AML CRYPTO LLC PERSONAL DATA PROCESSING POLICY

1.1. This AML Crypto LLC Personal Data Processing Policy, hereinafter referred to as the “Policy,” establishes the procedures and conditions governing the processing of personal data by AML Crypto Limited Liability Company.

1.2. Details of the personal data controller:

AML Crypto Limited Liability Company

• abbreviated name: AML Crypto LLC;
• Taxpayer Identification Number (INN): 9731092966;
• Primary State Registration Number (OGRN): 1227700289695;
• registered address: 42, Building 1, Bolshoy Boulevard, Skolkovo Innovation Center Territory, Mozhaysky Municipal District, Moscow, 121205, Russian Federation;
• email address for personal data enquiries: legal@amlcrypto.io;
• email address for general and customer enquiries: info@amlcrypto.io.

AML Crypto LLC is hereinafter referred to as the “Controller” or the “Company.”

1.3. This Policy applies to personal data processing carried out through:

• the website available at https://amlcrypto.io, including its language versions and individual webpages;
• the Btrace service available at https://btrace.amlcrypto.io;
• the Btrace Telegram bot @AMLCryptobot;
• contact and enquiry forms;
• user accounts;
• email;
• telephone communications;
• Telegram, WhatsApp, MAX, VKontakte, and other communication channels officially used by the Company;
• the customer relationship management system;
• software interfaces, including APIs;
• payment and analytics systems;
• other information systems used by the Company.

1.4. This Policy does not replace:

• consent to the processing of personal data;
• consent to receive advertising communications;
• consent to the public dissemination of personal data;
• the Terms of Use;
• the Cookie Policy;
• any agreement with a customer or counterparty.

Such documents and consents shall be executed separately where required by law or by the nature of the processing.

1.5. This Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data,” and other applicable laws and regulations of the Russian Federation.

1.6. This Policy is publicly available and shall be published on the Company’s online resources through which personal data is collected.

2.1. The following definitions apply for the purposes of this Policy:

Personal Data means any information relating directly or indirectly to an identified or identifiable individual.

Data Subject means the individual to whom the personal data relates.

Personal Data Processing means any operation or set of operations performed on personal data, whether or not by automated means.

Automated Processing means personal data processing performed using computer technology.

Provision of Personal Data means an action intended to disclose personal data to a specific person or a specific group of persons.

Dissemination of Personal Data means an action intended to disclose personal data to an indefinite group of persons.

Restriction of Personal Data Processing means the temporary suspension of personal data processing, except where processing is required to verify or correct the personal data.

Destruction of Personal Data means actions that make it impossible to restore the contents of personal data within an information system or that destroy the physical media containing such data.

Anonymisation of Personal Data means actions that make it impossible to determine, without using additional information, whether personal data relates to a particular Data Subject.

Cross-Border Transfer means the transfer of personal data to the territory of a foreign country, to a foreign public authority, foreign individual, or foreign legal entity.

Cookies means small data files stored by a browser or device when an online resource is accessed.

2.2. A cryptocurrency address, transaction hash, or other blockchain information does not necessarily constitute Personal Data in isolation. The Company shall treat such information as Personal Data where, together with other available information, it relates to a directly or indirectly identified or identifiable individual.

3.1. The Company processes Personal Data in accordance with the following principles:

• lawfulness and fairness;
• processing only for specific, predetermined, and lawful purposes;
• prohibition of processing incompatible with the original purposes of collection;
• prohibition of combining databases processed for incompatible purposes;
• compliance of the scope and content of Personal Data with the stated processing purposes;
• prohibition of excessive processing;
• ensuring that Personal Data is accurate, sufficient, and up to date;
• retaining Personal Data no longer than required by the processing purposes or applicable law;
• destroying or anonymising Personal Data once the processing purposes have been achieved, unless another lawful basis for retention applies;
• ensuring the confidentiality and security of Personal Data.

3.2. The Company does not use Personal Data for hidden purposes or purposes incompatible with those stated when the Personal Data was collected.

3.3. The mere technical ability to obtain certain information does not mean that the Company may process it without a defined purpose and lawful basis.

4.1. The Company may process Personal Data relating to the following categories of Data Subjects:

• Website visitors;
• Btrace users;
• Btrace Telegram bot users;
• customers and prospective customers;
• individuals purchasing Services;
• representatives of legal entities and individual entrepreneurs;
• representatives of public authorities and law enforcement agencies;
• persons submitting enquiries through forms, email, or messaging services;
• persons requesting technical support;
• API users;
• payers;
• job applicants;
• authors of reviews and other materials;
• employees and representatives of counterparties;
• persons whose information is contained in blockchain investigation materials;
• other persons whose Personal Data has been lawfully provided to the Company.

