Privacy Policy – PerkupToken App

Last Updated: October 20, 2025

1. Introduction

Welcome to the Privacy Policy of the PerkupToken application. Your privacy is extremely important to us. This document describes how we, at PerkupToken, process your personal data in compliance with the Brazilian General Data Protection Law (LGPD), Law No. 13,709/2018.

This application is a decentralized cryptocurrency wallet (DEX Wallet) for the Perkup (UP) utility token, operating on the Ethereum blockchain. As a decentralized platform, our goal is to minimize data collection and ensure your control over your information.

2. Data Controller

For the purposes of LGPD, the controller of your personal data is PerkupToken, a private legal entity, whose contact information is available at the end of this document. The controller is responsible for making decisions regarding the processing of your personal data.

3. Personal Data Collected and Processing Purpose

In line with the principle of minimization, we collect only the data strictly necessary for the operation of the application and to fulfill our obligations. The table below details the data we may collect and their respective purposes:

Data Category	Data Collected	Main Purpose
Blockchain Transaction Data	Your Ethereum wallet address (public key)	Identify and record Perkup (UP) token transactions on the Ethereum blockchain.
App Interaction Data	Information about the use of features (gamification, marketplace, staking)	Improve user experience, offer rewards, and ensure the functioning of the ecosystem.
Contact Data	Name, email (voluntarily provided)	Provide user support, answer questions, and send important communications about the project.

It is essential to note that, as a non-custodial wallet, we do not have access to or store your private keys. You are solely responsible for safeguarding and securing your keys.

3.1. Blockchain Data and LGPD

Transactions made with the Perkup (UP) token are recorded on the Ethereum blockchain, a public and immutable network. This means that once a transaction is confirmed, it cannot be altered or deleted. Your wallet address (public key) and the transaction history associated with it are publicly visible.

We understand the tension between blockchain immutability and the "right to be forgotten" provided by LGPD. Therefore, we adopt the following measures:

• On-Chain Data Minimization: Only your wallet address and transaction details are recorded on the blockchain. We do not directly link your personal identification data (such as name or email) to these on-chain transactions.
• Transparency: We clearly and transparently inform you that your transactions are public and permanent.
• Off-Chain Data: Data that is not essential for blockchain transactions, such as profile preferences or contact data, is kept off-chain and managed according to LGPD guidelines.

4. Legal Basis for Data Processing

The processing of your personal data is carried out based on the following legal grounds of LGPD:

• Contract Performance (Art. 7, V): To enable the use of the application, process your transactions, and provide access to PerkupToken ecosystem features.
• Compliance with Legal or Regulatory Obligation (Art. 7, II): To meet any legal and regulatory requirements of the crypto asset sector.
• Legitimate Interest (Art. 7, IX): To improve our services, prevent fraud, and ensure platform security, always based on a careful analysis that balances our interests with your rights and freedoms.
• Consent (Art. 7, I): For specific purposes, such as sending newsletters or marketing materials, for which we will request your authorization clearly and unequivocally.

5. Data Retention Period

Personal data collected will be stored only for the time necessary to fulfill the purposes for which they were collected, including for compliance with any legal, contractual, accountability obligations, or requests from competent authorities.

• Blockchain Transaction Data: Will remain recorded on the Ethereum blockchain indefinitely, due to the immutable nature of the technology.
• Contact and Interaction Data: Will be kept while you are an active user of our ecosystem or until you request deletion, whichever comes first, respecting the legal retention period.

6. Sharing of Personal Data

We do not sell, rent, or share your personal data with third parties for marketing purposes. Data sharing, when it occurs, is restricted to the following situations:

• Service Providers: We may share data with companies that assist us in operating the platform, such as data analysis services and cloud infrastructure. These providers are contractually obligated to protect your data and use it only for the contracted purposes.
• Legal Authorities: Your data may be shared with competent judicial, administrative, or governmental authorities whenever there is a legal determination, request, requisition, or court order.
• Public Blockchain: We reiterate that all transactions on the Ethereum blockchain are public and shared with all network participants.

7. Data Subject Rights

LGPD guarantees you, as a data subject, a series of rights. You may, at any time, request:

• Confirmation and Access: The right to know if we process your data and to access it.
• Correction: The correction of incomplete, inaccurate, or outdated data.
• Anonymization, Blocking, or Deletion: The anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data. It is important to note that deletion of data recorded on the blockchain is not technically feasible.
• Portability: The portability of your data to another service or product provider, upon express request.
• Information about Sharing: Information about public and private entities with which we share data.
• Consent Revocation: The revocation of your consent, in cases where data processing is based on this legal basis.

8. How to Exercise Your Rights

To exercise any of your rights under LGPD, or to ask questions about the processing of your personal data, contact us through our Data Protection Officer (DPO), whose contact information is available at the end of this document. Requests will be fulfilled at no cost and within the legal timeframe.

9. Data Security

We adopt technical and administrative security measures to protect your personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication, or any form of improper or unlawful processing. Our commitment to security includes, but is not limited to:

• Encryption of data in transit and at rest (for off-chain data).
• Restricted access controls.
• Continuous monitoring of our systems to identify and mitigate vulnerabilities.

10. Cookies and Tracking Technologies

Our application and website may use cookies and similar technologies to improve your experience. Cookies are small text files stored on your device. We use cookies for:

• Essential Functionalities: Ensure the proper functioning of the application.
• Performance Analysis: Collect anonymous data about platform usage to help us understand how to improve it.
• Preferences: Remember your settings and preferences.

You can manage your cookie preferences through your browser or device settings. However, disabling essential cookies may affect the functionality of the application.

11. Data Protection Officer (DPO)

To ensure compliance with LGPD and serve as a communication channel between the controller, data subjects, and the National Data Protection Authority (ANPD), we have appointed a Data Protection Officer (DPO). For any questions related to this Privacy Policy or the processing of your data, please contact:

12. Changes to This Privacy Policy

This Privacy Policy may be updated at any time to reflect improvements in our services or changes in legislation. We recommend that you review it periodically. Whenever there are material changes, we will notify you through available communication channels.

13. International Data Transfers

Considering that the Ethereum blockchain is a global and decentralized network, your transactions are processed and stored on nodes (computers) located in various countries around the world. Additionally, some of our service providers may be located outside Brazil. In these situations, we ensure that international data transfers are carried out in compliance with LGPD, adopting adequate safeguards, such as standard contractual clauses and recognized certification mechanisms.

14. Protection of Children's and Adolescents' Data

Our application is not intended for individuals under 18 years of age. We do not intentionally collect personal data from children or adolescents without specific consent from at least one parent or legal guardian. If we become aware that we have collected data from minors without proper authorization, we will take necessary measures to delete this information from our systems as quickly as possible.

15. Applicable Law and Jurisdiction

This Privacy Policy is governed by the laws of the Federative Republic of Brazil, especially the General Data Protection Law (Law No. 13,709/2018). Any disputes arising from this policy will be submitted to the jurisdiction of São José do Rio Preto, State of São Paulo, unless otherwise provided by law.

16. Contact Information

If you have questions, comments, or requests about this Privacy Policy or the processing of your personal data, please contact us:

---