Privacy Policy

Introduction

This Privacy Policy explains how BCA Labs Corporation, incorporated in the British Virgin Islands, Processes Personal Data in connection with the Blockchain-Ads advertising Platform and technology at hub.blockchain-ads.com, including Advertiser Accounts, Campaign delivery and measurement, pixels, integrations, APIs and related Platform services. BCA Labs Corporation operates the Platform and is the Advertiser's contracting party under the Advertising Agreement. In this Policy, "Platform" has the meaning given in the Advertising Agreement.

The public Blockchain-Ads website may be operated or managed by another Blockchain-Ads group company. That entity is not the operator of the Platform or a party to the Advertising Agreement unless expressly stated. This Policy applies only to the Platform activities described here.

In this Policy, "Blockchain-Ads", "we", "us" and "our" mean BCA Labs Corporation. The signup signature records that this Policy was made available and acknowledged. This Policy is a transparency notice, not blanket consent, a waiver of privacy rights or a separate commercial warranty.

This Policy covers:

• Platform users and visitors, and people who contact us about the Platform or Service
• representatives, users, and beneficial owners of advertisers and business partners
• individuals whose devices or browsers interact with advertisements delivered through the Platform
• individuals whose activity is measured through an advertiser-authorised Blockchain-Ads pixel, tag, SDK, or server-to-server connection
• individuals whose data may be obtained from lawful public sources

This Policy does not govern an advertiser's own independent processing or a Supply Partner's independent processing. Those parties must provide their own notices.

The Advertising Agreement governs the commercial relationship with BCA Labs Corporation. The Data Processing Addendum governs Personal Data processed on an Advertiser's behalf, and the Cookie Policy explains cookies and similar technologies. This Policy explains processing and privacy rights; it does not replace the Agreement or DPA. An Advertiser's signature does not provide consent on behalf of its employees, customers or other individuals.

Who We Are

BCA Labs Corporation provides the Blockchain-Ads demand-side advertising Platform and related Service. The Platform enables Advertisers to buy digital advertising inventory from independent Supply Partners and to configure or authorise Campaign settings, audiences, pixels, measurement and, where enabled by the Advertiser, retargeting and conversion measurement.

Blockchain-Ads does not own publisher inventory. In the programmatic supply chain, advertisers, Blockchain-Ads, Supply Partners, publishers, measurement vendors, and infrastructure providers may process different data for their own or instructed purposes.

Our Data-Protection Principles

We aim to process personal data lawfully, fairly, transparently, and securely; collect it for specified purposes; limit it to what is necessary; keep it accurate; retain it only as long as required; and use appropriate safeguards for international transfers.

1. Data Controller and Roles

1.1 Platform administration. BCA Labs Corporation is Controller for Personal Data it Processes for operation, administration and security of the Platform, including registration, login, Account interfaces, privacy preferences, Platform analytics and related support, except where another party is expressly identified as an independent Controller for a particular activity.

1.2 Advertiser relationships and administration. BCA Labs Corporation is controller for advertiser enquiries and qualification, Account administration, KYB and compliance, contracts, Campaign instructions, invoices, prepayments, refunds, advertiser support, security, and business communications. Public business branding may also be used to identify customer relationships and demonstrate the Service under the limited licence and email opt-out in Section 13.5 of the Advertising Agreement. Company branding is not necessarily Personal Data. Where an asset identifies an individual, the applicable lawful basis, notice and individual rights must be addressed separately; agreement by a corporate Advertiser is not automatically that individual's consent. Opt-out correspondence and suppression records are used to administer and respect the restriction, not to create a new marketing permission.

1.3 Advertiser-supplied campaign data. Where an Advertiser provides personal data or directs Blockchain-Ads to collect conversion or event data solely to deliver, measure, or report that Advertiser's Campaign, the Advertiser is generally controller and BCA Labs Corporation acts as processor under the Data Processing Addendum between the Advertiser and BCA Labs Corporation. BCA Labs Corporation may appoint affiliates and third-party service providers as subprocessors in accordance with that Data Processing Addendum.