4.2. This Policy does not govern the internal processing of Personal Data relating to the Company’s employees, except where such Personal Data is collected through the Company’s publicly available online resources.

5.1. Website Visitors

The Company may process:

• IP address;
• date and time of access;
• browser and operating system information;
• device type;
• technical identifiers;
• referral source;
• pages viewed;
• duration and sequence of actions;
• information about interaction with the interface;
• cookie data;
• approximate location determined from technical data;
• information about errors and Website performance.

Analytics data shall be processed in accordance with the choice made by the user through the cookie management mechanism.


5.2. Users of Contact and Enquiry Forms

Depending on the relevant form, the Company may process:

• first name;
• surname, where provided;
• email address;
• telephone number;
• username or account identifier in a messaging service;
• organisation name;
• job title;
• preferred communication method;
• contents of the enquiry;
• information voluntarily entered in a free-text field;
• attached documents and files;
• technical information relating to the submission of the form;
• date, time, and source of the enquiry;
• information concerning the consent provided.

5.3. Btrace Users

The Company may process:

• username;
• email address;
• password hash and other authentication information;
• internal Account identifier;
• IP address;
• browser and device information;
• registration date and subsequent login dates;
• history of actions performed within the Account;
• selected Tariffs;
• number of Screenings purchased and used;
• payment history;
• payment identifiers;
• information concerning generated Reports;
• cryptocurrency addresses and transaction hashes submitted for Screening;
• customer support enquiry history;
• security logs;
• information concerning the version of the Terms of Use accepted and the consents provided.

5.4. Btrace Telegram Bot Users

The Company may process:

• Telegram ID;
• first name and surname displayed in Telegram;
• Telegram username;
• interface language;
• contents of commands and enquiries;
• information concerning Screenings purchased and used;
• cryptocurrency addresses and transaction hashes;
• Screening results;
• technical data concerning interaction with the bot.

5.5. Payers

The Company may process information received from payment service providers, including:

• payer’s name, where transmitted;
• contact details required for issuing and delivering a payment receipt;
• payment amount and currency;
• payment date and time;
• transaction status;
• payment identifier;
• selected Service or Tariff;
• refund information;
• other information required to record the payment and perform the agreement.

The Company does not receive or store the full bank card number, card security code, or other information entered directly through the secure interface of a payment service provider, unless otherwise required by the relevant payment method.


5.6. Customers Using Blockchain Investigation and Other Individual Services

The Company may process:

• first name, surname, and patronymic;
• contact details;
• country and city of residence or location;
• organisation name and job title;
• documents confirming the circumstances of the enquiry;
• payment information;
• contents of correspondence;
• recordings of communications, where such recordings are made on a lawful basis;
• cryptocurrency addresses;
• transaction hashes;
• information concerning digital assets;
• identifiers of accounts held with exchanges and other services;
• screenshots, statements, and other materials;
• information relating to representatives and other persons involved in the interaction;
• information required to perform the agreement and prepare the agreed deliverables.

5.7. Third-Party Data Contained in Investigation Materials

Materials provided by a customer and information lawfully obtained from other sources may include:

• names and pseudonyms;
• contact details;
• usernames;
• account information;
• cryptocurrency addresses;
• transaction hashes and transaction details;
• IP addresses;
• device information;
• information concerning interactions with exchanges and other services;
• documents, correspondence, and images;
• information from public sources;
• other information directly related to the subject matter of an investigation.

The Company may refuse to process or may delete information that is clearly unrelated to the purpose of the investigation, is excessive, or has been provided without a lawful basis.


5.8. Representatives of Organisations and Public Authorities

The Company may process:

• first name, surname, and patronymic;
• job title;
• name of the organisation or public authority;
• business contact details;
• information confirming authority to act;
• contents of business correspondence;
• information contained in documents and requests relating to the interaction.

5.9. Job Applicants

Where a vacancy application form is active, the Company may process:

• first name, surname, and patronymic;
• contact details;
• information contained in a résumé;
• educational background;
• professional experience and qualifications;
• portfolio;
• position applied for;
• salary expectations;
• contents of correspondence;
• interview results and professional assessment results;
• other information voluntarily provided by the applicant.

