Privacy Policy

KEM BAHRAIN W.L.L.

(Kingdom of Bahrain – Personal Data Protection Law Compliance)

Effective Date: August 2026

Introduction

Kem Bahrain W.L.L. (“Kem”, “we”, “us” or “our”) is committed to protecting the privacy and confidentiality of personal data.

This Privacy Policy explains how we collect, use, disclose, store and safeguard personal data in accordance with:

• The Kingdom of Bahrain Personal Data Protection Law (PDPL) (Law No. 30 of 2018); • The Central Bank of Bahrain (CBB) Rulebook Volume 6; and • Other applicable laws and regulatory requirements.

For the purposes of the PDPL, Kem Bahrain W.L.L. acts as the Data Controller in respect of personal data collected through our platform and services.

Scope of This Policy

This Policy applies to personal data collected in connection with:

• Account registration; • Crypto-asset trading and wallet services; • Custody services; • KYC/AML onboarding; • Use of our website, mobile application and platform; • Customer support interactions.

Categories of Personal Data Collected

We may collect and process the following categories of personal data:

3.1 Identification Information

Full name, date of birth, nationality, identification number, passport details, residency information and government-issued identification documents.

3.2 Contact Information

Email address, telephone number, residential address and correspondence details.

3.3 Financial and Transaction Information

Bank account details, payment information, transaction records, wallet addresses, blockchain transaction data and trading history.

3.4 Verification and Compliance Information

KYC documentation, proof of address, source of funds documentation, video verification recordings and risk assessment data.

3.5 Technical and Usage Data

IP address, device identifiers, log data, cookies, browser type, operating system and usage patterns.

3.6 Location Data

Location data may be collected where necessary to verify jurisdictional eligibility and regulatory compliance.

3.7 Contact List Data (Optional Feature)

If you provide explicit consent, the application may access your contact list solely to identify other Kem users. Contact details of non-users invited to join the platform are stored temporarily (not exceeding 24 hours) to prevent duplicate invitations and are automatically deleted thereafter.

We do not share your contact list with third parties.

3.8 Device Permissions

The application may request access to:

• Camera (for identity verification and QR code scanning); • Microphone (for video verification); • Photo library (for document uploads); • Location services (for jurisdiction verification).

Access is only activated with your permission and may be withdrawn via device settings.

Lawful Basis for Processing

Under Bahrain PDPL, we process personal data on the following lawful bases:

4.1 Contractual Necessity

Processing necessary to provide crypto-asset services and maintain your account.

4.2 Legal and Regulatory Obligations

Compliance with AML/CFT/CPF, sanctions screening, CBB requirements and other legal obligations.

4.3 Legitimate Interests

Improving platform security, preventing fraud, enhancing user experience and protecting the integrity of our services.

4.4 Consent

Where required, including for marketing communications and optional features such as contact sharing.

You may withdraw consent at any time where processing is based on consent.

Purpose of Data Processing

We process personal data for the following purposes:

• Account creation and management; • Identity verification and customer due diligence; • Execution of crypto-asset transactions; • Wallet custody services; • Fraud prevention and security monitoring; • Regulatory reporting and compliance; • Communication regarding services; • Service improvement and analytics; • Handling complaints and disputes.

Disclosure of Personal Data

We may disclose personal data to:

6.1 Regulatory and Government Authorities

Including the Central Bank of Bahrain, law enforcement authorities and other competent bodies where required by law.

6.2 Service Providers

Third-party providers assisting with:

• Identity verification; • Blockchain analytics; • Cloud hosting; • Payment processing; • IT and cybersecurity services.

All service providers are bound by confidentiality and data protection obligations.

6.3 Professional Advisers

Auditors, legal advisers and insolvency practitioners where necessary.

6.4 Corporate Transactions

In the event of a merger, acquisition or restructuring, subject to confidentiality safeguards.

We do not sell personal data.

Cross-Border Data Transfers

Personal data may be transferred outside the Kingdom of Bahrain where necessary for operational or regulatory purposes.

Where such transfers occur, we ensure appropriate safeguards are implemented in accordance with the PDPL, including:

• Transfers to jurisdictions with adequate data protection standards; or • Contractual safeguards ensuring appropriate protection.

Data Retention

Personal data is retained only for as long as necessary to:

• Fulfil contractual obligations; • Comply with AML and CBB record-keeping requirements; • Meet legal and regulatory retention periods; • Resolve disputes and enforce agreements.

AML-related records may be retained for a minimum of ten (10) years or such period as required by Bahraini law.

Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption; • Multi-factor authentication; • Access controls; • Secure key management; • Monitoring and intrusion detection systems; • Regular security assessments.

Despite these safeguards, no system can guarantee absolute security.

Data Subject Rights

Under the Bahrain PDPL, you may have the right to:

• Access your personal data; • Request correction of inaccurate data; • Request erasure (subject to legal retention requirements); • Object to processing in certain circumstances; • Withdraw consent where applicable; • Request restriction of processing.

Requests may be submitted to:

Email: [email protected]

We may require identity verification before processing requests.

Certain rights may be limited where processing is required by AML/CFT laws.

Account Deletion

You may request deletion of your account via the application settings or by contacting us.

Upon deletion:

• Personal data will be removed except where retention is legally required; • AML and transaction records may be retained as required by law; • Certain data may be anonymised for statistical purposes.

You will be notified once deletion has been processed.

Confidentiality and Regulatory Obligations

We are subject to strict confidentiality obligations under CBB regulations. Personal data may be processed without your knowledge where required for AML/CFT/CPF, sanctions compliance or law enforcement cooperation.

Cookies and Analytics

Our platform may use cookies and similar technologies to enhance functionality and security. You may manage cookie preferences through browser settings.

Complaints

If you believe your personal data has been mishandled, you may contact us at [email protected].

You may also have the right to lodge a complaint with the relevant Bahraini supervisory authority responsible for data protection.

Changes to This Policy

We may update this Privacy Policy periodically. Updates will be published on our website and application with an updated effective date.

Continued use of our services after publication constitutes acceptance of the revised Policy.

Contact Information Kem Bahrain W.L.L. Kingdom of Bahrain Email: [email protected]