Privacy Notice

TrustSwap El Salvador, S.A. de C.V. (the operator of Panthea; “TrustSwap”, “we”) respects your privacy and processes personal data in accordance with applicable data-protection law and this notice. For questions or to exercise your rights, contact privacy@panthea.finance or write to Polígono 8, Oficina 118, Colonia San Benito, San Salvador, El Salvador.

2.1 Controller

TrustSwap El Salvador, S.A. de C.V. is responsible for the processing described here. Applicable law: the EU/UK GDPR or the Swiss Federal Act on Data Protection (FADP), where applicable.

2.2 Data we collect

• When you visit the site: technical data automatically logged by our servers and analytics — IP address, date/time of access, browser and device information, pages viewed.
• When you apply via “Request access”: organisation/entity name, website, your name, role, work email, jurisdiction, product interest, approximate treasury range, custody-model preference, timeline, and anything you include in the message field.
• When you contact us, subscribe to updates, or apply for a role: the details you provide (e.g. name, email, message).
• From third parties: information from publicly available sources, business partners, and compliance/identity- verification providers as needed to assess and onboard applicants.

We do not collect KYC/KYB identity documents through this website. KYC/KYB verification is carried out separately through a third-party provider (BlockPass) in a single flow that serves both Panthea and Blockfort.

2.3 How we use it

To respond to enquiries; assess and process access applications; provide and secure the site; analyse and improve the site; send updates you have asked for; carry out marketing consistent with law; comply with legal and regulatory obligations (including anti-money-laundering, know-your-customer/business, sanctions and tax-related requirements); and establish, exercise or defend legal claims. Our legal bases include our legitimate interests, performance of or steps toward a contract, your consent (which you may withdraw), and compliance with legal obligations.

2.4 Who we share it with

• Blockfort AG, our custody partner, to assess applications and onboard clients to custody;
• the KYC/KYB provider (BlockPass) for identity verification;
• other TrustSwap group companies;
• service providers (e.g. hosting, analytics, form processing, email);
• authorities, regulators and courts where required; and
• professional advisers, in each case under appropriate confidentiality and data-protection terms.

2.5 International transfers

We process personal data primarily in Switzerland and the United Arab Emirates, and by our processors in the locations set out in our sub-processor schedule. Where we transfer personal data to a country not listed in Annex 1 to the Swiss Data Protection Ordinance as providing adequate protection, we rely on the Swiss-adapted EU Standard Contractual Clauses or another safeguard permitted under the FADP. Blockfort processes custody-related data under its own privacy notice; note that data written to a blockchain in the course of providing services cannot be deleted.

2.6 Retention & security

We keep personal data only as long as necessary for the purposes above or to meet legal and regulatory obligations, and we apply appropriate technical and organisational security measures.

2.7 Your rights

Subject to applicable law and exceptions, you may request access to, correction, deletion or a copy of your personal data, and may object to certain processing. You may report a data protection matter to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Berne, Switzerland. You may also pursue civil remedies under Swiss law, including injunctive relief and claims for damages, satisfaction, or surrender of profits. To exercise your rights, email privacy@panthea.finance.

2.8 California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the CPRA — including the rights to know, delete, correct, opt out of the sale or sharing of personal information, limit use of sensitive personal information, and non-discrimination. We do not sell personal information for money and do not share personal information for cross-context behavioural advertising. We honour the Global Privacy Control browser signal as a valid opt-out. For full details and how to submit a request, see our Do Not Sell or Share My Personal Information notice.

2.9 Cookies & analytics

We use strictly necessary cookies to operate the site. We also use a privacy-friendly analytics cookie (Clicky, operated by Roxr Software Ltd.) to understand and improve site usage; it loads only after you accept cookies through our banner, and not at all if your browser sends Global Privacy Control. We do not set advertising, cross-site tracking, or social-media pixels. You can change your choice at any time via the “Cookie preferences” link in the footer.

2.10 Subprocessors

We use a limited number of service providers to operate this site: Formspree, Inc. (US) processes “Request access” and contact-form submissions; Clicky (UK) processes aggregate site-usage data when you have consented; and our hosting provider processes request metadata for security and reliability. Where personal data is transferred outside your jurisdiction, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

2.11 Changes

We may update this notice; the version published on the site applies. TrustSwap El Salvador, S.A. de C.V. · September 21, 2026