SPARK Pay Privacy Policy

Last Updated: May 6th, 2025

Version: v2.0

SPARK Pay is a platform that simplifies the acceptance of cryptocurrencies as payment for goods and services provided by SparkHop Technology Limited. (“SparkHop” or “SPARK Pay” or “Spark” or “we” or “us” or “our”). This Privacy Policy (the “Policy”) helps explain how we collect, use, store, and protect your information when you use SPARK Pay, the SPARK Pay service or any SPARK Pay APIs or third party applications relying on such APIs, or any other websites, pages, features, or content related to the SPARK Pay service (collectively the “Services”).

Please read this Policy carefully along with the SPARK Pay Terms of Service (the “Terms”), which describe the terms under which you use the Services. If you have any questions, please contact us at contact@sparkhop.xyz.

Acceptance of Privacy Policy

By accessing and using our Services, you signify your acceptance to the terms of this Policy. If you do not agree with or you are not comfortable with any aspect of this Policy, you should immediately discontinue access or use of our Services.

Changes to this Policy

We reserve the right to update or modify this Policy at any time, and when required by law, we will notify you of changes to this Policy. We may update or modify this Policy from time to time according to changes in our Services or data processing. If we update this Policy we will publish the latest version of the Policy on the website, and it will take effect immediately upon its release. You are advised to review this Policy periodically for any changes.

Spark may provide additional "just-in-time" disclosures or additional information about the data collection, use and sharing practices of specific Services. These notices may supplement or clarify our privacy practices or may provide you with additional choices about how we process your personal information.

Our Relationship to You

For you to understand our data protection obligations and your rights to your personal information under this Policy, it is important that you identify which relationship(s) you have with us. SparkHop has the following relationships:

• A “User” is an individual providing personal information to us via our website or other services, products or platforms, such as by signing up or making an account and using the available features. SPARK Pay is a “data controller” in relation to its Users.
• A “Customer” is a specific type of User that has engaged us to act as an agent (or, as a “Data Processor”) by obtaining our Services. SPARK Pay is a “data processor” in relation to Customers.

Hereinafter we may refer to Customers and Users collectively as “you”.

Information We Collect

We receive or collect personal information when we operate and provide our Services, including when you install, access, or use our Services. Personal information is data that can be used to identify you directly or indirectly, or to contact you. Our Policy governs all personal information we collect about you and obtain from third party sources. This Policy does not apply to anonymized information as it cannot be used to identify you.

If you register an account and use the service on behalf of a company or other organization, we will collect information about that organization and the organization's authorization from you.

Generally, we collect information to provide you with our Services. Except as described in this Policy, we will not sell, lease, rent or loan your personal information to any third party without your prior consent.

Information you provide

• Your Login Credentials - To create a SPARK Pay user account, you must provide us with a mobile number or an email address.
• Your Business Information - To create a customer profile and use the Services you must provide us with your enterprise registration certificate, power of attorney and other proof materials required by us.
• Your Products and Services - We retain information submitted by you when you create each payment order, which may include your product or service name, price, description, as well as user_id, order number from your shopping system.
• Your Cryptocurrency Addresses - We retain your public cryptocurrency addresses generated in the course of your use of the Service.
• Your Transactions - We retain any records, histories, or metadata for the transactions related to your business on the applicable blockchain. If you request personal information from your customers, such as wallet addresses, as part of the transaction, we retain a copy of this information. To monitor cryptocurrency transactions and provide you with account balance information, we store the public keys associated with your private keys.
• Customer Support - We collect any additional information you disclose to our customer support team.

Information we collect from our affiliates

Our “family of companies” is the group of companies related to us by common control or ownership (“Affiliates”). In accordance with applicable law, we may obtain information about you from our Affiliates in the normal course of business to provide the Services and Affiliates’ Services to you.

Automatically collected information

• Metrics and Performance Data - We collect service-related, diagnostic, and performance information. This includes high level information about your activity (such as how you use our Services and how you interact with others using our Services), and diagnostic, crash, website, and performance logs and reports.
• Device and Connection Information - We collect device-specific information when you install, access, or use our Services, including your IP address and your web-browser software.

