Privacy and Cookie Policy

Preamble

This Privacy and Cookie Policy (the "Policy") is the full privacy notice of Mira Financial, S.A. de C.V., a variable-capital corporation incorporated under the laws of the Republic of El Salvador (hereinafter "MIRA", "we" or the "Controller"). It explains, in plain language, what personal data we collect, what we use it for, who we share it with, how long we keep it, how we protect it and how you can exercise your rights.

This Policy is issued in compliance with the Personal Data Protection Law (Legislative Decree No. 144) and its amendments (the "LPDP"), the Personal Data Processing and Handling Policies issued by the State Cybersecurity Agency (the "ACE") and the provisions on confidentiality and protection of client information that apply to digital asset service providers under the Digital Asset Issuance Law (the "LEAD") and the regulations of the National Digital Assets Commission (the "CNAD").

Order of precedence. If any provision of this Policy contradicts applicable Salvadoran law, the law prevails. If this Policy imposes a stricter obligation than the law, the Policy applies, provided that full legal compliance is achieved.

This Policy forms an integral part of the Terms and Conditions of the Mira Financial Wallet (the "Terms"). Capitalized terms not defined here have the meaning given to them in the Terms.

1. Who the data controller is

The controller of your personal data is:

2. Purpose and scope of this Policy

2.1 This Policy explains how MIRA collects, stores, uses, shares, transfers and protects the personal data of individuals who (a) visit our website, (b) download or use our app, (c) sign up for and use the Mira Financial Wallet and the other services described in the Terms (the "Services"), (d) contact us through forms, chat, email, phone or social networks, or (e) act as representatives or contacts of our business partners and suppliers.

2.2 This Policy does not apply to sites, apps or services that MIRA does not own or control, such as those of our partners, advertisers, Commercial Operators, social networks or blockchain networks, even if they can be reached from our site or app. We recommend reading those third parties' privacy policies.

2.3 Data about our employees and job applicants is governed by specific internal privacy notices, not by this Policy.

2.4 MIRA is committed to the privacy of its users and to compliance with the LPDP. We have a Personal Data Protection Manual, a record of processing activities and internal procedures that ensure lawful, fair, informed and secure processing.

3. Definitions

For the purposes of this Policy:

4. Principles that guide processing

We process your data in line with the principles of lawfulness, consent, information, quality, purpose limitation, fairness, proportionality, security, confidentiality and accountability. In practice, this means we only collect the data needed for the purposes we tell you about; we keep it accurate and up to date; we do not use it for incompatible purposes without your consent; we keep it only for as long as necessary, and we can demonstrate our compliance to you and to the authorities.

5. Personal data we process, purposes and legal bases

The legal bases we rely on are those set out in the LPDP: (i) your consent; (ii) the performance of a contract to which you are a party or pre-contractual steps taken at your request; (iii) compliance with a legal obligation of MIRA; (iv) the protection of vital interests; (v) the performance of a task in the public interest, and (vi) the legitimate interests of MIRA, provided your rights and freedoms do not override them.

5.1 Wallet clients and users

When you sign up for and use the Services, we process the following categories of data:

If you do not provide the data marked as mandatory during sign-up, we will not be able to open your account or provide the Services, because the law requires us to identify our clients.

5.2 Website and app visitors

When you visit our site or use the app without signing up, we process browsing data (cookies and similar technologies, browser type and version, IP address, pages visited, length of visit and referral source) for the technical operation of the site, to remember your preferences, compile statistics, improve the experience and, if you authorize it, for advertising purposes. The basis is our legitimate interest for strictly necessary cookies and your consent for all others, which we ask for on your first visit (see section 15).

5.3 Contact forms, chat and customer support

If you write to us through the contact form, live chat, email or phone, we process your name, email, phone and the content of your inquiry to answer and follow up. The basis is our legitimate interest in handling inquiries or, if you are already a client, the performance of the contract. Please do not include sensitive data or login credentials in these channels: MIRA will never ask for your password, verification codes or seed phrases.

5.4 Social networks

If you follow, comment on or interact with Mira Financial accounts on social networks, we only process your username, name and, where applicable, email and the content of your message, based on our legitimate interest in managing our presence on those platforms and replying to you. Each social network is responsible for its own processing under its own policies (see section 16).

5.5 Representatives and contacts of business partners and suppliers

We process the name, position, email, phone and, when third-party due diligence requires it, the identification data of legal representatives and beneficial owners of our partners, suppliers and Commercial Operators, in order to enter into and perform contracts, manage the relationship, invoice and meet our accounting, tax and AML/CFT/CPF obligations. The bases are the performance of the contract, our legitimate interest and compliance with legal obligations, including those of the Commercial Code and the Tax Code.

6. Sensitive personal data

6.1 To provide the Services we need to process sensitive data: your biometric data (to verify your identity) and your financial and asset data. Under the LPDP, we only process it with your explicit consent, which we collect in writing through an electronic signature or express acceptance in the app before capture, except in the cases of exception provided by law.

