Oomero Privacy Statement

1Who We Are

Oomero currently operates through the following group entities. Depending on where you are located and which Client you have engaged with, the relevant Oomero entity acts as controller (or joint controller alongside that Client) of your personal data:

Oomero does not currently maintain a licensed or incorporated presence in the European Economic Area, the United States, Singapore, or Australia. Where individuals in those jurisdictions use the Platform (directly or via a Client), Oomero nonetheless complies with the applicable requirements described in Section 13, to the extent those laws apply to Oomero on an extraterritorial basis.

References in this Statement to "Oomero and its subsidiaries" include all of the entities listed above and any other Oomero group entity operating in a jurisdiction in which the Services are offered. Each Oomero group entity is bound by the standards set out in this Statement and by the data protection laws applicable in the jurisdiction in which it operates.

2Key Definitions

• "Client" means a business, institution, or organisation that has entered into an agreement with Oomero to use the Platform to onboard, verify, and manage its own end users.
• "Customer" means an individual end user whose personal data is collected, processed, or stored on the Platform, whether directly by Oomero or through a Client. Depending on the jurisdiction, this Statement also uses this term to refer to a "Data Subject" (EU/UK/DIFC), "Data Principal" (India), "Consumer" (United States), or "Individual" (Singapore/Australia), as defined under the relevant law listed in Section 17.
• "Oomero ID" means the unique digital identity record Oomero creates and maintains for each Customer, through which non-AML personal data is made visible and portable to the Customer and, where authorised, to Clients.
• "AML Data" means personal data collected or processed for anti-money laundering, counter-terrorist financing, sanctions screening, know-your-customer (KYC), or related financial-crime compliance purposes.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection law.
• "Sensitive Personal Data" means categories of personal data that applicable law treats as requiring additional protection, as described in Section 8.

3Data We Collect

Depending on how you interact with the Platform (as a Customer registering directly, or as an individual onboarded by a Client), we may collect:

• Identity data: full name, date of birth, nationality, government identification numbers, and identification documents, which may include a photograph or biometric facial data used for identity verification.
• Contact data: address, email address, and telephone number.
• Financial and AML/KYC data: source of funds, occupation, sanctions and politically-exposed-person (PEP) screening results, and risk-scoring data, which may include information about criminal or regulatory proceedings.
• Technical and usage data: device identifiers, IP address, log data, and app/website interaction data, collected via the website and the mobile application.
• Any other data a Customer or Client voluntarily submits to the Platform.

4Data Ownership

Customers own their own personal data. Oomero and its Clients act as custodians and processors of that data for the purposes set out in this Statement and in the applicable Client agreement, and do not acquire ownership of a Customer's personal data by virtue of collecting, processing, or storing it. Customers retain the right to access, port, and (subject to Section 7 and applicable law) request correction or deletion of their data at any time.

5How Data Is Shared

5.1 Non-AML data — shared via the Oomero ID

Personal data that is not AML Data is made visible to the relevant Customer through their Oomero ID, and may be shared with the Client(s) the Customer has engaged with, so that the Customer can see, verify, and reuse their own data across Clients on the Platform without having to re-submit it each time.

5.2 AML data — pseudonymised sharing between Clients

AML Data may be shared between Oomero Clients in pseudonymised form, sufficient to support shared financial-crime risk management (for example, flagging a previously identified risk) without disclosing the identity or full underlying record of the Customer to a Client that has not independently established a relationship with that Customer. In practice, a Client viewing a shared AML flag or comment sees only limited descriptive attributes (such as the industry and role of the individual who raised it) and cannot itself identify the Customer or the author of the flag from that view.

This data is pseudonymised, not anonymised: a restricted, access-controlled group within Oomero (specifically, designated members of the technical team and super administrators) retains the ability to re-identify the underlying record where necessary for platform security, audit, dispute resolution, or compliance purposes. Because re-identification remains possible within Oomero, this data continues to be treated as personal data under applicable law, and is subject to the same rights, safeguards, and retention limits as any other personal data described in this Statement. Access to the re-identification capability is restricted on a need-to-know basis, logged, and subject to internal confidentiality obligations.