1.4 Collection through an advertiser property. Where a Blockchain-Ads pixel, tag, or SDK directly collects data from an Advertiser's property, the Advertiser is responsible for presenting any required notice and consent mechanism. BCA Labs Corporation acts in the role stated in the applicable Data Processing Addendum and may use authorised subprocessors to provide the underlying technology and infrastructure.

1.5 Platform security and service-improvement data. BCA Labs Corporation is Controller where it determines the purposes and essential means of Processing for Account and Platform security, Invalid Traffic detection, fraud prevention, Platform-service analytics and service improvement. Advertiser pixel, conversion and event data used for Campaign delivery, measurement, audience configuration or retargeting is processed on the Advertiser's instructions under the DPA. Blockchain-Ads does not independently use that Advertiser-specific pixel/event data to create Blockchain-Ads-controlled retargeting audiences or cross-client audience products unless separately authorised and lawful.

1.6 Privacy questions and rights requests may be sent to privacy@blockchain-ads.com. The request will be directed to the entity responsible for the relevant processing. Requests sent to contact@blockchain-ads.com may also be routed to the privacy team where appropriate.

2. How We Collect Personal Data

We collect data:

• directly from you when you register, complete verification, fund an Account, configure a Campaign, contact us, attend a call, subscribe, or use the Platform
• automatically from the Platform, advertisements, pixels, tags, SDKs, APIs and server logs
• from Advertisers, Supply Partners, publishers, payment processors, verification providers, fraud-prevention providers, analytics providers, CRM and communication providers, and business partners
• from public sources, including company registries, sanctions and watch lists, professional profiles, and publicly accessible transaction records
• from authorised users, agents, and Connected AI Agents acting for an Account

Information marked as required is needed for the requested Account or function; not providing it may prevent that function from being provided. Other information and permissions are optional where indicated. We explain additional collection at the relevant point of use. Account users must have authority and a lawful basis for third-party Personal Data they provide. This responsibility does not remove Blockchain-Ads' own duties.

3. Personal Data We Use, Purposes and Legal Grounds

Platform and device data. Examples: IP address, browser, operating system, device type, language, referrer, page activity, timestamps, cookie identifiers. Main purposes: operate, secure, analyse and improve the Platform; remember preferences. Typical legal grounds: legitimate interests; consent where required.

Account and contact data. Examples: name, business email, phone, role, employer, username, authentication and access records. Main purposes: create and administer Accounts; provide support and notices; secure access. Typical legal grounds: contract; legitimate interests; legal obligation.

KYB and compliance data. Examples: company, registration and ownership information, identification documents, licences, sanctions screening results. Main purposes: verify customers; prevent fraud and financial crime; meet legal and partner requirements. Typical legal grounds: contract; legal obligation; legitimate interests.

Transaction data. Examples: payment method type, payer, billing details, currency, amount, date, transaction reference, wallet transaction reference. Main purposes: process and reconcile payments, refunds, billing, disputes, and accounting. Typical legal grounds: contract; legal obligation; legitimate interests.

Campaign data. Examples: creatives, targeting, bids, budgets, delivery, impressions, clicks, conversions, attribution and reporting. Main purposes: deliver, optimise, measure, bill, secure, and report Campaigns. Typical legal grounds: contract; legitimate interests; consent where required.

Advertising interaction data. Examples: pseudonymous IDs, IP address, user agent, device/browser, general location, publisher or app context, ad event, timestamp. Main purposes: ad delivery, frequency management, measurement, attribution, audience selection, fraud prevention. Typical legal grounds: legitimate interests; consent where required.

Pixel and event data. Examples: page or app event, conversion event, pseudonymous ID, campaign/referrer, timestamp, device/session data, general location. Main purposes: advertiser-directed conversion measurement, attribution, audience use, retargeting where enabled, and optimisation. Typical legal grounds: Advertiser is Controller and determines the lawful basis, including consent where required; BCA Labs Corporation Processes under the DPA and lawful documented instructions.