5.10. Reviews and Public Materials

Where a separate lawful basis exists, the Company may process:

• the author’s name or pseudonym;
• job title and organisation name;
• photograph;
• organisation logo;
• review text;
• audio or video materials;
• other information authorised by the Data Subject for publication.

Personal Data shall not be published merely because the user previously provided it to the Company.

6.1. Operation of Websites and Information Systems

Purposes:

• ensuring availability and proper operation;
• identifying errors;
• preventing attacks and misuse;
• maintaining information security;
• keeping technical logs.

Data: technical information, IP addresses, session identifiers, device information, and information concerning user activity.

Legal bases: the Company’s legitimate interests, compliance with information security obligations, and user consent where required.


6.2. Processing Enquiries and Applications

Purposes:

• receiving and reviewing an enquiry;
• contacting the user;
• providing information;
• preparing a proposal;
• conducting negotiations;
• entering into an agreement at the Data Subject’s request.

Data: name, contact details, contents of the enquiry, organisation, job title, and attached materials.

Legal bases: consent of the Data Subject, actions taken at the Data Subject’s request before entering into an agreement, performance of an agreement, and the Company’s legitimate interests.


6.3. Registration and Use of Btrace

Purposes:

• creating and maintaining an Account;
• authentication;
• providing functionality;
• recording purchased and used Screenings;
• generating and storing Reports;
• ensuring security;
• providing user support.

Legal bases: entering into and performing an agreement, consent where selected as the legal basis, the Company’s legitimate interests, and compliance with statutory obligations.


6.4. Processing Payments

Purposes:

• accepting and recording payments;
• confirming payment;
• providing the Service;
• issuing refunds;
• preparing payment, accounting, and tax documentation;
• complying with tax obligations.

Legal bases: entering into and performing an agreement and complying with statutory obligations imposed on the Company.


6.5. Blockchain Investigations

Purposes:

• assessing whether a matter may be accepted;
• entering into and performing an agreement;
• analysing the movement of digital assets;
• preparing reports;
• identifying known links between addresses and services;
• preparing information for communications with virtual asset service providers, asset issuers, public authorities, and other persons;
• protecting the rights and legitimate interests of the customer or the Company;
• investigating potentially unlawful conduct.

Legal bases: performance of an agreement, actions taken at the Data Subject’s request before entering into an agreement, consent of the Data Subject, legitimate interests of the Company or third parties provided that the Data Subject’s rights are not infringed, compliance with statutory obligations, and other applicable lawful bases.


6.6. Technical and Customer Support

Purposes:

• responding to enquiries;
• restoring access;
• resolving errors;
• resolving disputes;
• monitoring service quality.

Legal bases: performance of an agreement, consent, and the Company’s legitimate interests.


6.7. Prevention of Fraud and Breaches

Purposes:

• detecting misuse;
• reviewing suspicious activity;
• preventing unauthorised access;
• protecting the Company, users, and third parties;
• preserving evidence relating to incidents.

Legal bases: legitimate interests of the Company and third parties and compliance with statutory requirements.


6.8. Responding to Data Subject Requests

Purposes:

• identifying the applicant;
• providing information;
• correcting, restricting, or destroying Personal Data;
• processing withdrawal of consent;
• complying with statutory requirements.

Legal bases: compliance with the Controller’s obligations under applicable law.


6.9. Recruitment

Purposes:

• considering an application;
• communicating with the applicant;
• conducting interviews;
• making a recruitment decision;
• including the applicant in a candidate pool where a separate lawful basis exists.

Legal bases: the applicant’s consent, actions taken at the applicant’s request before entering into an employment agreement, and compliance with applicable law.


6.10. Advertising Communications

The Company does not currently use contact details obtained from ordinary enquiries for advertising communications without separate prior consent.

Where advertising communications by email, telephone, or messaging services are introduced, Personal Data shall be processed only on the basis of separate consent, which the user may withdraw.


6.11. Protection of Rights and Dispute Resolution

Purposes:

• confirming contractual relationships;
• processing complaints and claims;
• recovering debts;
• protecting rights in court;
• interacting with public authorities;
• conducting internal reviews.

Legal bases: the Company’s legitimate interests, performance of an agreement, and compliance with statutory requirements.

7.1. The Company shall retain Personal Data no longer than is necessary for the relevant processing purposes, unless a longer retention period is established by law or an agreement.

