AML/KYC CUSTOMER CLAIMS PORTAL

PRIVACY NOTICE

Effective Date: July 13, 2024

Last Updated: January 22, 2025

SCOPE AND OVERVIEW

We at FTX Trading Ltd. and the FTX Recovery Trust (and any of their respective successors), together with

our non-debtor affiliates that determine, whether alone or jointly with another, the purposes and means of

the processing of personal data under applicable laws (collectively, “FTX,” “we,” “us” or “our”) have created

this AML/KYC Customer Claims Portal (“Portal”) Privacy Notice (this “Privacy Notice”) to explain how your

personal data is used and shared.

This Privacy Notice applies to all personal data, including sensitive personal data that is collected from FTX

customers who submit information to FTX for (i) Know-Your-Customer (‘KYC”) and Anti-Money Laundering

(“AML”) customer identification and fraud prevention purposes, (ii) tax purposes and (iii) administration

purposes through the Customer Claims Portal in order to enable customer claims and distributions to be

processed and monitored.

COLLECTION AND PURPOSE OF PROCESSING PERSONAL DATA

In connection with the processing and monitoring of claims and distributions, FTX or its third-party vendors

may collect certain categories of personal data (i) for administrative or tax purposes, (ii) to prevent fraud and

money laundering or (iii) to verify your identity. We collect data that you provide to us directly, when you use

our Portal and services, and from other sources such as third-party services and organizations, as

described below. We will also use your personal data for assessing and calculating what, if any, rebate you

might be entitled to from your account holdings.

A. Information You Provide to Us Directly

We may collect the following personal data that you provide to us.

• Identification information: First and last name, date and place of birth, gender, phone number, email,

  address and proof of address, government identification number (including Social Security number,)

  driver’s ( license number and passport number), nationality, citizenship, and any other information

  necessary to verify your identity to comply with our regulatory obligations under financial crime

  prevention or anti-money laundering laws;

• Institutional information: If you are an institutional customer, we may collect your institution’s legal

  name, Employer Identification number (or comparable number issued by a government), and

  dentification information for all material beneficial owners;

• Financial information: Bank account information, transaction history, trading data and/or tax

  identification, source of funds/wealth;

• Biometric Data: photos of a face (including selfie images) and photo or scan of a facial image on the

  dentification document and, in some cases, any video footage;

B. Information Collected Automatically (Use of Cookies)

We may collect personal data automatically when you use our Portal:

• Identification information: First and last name, date and place of birth, gender, phone number, email,

  address and proof of address, government identification number (including Social Security number,)

  prevention or anti-money laundering laws;

• Institutional information: If you are an institutional customer, we may collect your institution’s legal

  name, Employer Identification number (or comparable number issued by a government), and

  dentification information for all material beneficial owners;

• Financial information: Bank account information, transaction history, trading data and/or tax

  identification, source of funds/wealth;

• Biometric Data: photos of a face (including selfie images) and photo or scan of a facial image on the

  dentification document and, in some cases, any video footage;

C. Information Collected from Other Sources

We may obtain information about you from other sources, including through third-party services and

politically exposed persons, individuals subject to economic sanctions, country-specific sanctions lists (e.g.,)

be screened against other media and news sources. The personal data you provide, we collect from you, or

we receive from third parties will be used to prevent fraud and money laundering, and to verify your identity.

COLLECTION AND PURPOSE OF PROCESSING SENSITIVE PERSONAL

DATA, INCLUDING BIOMETRIC DATA

FTX or its third-party vendors may collect certain information, including a photo or video of a face or a photo

or scan of a face on an identification card that is used to analyze numerical facial features and create a scan

of facial geometry (“Biometric Data”) along with technical data, such as software and hardware attributes of

the camera used to take the photo or video; a unique identifier, such as an Applicant ID; and geolocation

data, such as IP addresses and general geographic location (e.g., city, country) from a device. Processing

Biometric Data for the purpose of uniquely identifying a natural person is considered Sensitive Personal

documents, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, among

others.

INDIVIDUAL RIGHTS AND HOW TO EXERCISE THEM

Depending on the applicable data protection laws or regulations, individuals may have the following rights

with respect to personal data, including Sensitive Personal Data:

• To request access to personal data, and be provided with it in permanent form.
• To request correction of personal data that is inaccurate or incomplete.
• To request deletion of personal data to the extent permitted by law
• To request the restriction of the processing of personal data.
• To request the restriction of the processing of personal data.
• To request that we disclose to you:

• To not be subject to a decision based solely on automated processing based on profiling or

  otherwise that has a legal or significant effect.

• To not receive discriminatory treatment for the exercise of any of the foregoing rights.

For further information, or to exercise the rights listed above, please contact FTX at dataprivacy@ftx.com.

You may designate an authorized agent to make a request on your behalf pursuant to this Privacy Notice or

applicable law. Prior to completing a request made by such an authorized agent, we require that you

provide your authorized agent with written permission to submit such a request and require that you or your

individuals may also be entitled to appeal our decisions with regard to their requests by contacting us at

dataprivacy@ftx.com or lodge a complaint with the competent supervisory authority in the appropriate

jurisdiction.

FTX may update this Privacy Notice from time to time to reflect changes in its practices or applicable laws

and regulations. The updated version will be made available on our Portal and website, and we encourage

you to review it periodically.

If you have any questions concerning this Privacy Notice, please contact FTX at dataprivacy@ftx.com or

by writing to:

FTX Trading LTD.

125 Broad Street

New York, New York 10004-2498

Attention: FTX Mail Room