How We Use the Information We Collect

Our primary purpose in collecting information is to help us operate, provide, improve, customize, support, and market our Services. We may use your information:

To provide SPARK Pay Services

We process your personal information to provide the Services. For example, if you want to use our Services to accept Digital Currency for your products and services, we require that you provide us with your registered mobile number or email address, and login verification code. We cannot provide you with Services without such information.

To register and activate a self-custody blockchain wallet (“Internal Wallet”) for you

Our service partner provides Internal Wallet Service to SPARK to generate a self-custody blockchain wallet (“Internal Wallet”) to you. We need to provide the service partner with your registered mobile number or email address to achieve this purpose.

To provide Service communications

We send administrative or account-related information to you to keep you updated about our Services, inform you of relevant security issues or updates, or provide other transaction-related information. Without such communications, you may not be aware of important developments relating to your account that may affect how you can use our Services.

To provide customer service

We process your personal information when you contact us to resolve any questions, disputes, or to troubleshoot problems. Without processing your personal information for such purposes, we cannot respond to your requests and ensure your uninterrupted use of the Services.

To ensure quality control

We process your personal information for quality control and staff training to make sure we continue to provide you with accurate information. If we do not process personal information for quality control purposes, you may experience issues on the Services such as inaccurate transaction records or other interruptions.

For research and development purposes

We process your personal information to better understand you and, if applicable, your end-users and the way you use and interact with our Services. In addition, we use such information to customize, measure, and improve our Services and the content and layout of our website and applications, and to develop new Services. Without such processing, we cannot ensure your continued enjoyment of our Services.

To enhance your website experience

We process your personal information to provide a personalized experience, and implement the preferences you request. Without such processing, we may not be able to ensure your continued enjoyment of part or all of our Services.

To facilitate corporate acquisitions, mergers, or transactions

We may process any information regarding your account and use of our Services as is necessary in the context of corporate acquisitions, mergers, or other corporate transactions. You have the option of closing your account if you do not wish to have your personal information processed for such purposes.

To engage in marketing activities

Based on your communication preferences, we may send you marketing communications to inform you about relevant product offers and services; to deliver targeted marketing; and to provide you with promotional offers based on your communication preferences. We use information about your usage of our Services and your contact information to provide marketing communications. You can opt-out of our marketing communications at any time.

Any other purposes which we may separately notify you and obtain your consent for

We will not use your information for purposes other than those purposes we have disclosed to you. From time to time we may request your permission to allow us to share your personal information with third parties. You may opt out of having your personal information shared with third parties, or from allowing us to use your personal information for any purpose that is incompatible with the purposes for which we originally collected it or subsequently obtained your authorization. If you choose to limit the use of your personal information, certain features or Services may not be available to you.

Communications

We may send you communications that are related to your account or will be related to our Services or information we believe interests you. In the event we send any communication to you which is not related specifically to your account, we will provide you with an "unsubscribe" mechanism through which you may opt out of receiving other similar messages in the future.

How Your Information Is Shared With Your End Customers

If you use your account in a transaction with your end customers (ie. customers that make payments to you via SPARK Pay), that end customers will have access to the public blockchain address of your Internal Wallet to pay for their purchases.

How We Share Information With Affiliates and Third Parties

We work with our Affiliates and third-party providers to help us operate, provide, improve, customize, support, and market our Services. For example, we work with companies to provide our infrastructure, delivery, and other systems. When we share your information with third parties, their responsibilities and obligations will be governed by contracts and we will require them to take appropriate measures to ensure the safety of the information processed. These providers may provide us information about you in certain circumstances.

We will also share information with our Affiliates in the normal course of business to provide the Services and Affiliate services.

We may also share information with law enforcement, government officials, Affiliates or other third parties when:

• We are compelled to do so by a subpoena, court order, or similar legal procedure;
• We believe in good faith that the disclosure of personal information is necessary to prevent physical harm or financial loss, to report suspected illegal activity or to investigate violations of our Terms; or
• We may share your personal data for compliance, fraud prevention and safety purposes.

