EXODUS MOVEMENT, INC.

PRIVACY POLICY

Last Reviewed and Updated: February 10, 2023

Exodus Movement, Inc. and its subsidiary, Proper Trust AG (collectively, “Exodus,” “we,” “our,” and/or “us”), values the privacy of individuals who use our websites (including exodus.com (the “Website” or “Site”)), applications, or services, including the blockchain currency management software that is downloadable from the site, and any services that link to this Privacy Policy (collectively, our “Services”). This privacy policy (the “Privacy Policy”) explains how we collect, use, and disclose Personal Data from users of our Software, Site, and Services. For the purposes of this Privacy Policy, “Personal Data” means information that relates to an identified or identifiable natural person.

By using our Site or Services, you agree to the collection, use, and disclosure of your Personal Data as described in this Privacy Policy. Beyond this Privacy Policy, your use of our Site or Services is also subject to our Terms of Service. If you are a California resident, our California Resident Privacy Notice provides more information about your California privacy rights and explains how you can exercise those rights.

As the Exodus Wallet is a non-custodial crypto asset software wallet, we do not have customer accounts. We do not require you to provide your Personal Data to us to use the Exodus Wallet. If you sign up for our newsletter, certain beta programs and services, or provide your Personal Data in a customer service ticket or in connection with an advanced customer service program, that information will be collected by us. However, certain third-party API providers may require you to provide them with Personal Data, in order to use their services through the Exodus Wallet.

INFORMATION WE COLLECT

We may collect limited Personal Data from or about you or your devices from various sources, as described below.

Information You Provide to Us. When you contact us, sign up for our newsletter, sign up for advanced customer service, or participate in certain beta programs and services, we collect any Personal Data you provide to us, such as your name, email address, and country of residence. If you apply for a job with us, we will collect the Personal Data you provide to us through our Website or via a third-party website in connection with your job application.

Information We Collect Automatically. We may automatically collect information about you and your devices when you use our Site or Services. For example, when you visit our Website, we collect your internet protocol (IP) address, web browser type, web browser language, operating system type, the website you visited before browsing to our website, a pseudonymous User ID that is unique to Exodus for Exodus’s internal use in improving its products and services, the pages you view, the length of time you spend on a page, the dates and times of your visits, the hyperlinks you click on, and other information about your use of our Website. When performing an exchange through a third-party API provider, we log information such as the wallet addresses and the transaction IDs involved.

Cookies. We and the third-party API providers may collect information using cookies, pixel tags, or similar technologies. Our third-party partners, such as analytics or advertising partners, may use these technologies to collect information about your online activities over time and across different services. Cookies are small text files containing a string of alphanumeric characters. We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Site.

Our Website uses the following types of cookies for the purposes described below:

• Functional Cookies. We use functional cookies to recognize you when you return to our Site.
• Analytics and Performance Cookies. We use analytics and performance cookies for website analytics purposes to operate, maintain, and improve the Site and Services. The information gathered by these cookies is aggregated and anonymized and does not identify any specific individual visitor. We use Google Analytics to collect and process certain analytics data on our behalf. Google Analytics uses its own cookies that help us understand how you engage with the Site and Services and may also collect information about your use of other websites, apps, and online resources. The links below provide additional information and resources for Google Analytics:
  • Google Analytics
  • Prevent the Use of Google Analytics in Connection with your use of our Services
• Advertising Cookies. We may allow third-party advertising partners to use cookies on the Site to collect information about your browsing activities over time and across websites.

Further information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.

You can block cookies by setting your internet browser to block some or all of the cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our Site and Services. You can change your browser settings to block or notify you when you receive a cookie, delete cookies or browse our Site using your browser’s anonymous usage setting. Please refer to your browser instructions or help screen to learn more about how to adjust or modify your browser settings. If you do not agree to our use of cookies or similar technologies which store information on your device, you should change your browser settings accordingly. You should understand that some features of our Site or Services may not function properly if you do not accept cookies or these technologies. Where required by applicable law, you will be asked to consent to certain cookies and similar technologies before we use or install them on your computer or other device.

