Global Privacy Policy

DAT-001 POLÍTICA Y AVISO GLOBAL DE PRIVACIDAD

GLOBAL PRIVACY POLICY AND NOTICE

Versión 1.4 / Version

1.4 • Vigente desde el 6 de octubre de 2026 / Effective 6 October 2026

Entidad / Entity

BLIIM GLOBAL LLC — Delaware, United States

Documento / Document

Política y Aviso Global de Privacidad / Global Privacy Policy and Notice

ID

DAT-001

Versión / Version

V1.4

Fecha de Vigencia / Effective Date

6 de octubre de 2026 / 6 October 2026

Ámbito / Scope

Aplicación, sitio web, webviews, Legal Center, soporte y funcionalidades habilitadas / App, website, webviews, Legal Center, support and enabled features

Contacto de Privacidad / Privacy Contact

[email protected] Soporte / Support [email protected]

Dirección de Contacto / Contact

Address 1000 N. West Street, Suite 1200, Wilmington, Delaware 19801, United States

AVISO DE ALCANCE / SCOPE NOTICE Esta Política es el aviso global público de Bliim y regula los tratamientos realizados por BLIIM GLOBAL LLC en la medida en que Bliim determine sus fines y medios. Determinados productos, partners o jurisdicciones pueden requerir avisos adicionales, que se presentarán en el momento correspondiente. La presencia de una funcionalidad en la aplicación no implica su disponibilidad en todos los países ni para todos los usuarios.

This Policy is Bliim’s global public privacy notice and governs processing carried out by BLIIM GLOBAL LLC to the extent Bliim determines the relevant purposes and means. Certain products, partners or jurisdictions may require additional notices, which will be presented at the appropriate time. The presence of a feature in the app does not mean that it is available in every country or to every user.

1. Purpose and Scope

This Global Privacy Policy and Notice (the “Policy”) describes how BLIIM GLOBAL LLC (“Bliim” “we” , , “us” or “our”) collects, obtains, uses, accesses, organises, stores, shares, transfers, protects, retains and, where appropriate, deletes personal data in connection with the Bliim Account, mobile app, website, webviews, Legal Center, support channels and features that have been enabled.

This Policy applies to processing in respect of which Bliim acts as controller or in another applicable legal capacity. It does not replace the terms, privacy notices or disclosures of an issuer, bank, custodian, account provider, payment provider, lender, KYC/KYB provider or other third party where that third party processes data under its own responsibilities.

Features subject to financial, regulatory, contractual or partner requirements are enabled only where the conditions applicable to the product, jurisdiction and user are satisfied. Availability of the app or a Bliim Account does not mean that every product, currency, asset, network, card, account, rail or service is available.

2. Controller and Contact Details

Where Bliim determines the relevant purposes and means of processing, the controller is BLIIM GLOBAL LLC, a limited liability company formed under the laws of the State of Delaware, United States.

For privacy questions, exercise of rights or legal matters relating to personal data, you may contact [email protected]. For operational support, you may contact [email protected]. Bliim’s contact address for this Policy is 1000 N. West Street, Suite 1200, Wilmington, Delaware 19801, United States.

Where applicable law requires a local representative, data protection officer or other additional contact point, Bliim will identify that contact in the relevant jurisdictional notice, Legal Center or flow before it is required for the covered processing.

3. Relationship with Other Documents

This Policy should be read together with the Bliim General Terms of Use, the terms specific to the relevant product, the Acceptable Use and Prohibited or Restricted Activities Policy, the Cookies and Similar Technologies Policy, and specific notices for KYC, biometrics, marketing, BLIIA, BChat, partner products or other features where applicable.

In the event of inconsistency, mandatory law prevails. In respect of processing carried out under a third party’s own responsibility, that third party’s privacy notice governs that processing to the relevant extent.

4. Roles of Bliim and Third Parties

Bliim does not assume that every provider or partner acts solely as a processor. Depending on the purpose and actual operation, Bliim or a third party may act as controller, processor, service provider, contractor, independent controller, joint controller or another category recognised by applicable law.

Partners may independently determine aspects relating to KYC/KYB, product opening or provision, card issuance and management, accounts or account details, custody, payments, transfers, AML, sanctions, fraud prevention, eligibility, regulatory obligations, complaints or record retention.

