Privacy
Policy.

1. About this Privacy Policy

Effective date: 18 August 2026

This Privacy Policy explains how VELONXT INFORMATION TECHNOLOGY L.L.C S.O.C, a Dubai limited liability company - single owner, holding Dubai Department of Economy and Tourism commercial licence number 1643456 ("VELONXT", "NXT", "NXT Pay", "we", "us" or "our"), collects, uses, stores, discloses, transfers and protects Personal Data.

NXT Pay is a brand and service operated by VELONXT. This Privacy Policy applies when you use the NXT Pay mobile application, website, payment or checkout interfaces, customer-support channels and related products and services (together, the "Services").

This Privacy Policy is intended to comply with the UAE Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data, as amended, and other applicable UAE laws and regulatory requirements (the "UAE Data Protection Law"). It does not apply to third-party websites, applications or services that we do not control. Those third parties are responsible for their own privacy practices.

For the purposes of the UAE Data Protection Law, VELONXT will generally act as the Controller of Personal Data collected directly from NXT Pay users. In some merchant or partner arrangements, we may act as a Processor on the documented instructions of another Controller.

2. Important regulatory clarification

VELONXT's Dubai commercial licence records business activities that include Payment Services Provider, Computer Systems and Communication Equipment Software Design, and Information Technology Network Services.

A Dubai commercial licence is not, by itself, a representation that VELONXT holds every financial-services, stored-value, money-transfer, virtual-asset or payment-services regulatory approval that may be required for a particular product, transaction, country or customer. NXT Pay only makes a regulated service available where that service is lawfully provided by VELONXT or through an appropriately authorised bank, payment provider, virtual-asset provider or other partner.

3. Who this Policy applies to

This Privacy Policy applies to:

• current, former and prospective NXT Pay customers;
• users who pay or receive funds through an NXT Pay-supported checkout or payment flow;
• merchants, agents, beneficiaries and business partners;
• visitors to our website and users of our customer-support channels;
• directors, employees, contractors, suppliers and job applicants, where relevant; and
• any other person whose Personal Data we process in connection with the Services.

The Services are intended for persons aged 18 or older. We do not knowingly offer accounts to, or collect Personal Data directly from, children under 18. If you believe a child has provided Personal Data to us, contact us so that we can investigate and take appropriate action.

4. Personal Data we collect

"Personal Data" means data relating to an identified natural person or a natural person who can be identified, directly or indirectly, through one or more identifiers.

Depending on the Services you use, we may collect:

4.1 Identity and verification data

• full name, date of birth, nationality and gender;
• Emirates ID, passport, visa, national identity document or other government-issued identification;
• photograph, selfie, liveness result, signature and identity-verification results;
• tax identification or residency information where legally required; and
• sanctions, politically exposed person, adverse-media and other compliance-screening results.

4.2 Contact and profile data

• email address, mobile number and residential, billing or shipping address;
• username, account identifiers, language and communication preferences; and
• information you submit through forms, surveys, messages or customer support.

4.3 Financial and transaction data

• bank, card, mobile-money or other payment details, which may be collected directly by an authorised payment partner;
• transaction amount, currency, date, merchant, beneficiary, sender, recipient and payment status;
• NXT account balance and transaction history;
• wallet addresses, blockchain transaction identifiers and related public-ledger information where a supported service uses blockchain infrastructure; and
• refund, chargeback, cash-out, settlement, fee and exchange-rate information.

We do not intentionally store full card security codes. Card information may be tokenised or processed by payment providers subject to their own legal and security obligations.

4.4 Device, technical and usage data

• IP address, device identifiers, operating system, browser and application version;
• login events, authentication records, session information and diagnostic logs;
• pages or screens viewed, feature usage and interaction data;
• approximate location derived from IP address and, where you grant permission, more precise device location; and
• cookies, software development kits and similar technologies described below.

4.5 Information from other people and organisations

We may receive Personal Data from:

• banks, card schemes, payment processors, mobile-money providers and settlement partners;
• identity-verification, fraud-prevention, sanctions-screening and compliance providers;
• merchants, agents, beneficiaries, senders or recipients involved in a transaction;
• public registers, regulators, courts, law-enforcement agencies and publicly available sources; and
• service providers and business partners where the disclosure is lawful.

If you provide Personal Data about another person, you must be authorised to do so and must provide any notice required by applicable law.

5. Why we use Personal Data

We process Personal Data only where we have a lawful basis under applicable law. Depending on the circumstances, we use Personal Data to:

• register, verify, secure and administer your NXT Pay account;
• provide requested Services and process, route, reconcile or support transactions;
• confirm senders, recipients, beneficiaries, merchants and payment instructions;
• calculate and display balances, fees, rates, limits and transaction status;
• perform know-your-customer, anti-money-laundering, sanctions, fraud and risk checks;
• prevent account takeover, unauthorised transactions, abuse and other illegal activity;
• comply with UAE legal, regulatory, reporting, record-keeping and law-enforcement obligations;
• investigate complaints, disputes, refunds, chargebacks and suspected misconduct;
• operate, maintain, analyse, troubleshoot and improve the Services;
• provide service messages, security alerts and customer support;
• protect our rights, users, systems, personnel and business partners;
• establish, exercise or defend legal claims; and
• send marketing communications where permitted and subject to your right to opt out.

