PRIVACY POLICY

We process only such personal data as are necessary for the provision of our services or for compliance with legal obligations. In particular, this includes the following: • Data provided directly by you: When registering and using our website, you enter information into your user account, order services (such as Challenge or Learn from the Best), or participate in our programmes (such as the World Trading Championship). We typically process your identification and contact details, including your first name, surname, e-mail address, telephone number, address and date of birth. We also retain your login credentials (username and password) and, if you act in a business capacity, data relating to your business (e.g. Company ID No. or VAT ID No.). In the case of paid services, we also process payment-related data (e.g. bank account number or other payment information). In addition, we may record further information that you provide in the course of communications with us, such as the content of communications with our customer support team or data contained in complaints or claims. • Data collected automatically: When you use our website and services, technical and analytical information is recorded automatically. This includes, for example, information about your device and connection, such as IP address, device type, operating system, browser type or internet service provider. We also record information regarding your use of our website, for example the date and time of your visit, time spent on the website, the country from which you access the website, and which pages or features you viewed (browsing history). Similarly, we collect information regarding your use of our services and programmes, such as log-in and log-out times, your user account settings, the amount of your virtual capital, the currency set on your account, or the trading strategies used by you within the platform, together with other related information. We obtain these data primarily through cookies, logs and similar technologies in the course of your interaction with our services. • Data obtained from third parties: Certain information concerning you may be provided to us by other entities. This concerns, in particular, data received from operators of trading platforms that you select for simulated trading within our services. Specifically, we may obtain data regarding your fictitious trades (for example, the type of financial instrument traded, the price at which the relevant trade was executed, the volume of the relevant instrument, the opening and closing times of the position, the amount invested, the profit or loss achieved, etc.). Furthermore, if you decide to link your user account with us to a social media account, we will obtain certain data from the operator of the relevant social media platform, such as your username, profile photo or the e-mail address assigned to that social media account. Please note that if such third parties (e.g. trading platforms or social media providers) process your data for their own purposes, such processing is governed by their own privacy policies. We recommend that you review them on the websites of the relevant providers. All of the above information relating to an identified or identifiable natural person (you as the user) constitutes personal data. We always process such data only to the extent necessary and in compliance with applicable legal regulations.

We never process your personal data without a proper reason; there is always a specific purpose connected with the provision or improvement of our services or with compliance with our obligations. Below, we provide an overview of the purposes for which we use your data, together with the principal legal basis authorising such processing. • Registration and account creation: In order to enable you to use our services, we need to register you and create a user account for you. For this purpose, we process, in particular, your identification and contact details and the account settings that you enter during registration. Such processing is necessary for the performance of a contract, as without these data we would be unable to create your account or provide the services. The legal basis is therefore the performance of contractual obligations and, where applicable, your consent. • Provision of services and performance of the contract: We further use your data to ensure the ordinary operation of our services and all rights and obligations arising from the contractual relationship between us and you as the user. This includes, for example, enabling access to and operation of our trading platform, provision of the necessary tools and support, and enabling and evaluating your simulated trades. For this purpose, we process a broad range of data, in particular your identification and contact details, data concerning your use of the services, payment data (if paid services are involved), data relating to your fictitious trades and, where applicable, social media data (if you have linked your account). Certain specific processing after termination of active use of the services may take place on the basis of our legitimate interest, for example retention of necessary data for a limited period after you cease using the services for the purpose of protecting our rights (e.g. resolving possible disputes or complaints). The legal basis is the performance of contractual obligations and, where applicable, your consent. • Information notices and marketing communications: If you are one of our users, we may occasionally send you an e-mail containing commercial communications, for example information about our services, offers or information about events in which we participate. Such communications are sent only at a reasonable frequency and their content will always relate to products or services that you have previously used with us. Each e-mail of this kind will be clearly marked as a commercial communication and will contain a simple means of unsubscribing (for example, via an unsubscribe link). In addition, we may send you broader marketing communications if you grant us your consent to do so (for example, by ticking the option to subscribe to updates during registration). The legal basis is our legitimate interest in maintaining contact with users and informing them about related services (this applies to existing users in relation to similar services), and your consent (this applies to marketing beyond that scope or to non-users). Naturally, if you no longer wish to receive our communications, you may object or unsubscribe at any time, and we will cease sending you further marketing communications. • Customer support and communications: When you contact our customer support team with a question, request or issue, we use your personal data in order to assist you. We process identification and contact details (so that we can identify you and respond to you), the content of our mutual communication and, where applicable, further data arising in the course of handling your request. The same applies to communication through social media or other channels if you contact us in those ways. The legal basis is our legitimate interest in ensuring high-quality customer support, maintaining your satisfaction and supporting the full use of our services. • Improvement of services: In order continuously to improve our services, test new features and enhance security and user comfort, we also analyse data about how you use our services. This provides us with valuable feedback and supporting information for the development of new functionalities or improvement of existing ones. For these internal analyses, we primarily use technical data (such as information about your device), data about how you use our website and services, and information about your simulated trades. Such data are often aggregated or anonymised in order to protect your privacy to the greatest extent possible. The legal basis is our legitimate interest in improving and innovating our services for our users. • Analyses and statistics: In addition to the development of specific improvements, we also carry out more general analyses of user behaviour in order to understand how our website and services are used and what our users prefer. For this purpose, we may process different types of data in combination, ranging from your basic identification details to information concerning transactions on the trading demo account and, where applicable, payment data (if you use paid services). The output consists of statistical overviews that help us tailor our offering and content to users’ needs. The legal basis is our legitimate interest in evaluating user behaviour and adapting our services and marketing to users’ needs. • Compliance with legal obligations: We also process your personal data where necessary to comply with our legal obligations. Certain laws require us to retain specific data concerning users or transactions (for example, accounting and tax legislation requires us to retain invoices and payment records for a prescribed period). We may also be obliged to disclose your data to public authorities or other competent bodies on the basis of law or an enforceable decision (for example, in the course of criminal proceedings, tax audits, etc.). In such cases, we process only the data necessary to fulfil the relevant obligation and only for the period required by applicable legal regulations. The legal basis is compliance with a legal obligation to which we are subject.

