limits. Additional notices required by contract or law are sent through the designated channel; further messages may be sent by email, push notification or other permissible channels according to the process and User settings. External Rebuyers without a User Account use the channel agreed for the process. Legally effective receipt and the commencement of a time limit are governed by applicable law and the validly agreed channel; a provision, retrieval or dispatch log does not replace those requirements.

5.9 Defending against, investigating and enforcing claims, and preventing, detecting, investigating and responding to fraud, cyber-attacks, breaches of contract and other unlawful acts.

5.10 Reconciling crypto payments, contractual allocation and token holdings; checking necessary Wallet control and current entitlement before receipt, transfer, disbursement or agreed recovery. Earlier identification alone does not prove present entitlement. For loss, theft, a Wallet change or succession, only necessary Transaction data and evidence are processed to resolve competing rights and prevent duplicate performance. Processing does not create any additional recovery or acquisition claim.

5.11 Preparing the separate Rebuyer direct sale of the entire physical Asset: matching permissible buyer profiles, generating buyer PDFs and emails for the recipient and language after proper and successful dispatch of a specific purchase offer to the Seller, and allocating responses and counteroffers. The basis for contact, suppression records, document version and authority to disclose must be checked before dispatch. Profile matching or automated document generation does not replace a separate Whole-Asset Purchase Agreement. An enquiry, a stored draft or a failed dispatch does not trigger dispatch of a buyer offer.

5.12 Purpose-specific technical administrative reviews, maintenance, troubleshooting, handling specific support cases, protection against security risks and investigation of concrete indications of legal violations, including lawful comparisons, necessary interventions and preservation of evidence under Clauses 7.7 to 7.11.

5.13 Where automated or AI-assisted chat, assistance and support functions are used: answering questions about operation and processes, classifying requests and preparing any necessary human handling. Any further use of inputs, particularly for a separate additional purpose, requires a separately assessed legal basis and any necessary prior information or consent.

6. Grounds of Justification and Legal Bases

6.1 Under Swiss law, consent is not required for every processing activity. FinanceFarm processes personal data in accordance with the principles of the FADP; where a justification is required, FinanceFarm relies in particular on consent, overriding private or public interests, or law. Relevant private interests include steps prior to entering into and performance of contracts, secure operation of the Platform, prevention of fraud, preservation of evidence, improvement of services and enforcement of rights.

6.2 Where the GDPR applies, FinanceFarm relies on the following legal bases, depending on the purpose:

6.2.1 Article 6(1)(b) GDPR for processing necessary to perform a contract with the data subject or take pre-contractual steps at their request, including account administration, requested offers, purchases, payments, agreed Wallet, transfer and recovery checks, contractual communications and support. Unsolicited advertising and data concerning company representatives are not based on this ground merely because they relate to a contract.

6.2.2 Article 6(1)(c) GDPR for actually applicable legal obligations whose basis is laid down in Union or Member State law as required by Article 6(3) GDPR. A Swiss duty or order alone does not establish this legal basis. Where the GDPR applies, the necessary processing is assessed under another actually applicable basis, in particular Article 6(1)(f) GDPR with a documented balancing of interests; special requirements, particularly under Articles 9, 10 and 48 GDPR, remain unaffected.

6.2.3 Article 6(1)(f) GDPR, following a documented balancing of interests, for secure Platform operation, fraud prevention, ownership, provenance and entitlement checks, preservation of evidence, enforcement of rights, error analysis, necessary professional contact administration and permissible Rebuyer profile matching. The interests pursued are secure, traceable Transactions and targeted, lawful business development. Overriding interests and fundamental rights and objections must be respected; this basis does not replace required advertising consent.

6.2.4 Article 6(1)(a) GDPR for marketing, non-essential tracking technologies or other processing where consent is required or separately obtained. Advertising emails are additionally subject to the applicable electronic-marketing rules, including Article 3(1)(o) of the Swiss Federal Act on Unfair Competition where applicable.

6.3 Where the GDPR applies, FinanceFarm processes special categories of personal data only where a condition under Article 9(2) GDPR is met. Biometric data used for unique identification are processed only on a legally permissible basis identified when the data are collected. Personal data relating to criminal convictions or offences are processed only in accordance with Article 10 GDPR and any additionally applicable law. Where explicit consent is required, it is obtained separately.

6.4 Consent may be withdrawn at any time with effect for the future. Withdrawal affects neither the lawfulness of earlier processing based on consent nor another genuinely existing legal basis independent of that consent. After withdrawal, required consent is not replaced merely by invoking another purpose.