Our lawful bases may include your consent; taking steps at your request before entering into a contract; performing a contract with you; complying with legal obligations; protecting public interests or vital interests where recognised by law; establishing or defending legal claims; and other grounds permitted by the UAE Data Protection Law.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing already carried out lawfully and may prevent us from providing a feature that depends on the relevant data.

6. Automated checks and fraud prevention

We may use automated systems to identify unusual activity, assess fraud or compliance risk, apply transaction limits, request additional verification or refer a transaction for manual review.

Where a decision is based solely on automated processing and produces legal effects or similarly significant effects, you may have the right to request human review, express your view and challenge the decision, subject to exceptions under applicable law.

7. How we disclose Personal Data

We do not sell or rent Personal Data.

We may disclose Personal Data, only to the extent reasonably necessary, to:

• banks, payment processors, card schemes, mobile-money operators, settlement providers and other transaction participants;
• identity-verification, sanctions-screening, fraud-prevention and cybersecurity providers;
• cloud-hosting, communications, analytics, customer-support and software providers;
• merchants, agents, senders, recipients or beneficiaries involved in your transaction;
• professional advisers, auditors and insurers under confidentiality obligations;
• regulators, courts, governmental bodies and law-enforcement authorities where legally required or permitted;
• a buyer, investor or successor in connection with a merger, financing, reorganisation or sale, subject to appropriate safeguards; and
• another party where you direct or authorise us to disclose the data.

Service providers that process Personal Data for us are required to act on documented instructions, apply appropriate security measures and comply with applicable data-protection obligations.

8. International transfers

NXT Pay supports cross-border services and uses service providers that may process Personal Data outside the UAE. We transfer Personal Data internationally only where permitted by the UAE Data Protection Law.

Where the destination is not recognised as providing an adequate level of protection, we will use an available lawful transfer mechanism. This may include contractual safeguards, your explicit consent where legally valid, transfer necessary to perform or conclude a contract in your interest, transfer necessary for legal claims, protection of public or vital interests, or another mechanism permitted by law.

We assess the nature of the data, the purpose of the transfer, the recipient and the safeguards available. You may contact us for information about the safeguards relevant to your Personal Data.

9. Data security and incident response

We use administrative, organisational, physical and technical safeguards designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include encryption in transit and at rest where appropriate, access controls, authentication, logging, network protection, staff confidentiality obligations, vendor due diligence and security testing.

No system is completely secure. You are responsible for protecting your password, verification codes, device and account credentials. NXT staff and agents should never ask you to disclose your password.

If a Personal Data breach occurs, we will assess the risk and notify the UAE Data Office and affected Data Subjects where and within the period required by applicable law.

10. Data retention

We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services and satisfy legal, accounting, anti-money-laundering, sanctions, fraud-prevention, dispute-resolution and regulatory requirements.

Retention periods differ according to the type of data, the transaction, the country involved, the relationship with you and the applicable legal obligation. Closing your account does not automatically delete data that we must retain. When retention is no longer required, we will delete, anonymise or securely dispose of the data, subject to lawful backup and archival cycles.

11. Your rights

Subject to the UAE Data Protection Law, applicable exceptions and verification of your identity, you may have the right to:

• obtain information about the processing of your Personal Data;
• request access to and a copy of your Personal Data;
• request correction or completion of inaccurate or incomplete Personal Data;
• request deletion of Personal Data in qualifying circumstances;
• request restriction or suspension of processing in qualifying circumstances;
• object to processing and to certain automated decisions;
• request transfer of Personal Data in a structured, commonly used and machine-readable format where applicable;
• withdraw consent where consent is the lawful basis; and
• submit a complaint to the competent UAE authority.

To exercise a right, contact us using the details below. We may request information necessary to verify your identity and understand the request. Rights are not absolute; we may refuse or limit a request where permitted or required by law and will explain the applicable reason.

12. Marketing communications

We may send you news, product information or offers where permitted by law. You can opt out through the unsubscribe link in an email, your application settings or by contacting us. We may still send non-marketing communications needed to administer your account, complete transactions, provide security notices or comply with law.

13. Cookies and similar technologies

Our website and application may use cookies, pixels, local storage, software development kits and similar technologies to operate the Services, remember preferences, understand performance and, where you consent, support analytics or marketing.

Where required, non-essential technologies will be used only after you make a choice through the available consent controls. You can also manage cookies through your browser or device settings, although blocking necessary technologies may prevent parts of the Services from working.

14. Third-party services and public blockchains

The Services may link to or interoperate with third-party services. Their privacy policies apply to their own processing, and we are not responsible for services we do not control.

Where a supported transaction is recorded on a public blockchain, information such as wallet addresses, transaction identifiers, amounts and timestamps may be publicly visible and may not be capable of deletion or alteration by NXT. Do not include unnecessary Personal Data in public blockchain transaction fields.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, law, technology or our processing practices. We will publish the updated version and revise the effective date. Where a change materially affects your rights or our use of Personal Data, we will provide additional notice where required.

16. Contact and complaints

VELONXT INFORMATION TECHNOLOGY L.L.C S.O.C is established in Dubai, United Arab Emirates, under Dubai Department of Economy and Tourism commercial licence number 1643456.

For privacy questions or to exercise your rights, email privacy@nxtpay.io or use the support channel in the NXT Pay application. Please do not send passwords, one-time verification codes or complete payment-card details.

If you are not satisfied with our response, you may submit a complaint to the competent UAE data-protection authority in accordance with applicable law.