7.2. The following retention periods shall apply to the Company’s principal processing activities:

7.3. Where Personal Data relates to court, administrative, or criminal proceedings, a complaint, inspection, security incident, or binding request from a public authority, the relevant Personal Data may be retained until the relevant matter has been finally resolved.

7.4. Personal Data contained in backups shall be removed from active processing and deleted in accordance with the applicable backup rotation cycle, but no later than 90 calendar days after deletion from the primary information system, unless a different period is justified by technical or legal requirements.

7.5. The stated retention periods must correspond to the actual settings of the CRM system, email systems, Btrace, servers, backup systems, and other Company systems.

8.1. The Company may carry out automated, non-automated, and mixed Personal Data processing.

8.2. The Company may perform the following operations:

• collection;
• recording;
• organisation;
• accumulation;
• storage;
• clarification;
• updating;
• modification;
• retrieval;
• use;
• matching;
• analysis;
• transfer;
• provision;
• access;
• anonymisation;
• restriction;
• deletion;
• destruction.

8.3. Personal Data shall not be disseminated without a separate lawful basis and, where required, separate consent to dissemination.

9.1. The Company may obtain Personal Data:

• directly from the Data Subject;
• through Website forms;
• during Btrace registration;
• through the Telegram bot;
• by email;
• through messaging services;
• during negotiations and performance of an agreement;
• from the Data Subject’s representatives;
• from a customer submitting investigation materials;
• from payment service providers;
• from publicly available sources;
• from public blockchains;
• from virtual asset service providers, asset issuers, public authorities, and other persons on a lawful basis;
• from contractors and information systems used by the Company.

9.2. Where Personal Data is obtained from a person other than the Data Subject, the Company shall verify the existence of an applicable lawful basis to the extent reasonably necessary, taking into account the nature and purpose of the processing.

9.3. A customer providing Personal Data relating to third parties must have a lawful basis for such disclosure. This requirement does not release the Company from its own obligations as a Controller or as a party processing Personal Data on behalf of another Controller.

10.1. The Company may engage third parties in connection with the operation of the Website and provision of the Services.

10.2. Categories of such third parties may include:

• cloud and server infrastructure providers;
• the operator of the Tilda platform;
• the operator of the amoCRM system;
• corporate email service providers;
• technical support providers;
• payment and acquiring service providers, including the payment providers currently used by the Company;
• Yandex Metrica and related tools;
• Google Analytics;
• operators of Telegram, WhatsApp, MAX, and VKontakte;
• developers and technical contractors;
• accounting, legal, and audit advisers;
• information security service providers;
• public authorities and law enforcement agencies;
• exchanges, exchange services, digital asset issuers, and other organisations to which information is lawfully disclosed in connection with the provision of Services.

10.3. The specific recipients involved shall depend on the relevant resource, communication channel, payment method, and nature of the Service.

10.4. Where a third party processes Personal Data on the Company’s behalf, the relevant agreement or other legally binding terms shall specify:

• processing purposes;
• categories of Personal Data;
• permitted processing operations;
• confidentiality obligations;
• data localisation requirements;
• security measures;
• incident notification procedures;
• procedures for returning or deleting Personal Data;
• the obligation to demonstrate compliance with applicable law.

10.5. Certain services may act as independent personal data controllers. In such cases, they process Personal Data in accordance with their own policies and applicable law.

10.6. The Company does not sell Personal Data.

11.1. Where a user follows a link to Telegram, WhatsApp, MAX, or VKontakte and initiates a conversation, the relevant service independently receives the user’s technical and account information.

11.2. The user independently selects the communication channel. Use of a foreign messaging service may result in Personal Data being processed outside the Russian Federation.

11.3. The contents of correspondence may be retained:

• within the relevant messaging service;
• in amoCRM;
• in corporate email systems;
• in other Company systems required to process the enquiry.

11.4. Users should not submit excessive Personal Data, identity documents, special categories of Personal Data, or other sensitive materials through messaging services unless the Company has expressly requested that such materials be submitted through a secure channel.

12.1. The Company’s Websites may use:

• strictly necessary cookies;
• functional cookies;
• analytics cookies;
• Yandex Metrica technologies;
• Webvisor;
• retargeting tools;
• Google Analytics;
• other technologies disclosed to the user.

12.2. Strictly necessary technologies may be used without a separate user choice to the extent necessary to operate the Website, maintain security, and perform an action expressly requested by the user.

12.3. Analytics, advertising, and other non-essential technologies shall be activated only after active consent has been obtained where such consent is required as the applicable legal basis.

