Privacy Policy

1. Who we are and scope of this policy

TradeREA is operated by TradeREA Xchange Technologies Inc. (“TradeREA,” “we,” “us,” or “our”).

This Privacy Policy explains how we collect, use, disclose, safeguard, retain, and delete personal information through traderea.com, our iOS and Android applications, and related services.

TradeREA provides technology for accessing investment opportunities and related services. Depending on the service and jurisdiction, regulated activities may be provided by separately identified financial institutions, securities dealers, brokers, trading venues, custodians, or other authorized providers. Their roles, terms, and privacy notices will be disclosed when you access their services.

This policy does not represent that TradeREA holds a particular securities registration or that any investment has been approved by a regulator.

For privacy questions or requests, contact:

2. Personal information we collect

We collect information relevant to the services you request, your interactions with us, and applicable legal requirements. Different features require different information.

Account and contact information. This includes your name, email address, telephone number, residential or mailing address, account identifiers, authentication information, and communication preferences.

Identity and compliance information. Where required for a service, we or the relevant verification or financial services provider collect information such as your date of birth, citizenship, country of residence, occupation, government-issued identification, proof of address, and identity-verification results.

We may also collect information needed to establish beneficial ownership, authorized representatives, source of funds or wealth, tax residency, and sanctions or politically exposed person screening results.

Investor information. Where applicable, this includes financial circumstances, income, net worth, investment objectives, investment knowledge, experience, risk tolerance, investment time horizon, investor classification, eligibility confirmations, and supporting documents.

Financial and transaction information. This includes information needed to link or identify payment accounts, funding and withdrawal instructions, investment orders, holdings, transaction history, distributions, wallet addresses, and transaction identifiers, where those features are available.

Some information may be collected directly by a financial services provider. TradeREA's access depends on the integration and the permissions you authorize.

Communications and documents. We collect information contained in support requests, complaints, correspondence, agreements, acknowledgements, and documents you submit.

Device and usage information. This includes IP address, device and operating system information, app version, access times, platform interactions, security logs, and diagnostic information collected through the services and their integrated technologies.

Where the identity-verification process presented to you requires a photograph, selfie, video, liveness check, or facial comparison, the relevant provider explains the information collected and its purpose before collection and obtains any required consent. Sensitive verification material is used for verification, fraud prevention, and applicable compliance purposes. Any biometric processing requiring a separate notice or consent is subject to that additional notice and consent; this policy alone does not authorize it.

3. How we obtain information

We obtain information directly from you when you register, complete forms, upload documents, communicate with us, or use a feature.

We also receive information from providers involved in delivering a requested service, such as identity-verification providers, connected financial institutions, brokerage partners, custodians, and transaction-processing providers.

Where permitted by law and with consent where required, verification and compliance checks may involve sanctions lists, public records, fraud-prevention sources, and other appropriate databases.

Device and usage information is collected through interactions with our services and the technologies described in this policy.

We explain significant additional collection at the relevant point of use and obtain any required consent before it occurs.

4. Why we use personal information

We use personal information to:

• Establish, authenticate, administer, and secure accounts.
• Deliver requested features and facilitate authorized transactions.
• Complete identity, anti-money laundering, sanctions, fraud-prevention, and investor-eligibility checks.
• Support applicable know-your-client, suitability, tax-reporting, and securities-recordkeeping requirements, according to the responsibilities of the relevant entity.
• Maintain transaction records, agreements, acknowledgements, and audit trails.
• Provide customer support and address complaints.
• Send service, security, transaction, and legal notices.
• Diagnose problems and improve service reliability and usability.
• Send marketing communications where permitted and with consent where required.
• Comply with applicable law, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not use personal information for materially different purposes without providing additional notice and obtaining consent where required.

5. Consent and choices

We explain the purposes for collecting, using, and disclosing personal information and obtain consent where required. We may process information without consent where applicable law permits or requires it.

Accepting this policy does not replace separate consent required for sensitive information, optional marketing, tracking, or particular third-party disclosures.

