Privacy Policy

Preamble

WonderLive Sàrl (hereinafter "WonderLive", "we" or "our") is committed to protecting the privacy of its users. This privacy policy describes how we collect, use, share, and protect your personal data in accordance with the General Data Protection Regulation (GDPR), the new Swiss Federal Act on Data Protection (nFADP), the Digital Services Act (DSA), and the Swiss Blockchain and Digital Assets Services Act (LSBA).

This policy applies to all services provided by WonderLive, including the wonderlive.io website, the WonderLive platform, the mobile application, and all related services.

1

Categories of Data Collected

We collect different categories of personal data depending on your use of our services:

Identity Data

First name, last name, username
Date of birth
Nationality
Identity document (for KYC verification)
Profile photo

Contact Data

Email address
Phone number
Postal address
Social media accounts

Financial Data

Blockchain wallet address
Transaction history
Payment information
Tax data (if required)

Technical Data

IP address
Browser and device type
Operating system
Login data
Cookies and similar identifiers

Usage Data

Platform interactions
Content viewed and created
Preferences and settings
Gamification data (points, levels, badges)

2

Legal Bases for Processing

We process your personal data on the following legal bases:

Consent (Art. 6(1)(a) GDPR)

For sending marketing communications, use of non-essential cookies, and processing of sensitive data.

Contract Performance (Art. 6(1)(b) GDPR)

For providing our services, managing your account, and processing your transactions.

Legal Obligation (Art. 6(1)(c) GDPR)

For compliance with KYC/AML obligations, tax compliance, and responding to requests from authorities.

Legitimate Interest (Art. 6(1)(f) GDPR)

For platform security, fraud prevention, service improvement, and statistical analysis.

3

Purpose of Processing

Your personal data is processed for the following purposes:

Creating and managing your user account
Providing and improving our services
Processing transactions and blockchain operations
Identity verification (KYC) and regulatory compliance
Anti-money laundering (AML) and fraud prevention
Communicating with you about our services
Sending newsletters and marketing communications (with consent)
Personalizing your user experience
Statistical analysis and platform improvement
Compliance with our legal and regulatory obligations
Dispute management and exercise of our rights

4

Data Recipients

Your personal data may be shared with:

Internal Teams

Authorized members of our team who need access to your data to perform their functions (customer support, compliance, technical).

Processors

Hosting and cloud providers (Digital Ocean, AWS)
Payment providers and financial services
KYC/AML solution providers
Analytics and audience measurement tools
Communication services (email, notifications)

Authorized Third Parties

Regulatory, judicial, or tax authorities when required by law, as well as auditors and professional advisors subject to confidentiality obligations.

We never sell your personal data to third parties.

5

International Data Transfers

Your data may be transferred to countries outside Switzerland and the European Economic Area. In such cases, we ensure that:

The destination country offers an adequate level of protection recognized by competent authorities
Standard Contractual Clauses (SCCs) approved by the European Commission are in place
The recipient is certified under a recognized protection framework
Your explicit consent has been obtained for the transfer

Additional security measures are implemented in accordance with EDPB (European Data Protection Board) recommendations.

6

Data Retention Duration

We retain your personal data only for as long as necessary for the purposes for which it was collected:

Account Data

For the duration of your relationship with us, then 5 years after account closure.

Transaction Data

10 years in accordance with anti-money laundering legal obligations.

KYC Documents

10 years after the end of the business relationship, in accordance with Swiss regulations.

Marketing Data

3 years after the last active contact, or until withdrawal of your consent.

Technical Logs

12 months maximum, unless a security incident requires longer retention.

7

Your Rights

In accordance with GDPR and nFADP, you have the following rights:

Right of Access

Obtain confirmation that your data is being processed and access a copy of it.

Right to Rectification

Have your inaccurate or incomplete personal data corrected.

Right to Erasure

Request deletion of your data in certain circumstances ("right to be forgotten").

Right to Restriction

Restrict the processing of your data in certain cases.

Right to Portability

Receive your data in a structured format and transmit it to another controller.

Right to Object

Object to the processing of your data on legitimate grounds.

Withdrawal of Consent

Withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

Automated Decisions

Not be subject to a decision based solely on automated processing that produces legal effects.