AML Data is never shared between Clients in a manner that would allow a Client to re-identify the Customer, except where required by law or a regulatory or law-enforcement request. Consistent with applicable anti-money laundering (AML) and counter-terrorist financing (CTF) law, Oomero will not disclose to a Customer or a Client whether a specific suspicious activity report, investigation, or law-enforcement inquiry has been made in relation to a Customer, where doing so would constitute unlawful "tipping-off."

6Access and Amendment Rights

Customers can view the data they have shared with, or that has been input into, the Platform through their Oomero ID. Where a Customer identifies incorrect, incomplete, or outdated data, they may request an amendment either:

• directly with the Oomero team, using the contact details in Section 16; or
• through the Client they have engaged with, who will route the request to Oomero.

We aim to acknowledge amendment requests promptly and to action verified requests without undue delay, consistent with our obligations under applicable data protection law. Additional, jurisdiction-specific rights and response timeframes are set out in Section 13.

7Critical Changes Require Documentary Evidence

Certain changes to a Customer's record are treated as major or critical changes because of their importance to identity integrity and financial-crime compliance. These include, without limitation:

• Date of birth.
• Legal name (including name changes following marriage, divorce, or deed poll).
• Nationality or immigration/residency status.
• Any other change Oomero or the relevant Client reasonably deems critical to the accuracy of the Customer's identity record.

No such major change will be processed without supporting documentary evidence (for example, an updated passport, government-issued ID, marriage certificate, or deed poll) submitted by the Customer or the relevant Client and verified by Oomero. This requirement exists to protect Customers and Clients against identity fraud and to preserve the integrity of the Oomero ID.

8Sensitive Personal Data

Some of the data described in Section 3 — in particular biometric or facial identification data, and information relating to criminal, regulatory, or sanctions matters arising from AML/KYC checks — is treated as a special or sensitive category of personal data under the laws described in Section 13 (for example, "special category data" under GDPR/UK GDPR Article 9 and criminal offence data under Article 10; "Sensitive Personal Data" under the DIFC Data Protection Law; and "sensitive information" under the Australian Privacy Principles). Oomero processes this data only where permitted, including where necessary: to comply with a legal or regulatory obligation (including anti-money laundering, counter-terrorist financing, and sanctions law); for reasons of substantial public interest; or on the basis of the Customer's explicit consent. Additional safeguards apply to this data, including restricted access, encryption, and the pseudonymisation approach described in Section 5.2.

9Data Storage and Cross-Border Transfers

Personal data is stored locally within each jurisdiction in which the Platform operates, using data infrastructure located in that jurisdiction, so that Customer and Client data is retained in-region rather than transferred by default to a central or foreign data store. Where a cross-border transfer is strictly necessary (for example, for pseudonymised AML risk-sharing under Section 5.2, or where a Customer engages a Client operating in a different jurisdiction), Oomero relies on a legal transfer mechanism recognised under the law of the exporting jurisdiction, which may include: the UK and EU Standard Contractual Clauses or the UK International Data Transfer Addendum; an applicable adequacy regulation or decision; the DIFC Commissioner's adequacy or standard-clause mechanisms; India's cross-border transfer rules under the DPDP Act; or an equivalent safeguard recognised under the law of the relevant jurisdiction listed in Section 13.

10Data Security and Breach Notification

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data processed, including encryption in transit and at rest, access controls, and audit logging. If we become aware of a personal data breach that is likely to result in a risk to a Customer's rights, we will assess and, where required, notify the breach to the competent supervisory authority and to affected Customers, within the timeframe and in the manner prescribed by the applicable law identified in Section 13 (for example, generally within 72 hours of becoming aware of a qualifying breach under the UK GDPR, EU GDPR, and DIFC Data Protection Law). We maintain an internal breach-response process to support this obligation across all jurisdictions in which we operate.