We only disclose your personal data to the extent permitted by applicable laws and regulations, in accordance with this Policy, or in accordance with consent that you give us.

How We Use Cookies

When you access our Services, we or companies we work with may place cookies on your computer or other devices. These technologies help us better understand user behavior, and inform us about which parts of our websites people have visited.

Do-Not-Track

Some Internet browsers - like Internet Explorer, Firefox, and Safari - include the ability to transmit "Do Not Track" or "DNT" signals. Since uniform standards for "DNT" signals have not been adopted, our Services do not currently process or respond to "DNT" signals.

Children

We do not knowingly request or collect personal information from any person under the age of 18. If a user submitting personal information is suspected of being younger than 18 years of age, SPARK Pay will require the user to close his or her account and will not allow continued use of the Services. We will also take steps to delete the information as soon as possible. Please notify us if you know of any individuals under the age of 18 using our Services so we can take action to prevent access to our Services.

Access and Modification of Your Personal Information

You may contact us at contact@sparkhop.xyz to access the personal information we hold about you. If any of the information is inaccurate, you may rectify such information. We reserve the right to limit your access or modifications if your requests are too frequent and/or burdensome.

For individuals residing in Designated Countries, please refer to the “International Users” section below.

Security Safeguards

We maintain, and require our service providers to maintain, appropriate physical, technical and administrative safeguards to protect the security and confidentiality of the personal information you entrust to us.

However, we cannot guarantee that loss, misuse, unauthorized acquisition, or alteration of your data will not occur. Please recognize that you play a vital role in protecting your own personal information. When registering with our Services, it is important to protect your login verification code and reset verification code, and to immediately notify us if you become aware of any unauthorized access to or use of your account.

Furthermore, we cannot ensure or warrant the security or confidentiality of information you transmit to us or receive from us by Internet or wireless connection, including email, phone, or SMS, since we have no way of protecting that information once it leaves and until it reaches us. If you have reason to believe that your data is no longer secure, please contact us at the email address at the end of this Privacy Policy.

In a word, SparkHop is committed to protecting your personal data. Nevertheless, no security measure is perfect and no product, service, website, data transfer, computing system, or network connection is absolutely secure.

Retention

We limit our retention of your personal information to the only as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting obligations or to resolve disputes. While retention requirements vary by jurisdiction, information about our typical retention periods for different aspects of your personal information are described below.

• Information collected via technical means such as cookies, webpage counters and other analytics tools is kept for a period of up to one year from expiry of the cookie.

You can choose to close your account. After you close your account, we will stop providing you with the Services and delete your relevant personal data, provided that we are not required to continue to process certain of your personal data by law, e.g. for accounting or bookkeeping purposes or to perform our obligations, or exercise our rights under agreements related to the Services.

Please contact us if you have questions about retention periods for a particular aspect of your personal information which is not detailed above.

International Transfers of Personal Information

As a global entity, SPARK Pay may store, transfer, and otherwise process your personal information in countries outside of the country of your residence, including Hong Kong Special Administrative Region of the People's Republic of China and possibly other countries/regions/ jurisdictions. The data protection laws of such countries may not be as protective as the laws of the country in which you reside.

These jurisdictions may have different data protection laws, which may impose less stringent data protection requirements. In such cases, we will ensure the transfer is in accordance with applicable laws and regulations (including by ensuring that overseas recipients are subject to confidentiality and data protection obligations where appropriate), as well as this Policy.

International Users

This section only applies to individuals residing in a Designated Country (“Designated Country” means for any individual who resides in the United Kingdom, European Economic Area or Switzerland, pursuant to EU General Data Protection Regulation or any equivalent legislation).