Public-source data. Examples: publicly accessible identifiers, transaction records, and behavioural or interest signals. Main purposes: audience modelling, analytics, fraud prevention, and security. Typical legal grounds: legitimate interests, subject to balancing and applicable rights.

Communications. Examples: email, support ticket, call or chat content, meeting records, instructions, feedback, metadata. Main purposes: provide support, maintain business records, train personnel, protect rights, improve service. Typical legal grounds: contract; legitimate interests; consent where required for recording.

Marketing data. Examples: contact details, preferences, engagement with marketing. Main purposes: send requested or permitted marketing and measure effectiveness. Typical legal grounds: consent or legitimate interests, as applicable.

API and agent data. Examples: credentials metadata, prompts, instructions, outputs, actions, access logs. Main purposes: provide automation, execute instructions, security, audit, and service improvement. Typical legal grounds: contract; legitimate interests; consent where required.

We do not intentionally request direct identifiers or special-category/sensitive personal data through advertising pixels. Advertisers must not configure pixels or event fields to send names, email addresses, phone numbers, passwords, financial-account details, health data, precise location, or other sensitive data unless Blockchain-Ads has expressly agreed in writing and a lawful basis and controls are in place.

A reference to contract as a legal ground applies only where the individual is a party to the relevant contract and the processing is necessary for that contract. A contract with an Advertiser is not, by itself, a lawful basis for processing that Advertiser's employees' or end-users' data. For those data, the responsible controller must establish the applicable lawful basis, including consent where required; Blockchain-Ads' processor activities follow the Advertiser's lawful documented instructions under the DPA.

3.1 Current Platform integrations

The Platform currently uses third-party services for analytics and authentication, including Google Analytics 4, Google OAuth and Firebase Authentication where those options are enabled. These services and providers may change as the Platform changes. Using an authentication service does not itself authorise analytics, advertising tracking or access to another connected service.

Platform analytics may Process browser, device, page, session, identifier and interaction information. Non-essential analytics are used only where permitted by applicable law and any required consent. Authentication services Process the information necessary for the login method and permissions selected by the user. Provider-side Processing is governed by the provider's applicable privacy terms.

Current provider information and privacy choices may be presented through the Platform, consent or preference interface, or the provider's own notices. The use of a named provider in this Policy is a current disclosure, not a commitment to retain that provider.

3.2 Connected tag-management and third-party integrations

If an Advertiser connects a supported tag-management or other third-party service, the Platform connects through the provider's authorised API, OAuth or comparable permission process for the account and permissions selected by the Advertiser. Blockchain-Ads does not receive or store the Advertiser's provider password and does not independently control the connected account.

The Advertiser controls whether the connection is enabled and remains responsible for the connected service, permissions, configuration, deployed properties, required notices, consent signals and Campaign instructions. Event data generated by a deployed Blockchain-Ads pixel is Campaign Data governed by the DPA and is separate from account or configuration information used to establish the connection.

Where a connected provider imposes API-specific restrictions, Blockchain-Ads will Process data received through that API in accordance with those applicable restrictions. For Google API user data, the Google API Services User Data Policy and any applicable Limited Use requirements apply. A general Agreement acceptance does not override provider-specific API restrictions.

The Advertiser may revoke a connected service through the provider's controls and any disconnect control made available by the Platform. Revocation stops future authorised access, subject to technical propagation and lawful retention of security or audit records. Tags already published in an Advertiser-controlled environment may require a separate Advertiser action.

3.3 AI and machine-learning use

Blockchain-Ads does not currently use Personal Data or Campaign Data to train or improve general-purpose AI or machine-learning models and does not provide such data to third-party AI providers for their model training. Provider-specific restrictions applicable to connected-service data also apply. If Blockchain-Ads introduces a materially different AI use of Personal Data, it will update the applicable privacy information and obtain any authorisation or consent required by law before that Processing begins.