You may withdraw consent by contacting our Privacy Officer or using the relevant settings. Withdrawal applies prospectively and does not override lawful recordkeeping requirements.

If you decline information necessary for identity verification, investor eligibility, or another required process, we or the relevant provider may be unable to offer the affected service. Optional permissions and marketing consent are not conditions of unrelated services.

6. Who receives personal information

We disclose information only where reasonably necessary for an identified purpose, authorized by you, or permitted or required by law.

Service providers. These may include hosting, infrastructure, authentication, identity verification, fraud prevention, communications, customer support, analytics, and payment-processing providers. Providers acting on our behalf are subject to contractual restrictions concerning confidentiality, security, permitted use, retention, and deletion. We require them to provide protection equivalent to that described in this policy and required by applicable platform rules.

Financial services and investment participants. Depending on your requested service, information may be disclosed to the relevant securities dealer, broker, trading venue, custodian, financial institution, issuer, transfer agent, administrator, or professional adviser to process transactions, maintain ownership records, administer investments, and meet legal obligations. Some recipients act as independent organizations with their own legal responsibilities and privacy notices.

Affiliated entities. We share information with an affiliated entity only for a disclosed operational or legal purpose, subject to appropriate safeguards and any required consent.

Authorities and legal recipients. Information may be disclosed to regulators, tax authorities, financial intelligence units, courts, law enforcement, or other recipients where legally required or otherwise lawfully justified.

Business transactions. Information may be disclosed in connection with a proposed or completed financing, merger, acquisition, restructuring, or business transfer, subject to applicable law and confidentiality protections.

We do not sell identity documents, financial-account details, or investor financial assessments. Website advertising and campaign-measurement technologies can disclose online identifiers and browsing activity to advertising providers. Under some privacy laws, this may constitute sharing for cross-context behavioural advertising even when no money is paid for the information. Where those laws apply, you may exercise applicable opt-out rights through the available consent controls or by contacting support@traderea.com.

7. Mobile permissions, analytics, and tracking

The app requests device permissions only where needed for a particular feature.

Where enabled, camera or selected-file access may be used to submit identification or other requested documents. Notification permission may be used for account, security, or transaction messages. You can manage device permissions through your operating system settings. Where a device permission is declined, the associated feature may be unavailable. We provide alternatives where available and appropriate.

Our websites and apps may use cookies, local storage, analytics technologies, and integrated software development kits. Their data collection must be consistent with the purposes described in this policy.

Where consent is required for non-essential analytics, advertising technologies, or tracking, we obtain it before activating the relevant technology. Where Apple's App Tracking Transparency requirements apply, we request authorization through the required system prompt before tracking.

Our website uses Google tag-management technology and Meta advertising technology. Information processed through website measurement and advertising technologies can include IP addresses, browser and device information, online identifiers, referral information, page visits, and campaign interactions. The Cookie Policy provides further information about website cookies and controls.

8. Tokenized assets and blockchain records

Where a feature uses a blockchain, wallet addresses, transaction identifiers, token transfers, and other transaction details may be recorded on that network.

Public blockchain records can be visible worldwide, copied by third parties, and retained indefinitely. A wallet address may become associated with your identity through transactions or other available information.

Deletion of a TradeREA account does not erase an immutable blockchain record.

Sensitive identity documents and investor financial assessments are not intended for publication on a blockchain. Where a transaction records information on a public network, review the network and transaction details before authorizing it.

Do not include identity documents, government identification numbers, or other sensitive personal information in wallet labels or transaction messages that may be publicly recorded.

9. Securities and financial-services records

Investment-related services may require identity verification, investor classification, eligibility assessment, recordkeeping, transaction monitoring, and reporting.

Personal information may be supplied to the relevant regulated provider to perform these functions. That provider may be required to retain records or make disclosures independently of TradeREA.

Deleting your TradeREA account or withdrawing consent does not automatically close a separately maintained brokerage, custody, or investment account, cancel a settled investment, or remove legally required ownership records. We will explain any additional steps relevant to your request.