We retain personal data only for as long as is necessary in view of the purposes for which they are processed, or for such period as is prescribed by law. Thereafter, the data are either securely erased or anonymised. The retention period varies depending on the nature of the data and the purpose of processing: • Duration of the contractual relationship: Data connected with the performance of the contract and use of our services are processed for the duration of the contractual relationship. Following termination of the contract, we retain your basic data for the period strictly necessary, but for no longer than 10 years from its termination. This period reflects the limitation periods applicable to potential legal claims; retention of certain information for a limited period is in our legitimate interest for the purpose of possible dispute resolution, complaints or legal proceedings. • Commercial communications after termination of the service: If we have provided services to you in the past, we may, on the basis of our legitimate interest, continue for a certain period to send you commercial communications (see above). We retain and use such data for marketing without obtaining fresh consent for no longer than 5 years following termination of the last contractual relationship, or until you object, unsubscribe, or withdraw your consent to such communications, whichever occurs first. If you unsubscribe, object, or withdraw consent, we will of course delete your contact details for this purpose without undue delay. • Data for service improvement: Information processed for the purpose of improving and testing our services is typically retained only for a short period. Usually, such data are aggregated over the last several months, but in any event for no longer than 12 months, in order to enable us to derive relevant conclusions from them. We generally do not need them for a longer period, as older data tend to lose relevance for improvement purposes. • Compliance with legal obligations: Data that we are required by law to retain are kept for the period prescribed by the relevant legislation. For example, accounting and tax documents containing your personal data (invoices, payment records) must be archived for 10 years from the date of issue. Similar statutory periods may apply to other documents. Upon expiry of the prescribed period, the data are securely destroyed, unless another legal ground for further processing exists. • Processing based on consent: Where particular processing takes place exclusively on the basis of your consent (for example, sending commercial communications), such processing continues for the period specified in the relevant consent or until such time as you withdraw your consent. Following withdrawal of consent, we shall erase the relevant data without undue delay, unless we need them for another legitimate purpose.

Our employees and cooperating persons who need access to your personal data for the performance of their duties, and who are bound by confidentiality obligations, may access your personal data. In addition, we may disclose or transfer your data to third parties where necessary for the operation of our services or where required by law. We always ensure, however, that our partners also comply with a high standard of personal data protection. Specifically, recipients of your data may include: • Platform operators: In order to enable you to engage in simulated trading, we share the necessary information with the provider of the trading platform on which you trade (for example, data necessary to create and administer your trading demo account). These providers then ensure the technical execution of your fictitious trades. • Suppliers and service providers ensuring operation of our website: We cooperate with a range of external companies that assist us in operating and maintaining our services. These include, for example, companies within our business group, hosting and cloud storage providers, payment gateway operators and financial service providers (for payment processing), IT solution suppliers and system administrators, providers of customer support tools, marketing and communication agencies, external advisers, and providers of postal and courier services (for delivery of physical documents). We transfer to all such entities only the data strictly necessary for the provision of the relevant service, and we have concluded data processing agreements with them in order to ensure the security of your data. • Persons to whom disclosure is made with your consent: In certain cases, you may instruct or authorise us to provide your data to further entities, for example partners with whom we cooperate or another controller at your request. In such cases, we will transfer the data in accordance with your consent. • Public authorities: We may be legally obliged to disclose your personal data to various public authorities or bodies if they request such data within the scope of their statutory powers. Typically, this may include the police, courts, administrative authorities or tax authorities. We will disclose data only where such disclosure is required by applicable legal regulations or an enforceable decision of the competent authority. All third parties to whom we transfer your data are contractually bound to confidentiality and to using the data exclusively in accordance with our instructions and applicable legal regulations. We do not transfer your personal data to any third parties for their own marketing purposes, nor do we sell them.