11Data Protection Officer and Privacy Contact

Oomero has appointed a Data Protection Officer ("DPO") to oversee compliance with this Statement and applicable data protection law. Consistent with regulatory guidance in the jurisdictions in which Oomero operates, we publish the DPO's role-based contact address rather than an individual's name, which is the accepted approach under UK GDPR, EU GDPR, the DIFC Data Protection Law, and the Singapore PDPA: those laws require the DPO's contact details to be published and, where applicable, registered with the relevant regulator, but do not require the individual's name to appear in a public-facing document. The DPO's identity is registered with the relevant supervisory authority where such registration is required (including the UK Information Commissioner's Office, the DIFC Commissioner of Data Protection, and the Singapore Personal Data Protection Commission), and will be disclosed to a supervisory authority or affected individuals where required in connection with a specific breach notification or regulatory request.

You can reach our Data Protection Officer at:

dpo@oomero.com

Where a Client-facing grievance officer or equivalent local contact is required under a specific jurisdiction's law (for example, India's DPDP Act), that requirement is addressed in the corresponding subsection of Section 13.

12Your Rights

Subject to the conditions and exceptions set out in applicable law, and in addition to the jurisdiction-specific rights described in Section 13, Customers generally have the right to:

• be informed about how their personal data is processed;
• access the personal data Oomero holds about them;
• request rectification of inaccurate or incomplete data (see Sections 6 and 7);
• request erasure or deletion of their data, subject to Oomero's legal and regulatory record-keeping obligations (see Section 14);
• request restriction of, or object to, certain processing;
• receive or transfer their data in a portable format;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• nominate another individual to exercise these rights on their behalf in the event of death or incapacity, where recognised under applicable law;
• lodge a complaint with the competent supervisory authority identified in Section 13.

Requests can be made using the contact details in Section 16, or through the Client a Customer has engaged with.

13Jurisdiction-Specific Requirements

This section sets out how Oomero applies the general commitments above in each of the jurisdictions in which it currently operates, or in which Customers or Clients are commonly located. The specific laws referred to below are listed in full in the glossary at Section 17.

13.1 United Kingdom (operational)

Oomero's UK entity, [Oomero UK Ltd — registered office address to be confirmed], processes personal data in accordance with the UK GDPR and the Data Protection Act 2018. Customers in the UK have the rights described in Section 12, may lodge a complaint with the UK Information Commissioner's Office (ICO), and are entitled to a response to a data subject access request generally within one month of a valid request. Oomero's DPO contact details are registered with the ICO as required under Article 37(7) UK GDPR.

13.2 United Arab Emirates

Oomero's UAE entity, Oomero Technology Ltd, is established in the DIFC and processes personal data primarily under the DIFC Data Protection Law (DIFC Law No. 5 of 2020, as amended) and the DIFC Data Protection Regulations. Oomero is registered with the DIFC Commissioner of Data Protection and has assessed its AML/KYC and identity-verification processing as High Risk Processing under that law, requiring appointment of a DPO, which Oomero has done. Customers connected to the DIFC may lodge a complaint with the DIFC Commissioner of Data Protection.

Where Oomero or a Client processes personal data of individuals located onshore in the UAE (outside the DIFC or ADGM), the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL") and its Executive Regulations may additionally apply, including where Oomero processes such data from within the DIFC on an extraterritorial basis. Oomero assesses this on a Client-by-Client basis and applies the applicable requirements of the UAE PDPL, including its rules on legal basis, data subject rights, and cross-border transfer, in addition to the DIFC Data Protection Law where both apply.

