Privacy Policy

Preamble

By accessing or using the services provided by GD-MERCURY SP. Z O.O. (hereinafter referred to as the "Company"), you agree to be bound by this Privacy Policy ("Policy"). If you do not agree with any part of this Policy you must refrain from using or accessing the Company’s services.

The Company values the trust of its Clients and recognizes the importance of ensuring the confidentiality and security of their personal information. This Privacy Policy defines the principles governing the handling of confidential information when using the Provider website (“Website”) and Services. It is designed to comply with applicable data protection regulations including the General Data Protection Regulation (GDPR) and the Polish Personal Data Protection Act (Ustawa o ochronie danych osobowych). Familiarizing yourself with this Policy is mandatory for all Clients before using the services provided by the Company.

The Services may be available to Clients through third-party platforms, including P3X Platform. In such cases, the Client accesses the Services via such platform, which acts as an interface to the Company’s Services. The P3X Platform and/or any other third party may have its own privacy policy governing the processing of personal data independently of the Company.

Notwithstanding the foregoing, the Company acts as an independent data controller in relation to all personal processed in connection with its Services and determines the purposes and means of such processing independently of any third-party platforms through which the Services are accessed.

Terms

In this document unless the main text of the Policy expressly requires otherwise the following words and expressions shall have the following meanings:

A cookie is a piece of data created by a website and stored on the Client's computer in the form of one or more files. Cookies may contain identifiers and other information related to the use of the Website. Blocking cookies may lead to difficulties in using the Website or the complete inability to use it.
Informational materials (data) refer to any text images audio video or mixed-format materials intended for informational purposes.
Confidential information refers to any information that is not classified as public data and is either agreed upon by the Parties or required by applicable law to be treated as confidential.
Privacy means that information is available only to its owner and those to whom it must or may be disclosed under the law or an agreement with the owner.
Public data refers to data (including personal data) that the owner has made publicly accessible such as by posting it on an unrestricted website or data that under applicable law is not subject to confidentiality requirements.
Personal data means any information relating to an identified or identifiable natural person (the personal data subject).
Receiving Party refers to the party that receives Confidential Information. For the purposes of this Policy the Receiving Party is the Company unless explicitly stated otherwise.
Disclosure refers to the act or omission by which confidential information of one party becomes known to third parties without the consent of the owner. The form of disclosure (oral written electronic etc.) is irrelevant.
The Disclosing Party is the entity that shares Confidential Information. If disclosed by the Administrator the Disclosing Party is the Administrator if disclosed by a Participant the Disclosing Party is the Participant.
Disclosure of Confidential Information refers to any transfer of such information to third parties including leaks unauthorized access loss distortion falsification destruction modification copying or blocking resulting from non-compliance or improper fulfillment of obligations under this Policy by the Receiving Party.

General Provisions

By using any part of the Website and/or any of the Services, the Client grants the Company the right to receive, store, process, and use Personal Data and other Informational materials of the Client on the terms and conditions of this Policy and in accordance with applicable law of the Republic of Poland, including the Personal Data Protection Act (Ustawa o ochronie danych osobowych) and the GDPR.

This Policy applies exclusively to the processing of personal data carried out by the Company in connection with the Services. It does not apply to the processing of personal data carried out by third-party platforms, including the P3X Platform, which is governed by their respective privacy policies..

The main purpose of receiving, storing, processing, and using Personal, Public, and other Client data is to protect the interests of the Client, as well as to improve the quality of personalized and general services provided by the Company.
This Policy has no independent nature and is a Supplement to the Rules and does not supersede any provision of the main text of the Rules.
The provisions of this document and the concept of "Confidential information" shall not apply to information which:

Was, is, or becomes available to the Receiving Party on a non-confidential basis from a person who, according to the information of the Receiving Party, is not bound by any confidentiality agreement with the other Party or otherwise prohibited from disclosing Confidential Information to the Receiving Party, or;
Was in lawful possession of the Receiving Party before disclosure to it by the other Party as Confidential Information, or;
Was independently developed by the Receiving Party without access to the Confidential Information, or;
On which the Disclosing Party fails to take measures to protect its confidentiality, or;
To which the Receiving Party has access in accordance with the requirements of existing legal acts in the Republic of Poland, or;
Is publicly known as a result of actions and decisions of the Disclosing Party, or;
Was available to the Receiving Party on a non-confidential basis before the date of disclosure by the other Party, or;
Must be disclosed in accordance with the law of the Republic of Poland or by presenting legitimate demands of government or other competent authorities.