Advertiser-authorised automation may execute permitted Campaign instructions, but authorising a Connected AI Agent or other integration does not authorise Processing or disclosure beyond the Advertiser's documented instructions, the permissions of the connection and applicable law.

4. Information We May Provide to Third Parties

We may disclose data, limited to what is reasonably necessary, to:

• group companies supporting technology, operations, compliance, finance, or customer service
• Supply Partners and publishers for bidding, delivery, reporting, fraud prevention, and supply-quality purposes
• cloud hosting, content-delivery, analytics, security, customer-support, communications, CRM, and development providers
• identity, KYB, AML, sanctions, fraud-prevention, and verification providers
• banks, acquirers, card schemes, payment processors, collection agents, and cryptocurrency payment providers
• measurement, attribution, brand-safety, and Invalid Traffic vendors
• professional advisers, auditors, insurers, potential transaction counterparties, and financing providers under appropriate confidentiality duties
• authorities, regulators, courts, law enforcement, Supply Partners, or payment partners where disclosure is legally required or reasonably necessary to protect rights, prevent harm, investigate abuse, or comply with binding rules
• an authorised third-party application for a permitted connection, subject to Sections 3.2 and 3.3

We do not sell direct Account contact information for money. Advertising identifiers, network activity and related advertising inferences may be disclosed to advertising and supply partners where necessary for the Platform and Campaigns. Whether a disclosure is a "sale", "sharing" or "targeted advertising" depends on the applicable law and the actual role and purpose of the recipient. A disclosure to a Processor or service provider is not automatically a sale. Provider-specific API and data-use restrictions continue to apply where relevant.

5. Your Data-Protection Rights

Depending on your location and applicable law, you may have rights to:

• be informed about processing
• access personal data
• correct inaccurate data
• delete data
• restrict processing
• receive portable data
• object to processing based on legitimate interests
• withdraw consent without affecting earlier lawful processing
• opt out of direct marketing, targeted advertising, sale, or sharing where applicable
• appeal a denied privacy request where applicable
• complain to a competent data-protection authority

Send privacy requests to privacy@blockchain-ads.com or use a privacy-choice control where one is made available for the relevant right. Blockchain-Ads may verify identity and authority proportionately for access, correction, deletion or portability requests. Opt-outs and legally recognised browser signals do not require the same identity-verification process or creation of an Account where applicable law does not require it. Information requested to identify a preference or verify a request is used only to handle and secure that request. Rights are subject to applicable exceptions, including necessary legal retention, security and legal claims. Where we decline a request, we explain the applicable reason and any available review or appeal route.

Where Blockchain-Ads acts only as processor for an Advertiser, we may direct the request to that Advertiser or assist it under the applicable Data Processing Addendum.

Where applicable US state law grants sale, sharing or targeted-advertising opt-outs, use the privacy-choice control made available with the relevant service or email privacy@blockchain-ads.com. We honour legally required browser or device opt-out signals, including Global Privacy Control where applicable, and do not require an Account merely to exercise those rights. Requests to exercise rights are handled within applicable statutory periods, subject to lawful extensions and verification; the Agreement's commercial claim deadlines do not shorten them. You may use an authorised agent where permitted and ask the same privacy address to review a denied request where an appeal right applies. We do not unlawfully discriminate because you exercise a privacy right.

5.1 Further information for users in the European Union and United Kingdom

Where EU or UK GDPR applies, you may request access, correction, deletion, restriction and portability, withdraw consent, and object to processing on the applicable grounds. Consent withdrawal does not affect earlier lawful processing. You may object to direct marketing at any time without giving a reason. For other legitimate-interest processing, you may object on grounds relating to your circumstances. We can explain the relevant lawful basis, whether data is required and the consequences of not supplying it.

Requests are handled within the periods and subject to the verification, extension, fee and exception rules required by applicable EU or UK data-protection law. Where required, Blockchain-Ads communicates corrections, deletion or restrictions to recipients and provides relevant recipient information. Individuals may complain to the competent supervisory authority and may exercise rights concerning automated decisions where the statutory conditions are met.