12.4. The user shall be able to:

• accept non-essential cookies;
• reject them;
• select individual categories;
• change a previous choice;
• withdraw consent.

12.5. Detailed information concerning cookies, their duration, and the services used shall be provided in the separate Cookie Policy.

12.6. Google Analytics may be used only where the applicable requirements relating to data localisation, Cross-Border Transfers, user information, and consent have been satisfied.

13.1. When collecting Personal Data relating to citizens of the Russian Federation through the internet, the Company shall ensure that the recording, organisation, accumulation, storage, clarification, and retrieval of such Personal Data is performed using databases located in the Russian Federation, except where an exemption established by law applies.

13.2. The Company’s Btrace servers, Account databases, Telegram bot databases, and webhook infrastructure are hosted within Russian infrastructure.

13.3. Before introducing a new service, the Company shall determine:

• what Personal Data the service receives;
• where its servers are located;
• whether Personal Data is initially recorded outside Russia;
• whether a Cross-Border Transfer takes place;
• whether the notification filed with Roskomnadzor must be amended;
• whether the service complies with the Company’s security requirements.

14.1. The use of Google Analytics, Telegram, WhatsApp, and certain foreign information services may result in Cross-Border Transfers of Personal Data.

14.2. Before commencing a Cross-Border Transfer, the Company shall:

• identify the categories of Personal Data and Data Subjects involved;
• determine the purposes and lawful bases of the transfer;
• obtain the required information from the foreign recipient;
• assess the applicable level and conditions of protection;
• submit the required notification to Roskomnadzor;
• implement organisational and technical measures;
• obtain separate consent where required.

14.3. The Company shall not carry out a Cross-Border Transfer where it has been prohibited or restricted by the competent authority or where no lawful basis for the transfer can be established.

14.4. Details of foreign analytics services and cookies shall additionally be provided in the Cookie Policy.

15.1. The Company does not intentionally collect special categories of Personal Data through standard Website forms or Btrace registration.

15.2. The Company does not use images, voice recordings, or other physiological or biological characteristics to establish a person’s identity and does not intentionally process biometric Personal Data as part of its standard activities.

15.3. Investigation materials and free-form correspondence may unintentionally contain sensitive information.

15.4. Where such information is received, the Company shall:

• restrict access;
• assess whether continued processing is necessary and lawful;
• delete excessive information;
• request an additional legal basis or consent where required;
• discontinue processing where no lawful basis exists.

15.5. Users should not submit special categories of Personal Data or biometric Personal Data without prior agreement with the Company.

16.1. Paid Services and Btrace registration are intended for persons aged 18 or over.

16.2. The Company does not intentionally collect Personal Data relating to minors through its standard processes.

16.3. Where the Company determines that Personal Data relating to a minor has been submitted without a proper lawful basis, processing shall be discontinued and the Personal Data shall be destroyed unless another lawful basis applies.

17.1. Btrace automatically analyses submitted cryptocurrency addresses and transactions and generates analytical risk indicators.

17.2. A generated risk indicator does not constitute a Company decision that produces legal consequences for the owner of the relevant address.

17.3. The Company does not make decisions concerning a Data Subject that produce legal consequences or otherwise materially affect the Data Subject’s rights solely on the basis of automated processing, except where expressly permitted by law.

17.4. Btrace users must independently assess the results and carry out additional verification where necessary.

18.1. The Company implements the necessary and sufficient organisational, legal, and technical measures to protect Personal Data.

18.2. Such measures include:

• appointing a person responsible for organising Personal Data processing;
• adopting internal policies and procedures;
• defining processing purposes and categories of Personal Data;
• restricting and allocating access rights;
• using authentication controls;
• keeping records of persons with access;
• monitoring the actions of information system users;
• protecting data transmission channels;
• maintaining backups;
• using anti-malware protection and managing software updates;
• detecting and responding to incidents;
• assessing potential harm and security threats;
• monitoring contractors;
• training employees;
• revoking access following termination of employment or changes in duties;
• conducting internal compliance monitoring.

18.3. Access shall be granted only to employees and contractors who require it to perform their employment or contractual duties.

18.4. Details of specific security configurations may not be disclosed where disclosure could reduce the security of the Company’s information systems.