The Collection of Information

The Company may collect and process the following Client information: full name and surname, occupation, address, email address, telephone number, date of birth, bank or payment card details, as well as documents confirming the identity and address of the Client, at its request. This includes information about transactions carried out through the P3X Platformusing the Wallet and the fulfillment of Client Orders. The Company may receive personal data relating to Clients from third-party partners, including entities operating platforms through which the Services are available in accordance with applicable agreements. Upon receipt of such data, the Company may carry out its own onboarding, identity verification and due diligence procedures, including KYC and AML checks, in order to comply with applicable law. This may include verifying, supplementing or updating the information received from third parties.
To fulfill its legal obligations to combat fraud and money laundering, the Company may obtain Client-specific information from third parties, including information about financial history, bankruptcy decisions, and credit reports from credit bureaus and fraud prevention agencies. This information may be obtained when the Client opens a Wallet or whenever necessary to prevent fraud and minimize financial risks.
When registering in the P3X Platform and creating a Wallet, the Client must provide credentials and other mandatory or optional data. After creating and using the Wallet, the Company can identify the Client each time they use the P3X Platform and visit the Website.
The Company reserves the right to load cookies onto the Client's device (if the Client has not restricted this feature in their web browser). It may receive, store, process, and use information generated by cookies.
When the Client visits the Website, the Company automatically saves, processes, and uses non-personal data, such as the Client's IP address, data on the Client's location (which can be determined using their IP address), technical parameters of the Client’s device, the presence or absence of specific software on the Client's computer, the settings of this software, cookies, and statistical information about the Client’s activity.
In addition to visiting the Website, the Client may provide information when using the P3X Platform, social media applications, payment terminals, and other channels. The

Company may also receive information from other sources to verify the accuracy of information previously provided by the Client.

Use Of Information

The Company uses the information concerning its Clients for the following purposes:

To service Clients' Wallets and provide the Services requested by them.
To fulfill Client Orders related to Transfers of Funds, receiving Payments, and performing Transactions using the Services.
To inform Clients about changes in the Services, WebsiteRules, and software.
To comply with applicable Polish laws and regulations, particularly those concerning anti- money laundering and KYC ("Know Your Customer") procedures.
To verify the financial condition, identity, and creditworthiness of Clients.
To conduct checks to prevent fraud and money laundering.
To provide client service, including responding to questions, comments, and complaints.
To enhance the security of the Services.
To present the content of the Website (including interactive functions) in the most efficient way for Clients and their devices.
To offer goods and services to Clients that they request or may find interesting.
To assist in the development, provision, and improvement of Services, as well as the content of the Website and related communications with Clients.
For internal purposes, such as conducting audits, processing analytical data, and assessing the quality of the Services provided.

The Company processes Clients’ personal data on the following legal grounds in accordance with Article 6 GDPR:

Performance of a contract with the Client (Art. 6(1)(b));
Compliance with legal obligations, including those related to anti-money laundering, counter-terrorist financing and accounting requirements (Art. 6(1)(c));
Legitimate interests pursued by the Company, such as prevention of fraud, ensuring security of the Services, and defending legal claims (Art. 6(1)(f)).

Disclosure Of Information

The Company agrees not to provide Personal Data to third parties for their own commercial or marketing purposes without the explicit consent of the Client to whom the data pertains, unless such disclosure is required by the applicable law of the Republic of Poland.

Transfer of Personal Data to third parties is allowed in the following cases:

after obtaining the consent of the Client to whom the information relates;
at the reasonable request of government bodies or supervisory authorities that are legally entitled to receive such data;
the provision of data to agents and third parties acting under contract with the Company (including acquirers, payment card issuers, international card systems, service providers, billing or delivery companies, affiliated persons, IT and compliance providers, etc.), provided that:

they are informed of the confidential nature of such information;
they maintain appropriate technical and organizational security measures to protect confidential information from unauthorized access, use, alteration or disclosure; transfer may also be made to potential lenders, investors, acquirers, partners, shareholders, and auditors of the Company; furthermore, such data may be shared with companies that can offer their products and services to Clients, as well as in the context of exchanging information with other companies and organizations for the purposes of fraud protection and reduction of financial risk; in addition, if, in the reasonable opinion of the Company, the Client violates the terms of this Policy and/or other agreements between the Company and the Client, and/or the internal rules and policies of the Company, or if, again in the reasonable opinion of the Company, such provision is necessary to investigate, prevent, or take action against illegal activities, suspected fraud, potential threats to the physical safety of any person, or violations of

contractual obligations, rules, or bilateral agreements, then disclosure shall be permitted; finally, such transfer may occur as required by the applicable law of the Republic of Poland or relevant regulations, as well as in other cases, in accordance with the provisions of the Rules and binding legal acts of the Republic of Poland.

