Privacy Policy.

This Privacy Policy explains how Arvo Protocol (“Arvo”, “we”, “us” or “our”) collects, uses, stores and protects personal information when you visit arvoprotocol.com, contact us, subscribe to communications or interact with Arvo’s websites, applications and services.

This policy applies to information collected through the Arvo website and any related digital services that link to this policy.

Arvo may update this policy as the protocol, its services and its legal or operational structure develop. The latest version will always be published on this page.

The information we collect depends on how you interact with Arvo. It may include:

• Identity information, such as your name, job title or organisation.
• Contact information, such as your email address, telephone number or other details you provide when contacting us.
• Enquiry information, including messages, correspondence, feedback and other information submitted through forms or sent directly to us.
• Technical information, such as your IP address, browser type, device information, operating system, referring URLs and general website usage data.
• Usage information, including pages viewed, interactions, approximate visit duration and navigation through the website.
• Communication preferences, including whether you have asked to receive or stop receiving particular communications.
• Wallet information, such as a public blockchain address, where you choose to connect a compatible wallet to an Arvo application.

We do not ask you to provide wallet private keys, seed phrases or recovery phrases. You should never disclose this information to us or to anyone claiming to represent Arvo.

We may collect information:

• directly from you when you contact us or submit a form;
• when you subscribe to updates or request information about Arvo;
• automatically when you access or interact with our website or applications;
• when you connect a digital wallet to an Arvo application; and
• from service providers that help us operate, secure and understand the use of our services.

Information recorded on a public blockchain may also be publicly accessible. Blockchain records are not created or controlled solely by Arvo and may not be capable of being altered or deleted.

We may use personal information to:

• operate, maintain and improve the Arvo website and applications;
• respond to enquiries, requests and correspondence;
• provide information that you have requested;
• manage subscriptions and communication preferences;
• understand how visitors use our websites and improve performance, content and usability;
• protect our systems, users and services against fraud, misuse, security incidents and unlawful activity;
• establish, exercise or defend legal rights and comply with legal obligations;
• support governance, staking or other protocol functionality where those services become available; and
• carry out other purposes that we clearly explain when information is collected.

We will not sell your personal information to third parties for their own marketing purposes.

Where UK data protection law applies, we rely on one or more lawful bases when processing personal information. These may include:

• Legitimate interests, where processing is necessary to operate, improve, secure or communicate about Arvo and those interests are not overridden by your rights.
• Consent, where you have freely given permission for a particular use, such as certain marketing communications or non-essential cookies.
• Contract, where processing is necessary to take steps at your request or provide a service under an agreement.
• Legal obligation, where we need to process information to comply with applicable law or regulation.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Arvo may use cookies and similar technologies to operate the website, remember preferences, protect the website and understand how visitors interact with it.

These technologies may include:

• Strictly necessary technologies required for security, core functionality or network management.
• Preference technologies that remember choices or settings.
• Analytics technologies that help us understand traffic, performance and use of the website.

Where required, non-essential cookies or similar technologies will not be used unless you have provided the necessary consent. You can also manage cookies through your browser settings, although disabling certain technologies may affect website functionality.

We may share personal information with trusted organisations that provide services to Arvo, including:

• website hosting and infrastructure providers;
• security, monitoring and fraud-prevention providers;
• analytics and website-performance providers;
• email, communications and customer-support providers;
• professional advisers, including lawyers and accountants;
• companies within the Arvo organisational structure, where necessary for legitimate operational purposes; and
• regulators, authorities, courts or other parties where disclosure is required by law or necessary to protect legal rights.

Service providers are permitted to process personal information only for the purposes for which it has been provided and subject to appropriate contractual and security obligations.

We may also transfer relevant information as part of a restructuring, merger, acquisition, financing arrangement or transfer of all or part of the Arvo project or its operations.

Arvo and some of its service providers may operate across different countries. This means personal information may be accessed, processed or stored outside the country in which you are located.

Where applicable law requires additional protection for an international transfer, we will use an appropriate safeguard. This may include an adequacy regulation, approved contractual provisions or another legally recognised transfer mechanism.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to satisfy legal, regulatory, accounting, security or reporting requirements.

The appropriate retention period depends on the nature and sensitivity of the information, the purpose for which it is used, the risk associated with retaining it and any applicable legal obligations.

Public blockchain information may remain available indefinitely due to the permanent and decentralised nature of blockchain networks. Arvo may be unable to modify or erase information recorded directly on a public blockchain.

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or misuse.

However, no website, network, storage system or method of transmission can be guaranteed to be completely secure. You should take appropriate steps to protect your own devices, accounts and wallet credentials.

Arvo will never ask you to send a private key, seed phrase or wallet recovery phrase.

Depending on your location and the law that applies, you may have the right to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information in certain circumstances;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• receive certain information in a structured, commonly used and machine-readable format; and
• complain to an applicable data-protection authority.

These rights are not absolute and may be subject to legal limitations. We may need to verify your identity before responding to a request.

Rights relating to correction or deletion may not be technically enforceable against data recorded directly on a public blockchain. We will nevertheless consider any request relating to information controlled by Arvo.

We may send you updates where you have requested them, consented to receive them or where another lawful basis permits us to do so.

You can unsubscribe from marketing emails at any time by using the unsubscribe link included in the communication or by contacting us. We may retain limited information necessary to record and respect your opt-out request.

Our website may contain links to third-party websites, social media platforms, wallet providers, blockchain explorers or other services. Those services operate independently and have their own privacy policies and practices.

Arvo is not responsible for the content, availability, security or privacy practices of external websites and services. You should review the relevant privacy information before providing personal information to a third party.

Arvo’s website and services are not directed at children. We do not knowingly collect personal information from anyone under the age of 18.

Please contact us if you believe a child has provided personal information through an Arvo service so that we can investigate and take appropriate action.

Questions, requests or concerns about this Privacy Policy or our use of personal information can be submitted through the Arvo contact page.

We encourage you to contact us first so that we have an opportunity to address your concern.

Where UK data protection law applies, you may also have the right to complain to the Information Commissioner’s Office or another applicable supervisory authority.