5.2 US state privacy rights

Where an applicable US state privacy law applies, qualifying consumers may have rights to access or know about Personal Data, obtain a portable copy, correct or delete data, limit certain uses of sensitive information, and opt out of sale, sharing, targeted advertising or certain profiling. Applicable law may also provide authorised-agent, appeal and non-discrimination rights. Sections 2 to 4 describe the main categories, sources, purposes and recipients of Personal Data, and Section 7 describes retention.

Where required, Blockchain-Ads provides a privacy-choice or "Do Not Sell or Share" mechanism and honours legally recognised browser or device opt-out signals, including Global Privacy Control where applicable. An Account is not required solely to exercise an opt-out where applicable law does not require one. Blockchain-Ads does not knowingly sell or share the Personal Data of children in circumstances prohibited by applicable law.

Requests may be sent to privacy@blockchain-ads.com and are handled under the verification, timing, frequency, extension and appeal rules of the applicable law. Blockchain-Ads may request information reasonably necessary to verify a request, but uses that information only to handle and secure the request. Applicable legal exceptions, retention duties and regulator complaint rights remain available.

6. International Transfers

Blockchain-Ads operates globally. Personal Data may be Processed in countries where BCA Labs Corporation, its authorised service providers, Subprocessors or other permitted recipients operate. Processing locations and providers may change over time. Where a particular transfer requires a recognised transfer mechanism or other safeguard, the applicable DPA, transfer terms and legal requirements govern that transfer. The Privacy Policy does not commit Blockchain-Ads to a particular cloud provider, data centre, country or hosting region.

Where required, we use recognised safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, contractual protections, and supplementary technical and organisational measures.

You may contact privacy@blockchain-ads.com for information about applicable transfer safeguards.

7. Retention and Deletion

We retain data only as long as reasonably necessary for the purposes described, including contractual, security, accounting, tax, dispute, regulatory, and legal requirements.

Retention is determined by the purpose, legal requirements and operational need. In particular:

• auction and ad-delivery logs, excluding Advertiser pixel and conversion-event data: retained for the period reasonably necessary for delivery, billing, reconciliation, fraud and Invalid Traffic controls, security, dispute handling and legal obligations
• pixel, conversion-event and wallet-related Campaign Data collected through Advertiser-controlled pixels or integrations: up to 12 months from collection, unless deletion is required earlier or lawful retention is required longer for a documented legal, security or dispute purpose
• security, Invalid Traffic, consent-evidence and dispute-support records: retained for the period reasonably necessary for those purposes and applicable legal requirements
• Account, contract, acceptance, payment, invoice and compliance records: retained for the relationship and afterwards for the period reasonably required for accounting, tax, compliance, legal claims and applicable law
• support and business communications: retained for the period reasonably necessary for support, business records, claims and compliance
• consent and suppression records: as long as necessary to demonstrate and respect the choice
• aggregated or irreversibly de-identified data: may be retained without a fixed limit

Advertiser pixel, conversion, audience-event and wallet-related Campaign Data is retained for up to 12 months as stated above. Other Platform records may follow different retention criteria based on their purpose and applicable law. Cookies or identifiers used only for Platform operation may expire sooner according to their configured lifetime. Revoked third-party permissions are no longer used for access, subject to technical propagation and lawful retention of security or audit records.

At the end of the applicable period, data is deleted, securely destroyed, or irreversibly de-identified. An expiry date does not remove rights over copies or other personal data still retained. Any legal hold is limited to its justified purpose; a provider's separate retention cycle does not authorise indefinite retention by Blockchain-Ads.

8. Collection and Processing of End-User Data

8.1 When an advertisement is requested or delivered, or when an Advertiser enables a Blockchain-Ads pixel or Campaign integration on its property, Blockchain-Ads may receive Campaign Data such as cookie or device identifiers, IP address, user agent, device/browser information, general location, publisher or application context, auction information, timestamps, impressions, clicks, conversion signals and, where the Advertiser enables them, wallet-related events or wallet or wallet-derived identifiers.