7. Checks, Administration and Automated Assistance

7.1 FinanceFarm checks identity, representation, ownership, origin and necessary plausibility indicators according to the specific process and risk. Further enquiries into beneficial ownership, source of funds or wealth, sanctions, politically exposed persons, relevant media information or fraud indicators take place only where necessary for a justified lawful verification purpose or actually required by law. The checks serve the specific agreed purchase transactions and secure operation of the Platform. Special statutory anti-money laundering duties apply only insofar as they arise from the actual activity.

7.2 Checks may be supported by specialised service providers. FinanceFarm remains responsible for its own processing and contractually requires processors to comply with data protection and security obligations.

7.3 FinanceFarm may use partially automated analyses and profiling to examine identity, Asset, provenance, Transaction, device, security, sanctions, PEP, fraud and plausibility indicators, flag inconsistencies and refer processes for human review. Automated tools generate risk indicators or provisional statuses; they do not replace any required approval. AI, chat and support outputs are not binding individual decisions, offers or contract amendments. Only declarations expressly approved by authorised persons in accordance with the Contract Documents are binding. The assistance systems described do not take final decisions based solely on automated processing that produce legal effects or similarly significantly affect a person. Clause 7.4 applies to any future introduction of such decisions.

7.4 If FinanceFarm introduces a decision based solely on automated processing that produces legal effects or similarly significantly affects a person in future, it may be used only where permitted by applicable law. FinanceFarm informs the data subject in advance or at the time prescribed by law of its existence, meaningful information about the logic involved, its significance and possible consequences, and provides the statutory rights to express a point of view and obtain human review. Any required explicit consent is obtained separately; Article 21 FADP and, where applicable, Article 22 GDPR remain authoritative.

7.5 Rebuyer profile matching may apply rules to recorded interests, Asset category, artist or brand/model, budget, currency, trading region, language and contact status. This may constitute profiling where personal aspects of natural persons are evaluated. Matching selects recipients; it establishes neither ability to pay nor current willingness to buy. Co-Participants or Sellers do not become Rebuyer recipients merely because of their role. Marketing objections also apply to related profiling.

7.6 Before processing likely to entail a high risk, the legally required data protection impact assessment is conducted, including for profiling or blockchain use that meets that threshold. Solely automated decisions producing legal or similarly significant effects may be used only where the statutory conditions are met; Clause 7.4 does not independently authorise them. Required safeguards, information, human review and means of contesting decisions remain available.

7.7 Persons specifically authorised and bound by confidentiality may directly review individual User Accounts through technical administration functions where necessary for operation, maintenance, troubleshooting, performance of contracts, a specific support case, protection against security risks or investigation of concrete indications of a threatened or actual violation of law or infringement of rights. Access is limited to what the task requires. Stored data and documents not yet submitted for sale review may also be examined where necessary for the documented reason; this does not trigger a submission or sales process.

7.8 To the extent necessary and legally permissible, relevant account contents, documents, Transaction data and logs may be inspected, lawful comparisons performed, and case-specific copies or extracts created for investigation and preservation of evidence. Necessary and proportionate protective measures, particularly ending sessions and temporarily restricting content or functions, require statutory or contractual authority. In cases of imminent danger, such measures may be taken immediately; their conditions and scope are documented. The reason, purpose, person accessing the data, time, scope, material interventions and disclosures are recorded in an auditable manner.

7.9 Access, copies and retention are limited to the data necessary for the specific purpose. The origin and preservation time of evidential copies are documented; copies are protected against unauthorised access and alteration and distinguishable from working copies. Original data relevant to evidence are preserved before technical corrections or changes; material corrections remain traceable by reference to the original state, the change and its reason. Continued retention is regularly reviewed against its purpose and governed by Clause 10.

7.10 Where concrete indications of money laundering, sanctions violations, fraud or other offences exist, necessary records may be secured within the above limits and further lawful enquiries conducted. Necessary data or copies are disclosed to competent public prosecutors, law-enforcement authorities or other competent bodies only under an actually applicable statutory duty, a lawful order or another permissible basis following a documented assessment of legal basis, necessity and proportionality, particularly a lawful criminal complaint. Special due diligence, reporting and retention duties apply only insofar as FinanceFarm is subject to them because of its actual activity. Where the GDPR applies, particularly Clauses 6.2.2 and 6.3 and the conditions for transfers to third countries remain respected.