• Legal bases for processing personal information. Our legal bases for processing are described in the sections above entitled “How We Use the Information We Collect” and “Information We Collect”. We may process your personal information if you consent to the processing, to satisfy our legal obligations, if it is necessary to carry out our obligations arising from any contracts we entered with you or to take steps at your request prior to entering into a contract with you, or for our legitimate interests to protect our property, rights or safety of SPARK Pay, our customers or others.
• Direct Marketing. If you are located in the Designated Countries and are a current customer, we will only contact you by electronic means (email or SMS) with information about our Services that are similar to those which were the subject of a previous sale or negotiations of a sale to you. If you are a new customer and located in the Designated Countries, we will contact you by electronic means for marketing purposes only if you have consented to such communication. If you no longer want us to use your personal information in this way, or to pass your personal information on to third parties for marketing purposes, please contact us at contact@sparkhop.xyz. You may raise such objections with regard to initial or further processing for purposes of direct marketing, at any time and free of charge. Direct marketing includes any communications to you that are only based on advertising or promoting products and services
• Individual Rights. Residents of Designated Countries have the following rights, which can be exercised by contacting us at contact@sparkhop.xyz so that we may consider your request under applicable law.
• Right to withdraw consent. You have the right to withdraw your consent to the processing of your personal information collected on the basis of your consent at any time. Your withdrawal will not affect the lawfulness of SPARK Pay’s processing based on consent before your withdrawal.
• Right of access to and rectification of your personal information. You have a right to request that we provide you a copy of your personal information held by us. This information will be provided without undue delay subject to some fee associated with gathering of the information (as permitted by law), unless such provision adversely affects the rights and freedoms of others. You may also request us to rectify or update any of your personal information held by us that is inaccurate.
• Right to erasure. You have the right to request erasure of your personal information that: (a) is no longer necessary in relation to the purposes for which it was collected or otherwise processed; (b) was collected in relation to processing that you previously consented, but later withdraw such consent; or (c) was collected in relation to processing activities to which you object, and there are no overriding legitimate grounds for our processing. If we have made your personal information public and are obliged to erase the personal information, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other parties that are processing your personal information that you have requested the erasure of any links to, or copy or replication of your personal information. The above is subject to limitations by relevant data protection laws.
• Right to data portability. If we process your personal information based on a contract with you or based on your consent, or the processing is carried out by automated means, you may request to receive your personal information in a structured, commonly used and machine-readable format, and to have us transfer your personal information directly to another “controller”, where technically feasible, unless exercise of this right adversely affects the rights and freedoms of others. A “controller” is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of your personal information.
• Right to restriction of or processing. You have the right to restrict or object to us processing your personal information where one of the following applies
• You contest the accuracy of your personal information that we processed. In such instances, we will restrict processing during the period necessary for us to verify the accuracy of your personal information.
• The processing is unlawful and you oppose the erasure of your personal information and request the restriction of its use instead.
• We no longer need your personal information for the purposes of the processing, but it is required by you to establish, exercise or defense of legal claims.
• You have objected to processing, pending the verification whether the legitimate grounds of our processing override your rights.

Restricted personal information shall only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. We will inform you if the restriction is lifted.

• Notification of erasure, rectification and restriction. We will communicate any rectification or erasure of your personal information or restriction of processing to each recipient to whom your personal information has been disclosed, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients if you request this information.
• Right to object to processing. Where the processing of your personal information is based on consent, contract or legitimate interests you may restrict or object, at any time, to the processing of your personal information as permitted by applicable law. We can continue to process your personal information if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law.
• Automated individual decision-making, including profiling. You have the right not to be subject to a decision based solely on automated processing of your personal information, including profiling, which produces legal or similarly significant effects on you, save for the exceptions applicable under relevant data protection laws.
• Right to lodge a complaint. If you believe that we have infringed your rights, we encourage you to contact us first at contact@sparkhop.xyz so that we can try to resolve your issue or dispute informally.
• Storage of your personal information. We will try to limit the storage of your personal information to the extent that storage is necessary to serve the purpose(s) for which the personal information was processed, to resolve disputes, enforce our agreements, and as required or permitted by law.
• Data Protection Officer: You may reach our Data Protection Officer at compliance@sparkhop.xyz.

Your rights to personal information are not absolute. Access may be denied when:

• Denial of access is required or authorized by law;
• Granting access would have a negative impact on other's privacy;
• To protect our rights and properties; and
• Where the request is frivolous or vexatious.

Contact Us

If you have any questions about our Privacy Policy, please do not hesitate to contact us at contact@sparkhop.xyz .