Our Company primarily processes data within the Czech Republic and the European Union. It may, however, occur that one of our suppliers or partners is established outside the European Union (or the European Economic Area) or stores data on servers located in such a “third country”. In such event, we will ensure that any transfer of your personal data abroad is carried out in compliance with the GDPR. This means that either the destination country ensures an adequate level of protection on the basis of an adequacy decision of the European Commission, or we conclude with the relevant recipient the Standard Contractual Clauses approved by the European Commission, or we rely on another appropriate transfer mechanism permitted by law (for example, the explicit consent of the data subject in a specific case). Accordingly, you need not be concerned about the security of your data even where they are processed outside the EU, as they will always remain subject to contractual and legal safeguards.

In connection with the processing of personal data, you are entitled to a number of rights, which you may exercise at any time. Below, we explain the individual rights so that you have a clear understanding of what each of them means. If you wish to exercise any of these rights, you may contact us by e-mail. We do not require any special form; an ordinary message stating your name, the right you wish to exercise and the measure you request will suffice. In order to prevent unauthorised handling of your data, we may, where necessary, request additional information to verify your identity. We respond to requests without undue delay and no later than within the statutory 30-day period (which may be extended in exceptional cases). Your principal rights include: • Right of access: You have the right to obtain confirmation as to whether or not we process your personal data and, if so, to receive information concerning the details of such processing. In particular, upon request, we will provide information on what personal data concerning you we retain, for what purposes, to whom they may have been disclosed, what the intended retention period is, etc. You also have the right to obtain a copy of the personal data being processed. The first basic copy will be provided free of charge. For any additional copies, we may charge a reasonable fee corresponding to the administrative costs. • Right to rectification: We take care to ensure that your data are current and accurate. If you discover that we hold incomplete or inaccurate information about you, you have the right to request that such information be corrected or completed. Upon receipt of your request, we will rectify inaccurate data without undue delay. If you maintain a user account with us, you may also update certain of your data (for example, contact details) directly after logging into your profile. • Right to erasure (“right to be forgotten”): In certain circumstances, you have the right to request that we erase your personal data. Upon your instruction, we will remove all data that we hold about you if one of the following conditions is met: o the data are no longer necessary for the purposes for which they were collected or otherwise processed; o you withdraw the consent on which the processing was based and there is no other legal ground for the processing (this applies where processing is based exclusively on consent); o you object to processing based on our legitimate interest and we determine that we no longer have overriding legitimate grounds for the processing, or you object to processing for direct marketing purposes (in which case we will always comply); o the personal data have been processed unlawfully (for example, where we processed them without an appropriate legal basis). If any of the above situations applies, we will erase your data upon request. Please note, however, that there are also statutory exceptions under which we may be unable to comply with an erasure request. This may occur, for example, where continued processing is necessary for compliance with a legal obligation (e.g. archiving invoices), for the establishment, exercise or defence of legal claims (e.g. ongoing litigation), or for other reasons provided for by the GDPR (e.g. protection of freedom of expression and information or public interest grounds). We will of course inform you of the reasons if we are unable to comply with your erasure request. • Right to restriction of processing: In certain situations, you may also exercise your right to restriction of processing. This means that you request that we temporarily merely store your data but do not otherwise actively process them. You may exercise this right, for example, if you contest the accuracy of the processed data (for the period necessary to verify their accuracy) or if you object to processing (pending verification whether our grounds override yours). You may also request restriction where the processing is unlawful but you do not wish the data to be erased, or where we no longer need the data but you require them for the establishment, exercise or defence of legal claims. During the period of restriction, we will only store the data and not otherwise process them (save for exceptions provided by the GDPR). You will be informed in advance before any restriction is lifted. • Right to data portability: The GDPR also grants you the right to data portability. Where we process your personal data by automated means (in electronic form) on the basis of your consent or in the performance of a contract, you have the right to receive such data from us in a structured, commonly used and machine-readable format (typically CSV, JSON, etc.) so that you may transmit them to another controller. Where technically feasible, you may also request that we transmit your data directly to another controller designated by you (provided that doing so does not adversely affect the rights of third parties). • Right to object: Where we process your personal data on the basis of our legitimate interest, you have the right to object at any time to such processing. You may raise such objection on grounds relating to your particular situation. If we receive such an objection, we will assess whether our legitimate interest in the processing overrides your rights and freedoms. If not, we will cease processing the relevant data. We will always comply with an objection to processing for direct marketing purposes (sending commercial communications) and will cease such processing immediately, meaning that your data will no longer be used for marketing purposes. We will inform you of the outcome of our assessment. • Right to withdraw consent: Where personal data are processed on the basis of your consent, you have the right to withdraw such consent at any time. Withdrawal may be effected as easily as consent was given, for example by sending us an e-mail or clicking the unsubscribe link in the footer of a commercial communication. Once consent has been withdrawn, we will cease processing the relevant data for the relevant purpose. Please note that withdrawal of consent affects only future processing and has no retroactive impact on the lawfulness of processing carried out before such withdrawal while the consent remained valid. • Right not to be subject to automated individual decision-making: You have the right not to be subject to a decision based solely on automated processing (i.e. without human intervention) if such decision produces legal effects concerning you or similarly significantly affects you. In simple terms, you have the right to human review of significant decisions concerning your rights and obligations. More information on whether automated decision-making takes place within our Company is set out in a separate section below. At present, we do not carry out any such purely automated decision-making. • Right to lodge a complaint with a supervisory authority: If you believe that we process your personal data in breach of applicable personal data protection laws, you have the right to lodge a complaint with the supervisory authority. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů). It may be contacted at Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, or electronically (e-mail: posta@uoou.cz, website: www.uoou.cz). We would, however, appreciate the opportunity to address any concerns directly with you first. The protection of your data is extremely important to us, and we would make every effort to remedy any shortcomings without delay. Nevertheless, the decision whether to contact the supervisory authority directly remains entirely yours.