The existence of a technical integration, API, dashboard or commercial brand does not by itself determine a party’s legal role. The applicable classification depends on the facts, contracts, purpose, data processed, jurisdiction and actual product configuration.

5. Categories of Personal Data

Depending on the Bliim Account and the features actually used, Bliim may process the following categories of data:

• Identity and Contact Data. First and last name, email address, telephone number, date of birth, address, country of residence, nationality and other reasonably necessary identifiers.
• Bliim Account Data. User identifier, account status, language, preferences, devices, sessions, security settings, tokenised credentials where applicable and history of acceptance of terms, notices and consents.
• KYC/KYB and Compliance Data. Identity documents, document data, photographs or selfies, address verification, tax residence, economic activity, UBO or control-person information, source-of-funds or source-of-wealth information where relevant, PEP or sanctions screening, fraud indicators and verification results.
• Financial and Product Data. Account or routing details, bank identifiers, card information where applicable, displayed balances, currency, limits, beneficiaries, payments, transfers, fees, FX, settlement references and transaction data.
• Wallet and Blockchain Data. Wallet addresses, assets, networks, blockchain identifiers, transaction hashes and related data where those features are enabled.
• Technical and Security Data. IP address, device type, operating system, app or build version, technical identifiers, authentication events, logs, crash data, performance data and fraud or security signals.
• Usage, Support and Complaint Data. Product events, features used, support tickets, communications, complaints, disputes, documents and evidence provided by the user.
• User Content. Messages, files, prompts, voice, images or other content only where an enabled feature requires it and in accordance with the applicable specific notice.
• Sensitive Data. Where classified as such by applicable law, this may include biometric data if generated or used for identification, precise geolocation, official identifiers, financial credentials or other protected categories. Bliim will apply the relevant legal bases, authorisations and enhanced safeguards.

6. Sources of Data

Bliim may obtain data directly from the user; from the app or device; from a company, representative, UBO or control person in a business relationship; from identity, KYC or KYB providers; from product partners; from issuers, processors, banks, rails, custodians or other financial institutions; from security and anti-fraud providers; from public or lawfully accessible sources where necessary for compliance; and from other sources authorised by the user or permitted by law.

Where data is not obtained directly from the individual and applicable law requires additional information, Bliim will provide the relevant notice within the applicable period.

7. Purposes of Processing

Bliim may process personal data, as applicable, for the following purposes:

• Create, administer, authenticate, maintain and close the Bliim Account.
• Prevent unauthorised access, fraud, account takeover, abuse, money laundering, terrorist financing, sanctions evasion and other risks.
• Provide, maintain, protect and improve requested technology features.
• Determine eligibility by product, country, profile or partner requirements.
• Perform or support KYC, KYB, AML, PEP, sanctions, anti-fraud and other legal or contractual controls.
• Connect the user with enabled partners and transmit information reasonably necessary for the requested product.
• Present, record, technically transmit or reconcile instructions and transaction data within Bliim’s actual role.
• Maintain evidence of terms, consents, notices, disclosures, instructions and communications.
• Manage support, complaints, errors, disputes, refunds, chargebacks, incidents and privacy requests.
• Comply with legal, regulatory, contractual, judicial or competent-authority obligations.
• Protect Bliim’s rights, systems, users, partners, assets and legitimate interests.
• Perform analytics, measurement and product improvement where a valid legal basis exists and in accordance with applicable choices.
• Send promotional communications where the required legal basis and choice mechanism exist.
• Carry out the specific purposes of BLIIA, BChat or other products only where they have been enabled and explained through the relevant terms and notices.

8. Legal Bases, Authorisations and Consent

The applicable legal basis depends on jurisdiction, purpose and data category. Where appropriate, Bliim may process data to perform a contract or pre-contractual steps, comply with legal obligations, pursue legitimate interests subject to the relevant assessment, protect vital interests or on the basis of valid consent or authorisation.

Bliim will not use consent as a generic formula where another basis is legally appropriate. Acceptance of the Terms of Use does not automatically amount to consent for marketing, optional tracking, biometrics or other processing that requires a separate choice.