6.2 We limit the processing of sensitive data to what is strictly necessary, apply enhanced security measures to it and restrict access to authorized staff. Biometric templates are used exclusively for identity verification and fraud prevention, never for commercial purposes.

6.3 We do not process data on racial or ethnic origin, political opinions, religious beliefs, union membership, health or sex life, unless it appears incidentally in the documents you provide or in the mandatory screening of Politically Exposed Person lists, in which case it is only used to comply with the law.

7. Automated decisions and profiling

To meet our AML/CFT/CPF obligations and protect your account, we use tools that automatically assess your risk as a client, matches between your data and sanctions lists, the risk of the wallet addresses you transact with and unusual transaction patterns. These processes may lead to a transaction being temporarily held, to requests for additional information or to enhanced due diligence.

No decision that significantly affects you, such as rejecting your sign-up or closing your account, is made solely by automated means: a person from the Compliance team is always involved. You can object to this type of processing, request human review, express your point of view and challenge the decision, as set out in section 13. Decisions to report a transaction to the Financial Investigation Unit are confidential by law and will not be disclosed to you.

8. Secondary purposes and how to opt out

The primary purposes are those needed for the contractual relationship and legal compliance described in section 5. The secondary purposes (optional) are: (a) sending you marketing communications, promotions and MIRA news by email, push notifications, SMS or messaging; (b) running satisfaction surveys and market research, and (c) personalizing offers based on your use of the Services.

You can opt out of secondary purposes at any time without affecting the Services: from the notification settings in the app, through the unsubscribe link in each communication, or by writing to cumplimiento@mirafinance.com with the subject "Secondary purposes". Withdrawing consent does not affect the lawfulness of processing carried out before it.

9. Recipients of your data

We only share your data when necessary for the purposes described, with recipients that offer adequate security and confidentiality guarantees. MIRA does not sell or rent your personal data. Recipients may include:

Processors only handle your data according to our documented instructions, under a contract with confidentiality and data protection clauses, and may not use it for their own purposes.

Public blockchain networks. When you order a transfer of digital assets to an external address, the transaction is recorded on a public blockchain network. That information (addresses, amounts, date and hash) is visible to anyone, is immutable and cannot be modified or deleted by MIRA or anyone else. MIRA does not publish your name or other identification data on the blockchain, but third parties could link an address to your identity by other means.

Travel rule. When you transfer digital assets to or receive them from another digital asset service provider, we exchange with that provider the originator and beneficiary data required by AML/CFT/CPF regulations.

10. International transfers

10.1 Because the Services are regional, your data may be transferred or stored outside El Salvador, in particular in the United States (cloud infrastructure and technology providers), in Mexico, Colombia and Argentina (Local Entities) and in the countries where our identity verification, monitoring and custody providers are located.

10.2 We only make international transfers when the recipient guarantees an adequate level of protection equivalent to that required by the LPDP. To do so, we sign contracts with data protection, confidentiality and security clauses, including intercompany agreements with the Local Entities, and, when the law requires it, we obtain your consent.

10.3 You can request information about the safeguards that apply to a transfer by writing to cumplimiento@mirafinance.com.

11. Data retention

We keep your data only for as long as necessary for the purpose for which it was collected and to meet legal retention periods. Once that period ends, the data is blocked and then securely deleted, with a record kept in audit logs.

Retention periods may be extended when an authority requires it or when the data is needed for ongoing judicial or administrative proceedings.

12. Information security

12.1 We apply administrative, technical and physical security measures proportionate to the sensitivity of the data and to our activity as a digital asset service provider, in line with the LPDP, the ACE Policies, the Cybersecurity and Information Security Law and the CNAD's cybersecurity requirements. These include: encryption of data in transit (TLS) and at rest; multi-factor authentication; role-based access control under the principle of least privilege; environment segregation; audit logs; backups; continuous monitoring; periodic penetration testing; secure management of cryptographic keys by the Custodian; confidentiality agreements with staff and suppliers, and regular training.

12.2 You are responsible for keeping your password, verification codes and access to your device confidential, and for keeping your data up to date. If you suspect unauthorized access to your account, let us know immediately at cumplimiento@mirafinance.com.

12.3 MIRA is not responsible for data you voluntarily share with third parties, for example when you link your account to third-party services you authorize or publish your wallet address.

13. Your rights

13.1 Rights you can exercise

Under the LPDP, you have the right to:

• Access: know whether we process your data, what data we process, for what purpose, where we got it and who we have disclosed it to.

• Rectification: ask us to correct inaccurate, incomplete or outdated data.

• Cancellation or deletion: ask us to delete your data when it is no longer needed, when you withdraw your consent or when it has been processed unlawfully, without prejudice to our legal retention obligations.