Information We Receive from Third Parties. We may receive Personal Data about you from third parties such as data or marketing partners and combine it with other Personal Data we have about you

HOW WE USE THE PERSONAL DATA WE COLLECT

We use the Personal Data we collect for the following purposes:

• To provide, maintain, debug, improve, and enhance our Site and Services.
• To understand and analyze how you use our Site and Services and develop new products, services, features, and functionality.
• To communicate with you, provide you with updates and other information relating to our Site and Services, provide information that you request, provide you with our newsletter, respond to comments and questions, and otherwise provide customer support.
• For marketing purposes, such as developing and providing promotional and advertising materials that may be useful, relevant, valuable, or otherwise of interest to you.
• To personalize your experience on our Site such as identifying you as a repeat visitor.
• To facilitate the connection of third-party services or applications.
• To create de-identified and/or aggregated data to improve for our business purposes, including to improve our Services.
• To find and prevent fraud, detect security incidents, and respond to trust and safety issues that may arise.
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.
• To contract with third-party API providers, including providing customer service, processing job applications, verifying customer information, providing advertising or marketing services, providing analytic services or providing similar services on behalf of the business or service provider.
• For other purposes for which we provide specific notice at the time the Personal Data is collected.

LEGAL BASIS FOR PROCESSING EUROPEAN PERSONAL DATA

If you are located in the European Economic Area or the United Kingdom, we only process your Personal Data when we have a valid “legal basis”, including when:

• Consent. You have consented to the use of your Personal Data, for example, to send you marketing communications or to use cookies.
• Contractual necessity. We need your Personal Data to provide you with the Services, for example, to respond to your inquiries.
• Compliance with a legal obligation. We have a legal obligation to use your Personal Data, for example, to comply with tax and accounting obligations.
• Legitimate interests. We or a third party have a legitimate interest in using your Personal Data. In particular, we have a legitimate interest in using your Personal Data for product development and internal analytics purposes, and otherwise to improve the safety, security, and performance of our Site and Services. We only rely on our or a third party’s legitimate interests to process your Personal Data when these interests are not overridden by your rights and interests.

HOW WE SHARE THE PERSONAL DATA WE COLLECT

We do not share or otherwise disclose Personal Data we collect from or about you except as described below or otherwise disclosed to you at the time of collection.

• Affiliates. We may share any information we receive with our affiliates for any of the purposes described in this Privacy Policy.
• Analytics Partners.We use analytics services such as Google Analytics to collect and process certain analytics data. These services also may collect information about your use of other websites and online resources.
• As Required by Law and Similar Disclosures. We may access, preserve, and disclose your Personal Data if we believe doing so is required or appropriate to: (i) comply with applicable laws; (ii) respond to law enforcement requests and legal process, such as a court order or subpoena; or (iii) protect the rights, property, and safety of Exodus, our employees, agents, customers, and others, including to enforce our agreements, policies, and Terms of Service.
• Merger, Sale, or Other Asset Transfers. We may transfer your Personal Data to service providers, advisors, potential third-party API providers, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.
• Vendors and Service Providers. We may share your information with vendors and service providers retained in connection with the provision of our Services.
• Consent. We also may disclose your Personal Data with your consent.

INTERNATIONAL DATA TRANSFERS

Your information, including the Personal Data that you provide to us, may be transferred to, stored at and processed by us outside the country in which you reside, including, but not limited to the United States, where data protection and privacy regulations may not offer the same level of protection as in other parts of the world. By providing any information, including Personal Data, on our Site, you consent to such transfer, storage, and processing. We may also transfer Personal Data from the European Economic Area or the United Kingdom to the United States, as needed, to perform the Services that you have requested from us. We will take steps that we believe to be reasonably necessary to treat your Personal Data securely and in accordance with this Policy.

SECURITY

We use reasonable organizational, technical, and administrative measures to protect Personal Data within our organization. However, as no electronic transmission or storage of Personal Data can be entirely secure, we can make no guarantees as to the security or privacy of your Personal Data. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us of the problem by contacting us via the “Contact Information” section below.

RETENTION

We will only retain your Personal Data as long as reasonably required for us to provide the requested customer support and inquiry services. In the context of customer support, we retain information sufficient to connect subsequent requests from the same user in order to provide efficient service, unless a longer retention period is required or permitted by law (for example for regulatory purposes).