In Colombia, where the individual’s authorisation is required, it will be obtained through a prior, express and informed action capable of being evidenced. In Mexico, the notice and consent rules applicable to the data and purposes will be followed. In the EEA, where the GDPR applies, Bliim will identify the relevant legal basis and provide the information required by Articles 13 or 14, as applicable. In Brazil, where Law No. 13,709/2018 (Lei Geral de Proteção de Dados Pessoais — LGPD) applies, Bliim will map each purpose and data category to an applicable legal basis under the LGPD, including, where relevant, the specific regime for sensitive personal data, and will not use consent as a generic basis where another legal basis is legally appropriate.

9. Required and Optional Data

Certain data is necessary to create or protect a Bliim Account, comply with legal obligations, verify identity, provide a requested feature or satisfy partner requirements. If the user does not provide such data, Bliim may be unable to create the account, complete verification or enable the relevant feature.

Where data or processing is optional, refusal should not prevent unrelated features unless there is a legitimate legal, technical, security or product need linked to that data or processing.

10. KYC, KYB, Biometrics and Compliance

Where a feature requires identity or business verification, Bliim and/or the applicable partner may request documents, selfies, address data, corporate information, UBOs, economic activity and other reasonably necessary data.

A photograph or selfie is not automatically biometric data. If technology generates or uses a template, facial geometry or another biometric identifier, Bliim will apply the notice, consent or authorisation, minimisation, security, retention and other controls required by applicable law.

Provider results, scores, matches or alerts are signals to be interpreted under the relevant process and do not by themselves constitute a final legal conclusion. Where a partner is the responsible entity for a regulated onboarding, eligibility, monitoring or reporting decision, the allocation of responsibility will be reflected in the relevant flow and records.

11. Financial Products and Partners

Where the user requests a card, account or account details, wallet, stablecoin, conversion, transfer, cross-border, credit or another third-party-supported feature, Bliim may share strictly necessary data with the partner and other material participants in the product.

The user will receive, where applicable, the issuer’s, bank’s, custodian’s, lender’s, provider’s or partner’s own terms, privacy notices and disclosures. This Policy does not replace those documents.

For card products, the relevant issuer or programme privacy notices will be presented within the card-specific flow. For products supported by Bridge or another account, wallet or rail provider, the partner’s terms and notices will be presented at the point defined by that product flow.

12. Wallet, Stablecoins and Blockchain

Where these features are enabled, Bliim may process wallet addresses, asset IDs, network IDs, transaction hashes, quotes, fees, FX, settlement references and other data necessary to present, transmit or support an instruction.

The fact that information may be visible on a blockchain does not mean that its association with an identified person or Bliim Account ceases to be personal or confidential. Private keys, secrets, signing material or critical credentials must not be used for purposes incompatible with their function.

13. Support, Complaints, Errors and Fraud

Bliim may process information contained in tickets, complaints, disputes or fraud reports, including transaction identifiers, evidence, communications, logs, KYC data, partner information and investigation results.

Where a matter materially relates to a function provided by a partner or another entity, Bliim may refer or coordinate the matter with that entity. Routing to a third party does not remove obligations that apply directly to Bliim.

Records will be retained for the period required by applicable law, contracts, recordkeeping policy, defence of claims or a valid legal hold.

14. Cookies, SDKs, Permissions and Tracking

Bliim may use cookies, SDKs, pixels, local storage, identifiers and similar technologies in accordance with the Cookies and Similar Technologies Policy.

Strictly necessary technologies may operate without optional consent where permitted by law. Analytics, advertising or tracking technologies that require consent, opt-out or another choice must not be activated inconsistently with those requirements. In Brazil, where the LGPD applies, the legal basis, transparency and choice mechanisms for cookies, SDKs and identifiers will be determined according to the purpose and actual processing; the Cookies Policy will not assume that every use of these technologies necessarily depends on consent.

Camera, photos, contacts, location, microphone, Face ID, biometric or notification permissions will be requested only where relevant and with an explanation consistent with actual use. Refusal of a permission should not block unrelated features unless there is a legitimate need.

15. Marketing and Communications

Operational, security, transactional, legal and support communications are distinct from promotional communications.

Where required by law, marketing by email, push, SMS, WhatsApp or other channels will be sent only with the applicable legal basis and opt-in or opt-out mechanism. Preferences will be managed by channel and will not be automatically inferred from acceptance of the Terms of Use or a product.

The user may modify or withdraw marketing preferences through available controls or the mechanism identified in the communication.