Where a financial institution must provide a separate statutory privacy notice or disclosure choice, this policy does not replace that notice or choice.

10. Retention

We retain personal information only for as long as reasonably necessary for its stated purpose, applicable legal obligations, security, dispute resolution, and the establishment or defence of legal claims.

Retention depends on the record type, applicable jurisdiction, relevant entity, and the event from which the retention period runs, such as record creation, transaction completion, or account closure.

Investment, identity-verification, transaction, tax, complaint, and compliance records may need to be retained after account deletion. A retention obligation applicable to a regulated partner does not automatically require TradeREA to retain every duplicate record.

Information no longer required is securely deleted or irreversibly anonymized. Backup copies are removed through the applicable backup lifecycle and remain protected pending removal.

For example, where Canadian securities-registration requirements apply, required records are generally retained for seven years from creation; applicable anti-money-laundering requirements prescribe at least five years for specified records, measured from the event specified by law. We apply the longest legally applicable period to an individual record. You may contact us for the retention period applicable to your records.

11. Account deletion and personal information deletion

You may initiate deletion of your TradeREA account:

In the app: use the account-deletion option in your account settings to initiate a request. If you need assistance, contact support@traderea.com.

Outside the app: email support@traderea.com with the subject “TradeREA Account Deletion” from your registered email address. State that you wish to delete your account and associated personal information.

We may verify your identity using proportionate measures to protect against unauthorized deletion. Upon completing your request, we delete the account and associated personal information, except information that must lawfully be retained for a specified purpose.

Where information is retained, we explain the relevant categories, reasons, and applicable retention periods or criteria, unless disclosure is legally prohibited. Pending transactions, holdings, or legal restrictions may require additional steps.

We process deletion requests without undue delay and within the timeframe required by applicable law.

12. Your privacy rights

Subject to applicable law and permitted exceptions, you may request access to your personal information, correction of inaccuracies, information about its use and disclosure, and deletion.

Depending on your jurisdiction, you may also have rights to portability, restriction, objection, withdrawal of consent, or choices concerning certain disclosures and advertising uses.

We verify requests proportionately and respond within applicable legal deadlines. Where a request cannot be fulfilled, we explain the reason and available complaint options, unless prohibited by law.

You may contact our Privacy Officer with a concern and may complain to the privacy regulator with jurisdiction over your matter. In Canada, this may include the Office of the Privacy Commissioner of Canada or an applicable provincial authority.

13. Marketing and notifications

You can unsubscribe from marketing emails through the unsubscribe link or contact us to update your preferences.

You can manage push notifications through your device settings and any available app controls.

Opting out of marketing does not prevent necessary security, transaction, account, or legal communications.

14. International processing

Our providers and financial services partners may process information outside your province, state, or country. Foreign courts, law enforcement, or authorities may access information under the laws applicable in those locations.

We use safeguards appropriate to the transfer and applicable law, including contractual and organizational measures and any legally required transfer mechanism.

Canadian and United States providers may be involved in delivering the services. You may contact our Privacy Officer for information about relevant processing locations and safeguards.

15. Security and incidents

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information and associated risks. Access is limited to authorized persons with a business or legal need. Providers handling information are subject to appropriate security obligations.

No system is completely secure. Where a security incident triggers a legal notification obligation, we notify affected individuals, regulators, or other required recipients within the applicable timeframe.

You should protect your credentials, use available account-security controls, and promptly report suspected unauthorized activity to support@traderea.com.

16. Children and minimum age

TradeREA is not intended for individuals under 18 or any higher minimum age applicable to the relevant service.

We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

17. Changes to this policy

We update this policy when our practices or applicable requirements change and revise the effective date.

For material changes, we provide appropriate notice. Where a new use or disclosure requires consent, we obtain that consent before proceeding. Continued use does not substitute for consent where separate consent is legally required.

18. Contact us

For privacy questions, access or correction requests, consent withdrawal, account-deletion assistance, or complaints: