1. Introduction

Savala Commodities Corp. and its affiliates (collectively, “Savala”, “we”, “us”, or “our”) own and operate the Savala peer-to-peer commodity trade facilitation platform (the “Platform”). The Platform utilizes blockchain technology to tokenize the user’s: (i) purchase and ownership of the graphite from Ceylon Graphite Corp., a producer of graphite (the “Seller”); and (ii) entitlement to receive the revenue generated by the sale of the graphite by Savala to end buyers of the graphite at market prices (each, a “Token”). The Platform permits users to purchase and sell the Tokens on the Platform in transactions involving other users.

This Privacy Policy describes the way that we collect, use, and disclose your personal information in connection with your access to and use of the Platform. We will only collect, use, and disclose your personal information in accordance with this Privacy Policy unless otherwise required by applicable law. This Privacy Policy forms part of the Savala Platform Terms and Conditions (the “Terms”) and any capitalized terms that are not defined in this Privacy Policy shall have the meaning set out in the Terms.

By accessing or using the Platform or otherwise providing us with your personal information, you signify your acceptance of this Privacy Policy and consent to our collection, use, and disclosure of your personal information as described in this Privacy Policy. You can withdraw your consent at any time by contacting our Privacy Officer as directed below; however, if you choose to withdraw your consent, we may not be able

Savala is subject to the Personal Information Protection and Electronic Documents Act (Canada) and applicable Canadian provincial privacy legislation. Privacy laws vary by jurisdiction. You acknowledge and agree that access to the Platform is provided via the Internet and that your information, including personal information, may be transferred across provincial and national borders and stored or processed in accordance with the terms and conditions of this Privacy Policy.

This Privacy Policy has a limited scope and application. As a result, the rights and obligations contained in this Privacy Policy may not be consistent with privacy requirements for all jurisdictions.

For the purposes of this Privacy Policy, personal information is any information about an individual or that identifies a specific individual.

Savala may make changes to this Privacy Policy from time to time to reflect changes in its legal or regulatory obligations or in the manner in which we deal with your personal information. We will post any revised version of this Privacy Policy on the Platform.

If we make any material changes, we will notify you as required by law, but we encourage you to check back often for updates. Your continued use of the Platform after an update or amendment to this Privacy Policy means that you consent to the collection, use, and disclosure of your personal information as described in the updated Privacy Policy.

As a general rule, Savala collects personal information directly from you. In other circumstances, we receive personal information about you from third parties and third parties may collect personal information directly from you in connection with your use of the Platform. We will obtain your permission before we collect personal information about you from third parties (such permission may be given directly by you or implied by your actions – e.g., signing up for an Account and completing the KYC Screen described below).

Personal information that Savala collects from you

We collect and maintain different types of personal information in respect of the individuals with whom we interact. This personal information may include, but is not limited to:

• contact and identification information, such as your name, email address, phone number, EVM wallet address, screen name, Account ID, or device ID, including any information that you include in a Purchase Agreement that you enter into in connection with purchase or sale of graphite on the Platform;
• your Account information, such as your username, password, and transaction history;
• location and demographic information, such as your IP address and location;
• personal information that you include in any feedback or communication that you provide to us; and
• any other personal information that you choose to provide to us from time to time.

Personal information that our third-party service providers collect from you

When you create an Account, you will be re-directed to our third-party service provider’s Know-Your-Client (KYC) platform to complete a KYC screen (the “KYC Screen”). You may be asked to provide additional personal information in connection with your completion of the KYC Screen by our third-party service provider. When your KYC Screen is complete, you will be provided with a one-time-password to activate your Account.

When you transact on the Platform using a Funding Card, you may be asked to provide credit card number, debit card number, and other payment information to our third-party payment processor, Stripe, Inc. (“Stripe”), to process the transaction. Savala will not collect, use, disclose your credit card number, debit card number, or other payment information that you provide to Stripe. Stripe will handle your personal information in accordance with Stripe’s Privacy Policy.

When you transact on the Platform using a Funding Account, you may be asked to provide the provider of your Funding Account with your personal information in connection with the payment or receipt of Funds. The Funding Account provider may share certain of your personal information with us in order to complete the transaction you have initiated.

We may also collect information related to your visit to the Platform, including the device domain used to access the Platform, the operating system on your device, your device settings, application IDs, the type and version of your browser, crash data, other unique device identifiers, the website you came from to access the Platform, the page of the Platform you entered and exited at, any page within the Platform that is viewed by your IP address, and what country you are from. We use this information to monitor the Platform’s performance (such as number of visits, average time spent, page views, etc.) and for our business purposes (such as working to continually upgrade the Platform).

We collect personal information to provide you with the access to and use of the Platform, the services that are available on and through the Platform, and which enables us to manage, maintain, and develop our operations. For example, we collect personal information to:

• establish, maintain, and manage our relationship with you, including by contacting you, so that we may provide you with any services or communications that you have requested;
• provide our product and services, including to open and service your Account and to verify your Account and your identity;
• facilitate and process transactions on the Platform, such as Primary Sales and Secondary Sales, including through our third-party service providers,
• facilitate and process payments via your Funding Card and Funding Account, including through our third-party service providers;
• comply with legal and regulatory requirements;
• collect amounts that are owning to us;
• administer the Platform and our related business operations;
• protect us against error, fraud, theft, and damage to the Platform and our services, assets, and other property;
• conduct analysis and evaluations to understand usage and trends to improve the Platform and our services, communications, and operations; and
• fulfil any other reasonable purpose to which you consent.

By consenting to the collection, use, and disclosure of your personal information through the Platform, you allow us to fulfill the purposes for which we collect your personal information. When we collect your personal information for research, statistical, and development purposes, we ensure that any information used for our analysis and reports will be de-identified and aggregated in a manner that will not identify you. This de-identified information may be disclosed to third parties.

We may send you emails and other communications about products and services that we think may be of interest to you. You can unsubscribe from these communications at any time by using the unsubscribe mechanism provided in these communications or by contacting our Privacy Officer. Please note that unsubscribing will not unsubscribe you from Account or transactional communications which are delivered to you in connection with your use of the Platform. We will collect your express consent prior to sending you marketing communications, unless an exception to obtaining your express consent applies under applicable law.

We may disclose your personal information for the purposes and in the circumstances set out below:

• Affiliates, Employees, and Service Providers. We may disclose your personal information to our affiliates and our respective employees, contractors, consultants, service providers, and other parties who require such information to assist us with managing our relationship with you, including third parties that provide services to us or on our behalf. For example, we use third-party service providers to assist us with payment processing and our marketing and advertising activities and communications. These service providers may send you communications on our behalf.
• Seller. We may disclose your personal information to the Seller in connection with your purchase of graphite through the Platform.
• Business Transactions. Personal information may also be disclosed or transferred to another party during the course of, or upon completion of, a change in ownership of, or the grant of a security interest in, all or a part of Savala or its affiliates through, for example, an asset or share sale, or some other form of business combination, merger, or joint venture, provided that such party is bound by appropriate agreements or obligations and required to use or disclose your personal information in a manner consistent with the use and disclosure provisions of this Privacy Policy, unless you consent otherwise.
• Legal Requirements. Your personal information may also be disclosed:
  • as permitted or required by applicable law or regulatory requirements;
  • to comply with valid legal processes, such as search warrants, subpoenas, or court orders;
  • as part of Savala’s regular reporting activities under applicable law to protect the rights and property of Savala;
  • during emergency situations or where necessary to protect the safety of a person or group of persons; and
  • for any additional purposes for which we have obtained your consent to disclose your personal information.

Since we may share your personal information with third parties, as described in this Privacy Policy, your personal information may be collected, used, processed, stored, or disclosed outside of your jurisdiction of residence, including in India, Australia and New Zealand and India. As such, your personal information may potentially be accessible to law enforcement and national security authorities of another jurisdiction where local laws provide for a different level of protection for personal information. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security agencies in those other countries may be entitled to access your personal information.

If you would like further information about our policies and practices regarding the third parties (including our service providers) with whom we disclose your personal information and how these third parties collect, use, disclose, and store personal information, please contact our Privacy Officer using the contact details below. By providing your personal information to us, youconsent to our disclosure of this information to our service providers (and other third parties) as described in this Privacy Policy, including those that may be located outside of your jurisdiction of residence.

The security of your personal information is very important to us. We use commercially reasonable physical, electronic, and administrative measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure.

The safety and security of your information also depends on you. Where you have chosen a password for access to certain parts of our Platform, you are responsible for keeping this password confidential. Do not share your password with anyone.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to the Platform. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Platform.

Please advise our Privacy Officer immediately of any incident involving the loss of or unauthorized access to or disclosure of personal information that is in our custody or control.

We don’t keep your personal information forever. We keep your personal information as long as is reasonably necessary for us to complete our dealings with you, or as may be required by law, whichever is longer.

It is important that the personal information we hold about you is accurate and current. You have the right to request access to and to correct the personal information that we hold about you.

If you want to review, verify, correct, or withdraw consent to the use of your personal information, you may also send an email to our Privacy Officer at connect@savala.global to request access to, correct, or delete any personal information that you have provided to us.

We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. We may request specific information from you to: (i) help us confirm your identity and your right to access; (ii) provide you with the personal information that we hold about you; or (iii) make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, erased, or made your personal information anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal information, we will inform you of the reasons, subject to any legal or regulatory restrictions. If you are concerned about our response or would like to correct the information provided, you may contact our Privacy Officer at connect@savala.global .

It is important to us that we collect, use, and disclose your personal information only when we have your consent to do so. Your consent may be implied, deemed (using an opt-out mechanism), or express. We may collect, use, and disclose your personal information without your knowledge or consent where we are permitted or required to do so by applicable law or regulatory requirements.

Typically, we will seek your consent at the time that we collect your personal information. In certain circumstances, your consent may be obtained after collection but prior to our use or disclosure of your personal information. If we plan to use or disclose your personal information for a purpose not previously identified (either in this Privacy Policy or separately), we will endeavour to advise you of that purpose before such use or disclosure.

You may change or withdraw your consent at any time, subject to legal or contractual obligations and reasonable notice, by contacting our Privacy Officer using the contact information set out below. All communications with respect to such withdrawal or variation of consent should be in writing and addressed to our Privacy Officer at connect@savala.global . If you withdraw or vary your consent, we may not be able to provide you with the communications and/or services you request through the Platform. For example, if you would like to receive our communications, but are not willing to provide your email address, we will not be able to fulfil your request.

This Privacy Policy does not create or confer upon any individual any rights or impose upon Savala any rights or obligations outside of, or in addition to, any rights or obligations imposed by Canada’s federal and provincial privacy laws, as applicable. Should there be, in a specific case, any inconsistency between this Privacy Policy and Canada’s federal or provincial privacy laws, as applicable, this Privacy Policy shall be interpreted, in respect of that case, to give effect to, and comply with, such privacy laws.

If you have any questions about this Privacy Policy or concerns about how we manage your personal information, please contact our Privacy Officer by telephone, in writing, or by email. We will endeavour to answer your questions and advise you of any steps taken to address the issues raised by you. We have appointed a Privacy Officer to oversee compliance with this Privacy Policy. The contact information for our Privacy Officer is at connect@savala.global .

If you are dissatisfied with our response, you may be entitled to make a written submission to the Office of the Privacy Commissioner of Canada.