Unless otherwise agreed in writing with the Client, the Company reserves the right to publicly disclose the fact of its business relationship with the Client, provided that such disclosure does not conflict with applicable data protection or confidentiality obligations.
The Company reserves the right to disclose Confidential Information when such disclosure is required by applicable professional, ethical or business rules binding upon the Company.
Nothing in this Policy limits either Party’s legal obligation to disclose Confidential Information in compliance with judicial decisions or other legitimate statutory or regulatory obligations. If such disclosure is necessary, the Company will, where reasonably possible and not prohibited by law or regulatory instructions, notify the other Party in advance.
All Confidential Information remains the property of the Disclosing Party. No rights or licenses regarding such Confidential Information are granted to the Receiving Party, except as explicitly provided in this Policy or in the Rules.
Each Party must, upon written request from the other Party, return or securely destroy all Confidential Information (including any copies, records, drawings, diagrams, computer programs, or other media), unless retention is required by the applicable law of the Republic of Poland. The destruction must be confirmed in writing by an authorized person of the Party that carried it out.
Clients may request the Company to restrict access to, or use of, their Personal Data by third parties for marketing purposes, provided such a request complies with the applicable law of the Republic of Poland and applicable regulations. Such a request may be submitted using the contact details specified in this Policy, including by email at workmercuryfirm@gmail.com.

Processing Information

By providing Personal Data during Registration and when using the Services, the Client agrees and acknowledges that such Personal Data may be processed by the Company using automation tools and without using automation tools, including collection, storage, transfer to third parties, and use by the Company in order to provide Services to the Client and for other purposes specified in this Policy and the Rules. Such processing is carried out on the legal grounds set out in Article 6 GDPR, in particular performance of a contract, compliance with legal obligations and legitimate interests of the Company.
If the Client does not want their Personal Data to be processed for certain purposes, they must contact the Company for further instructions. In such cases, the Company will explain the possible consequences, including the inability to provide some or all of the Services. Where the Client withdraws consent or objects to processing, the Company will stop the relevant processing to the extent permitted by applicable law. At the same time, the Company may retain certain Personal Data if and to the extent that such retention is required by the applicable law of the Republic of Poland (in particular in the area of anti-money laundering, counter-terrorist financing, accounting and tax obligations).
If Personal Data is transferred to countries outside the European Economic Area, including to the United Kingdom and other third countries, such transfers are carried out only where adequate safeguards are in place, such as an adequacy decision of the European Commission or the use of Standard Contractual Clauses (SCCs). The Company ensures that such transfers comply with applicable data protection laws. Clients may request further details regarding the safeguards applied to international transfers by contacting the Company.
Where personal data has not been obtained directly from the Client, the Company will provide the Client upon request with the information required under applicable data protection laws, including the categories of Personal Data concerned and the source from which the data originates.

Access To Information

In order to exercise the rights of Clients and ensure proper fulfillment of the obligations stipulated by the Rules and agreements of the Parties, the Company may review the Informational Materials of the Clients to promptly resolve technical issues and to suppress illegal actions that violate the rights of any of the Parties, other Clients, or the Company itself.

The Company provides limited access to the Personal Data of Clients only to those employees who, in its reasonable opinion, genuinely need to use this information to provide Clients with services or to fulfill their official duties.
The Client has the right to request, change, or delete their Personal Data stored by the Company and/or on the Website. The Client can independently change or delete their Personal Data using the appropriate functions of the Website and their Wallet, where such functions are available. In some cases, the Company may be unable to delete certain Personal Data if its retention is required by the applicable law of the Republic of Poland (in particular in the area of anti-money laundering, counter- terrorist financing, accounting and tax obligations).
The applicable law of the Republic of Poland on personal data protection grants the Client the right to access their information. Any request for access will be processed in accordance with GDPR and other applicable regulations. The Company may charge a reasonable fee where such requests are manifestly unfounded or excessive, or for additional copies of the data, as permitted by applicable law.
Clients, as data subjects, are entitled to exercise the following rights under GDPR:

Right of access to their personal data (Art. 15);
Right to rectification of inaccurate data (Art. 16);
Right to erasure ("right to be forgotten ") where applicable (Art. 17);
Right to restriction of processing (Art. 18);
Right to data portability (Art. 20);
Right to object to processing, including processing for direct marketing purposes (Art. 21);
Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects (Art. 22).