THIRD-PARTIES

Our Site may contain links or API connections to other websites, products, or services that we do not own or operate. We are not responsible for the privacy and advertising practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party API providers or any Personal Data you disclose to these third parties. We encourage you to read their privacy policies before providing any Personal Data to them.

DO NOT TRACK SIGNALS

Some Internet browsers may be configured to send "Do Not Track" signals to the online sites that you visit. There is no accepted standard on how to respond to Do Not Track signals, and we do not respond to such signals. To find out more about "Do Not Track," please visit www.allaboutdnt.com

YOUR RIGHTS AND CHOICES

Opt-out. You may contact us anytime to opt-out of: (i) automated decision-making and/or profiling; (ii) any new processing of your Personal Data that we may carry out beyond the original purpose; (iii) any consent you previously provided to us regarding the processing of your Personal Data; or (iv) the transfer of your Personal Data outside the EEA. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent. Please note that your use of parts of our Website may be ineffective upon opt-out.

Access. You may access the information we hold about you by contacting us via the “Contact Information” section below.

Amend. You may update or correct any inaccuracies in your Personal Data by contacting us via the “Contact Information” section below. Restrict or Object. You may request us to restrict the processing of your Personal Data, or object to our processing of your Personal Data via the “Contact Information” section below.

Move. Your Personal Data is portable – i.e. you to have the flexibility to move your data to other service providers as you wish.

Erasure. In certain situations, for example when the information we hold about you is no longer relevant or is incorrect, you may request that we erase your data.

Exercising Your Rights. If you wish to exercise any of these rights, please contact us via the “Contact Information” section below. In your request, please clearly describe: (i) what Personal Data is concerned and (ii) which of the above rights you would like to enforce. For your protection, we only process requests with respect to the Personal Data associated with the particular email address that you use to send us your request, and we may need to verify your identity before processing your request. We will try to comply with your request as soon as reasonably practicable and, in any event, within thirty (30) days of your request. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason for such retention.

Marketing Communications. You may unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us.

California Residents. If you are a California resident, you can review our California Resident Privacy Notice for information about your privacy rights and choices under California law.

COMPLAINTS

We are committed to resolve any complaints about our collection or use of your Personal Data. If you would like to make a complaint regarding this Privacy Policy or our practices in relation to your Personal Data, please contact us as set forth below. We will reply to your complaint as soon as we can and, in any event, within thirty (30) days. We hope to resolve any complaint brought to our attention; however if you feel that your complaint has not been adequately resolved, you have the right to contact your local data protection supervisory authority.

CONTACT INFORMATION

We welcome your comments or questions regarding our privacy practices. If you have questions about your privacy related to the Site or Services or this Privacy Policy, you may contact us at the address below.

Exodus Movement, Inc. 15418 Weir Street, No. 333
Omaha, NE 68137 data@exodus.com

CHANGES TO THIS PRIVACY POLICY

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share Personal Data previously collected from you through our Site or Services, we will attempt to notify you by email, or other means

Exodus Movement, Inc. California Resident Privacy Notice

Last Reviewed and Updated: February 10, 2023
This California Resident Privacy Notice supplements the information and disclosures contained in our Privacy Policy. It applies to individuals residing in California from whom we collect Personal Information as a business under the CCPA through our websites, including https://www.exodus.io, applications, or services that link to this Privacy Policy (collectively, our “Services”).

Personal Information Collection, Disclosure, and Sale
For the purposes of this notice, Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”).

Personal Information does not include information that is:

• Lawfully made available from government records.
• Deidentified or aggregated.
• Otherwise excluded from the scope of the CCPA.

The chart below provides the categories of Personal Information (as defined by the CCPA) we have collected, disclosed for a business purpose, sold, or used for business or commercial purposes in the preceding twelve (12) months since this California Resident Privacy Notice was last updated, as well as the categories of sources from which that Personal Information was collected, and the categories of third parties with whom we shared Personal Information. The examples of Personal Information provided for each category reflect each category’s statutory definition and may not reflect all of the specific types of Personal Information associated with each category.

In the preceding twelve months, we have not sold any California resident’s Personal Information.

Use of Personal Information

We collect, use, and disclose your Personal Information in accordance with the specific business and commercial purposes below:

1. To provide, maintain, debug, improve, and enhance our Services
2. To understand and analyze how you use our Services and develop new products, services, features, and functionality
3. To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, provide you with our newsletter, respond to comments and questions, and otherwise provide customer support
4. For marketing purposes, such as developing and providing promotional and advertising materials that may be useful, relevant, valuable or otherwise of interest to you
5. To personalize your experience on our Services such as identifying you as a repeat visitor
6. To facilitate the connection of third-party services or applications
7. To facilitate transactions such as an exchange
8. To create de-identified and/or aggregated data to improve for our business purposes, including to improve our Services
9. To process your job application.
10. To find and prevent fraud, detect security incidents, and respond to trust and safety issues that may arise.
11. For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.
12. For short-term, transient use.
13. To contract with service providers to perform services on our behalf, including providing customer service, processing job applications, verifying customer information, providing advertising or marketing services, providing analytic services or providing similar services on behalf of the business or service provider.
14. For other purposes for which we provide specific notice at the time the Personal Information is collected.

Collection of Personal Information

In the preceding twelve (12) months since this notice was last updated, we have collected Personal Information from the following categories of sources:

1. You/Your Devices: You or your devices directly.
2. Analytics Providers.
3. OS/Platform Provider: Operating systems and platforms.

Disclosure of Personal Information

Pursuant to our Privacy Policy, we share your Personal Information with the following categories of third parties:

1. Affiliates.
2. Analytics Providers.
3. Vendors: Vendors and service providers.
4. Integrated Third Parties: Third parties integrated into our Services.
5. Third Parties as Legally Required: Third parties as required by law and similar disclosures.
6. Third Parties in Merger/Acquisition: Third parties in connection with a merger, sale, or asset transfer.
7. Third Parties with Consent: Other third parties for whom we have obtained your permission to disclose your Personal Information.

Your California Privacy Rights

If you are a California resident, you may exercise the following rights.

Right to Know and Access. You may submit a verifiable request for information regarding the: (i) categories of Personal Information collected, sold, or disclosed by us; (ii) purposes for which categories of Personal Information are collected or sold by us; (iii) categories of sources from which we collect Personal Information; (iv) categories of third parties with whom we disclosed or sold Personal Information; and (v) specific pieces of Personal Information we have collected about you during the past twelve months.

Right to Delete. Subject to certain exceptions, you may submit a verifiable request that we delete Personal Information about you that we have collected from you.

Verification. Requests for access to or deletion of Personal Information are subject to our ability to reasonably verify your identity in light of the information requested and pursuant to relevant CCPA requirements, limitations, and regulations. Please note that, unless you have contacted us for customer support, signed up for our newsletter, or otherwise provided us with your identifiable personal information, we will have no reasonable method by which we can identify you and will be required to deny your request. To verify your access or deletion request, we may request that you provide us with some information that matches the identifying information that you have already provided to us.

Right to Opt Out. In some circumstances, you may opt out of the sale of your Personal Information. We do not sell your Personal Information.

Right to Equal Service and Price. You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations.

Shine the Light. We do not rent, sell, or share Personal Information with non-affiliated companies for their direct marketing uses as contemplated by California’s “Shine the Light” law (Civil Code § 1798.83), unless we have your permission.

Submit Requests. To exercise your rights under the CCPA, please email us via our Contact Information section.

Authorizing an Agent. To authorize an agent to make a request to know or delete on your behalf, please send us an email via our Contact Information section. To authorize an agent to make an opt-out request on your behalf, please send a written authorization signed by you and the authorized agent to us via the Contact Information section.

Do Not Track

There is no accepted standard on how to respond to Do Not Track signals, and we do not respond to such signals.

Contact Information

If you have any questions, comments, or concerns about this notice or our processing activities, or you would like to exercise your privacy rights, please email us at data@exodus.com or write to us at Exodus Movement, Inc., 15418 Weir Street, No. 333, Omaha, NE 68137.