16. Recipients and Categories of Third Parties

Bliim may disclose data, to the extent reasonably necessary and permitted by law, to the following categories of recipients:

• Identity, KYC/KYB, AML, sanctions, fraud and security providers.
• Card program managers, issuers, processors and networks.
• Account, wallet, custody, payment, transfer, FX, settlement and rail providers.
• Underlying financial institutions where applicable.
• Cloud, hosting, authentication, analytics, communications, customer-support and cybersecurity providers.
• Professional advisers, auditors, insurers and investigators where a legitimate purpose exists.
• Authorities, courts and bodies where there is a legal obligation, valid request or sufficient legal basis.
• Third parties involved in a reorganisation, financing, merger, acquisition, asset sale or other corporate transaction, subject to confidentiality obligations and applicable law.

The identity of a material partner for a product will be shown in the relevant flow, terms, disclosure or notice where relevant to understanding who processes the data or provides the feature.

17. Sale, Sharing and Targeted Advertising

Bliim does not treat acceptance of the Bliim Account as automatic authorisation to sell personal data, share it for behavioural advertising or use it for targeted advertising where the law requires a separate choice.

If a production practice were to be legally classified as sale, sharing, targeted advertising or an equivalent category, Bliim will provide the required notice and opt-out, consent or universal-preference mechanism before applying that practice to a covered user.

Data obtained for security, fraud, KYC, transactions, settlement or compliance must not be repurposed for incompatible advertising without an appropriate legal basis and transparency.

18. International Data Transfers

Bliim and its providers may process data in countries other than the user’s country of residence. Before enabling a transfer that requires a specific legal mechanism, Bliim will implement that mechanism.

Where the GDPR applies, transfers outside the EEA will, as appropriate, rely on an adequacy decision, appropriate safeguards, Standard Contractual Clauses or another permitted mechanism. Bliim will provide required information about the mechanism or how to obtain a copy where applicable.

Where the Brazilian LGPD applies to an international transfer of personal data, Bliim will rely on a lawful basis and transfer mechanism permitted by Article 33 of the LGPD and the ANPD regulations then in force, including, as applicable, an adequacy decision, standard contractual clauses, specific contractual clauses, binding corporate rules or another legally permitted mechanism. Where required, Bliim will make available in Portuguese, in an accessible manner, the required information about the transfer, its purposes, destination, responsible parties, security measures and means to exercise rights.

Vendor and partner transfers and access must be documented by purpose, entity, location, data and legal basis. Technical availability of an API does not by itself authorise a data transfer.

19. Retention and Deletion

Bliim does not apply one retention period to all data. The applicable period depends on the purpose, record category, product, partner, jurisdiction, AML/KYC obligations, recordkeeping, security, contracts, limitation periods, defence of claims, investigations and legal holds.

When data is no longer necessary and there is no valid basis for retaining it, Bliim will delete, anonymise or block it in accordance with the applicable policy and configuration.

Closure of a Bliim Account does not require immediate deletion of records that must be retained for law, contract, fraud, sanctions, disputes, chargebacks, audit, security or legal hold. Remaining data will be deleted or anonymised where legally appropriate.

20. Security and Confidentiality

Bliim applies reasonable technical and organisational measures proportionate to the nature, volume and risk of processing. These measures may include authentication, access controls, encryption, segregation of duties, logging, monitoring, secure development, backup and resilience, incident response, vendor security and least privilege.

No measure eliminates risk completely. Bliim reviews its controls and requires relevant providers to maintain appropriate contractual and technical safeguards.

Where a security incident creates a duty to notify users or authorities, Bliim and/or the responsible entity will provide the notice required by applicable law and the actual allocation of responsibility. In Brazil, where the LGPD applies, Bliim will also follow the ANPD rules then in force for assessing, recording and communicating incidents that may cause relevant risk or harm, within the time limits and with the information required from the responsible controller.

21. Privacy Rights

Depending on jurisdiction, the user may have rights of access or knowledge, confirmation of processing, correction or rectification, updating, deletion, objection, restriction, portability, revocation or withdrawal of consent, opt-out of certain activities, information about third parties, appeal and complaint to a competent authority.

Rights are not absolute. Exceptions may apply in relation to legal obligations, fraud, AML or sanctions, security, defence of claims, freedom of expression, mandatory retention or other grounds provided by law.