These rights may be limited where the processing of data is required by law, in particular in the context of anti-money laundering and counter-terrorist financing obligations, or for the establishment, exercise, or defense of legal claims.
For all matters related to the processing of personal data, Clients may contact the Company via the Contact Us section on the Company’s website or by email at: workmercuryfirm@gmail.com. All requests will be reviewed in accordance with applicable data protection laws.

Protection Of Information

The Parties (the Company and the Client) guarantee the confidentiality of the information received during the execution of the Rules, unless otherwise expressly provided in the Rules, this Policy, or other agreements of the Parties.
The Client who violates the obligation to maintain the confidentiality of information shall be liable for compensating all losses, including lost profits, incurred by third parties and/or the Company as a result of such actions, in accordance with the applicable law of the Republic of Poland.
Confidentiality conditions are contained in these Rules and in this Policy and are accepted by the Client in full upon their acceptance of the Rules and use of the Services.
The Parties undertake not to disclose information about the operating conditions or any other information received during the fulfillment of their obligations under the Rules, unless disclosure is required by the applicable law of the Republic of Poland or expressly permitted by this Policy or other agreements of the Parties.
The Parties are obligated to inform each other within 1 (one) business day of any disclosure or threat of disclosure made by them or discovered by them, including illegal receipt or unauthorized use of Confidential Information by third parties, to the extent permitted by the applicable law of the Republic of Poland.
The Parties do not have the right to unilaterally terminate the protection of the confidentiality of information provided under these Rules, including in the event of reorganization (merger, accession, separation, transformation, or any other form of change in legal status) or liquidation, except as required by the applicable law of the Republic of Poland.

It is not a violation of confidentiality to provide Confidential Information at the lawful request of law enforcement or other authorized state bodies or officials, in cases and in the manner prescribed by the applicable law of the Republic of Poland.
If Confidential Information is disclosed to such authorities or individuals, the Party disclosing the information shall, where not prohibited by law, notify the owner of the Confidential Information in writing about the disclosure, its content, and the authority to which the Confidential Information was disclosed, no later than 1 (one) business day after the disclosure.
As stated in other sections of these Rules, Clients are responsible for maintaining the confidentiality of their Authentication Data. The Company is not responsible for transactions made as a result of improper storage, loss, or disclosure of this information by the Clients.

Other Provisions

The Company has the right to save the Client’s Personal Data and other data for as long as necessary to achieve the goals specified in this Policy, within the time period established by the applicable law of the Republic of Poland. Where the Client requests deletion of Personal Data, the Company will comply to the extent permitted by applicable law.

Personal data processed for the purposes of AML/CFT compliance, client identification and transaction monitoring is retained for a minimum of 5 years after the end of the business relationship or the completion of a single transaction, in accordance with the Polish AML Act. This period may be extended up to 10 years if required by competent authorities.
Other personal data is retained only as long as necessary to achieve the purposes set out in this Policy, after which it is securely deleted or anonymised.

The Client is responsible for providing accurate and reliable information and for updating previously provided data in case of any changes.
The Client authorizes the Company to allow third parties with whom the Company has entered into relevant agreements to receive, save and process data about the Client that is necessary for the provision, improvement and support of services (including, where applicable, Personal Data such as the Client’s IP address, cookies and statistical information about the Client’s activity). Such data processing is intended to improve the quality of services provided by these third parties and to deliver information of an advertising or informational nature, and shall be carried out in accordance with this Policy and applicable data protection laws.
The Client agrees that the confidentiality of data transmitted via the Internet cannot be absolutely guaranteed if third parties outside the area of technical communications controlled by the Company gain access to this data. The Company is not responsible for damage caused by such access, provided the Company has applied appropriate technical and organizational measures required by applicable law.
If, during the use of the Website or the Services, the Client becomes aware of information related to the Company or third parties that is deemed confidential or a trade secret under the applicable law of the Republic of Poland, the Client is prohibited from storing, using or distributing such information, except as expressly permitted by such law or by the rights holder.
When clicking on links provided on the Company’s Website, the Client may be redirected to third-party websites. The Company is not responsible for the content of these third-party websites or for the Personal Data they may collect, including their policies on data storage and use. Third-party websites may have their own rules regarding personal information. The Company strongly recommends that Clients familiarize themselves with the privacy policies of these third-party websites to understand how they handle Personal Data. Once the Client leaves the Company’s Website or stop using the Services, this Privacy Policy no longer applies.