8.2 Blockchain-Ads Processes Campaign Data to participate in auctions, deliver and frequency-manage advertisements, measure results, attribute conversions, protect security and detect Invalid Traffic under the roles described in this Policy and the DPA. Where an Advertiser enables retargeting or creates an audience using its pixel/event data, the Advertiser determines that Campaign purpose and audience configuration and BCA Labs Corporation Processes the resulting Campaign Data on the Advertiser's documented instructions. Blockchain-Ads does not independently convert Advertiser pixel/event data into Blockchain-Ads-controlled retargeting audiences. Where consent is required, neither legitimate interests nor the Advertiser's signature replaces that consent.

8.3 Supply Partners and publishers are responsible for notices and choices required on the properties they control. Advertisers are responsible for notices, consent, and instructions relating to their properties, pixels, event data, customer lists, and Campaigns.

8.4 Blockchain-Ads may use lawfully obtained public-source data for audience modelling, analytics, fraud prevention, and security. Public availability does not necessarily make information anonymous; data that can reasonably be linked to an individual is handled as personal data where applicable law requires.

8.5 The Service is not directed to children. Advertisers and Supply Partners must not knowingly provide data about children or target children contrary to applicable law. If we learn that we processed such data unlawfully, we will take appropriate steps to delete or restrict it.

9. Confidentiality and Security

We use technical and organisational safeguards appropriate to the nature and risk of the data, which may include encryption in transit and at rest, authentication, access controls, least-privilege practices, environment segmentation, logging, monitoring, vulnerability management, incident response, and confidentiality obligations.

No online system is completely secure. Account users are responsible for secure passwords, multi-factor authentication where available, API credentials, authorised-user access, and prompt notification of suspected compromise.

10. Platform Cookies and Similar Technologies

The Platform uses cookies, local storage and similar technologies for authentication, security, preferences, Platform analytics and functionality. Those Platform technologies are separate from Blockchain-Ads pixels, tags or server-to-server tools that an Advertiser chooses to deploy on properties it controls. Non-essential Platform technologies are used only with consent where consent is required.

For Platform cookie details and choices, see the Cookie Policy. Where consent is required for non-essential Platform technologies, the relevant Platform interface presents a consent or preference control. Advertiser-deployed pixels are governed by the Advertiser's own property notices and consent choices, together with the DPA; signing the Advertising Agreement or acknowledging this Policy is not end-user consent to those tools.

11. Changes to This Privacy Policy

We may update this Policy from time to time and will publish the revised version and effective date. Where applicable law requires additional notice, authorisation or consent for a materially different Processing activity, Blockchain-Ads will follow that requirement before the new Processing begins. Publishing a revision is not, by itself, consent where consent is legally required.

12. Contacts

Company and Platform contact: BCA Labs Corporation, Intershore Chambers, P.O. Box 4342, Road Town, Tortola, British Virgin Islands. Privacy requests concerning the Platform: privacy@blockchain-ads.com. Legal contact: legal@blockchain-ads.com. A request received through another Blockchain-Ads contact may be routed where reasonably practicable.

Where Article 27 EU GDPR or Article 27 UK GDPR requires a company identified in this Policy to appoint a representative, that company must appoint one and publish the representative's contact details in this Policy before beginning the affected processing. This Policy is not a substitute for a required appointment.

Individuals in the EEA or UK may complain to the supervisory authority in their country of residence, place of work, or place of the alleged infringement.

Definitions

Personal Data means information relating to an identified or identifiable individual. Controller means the entity that determines the purposes and essential means of Processing; Processor means a party that Processes Personal Data on a Controller's behalf. References to the Platform mean the Blockchain-Ads advertising platform and technology defined in the Advertising Agreement. Cookies and similar technologies include cookies, identifiers, pixels, tags, local storage and comparable recognition technologies. Statutory definitions and protections prevail where applicable.