To Exercise Your Rights

Send your request to: privacy@wonderlive.io

We will respond within a maximum of 30 days. This period may be extended by 60 days for complex requests, in which case you will be informed.

8

Data Security

We implement appropriate technical and organizational security measures to protect your data:

Encryption of data in transit (TLS 1.3) and at rest (AES-256)
Multi-factor authentication (MFA) for account access
Strict role-based access controls
Continuous monitoring and intrusion detection
Regular backups and disaster recovery plans
Periodic security audits and penetration testing
Staff training on data protection

In the event of a data breach likely to result in a high risk to your rights, we will notify you as soon as possible in accordance with legal requirements.

9

Creator-Specific Data

If you are a creator on our platform, we also collect:

Content you create and publish
Engagement and performance statistics
Revenue and compensation data
Information about your community and followers
Verification and authentication data

Some of this information may be made public according to your profile settings.

Content is subject to our moderation rules and may be analyzed to detect violations of our terms of use.

10

Protection of Minors

WonderLive places particular importance on protecting minors and their personal data.

Minimum age requirement

Our services are reserved for persons aged 18 years and older. We do not knowingly collect personal data from minors.

Age verification

Mandatory age declaration during registration
KYC verification for payment features
Automatic inconsistency detection systems
Right to request proof of age in case of doubt

If a minor account is discovered

Immediate account suspension
Deletion of all personal data within 72 hours
Notification to parents/guardians if contact available
No data retention beyond legal obligations

Rights of parents and guardians

Request deletion of a minor's data
Report an account suspected of belonging to a minor
Obtain information about our protection measures

Reporting

If you believe a minor is using our services or that we have collected data from a minor, contact us immediately:

minors@wonderlive.com

WonderLive commits to processing any request concerning minors within a maximum of 48 hours.

11

Cookies and Similar Technologies

We use cookies and similar technologies to improve your experience:

Essential Cookies

Necessary for website operation (authentication, security, preferences). They cannot be disabled.

Analytics Cookies

To understand how you use our site and improve our services (Google Analytics 4). Only activated with your consent.

Marketing Cookies

To offer you relevant advertisements and measure their effectiveness (Meta Pixel). Only activated with your consent.

You can manage your cookie preferences at any time via the "Manage my cookies" link available at the bottom of each page.

Non-essential cookies are only placed after your explicit consent via our cookie banner.

12

Marketing and Communications

With your consent, we may send you:

Newsletters about WonderLive news
Information about new features
Promotional offers and opportunities
Event invitations

You can unsubscribe at any time by clicking the unsubscribe link in each email or by contacting us directly.

Transactional communications (confirmations, security alerts) are not subject to this consent as they are necessary for providing our services.

13

Jurisdiction-Specific Rights

European Union Residents

You benefit from all rights provided by GDPR. You may file a complaint with your national data protection authority.

Swiss Residents

Your rights are protected by nFADP. You may contact the Federal Data Protection and Information Commissioner (FDPIC).

Other Jurisdictions

Depending on your place of residence, you may have additional rights under local data protection laws.

14

Validity and Updates

This privacy policy is effective from its publication date. We reserve the right to modify it at any time.

In case of substantial modification, we will inform you by email or via a notification on the platform at least 30 days before the changes take effect.

Your continued use of our services after the effective date of modifications constitutes acceptance of the updated policy.

15

Contacts

Data Controller

WonderLive Sàrl

Rue du Centre 136, 1025 St-Sulpice VD, Switzerland

Data Protection Officer

dpo@wonderlive.io

Privacy Questions

privacy@wonderlive.io

Supervisory Authority

Federal Data Protection and Information Commissioner (FDPIC)

Feldeggweg 1, 3003 Bern, Switzerland

16

Final Provisions

Due to the immutable nature of blockchain technology, certain data recorded on-chain cannot be modified or deleted. We will inform you of the implications before any data is recorded on the blockchain.

Our services are not intended for persons under 18 years of age. We do not knowingly collect personal data from minors.

This policy is governed by Swiss law. Any dispute shall be subject to the exclusive jurisdiction of the courts of the Canton of Vaud, Switzerland.