13.3 European Union / European Economic Area

Oomero does not currently have an establishment in the EU or EEA. Where Oomero processes personal data of individuals located in the EU or EEA in connection with offering the Services to them or monitoring their behaviour, the EU GDPR applies on an extraterritorial basis under Article 3(2). Where this threshold is met and no exemption applies, Oomero will appoint a representative in the EU under Article 27 GDPR: [EU representative name, firm, and contact address to be confirmed]. Customers in the EU/EEA may lodge a complaint with the supervisory authority of their member state of residence.

13.4 India

Oomero's India entity, Oomero Technology Private Limited, has been established but is not yet operational. Once operational, Oomero's processing of personal data of individuals in India will be governed by the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 ("DPDP Act"), under which Oomero (or the relevant Client) acts as a "Data Fiduciary" and Customers are "Data Principals." Consistent with the DPDP Act, Oomero will provide a clear notice describing the personal data collected and the purpose of processing, obtain consent (or rely on a recognised "legitimate use," such as compliance with law, where applicable to AML/KYC processing), and designate a grievance officer whose contact details will be published to Data Principals in India. If Oomero's India processing meets the volume or sensitivity thresholds for designation as a "Significant Data Fiduciary," Oomero will appoint an India-resident Data Protection Officer reporting to its board, who will also act as the point of contact for grievance redressal, and will conduct Data Protection Impact Assessments and independent audits as required. The DPDP Act treats any individual under the age of 18 as a child and requires verifiable parental or guardian consent for processing a child's personal data; Oomero does not knowingly onboard individuals under 18 (see also the age restriction in the Oomero Mobile EULA).

13.5 United States

Oomero does not currently have an establishment in the United States. Where Oomero or a Client processes personal data of California residents in a manner that meets the applicable thresholds, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), applies, giving Customers the right to know, delete, and correct their personal information, to opt out of the sale or sharing of personal information (Oomero does not sell Customer personal data), and to limit the use of sensitive personal information. Customers may lodge a complaint with the California Privacy Protection Agency. Where Oomero or a Client processes personal data of residents of other U.S. states with comprehensive privacy laws in effect (for example, Virginia, Colorado, Connecticut, or other states listed in Section 17), Oomero applies the equivalent rights and obligations under those laws.

13.6 Singapore

Oomero does not currently have an establishment in Singapore. Where Oomero or a Client processes personal data of individuals in Singapore, the Personal Data Protection Act 2012 ("PDPA") applies. Consistent with the PDPA's mandatory DPO requirement, Oomero's DPO contact details (Section 11) are made available and, where required because Oomero is an organisation subject to the PDPA in respect of that processing, registered through the Personal Data Protection Commission's ("PDPC") notification channel. Customers in Singapore may lodge a complaint with the PDPC.

13.7 Australia

Oomero does not currently have an establishment in Australia. Where Oomero or a Client processes personal data of individuals in Australia in a manner that engages the Privacy Act 1988 (Cth), Oomero applies the Australian Privacy Principles (APPs), including in respect of the collection, use, and disclosure of personal and sensitive information, and complies with the Notifiable Data Breaches scheme, notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals of an eligible data breach as soon as practicable. Customers in Australia may lodge a complaint with the OAIC.

14Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Statement, to meet AML/KYC record-keeping obligations under applicable financial-crime law, or to comply with other legal, regulatory, or contractual requirements, after which it is securely deleted or anonymised.

15Changes to This Statement

We may update this Privacy Statement from time to time to reflect changes in our practices, the Platform, applicable law, or the jurisdictions in which we operate. Material changes will be notified to Clients and, where required by law, to Customers, via the website, the mobile application, or direct communication, together with the revised effective date shown at the top of this Statement.

16Contact Us

Questions, amendment requests, or complaints regarding this Privacy Statement or the handling of personal data can be directed to:

Customers may also raise a request through the Client they have engaged with, who will forward it to Oomero. Jurisdiction-specific complaint mechanisms and regulators are listed in Section 13.

17Glossary of Applicable Laws

This Statement refers to the following laws by jurisdiction: