Privacy Policy

This Privacy Policy ("Privacy Policy") sets out the manner and legal basis on which Mask Virtual Assets Exchange LLC (Licence No: 1001596), trading as MetraCore ("Metra", "We", "Us", or "Our"), collects, uses, discloses, processes, and protects Personal Data in accordance with the UAE's Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data ("PDPL") and all other applicable data protection laws.

This Privacy Policy applies to all Personal Data provided to or collected by Us in connection with your access to or use of our platform, including all subdomains, web pages, applications, and content made available by Metra.

Definitions

• "Cookie" — small data files placed on your device when you access or use the platform.
• "Data Processors" — any party that processes Personal Data on our behalf in accordance with documented instructions.
• "Personal Data" — any data relating to an identified natural person or a person who can be identified, directly or indirectly, by reference to identifiers such as name, voice, image, identification number, electronic identifier, location data, or physical, physiological, cultural, or social characteristics.
• "Processing" — any operation or set of operations performed on Personal Data, whether by automated or manual means, including collection, recording, storage, organisation, adaptation, use, disclosure, transfer, erasure, or destruction.
• "Services" — all features, tools, applications, interfaces, and functionalities made available by Us through the platform, including account management, virtual-asset trading, wallet integrations, transaction execution, compliance verification, and customer support.
• "UAE Data Office" — the federal authority established under the UAE PDPL, which oversees data protection compliance across the UAE.

This Privacy Policy applies to all Personal Data collected, used, and disclosed by Us in connection with your use of our platform. It governs how We handle the Personal Data of Users who visit our platform or utilise our Services, including:

• Your access to or use of the platform and its associated Services;
• Any interactions you have with Us, whether through the platform, email, customer support, or other communication channels; and
• Any Personal Data shared with or obtained by Us from third-party service providers, affiliates, or business partners.

This Privacy Policy does not apply to third-party platforms or services linked to our platform, data that is fully anonymised or aggregated, or Personal Data collected by third-party service providers using our intellectual property.

We collect only the Personal Data necessary to fulfil lawful and legitimate business purposes. The following categories of Personal Data may be collected:

• Identity and Verification Data — full name, date of birth, nationality, government-issued identification (e.g., passport or Emirates ID), and KYC documentation.
• Contact and Account Data — email address, username, and account-related identifiers.
• Financial and Transaction Data — virtual asset wallet details, transaction history, payment instructions, deposits, and withdrawals.
• Device and Technical Data — IP address, browser type, device identifiers, operating system, and access logs.
• Usage and Interaction Data — activity on the platform, clickstream data, trade execution records, and other logs.
• Support and Communication Data — messages, attachments, or feedback provided when contacting our support channels.
• Marketing and Preference Data — communication preferences and consents for receiving promotional materials.

We do not intentionally collect sensitive categories of data such as health information, religious beliefs, or biometric identifiers, except where strictly required by law.

We process Personal Data strictly in accordance with the principles of lawfulness, fairness, and transparency set out under the PDPL. We may process your Personal Data for the following purposes:

• To enable you to register and maintain a user account and authenticate your identity;
• To execute, record, and settle trades, orders, and virtual-asset transactions;
• To detect, investigate, and prevent fraudulent, unauthorised, or illegal activities;
• To improve the functionality and user experience of the platform;
• To provide customer support and communicate operational updates; and
• To fulfil legal or regulatory requirements imposed by competent UAE authorities.

The legal bases on which We rely to process Personal Data include: performance of a contract; compliance with a legal obligation; legitimate interests; consent; and protection of vital or public interests.

We may disclose or share Personal Data with third parties only to the extent necessary for achieving the purposes specified in this Privacy Policy. All such disclosures are made under appropriate contractual, technical, and organisational safeguards.

We do not sell, rent, or lease Personal Data to unaffiliated third parties for marketing or commercial purposes. Any disclosure is conducted on a "need-to-know" basis, consistent with the principles of data minimisation and purpose limitation under the PDPL.

We implement appropriate technical and organisational safeguards to protect Personal Data against loss, misuse, unauthorised access, alteration, or destruction. These include:

• Encryption and pseudonymisation of Personal Data;
• Access controls to restrict data access to authorised personnel only;
• Use of secure servers and encrypted communication protocols;
• Periodic testing and review of security measures; and
• Requiring third-party service providers to adhere to comparable security standards.

While We take these precautions, no method of transmission over the internet is completely secure. Accordingly, We cannot guarantee absolute security of your Personal Data.

Certain Personal Data may be transferred or stored outside the United Arab Emirates due to the nature of our Services and technology infrastructure. Any such transfer is conducted strictly in accordance with the PDPL and only where adequate protection and enforceable rights are ensured. Where the receiving jurisdiction does not provide an adequate level of protection, We implement appropriate safeguards through standard contractual clauses or other mechanisms approved by the UAE Data Office.

We retain Personal Data only for as long as it is necessary to fulfil the purposes for which it was collected or as required under applicable laws and regulations. Where retention is required under AML, CFT, tax, or regulatory laws, data shall be preserved for the period prescribed by such laws and VARA regulations. Once the retention period expires, Personal Data will be securely deleted, anonymised, or pseudonymised.

You have the following rights in relation to the Personal Data We collect and process:

• Request confirmation of whether We process your Personal Data and obtain a copy;
• Request the correction or updating of inaccurate or incomplete Personal Data;
• Request erasure of your Personal Data where it is no longer necessary;
• Request restriction of processing in certain circumstances;
• Object to processing where it is based on our legitimate interests;
• Request data portability where technically feasible;
• Withdraw consent at any time where processing is based on consent; and
• Lodge a complaint with the UAE Data Bureau.

If a breach involving your Personal Data occurs that is likely to impact its confidentiality, integrity, or security, We will notify you and the UAE Data Office within 72 hours of becoming aware of the breach.

We will respond to all legitimate requests within thirty (30) calendar days as required by UAE PDPL.

We may use Cookies and similar tracking technologies on the platform to improve functionality, analyse usage patterns, enhance security, and deliver personalised content. We use the following types of Cookies:

• Strictly Necessary Cookies: Essential for the operation of the platform. These cannot be disabled.
• Performance and Analytics Cookies: Help us understand how you interact with the platform.
• Functionality Cookies: Allow us to remember your settings and preferences.
• Targeting or Advertising Cookies: Used to deliver relevant advertisements based on your browsing activity.

In accordance with UAE PDPL requirements, We will obtain your explicit consent before placing any non-essential Cookies on your device.

If you need assistance or have questions about exercising your data protection rights, please contact our Data Protection Officer:

• Data Protection Officer: support@metra.ae
• General privacy inquiries: legal@metra.ae

If you are unsatisfied with our response, you have the right to file a complaint with the UAE Data Office.

We may update this Privacy Policy from time to time to ensure compliance with applicable laws and regulations. We will notify you of any material changes at least 30 days before they become effective. For material changes, we may also send a notice to the primary email address associated with your account or place a prominent notice on the platform.