7.11 Administration rights do not permit declarations or payments in a User’s name, changes to contractual rights or disposal of the User’s property without a separate valid basis. They do not permit access to external Non-Custodial Wallets, private keys or recovery secrets. Lawful review of accessible blockchain information and separately agreed and disclosed technical NFT administration, suspension or Recovery powers remain possible within the limits of Clause 17 of the Overall Service GTC. Affected Users are appropriately informed of material account interventions and their consequences. Required information may be restricted, deferred or withheld only to the extent of an actually applicable statutory exception or information prohibition, with the reasons documented; information due is provided once a temporary impediment ceases. Data protection rights are assessed separately under Clause 15.

8. Disclosure and Categories of Recipients

8.1 FinanceFarm discloses personal data only where necessary for a stated purpose and legally permissible.

8.2 Recipients may include, in particular:

8.2.1 IT, hosting, cloud, security, communication and support providers, and providers of automated or AI-assisted tools actually used, in each case only to the extent necessary and legally permissible.

8.2.2 Identification, sanctions, registry and verification service providers.

8.2.3 Banks and payment service providers for the specific agreed payment, and necessary technical service providers for approved crypto payments; this does not establish Wallet or asset management by FinanceFarm.

8.2.4 Appraisers, restorers, physical safekeeping or storage providers, logistics providers and insurers.

8.2.5 Auction houses, dealers and lawfully approached potential purchasers, including Rebuyers, where necessary for specific marketing of an Asset. Buyer documents contain only authorised, sanitised Asset information and images. Seller identity, bank and identification documents and internal pricing and verification material are not disclosed with the buyer PDF. Any further necessary disclosure, for example of provenance documents, is assessed separately for its legal basis, scope and protection of third-party data.

8.2.6 Lawyers, auditors, tax advisers and other professional advisers subject to duties of confidentiality.

8.2.7 Courts, competent public prosecutors, law-enforcement authorities and other competent authorities or bodies, only under an actually applicable duty, a lawful order or another documented and assessed permissible basis. Clause 7.10 and the information rules in Clause 7.11 additionally apply to enquiries concerning suspected offences.

8.2.8 Purchasers or legal successors in connection with a carefully prepared corporate transaction.

8.3 Authorised internal personnel and external recipients receive only the data necessary for their respective tasks. Processors may process personal data only on documented instructions and subject to appropriate security and confidentiality duties; further use for their own purposes is not automatically covered. Administrator access and disclosures are limited and logged under Clauses 7.7 to 7.11.

8.4 Depending on the service concerned, recipients may act as processors within the meaning of Swiss law or the GDPR, as joint controllers or as independent controllers. Where a recipient independently determines the purposes and means of its processing, its own privacy information also applies. Such independent responsibility does not release FinanceFarm from its own duties to provide information and select recipients with due care.

8.5 Before cookie, analytics or comparable services are used, current particulars of the providers and processing activities actually used are made accessible through the relevant privacy and consent information or Cookie Manager.

8.6 Where actually engaged, Wallet, blockchain-access or Transaction-verification services may receive the data necessary for their specific task; the provider, role and foreign processing are explained in the relevant process notice. For a lawful publication on a public blockchain, network participants and third parties may also access public information. They are not thereby FinanceFarm processors. Responsibilities depend on actual functions and influence; Clauses 9 and 13 continue to apply.

9. Cross-Border Disclosure

9.1 Processing by FinanceFarm and specifically engaged services may take place in Switzerland or abroad. The specific recipient countries or international organisations and required safeguards are identified before the relevant collection or at the time prescribed by law in the accessible provider and process notice or cookie information. Where disclosure abroad is planned subsequently, the required information is provided before the affected further processing. Changes to that information are made accessible in good time. Public blockchain operations additionally require assessment under Clause 9.4.

9.2 Where personal data are disclosed to a country that is not legally recognised as providing an adequate level of data protection, FinanceFarm ensures protection in particular through recognised standard data protection clauses supplemented as required under Swiss law and, where necessary, through additional technical, contractual or organisational measures. FinanceFarm relies on an exception under Article 17 of the Swiss Federal Act on Data Protection or Article 49 GDPR only in an individual case permitted by law.

9.3 Information on the specific recipient country, the applicable safeguard and the possibility of obtaining a copy of the material safeguard may be requested at info@financefarm.com. Trade secrets and third-party rights remain protected.

9.4 Public blockchain information may be accessed worldwide and replicated by network participants in different countries; FinanceFarm cannot control all locations or subsequent uses. Before enabling publication, FinanceFarm assesses the architecture, necessary data, recipients and countries involved and statutory transfer and protection requirements, and provides information about the specific publication. Worldwide visibility or agreement to contractual terms does not replace a required transfer basis. Unlawful publication must not take place.