We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures in order to protect your data against unauthorised access, misuse, loss or any other compromise. Your data are stored in secure information systems with restricted access, and sensitive databases are encrypted. Personal data are accessible only to authorised persons for whom such access is necessary, and all such persons are bound by confidentiality obligations. We regularly update our security procedures so that they reflect the latest threats. Should an incident affecting your data nevertheless occur despite all our efforts, we will proceed in accordance with the GDPR, in particular by adopting immediate remedial measures and, where the incident is of a more serious nature, informing you (and, where applicable, the supervisory authority) of the situation.

Within the scope of personal data processing carried out by our Company, we do not use any processes involving fully automated decision-making that would produce legal effects concerning the user or similarly significantly affect the user. This means that no important matters are decided solely by an algorithm or computer program without human assessment. All significant decisions (for example, evaluation of the success of your trading for progression to the next phase, etc.) are always reviewed by our staff. Should we, in the future, begin to use automated decision-making on a broader scale, we will do so only in compliance with applicable legal requirements and will inform you thereof in advance, including information regarding your available rights (for example, the right to obtain human intervention in the decision-making process).

The content of this Privacy Policy may be updated or amended in the future, in particular if required by changes in our services or changes in personal data protection legislation. If we make any material changes, we will notify you thereof in advance by appropriate means. Information regarding such update may, for example, be published on our website, within your user account (user section), or sent to you by e-mail. The new version of the policy will always be available on our website and shall become effective as of the date stated therein. We recommend that you review this page from time to time so that you remain informed as to how we currently handle your data. By continuing to use our services after the effective date of the new policy, you acknowledge such changes. This Privacy Policy is valid and effective as of 1 January 2026.

Users of the TRONEXO trading platform have the right to request the permanent deletion of their account and all associated personal data at any time. HOW TO REQUEST ACCOUNT DELETION To submit an account deletion request, please send an email to: support@tronexo.com The request must be sent from the email address associated with your TRONEXO account. This is required to verify your identity and ensure the security of your account. WHAT TO INCLUDE IN YOUR REQUEST

Your email should contain:
• A clear statement that you wish to delete your account (e.g. "I request the permanent deletion of my TRONEXO account.")
• Your registered email address (if different from the sender address)
• Any additional identification details if requested by our support team.

PROCESSING TIME All account deletion requests are processed within 24 hours of receipt. You will receive a confirmation email once your account and associated data have been successfully deleted. WHAT GETS DELETED

Upon confirmed deletion, the following data will be permanently removed:
• Your TRONEXO user account and login credentials
• Personal profile information
• Any stored preferences and settings linked to your account

Please note that certain data may be retained for a limited period where required by applicable law or regulatory obligations (e.g. financial records). CONTACT For any questions regarding account deletion or data privacy, contact us at: support@tronexo.com