• Objection: object to the processing of your data on grounds relating to your particular situation, to its use for secondary purposes and to decisions based solely on automated processing.

• Portability: receive the data you gave us in a structured, commonly used and machine-readable format, and transmit it to another controller, where applicable.

• Restriction of processing: ask us to restrict the use of your data while a rectification or objection request is being resolved, or when you need it for a claim.

• Blocking: ask us to keep your data blocked, unused, while a dispute is resolved.

• Withdrawal of consent: withdraw at any time the consent you have given us, without retroactive effect.

• Complaint to the authority: file a complaint with the State Cybersecurity Agency.

13.2 How to exercise your rights

You can submit your request directly to MIRA, free of charge, by email to cumplimiento@mirafinance.com or from the support section of the app. The request must include:

• Full name, email and phone number associated with your account.

• A copy of your DUI, passport or other valid official document proving your identity and, if you act through a representative, the document proving that representation.

• The right you wish to exercise and a clear description of your request and of the data it refers to.

• Where applicable, documents supporting the request (for example, for a rectification).

If the information is insufficient, we will ask you to complete it. We will reply within a maximum of twenty (20) business days from receipt of the complete request, extendable for an equal period when there are justified reasons, which we will tell you about. If the request is upheld, we will carry it out within the legal period.

13.3 Limits to your rights

Some rights may be limited by law. In particular, we cannot delete data we must keep for fifteen (15) years under the Special AML/CFT/CPF Law, nor inform you about suspicious transaction reports or authority requests subject to confidentiality. In those cases we will explain the reason for the refusal, unless the law prohibits it, and the data will remain blocked.

14. Minors

The Services are intended exclusively for individuals aged eighteen (18) or over with full legal capacity. MIRA does not knowingly collect data from minors and verifies age during sign-up. If we find that we have collected data from a minor, we will close the account and delete their data, except data we must keep by legal obligation. If you are a parent or guardian and believe a minor has given us data, write to cumplimiento@mirafinance.com.

15. Cookie Policy

15.1 What cookies are

Cookies are small text files that a website stores on your device when you visit it. In this Policy the term also includes similar technologies, such as web storage (HTML5), pixels, SDKs and device identifiers used in the app. Session cookies are deleted when you close the browser; persistent cookies remain until they expire (never more than thirteen (13) months) or until you delete them.

15.2 Consent

On your first visit we show you a notice that lets you accept all, reject all or configure cookies by category. Strictly necessary cookies do not require consent because the site does not work without them. Rejecting the others does not stop you from using the site, although some features may be limited. You can change your choice at any time from the "Cookie settings" link in the site footer.

Cookies do not directly record your name or address, but they do record browsing patterns and your IP address, which could identify you indirectly; that is why we treat them as personal data.

15.3 Types of cookies we use

15.4 How to delete or block cookies

Besides the site's settings panel, you can block or delete cookies from your browser settings (Chrome, Safari, Firefox, Edge or others). If you use several browsers or devices, you need to do it on each one. In the app, you can limit ad tracking from your operating system's privacy settings (iOS or Android).

16. Social networks and third-party plug-ins

Our site may include social network plug-ins such as Facebook, Instagram, LinkedIn, X, YouTube and TikTok. When they load, these plug-ins may send the platform information about your visit, including your IP address, even if you do not have an account or are not logged in, and they may set cookies subject to your consent. MIRA does not control how much data these platforms collect and only receives anonymous statistics from them. We recommend reading their privacy policies and managing your settings on each platform.

Direct messages you send us through social networks are moved to our support channels and deleted from the social network once handled; public posts and comments you make remain on the platform until you delete them.

17. Security breaches

If a security breach affects your personal data, MIRA will notify the State Cybersecurity Agency, the Attorney General's Office and the affected data subjects within a maximum of seventy-two (72) hours of becoming aware of it, in accordance with the LPDP and the ACE Policies. The notice will tell you the nature of the incident, the data compromised, the measures we recommend you take and the corrective actions we have taken. When the incident affects digital asset operations, we will also notify the CNAD.

18. Questions and complaints

If you have questions about this Policy, want to exercise your rights or file a complaint about how we process your personal data, write to us at cumplimiento@mirafinance.com.

19. Changes to this Policy

We may update this Policy to reflect regulatory, technological or Service changes. We will publish the current version on our website and in the app, with its update date. If a change is material, for example a new purpose that requires your consent or a new category of transfer, we will notify you by email or in the app before it takes effect and, when the law requires it, we will ask for your consent again.

20. Contact information

Consent

When you sign up in the Mira Financial app, we will ask you to confirm that you have read and understood this Policy and to give your explicit consent to:

• The processing of your biometric data to verify your identity and prevent fraud (required to open the account).

• The processing of your financial and asset data as described in section 5.1 (required to open the account).

• The international transfers described in section 10, to the extent the law requires consent (required to open the account).

• Sending marketing communications and the other secondary purposes in section 8 (optional).