10. Retention and Erasure

10.1 FinanceFarm retains personal data only for as long as needed for the specific notified purpose, performance of contracts, justified preservation of evidence and security measures, actually applicable statutory duties or necessary enforcement of rights. Necessity is regularly reviewed against the purpose; the mere possibility of a future claim does not justify unlimited storage of all account data.

10.2 Accounting records, accounting vouchers, annual reports and audit reports, together with the contractual, Transaction and invoice data necessary for those records, are retained for ten years from the end of the relevant financial year where Article 958f of the Swiss Code of Obligations or another actually applicable provision requires this. Other contract, communication and Transaction data are retained while necessary for the business relationship and thereafter only insofar as necessary for applicable limitation and evidential periods, generally for no longer than ten years. Longer retention requires a specifically documented statutory duty or justified need for evidence or enforcement of rights, particularly pending litigation or proceedings before a public authority. This is not a blanket ten-year retention period for all account contents.

10.3 Identity, ownership, provenance and verification data, and administration and evidential copies, are retained only for the specifically necessary review, contractual, security or evidential period. Their type, scope and duration depend on the process, actually applicable duties and a documented need for evidence or enforcement of rights. Retention throughout the business relationship or beyond occurs only where that necessity continues; special anti-money laundering retention periods apply only where FinanceFarm is actually subject to the relevant law.

10.4 Security and access logs are generally retained for purpose-specific periods shorter than those for Contract Documents and then erased or anonymised. Where a specific incident, a justified evidential purpose or a statutory duty requires longer retention, the necessary entries are preserved for that case and the duration reviewed.

10.5 Contact and interest data are processed for marketing only while the basis for contact remains valid and the data are necessary and current. Withdrawal of consent or a marketing objection ends the affected marketing use, including related profiling; data imports must not override suppression. A minimal suppression and consent record may be retained to honour the objection and meet necessary accountability requirements. Contractual and statutory communications rely on their own grounds.

10.6 Once the purpose ceases and necessary periods expire, data are erased or effectively anonymised unless a specifically continuing statutory duty or justified need for evidence or enforcement of rights prevents this. Backups are cleared through the documented ordinary deletion or overwrite cycle and are not used for new operational purposes; required erasures are reapplied following a restoration. Technical limits of public blockchain records are addressed under Clause 13 and do not override statutory rights.

11. Cookies and Similar Technologies

11.1 Where used for the relevant Platform functions, cookies, local storage, pixels, software development kits and comparable technologies may process data. The technologies actually used and their purposes are specifically identified before the relevant use.

11.2 Strictly necessary technologies serve only functions essential to an expressly requested service, particularly sessions, login, security, load balancing, necessary form progress and storage of privacy preferences. Necessity is assessed for each technology; language, convenience, analytics and marketing functions are not necessary merely because they are useful.

11.3 Functional technologies store voluntary convenience and display preferences.

11.4 Analytics and performance technologies help FinanceFarm understand reach, use, errors and performance. Marketing technologies may measure campaigns and support interest-based content.

11.5 Non-essential technologies remain disabled until any consent required under applicable law has been given. Consent management provided before their use enables category-specific acceptance and refusal and allows consent to be withdrawn at any time as easily as it was given. Consent and withdrawal are documented together with the relevant information version.

11.6 Before use, cookie and consent information identifies the providers, purposes, categories, retention periods, recipient countries and applicable safeguards actually involved. Where a Cookie Manager is used, these particulars and options to change choices are accessible there. Browser settings may additionally erase or block cookies; this may restrict functions.

11.7 Mere continued use of the Platform does not constitute consent to non-essential cookies where explicit consent is required.

12. Mobile Applications and Device Permissions

12.1 Mobile Applications may request access to the camera, photographs, files, notifications or device functions protected by biometrics where required for uploads, identification, contracts or security.

12.2 Permissions are controlled through the operating system and may be withdrawn there. Withdrawal may restrict individual functions.

12.3 FinanceFarm does not receive biometric unlock data protected by the operating system where a device function is used solely and locally for login.

13. Technical Records and Tamper-Resistant Logs

13.1 FinanceFarm may record timestamps, integrity values, document and GTC versions, Transaction and Consent Event IDs, status changes and other technical events in tamper-resistant logs.