Bliim may reasonably verify the requester’s identity to protect the data. Bliim will not require creation of a new account to exercise a right where prohibited by applicable law.

22. Exercising Rights and Requests

Privacy-related requests may be sent to [email protected] and, when available, through the Privacy Center or relevant in-app route.

Bliim may request information reasonably necessary to verify identity, locate the data and determine the applicable jurisdiction or right.

Where appropriate, Bliim will provide a request identifier or evidence of receipt.

Where a partner is responsible for part of the processing, Bliim may refer or coordinate the request with that partner while preserving traceability. Time limits, requirements and appeal mechanisms depend on applicable law.

23. Automated Decisions and Profiling

Bliim or its providers may use automated tools for authentication, security, fraud detection, identity verification, risk indicators, eligibility support, compliance or product operation.

A score or automated result does not necessarily mean that Bliim makes the final legal decision. The responsible decision maker depends on the product, partner, contract, data and jurisdiction.

Where law grants rights in relation to solely automated decisions or profiling producing legal or similarly significant effects, Bliim will provide the transparency, review, opt-out or other mechanism required for the covered processing.

24. Minors

The general Bliim app is not designed as a service directed to children. The minimum age for a Bliim Account and each product depends on legal capacity, jurisdiction and partner requirements.

A future Kids feature is not enabled by this Policy. Before processing minors’ data under a specific product, Bliim will implement the relevant child or minor privacy notice, parental consent or verification where applicable, minimisation, security, profiling and marketing restrictions and other applicable requirements.

If Bliim determines that it has collected a minor’s data without the required authorisation or legal basis, it will take reasonable steps to restrict or delete that processing in accordance with law.

25. Account Closure and In-App Deletion

The user may initiate closure or deletion of the Bliim Account through the available in-app route or support, subject to reasonable verification.

Closure of the Bliim Account is distinct from closure of third-party products. A card, local account, wallet, credit or another partner relationship may require a separate process and satisfaction of outstanding obligations.

Bliim will explain where certain records must be retained after closure and will delete or anonymise remaining data where legally appropriate.

26. Changes to this Policy

Bliim may update this Policy to reflect legal, regulatory, technology, product, vendor, partner or processing changes.

The current version will be identified by version number and effective date. Where a change requires a new notice, authorisation, consent, opt-out or reacceptance, Bliim will implement the relevant mechanism.

Bliim will retain historical versions and evidence of changes, notices and consents under its applicable recordkeeping controls.

27. United States Supplement

Privacy obligations in the United States may vary by state, nature of processing, data category and applicability thresholds.

Where the California Consumer Privacy Act, as amended, applies, Bliim will provide the required Notice at Collection and mechanisms for rights to know, access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information where applicable, and non-discrimination. Bliim will recognise Global Privacy Control where required by law.

Where the CCPA applies, the Notice at Collection will be shown at or before collection and will reflect the categories actually collected, their purposes, retention criteria or periods and, where relevant, whether the categories are sold or shared and the applicable opt-out mechanism.

Where the Delaware Personal Data Privacy Act applies, Bliim will provide a reasonably accessible, clear and meaningful privacy notice and mechanisms to exercise and, where applicable, appeal rights recognised by that law.

Financial privacy notices specific to issuers, banks, card programmes or other product providers will be presented separately where applicable.

28. Spain and European Economic Area Supplement

Where Regulation (EU) 2016/679 (GDPR) applies, Bliim will provide the identity and contact details of the controller and, where applicable, its representative or data protection officer; purposes and legal bases; legitimate interests where relevant; recipients; international transfers; the retention period or criteria; rights; the ability to withdraw consent; the right to complain to a supervisory authority; whether provision of data is mandatory and the consequences of not providing it; and required information about automated decision-making.

Where Article 27 GDPR requires Bliim to appoint a representative in the Union, that representative’s contact details will be made available before Bliim enables covered processing requiring that appointment. If applicable law requires a Data Protection Officer, those contact details will also be published.

The user may lodge a complaint with the competent data protection authority in the relevant Member State, without prejudice to other available remedies.

29. Colombia Supplement

Where Law 1581 of 2012, Decree 1074 of 2015 and other applicable Colombian data-protection provisions apply, Bliim will process data in accordance with the principles of legality, purpose limitation, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality.

Where authorisation is required, Bliim will obtain and retain a prior, express and informed action from the individual. Mere acceptance of this Policy does not by itself constitute authorisation for all processing.

The individual may know, update and rectify data; request evidence of authorisation where applicable; be informed about use of the data; submit queries or complaints; request deletion or revoke authorisation where legally permitted; and approach the Superintendencia de Industria y Comercio once applicable legal requirements have been satisfied.

Before enabling processing subject to this regime, Bliim will make available any additional channels required by applicable rules, including a telephone channel where legally necessary, and will maintain a route for data-subject queries and complaints.

30. Mexico Supplement

For processing subject to the Federal Law on Protection of Personal Data Held by Private Parties published in the Official Gazette of the Federation on 20 March 2025, as currently amended, BLIIM GLOBAL LLC acts as controller in respect of processing for which it determines the purposes and means.

For privacy-notice purposes, Bliim identifies its contact domicile as 1000 N. West Street, Suite 1200, Wilmington, Delaware 19801, United States. Bliim will identify applicable personal and sensitive data, purposes, mechanisms to limit use or disclosure, transfers requiring information or consent, mechanisms to exercise ARCO rights and the procedure for communicating changes to the notice.

Where data is collected electronically, Bliim may provide a simplified notice identifying the controller and essential purposes and linking to this integral notice, without prejudice to specific consents that may be required.

In Mexico, data subjects may exercise ARCO rights through [email protected] and, where applicable, may approach the competent federal authority responsible for private-sector personal-data protection under the current legal framework.

31. Brazil Supplement

Where Law No. 13,709/2018 (Lei Geral de Proteção de Dados Pessoais — LGPD), as amended, applies, BLIIM GLOBAL LLC will act as controller for processing whose purposes and means it determines and will recognise controller, operator or other legally applicable roles according to the actual facts, contracts and allocation of responsibilities. Applicability of the LGPD will be determined by the processing and its legal nexus with Brazil, and not solely by the user’s nationality or the location of the technology infrastructure.

Bliim will process personal data under the applicable legal bases of the LGPD and will observe the enhanced regime applicable to sensitive personal data. Where consent is the applicable legal basis, it must be freely given, informed and unambiguous for specified purposes and may be withdrawn through a free and facilitated procedure; where another legal basis is appropriate, Bliim will not present consent as an artificial or universal basis for processing.

Subject to the terms and limitations of the LGPD and its regulations, the data subject may exercise rights to confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data or data processed unlawfully, portability where regulated and applicable, deletion of consent-based data subject to legal exceptions, information about data sharing, information about the consequences of refusing consent, withdrawal of consent, objection where legally provided, and petition before the Agência Nacional de Proteção de Dados (ANPD) and consumer-protection bodies. In relation to decisions made solely on the basis of automated processing that affect the data subject’s interests, the data subject may request the review and information required by applicable law.

Where an international transfer is subject to the LGPD, Bliim will apply a mechanism permitted by the LGPD and the ANPD regulations then in force, including ANPD Resolution CD No. 19/2024 and its amendments or successor rules where applicable. Vendor and partner data flows must document the purpose, data categories, relevant countries or destinations, roles of the parties, transfer mechanism and applicable safeguards before production processing that requires such a mechanism.

Bliim will maintain an accessible channel for data-subject requests through [email protected] and will publish the contact details of its data protection officer (encarregado) where designation and publication are required under the LGPD and regulations then in force. Where a security incident subject to the Brazilian regime may cause relevant risk or harm, assessment, recordkeeping and communication to the ANPD and affected data subjects will be carried out in accordance with the obligations applicable to the responsible controller.

The terms, notices and privacy policies of banks, payment institutions, PIX participants, account providers, KYC/KYB providers, custodians, processors or other partners acting under their own responsibilities will continue to govern their respective processing.

Enabling BRL, PIX, local accounts or local account details does not by itself determine Bliim’s legal role or replace the applicable Product × Country × Partner allocation.

32. Contact and Effective Date

For privacy questions or exercise of rights: [email protected] For operational support: [email protected] Contact address: BLIIM GLOBAL LLC, 1000 N. West Street, Suite 1200, Wilmington, Delaware 19801, United States.

This Policy is effective from 6 October 2026 and remains in force until replaced by a later version published by Bliim.