19.1. A Data Subject has the right to:

• receive information concerning the processing of their Personal Data;
• request correction of incomplete, outdated, or inaccurate Personal Data;
• request restriction or destruction of Personal Data that has been unlawfully obtained or is no longer required for the stated purpose;
• withdraw consent;
• object to processing where provided by law;
• request that advertising communications be discontinued;
• challenge the Company’s actions before Roskomnadzor or a court;
• protect their rights and seek compensation in accordance with law;
• receive information concerning persons to whom Personal Data may be disclosed;
• receive information concerning Cross-Border Transfers and automated processing to the extent provided by law.

19.2. Withdrawal of consent does not automatically require the destruction of all Personal Data. The Company may continue processing where another lawful basis applies, including performance of an agreement, accounting requirements, protection of legal rights, or compliance with statutory obligations.

20.1. Personal Data enquiries and requests may be submitted:

• by email to legal@amlcrypto.io;
• by post to the Company’s registered address.

20.2. A request should include:

• the applicant’s first name, surname, and patronymic;
• contact information for the response;
• information enabling the Company to identify the applicant’s interaction with the Company;
• the relevant Account, email address, agreement number, or enquiry number;
• the substance of the request;
• documents confirming the representative’s authority where the request is submitted by a representative.

20.3. Requests for information under Article 14 of Federal Law No. 152-FZ must comply with statutory requirements and allow the Company to reliably identify the applicant.

20.4. The Company shall not require a copy of a passport to be sent through ordinary email where identity and authority can reasonably be verified through a less risky method.

20.5. The Company may request additional information where necessary to identify the applicant or prevent disclosure of Personal Data to an unauthorised person.

20.6. A response shall be provided within the periods established by the laws of the Russian Federation.

21.1. Where Personal Data is confirmed to be inaccurate, the Company shall correct it or ensure that the party processing it on the Company’s behalf makes the required correction.

21.2. Disputed Personal Data may be restricted while it is being verified where required by law.

21.3. Where unlawful processing is identified, the Company shall discontinue such processing or ensure that it is discontinued.

21.4. Once the processing purpose has been achieved, Personal Data shall be destroyed within the period established by law unless another lawful basis for retention applies.

21.5. Where consent is withdrawn and no other lawful basis applies, the Company shall discontinue processing and destroy the Personal Data within no more than 30 days from receipt of the withdrawal.

21.6. Where immediate destruction is technically impossible, the Personal Data shall be restricted and subsequently destroyed within the period prescribed by law.

21.7. Destruction shall be evidenced by a destruction certificate, an information system log, or another document provided for by the Company’s internal procedures.

22.1. Where unlawful or accidental access results in a breach of Data Subjects’ rights, the Company shall:

• take measures to stop the breach;
• restrict further access;
• determine the causes and consequences;
• identify the affected categories of Personal Data and Data Subjects;
• conduct an internal investigation;
• implement measures to prevent recurrence;
• cooperate with Roskomnadzor and other competent authorities.

22.2. The Company shall submit an initial notification to Roskomnadzor within 24 hours after identifying the relevant incident and shall provide additional information concerning the results of its internal investigation within 72 hours.

22.3. Where required by law or justified by the nature of the risk, the Company shall notify the affected Data Subjects.

23.1. The Company shall review this Policy periodically, including where:

• applicable law changes;
• the range of Services changes;
• a new service is introduced;
• the purposes or categories of Personal Data processing change;
• the routes through which Personal Data is transferred change;
• retention periods change;
• information concerning Cross-Border Transfers changes;
• new risks are identified.

23.2. A new version shall take effect from the date stated at the beginning of that version.

23.3. The date of the latest update shall be displayed on the webpage containing this Policy.

23.4. The Company shall retain previous versions or otherwise preserve the technical ability to establish the contents of the Policy applicable during a particular period.

23.5. Material amendments affecting registered Btrace users may additionally be communicated through the Account or by email.

24.1. The Russian-language version of this Policy is the governing version.

24.2. Translations may be published for the convenience of foreign users. In the event of discrepancies, the Russian-language version shall prevail, subject to any mandatory provisions of applicable law.

24.3. If any provision of this Policy is found to be invalid, the remaining provisions shall remain in full force and effect.

24.4. Matters not addressed in this Policy shall be governed by the laws of the Russian Federation.

24.5. The Controller’s contact details for Personal Data matters are:

legal@amlcrypto.io

AML Crypto LLC

42, Building 1, Bolshoy Boulevard,
Skolkovo Innovation Center Territory,
Mozhaysky Municipal District,
Moscow, 121205, Russian Federation.