13.2 Logging records necessary Reservation, contract, acceptance, release, payment, token, transfer and recovery events and communication and Rebuyer dispatch statuses with the relevant reference and version. It serves performance, reconciliation, preservation of evidence, monitoring of periods, security and enforcement of rights. Technical dispatch or blockchain evidence alone does not establish contract formation, receipt, ownership, current entitlement or a validly created pledge.

13.3 Identity and entitlement documents, contact and bank details, confidential contracts, internal safekeeping information and unredacted dossiers are not stored on a public blockchain. The protected link between User, contract, Original Asset position, digital position, payment and Wallet is maintained off-chain. Only necessary technical references, integrity values and token information that may lawfully be published are made public; metadata and linked files must also be assessed accordingly.

13.4 Wallet addresses, transaction hashes, token identifiers and integrity values may be personal data when linked to other information. Pseudonymisation does not ensure anonymity; a hash alone ensures neither anonymity nor confidentiality. Before blockchain use, FinanceFarm assesses lawfulness, including rectification and erasure rights, international transfers and any required impact assessment under Clauses 7.6, 9 and 13.5. Content, access, linkage and publication are limited to what is necessary and lawful. Before a binding confirmation, the intended public information and its potential worldwide visibility, linkability and lasting retention are explained. No blanket consent is inferred from that confirmation.

13.5 Statutory data protection rights remain applicable to tamper-resistant records. Public blockchain records may be technically incapable of erasure or alteration; burning a token does not erase its history. FinanceFarm fulfils required rectification, erasure, restriction and information duties in the systems for which it is responsible and takes any further legally required measures. De-linking qualifies as anonymisation only where identification is no longer possible by means reasonably likely to be used. Technical limits do not replace prior assessment of lawfulness.

14. Data Security and Personal Data Breaches

14.1 FinanceFarm implements appropriate technical and organisational safeguards. According to risk, these include role- and task-based access controls, secured administration access, multi-factor authentication, encryption in transit and, where appropriate, at rest, auditable logging, protection and separation of evidential copies, backups, vulnerability management, supplier controls and training. Links between technical references suitable for public use and persons or contracts are kept protected outside the blockchain.

14.2 Security measures are reviewed and further developed having regard to risk, the state of the art, implementation costs and the nature of the personal data.

14.3 No electronic system is completely secure. Users must protect their devices and credentials and report any suspected security incident without delay.

14.4 FinanceFarm assesses data security breaches and personal data breaches without delay. It notifies the Federal Data Protection and Information Commissioner as quickly as possible where a breach is likely to result in a high risk to the personality or fundamental rights of the data subject, and informs the data subject where this is necessary for the data subject’s protection or is ordered. Where the GDPR applies, FinanceFarm notifies the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where a high risk is likely, affected data subjects are informed in accordance with applicable law.

15. Rights of Data Subjects

15.1 Under applicable law, data subjects may in particular request access, rectification, erasure, restriction, delivery or portability of certain data and object to particular processing. Statutory access, delivery and portability rights are assessed and fulfilled independently of any voluntarily offered technical Platform export.

15.2 Where processing is based on consent, consent may be withdrawn with effect for the future. Data subjects may object to direct marketing at any time.

15.3 A right may be restricted, deferred or refused only where the conditions of a statutory exception actually applicable to that right are met. Retention duties, third-party rights, trade secrets and security or evidential interests are assessed for the specific request rather than invoked generally; where necessary, data are separated or redacted. Reasons and any information required by law are provided to the extent permissible. Clause 7.11 additionally applies to deferred information concerning account interventions.

15.4 Requests must be sent to info@financefarm.com or to the postal address stated in Clause 1. FinanceFarm may require appropriate proof of identity and responds within the statutory periods.

15.5 Data subjects may lodge a complaint with the Federal Data Protection and Information Commissioner or, where the GDPR applies, with a competent European supervisory authority.

16. Minors, Amendments and Language Version

16.1 Transaction functions are not intended for persons under eighteen years of age. FinanceFarm erases personal data of minors collected inadvertently unless a legal basis exists for further processing.

16.2 FinanceFarm may amend this Privacy Policy to reflect factual or legal changes. The current version is published together with its date. Material amendments are communicated in an appropriate manner.

16.3 Amendments to the Privacy Policy do not become consent merely through continued use. Any consent required is obtained separately.

16.4 The German version is the original and authoritative version. The corresponding English version is provided for ease of understanding. In the event of discrepancies, the German version is authoritative; mandatory data protection and transparency rules and non-waivable rights of data subjects remain unaffected.