Privacy Policy.

This Privacy Policy (the “Policy”) describes how Uruk, a limited liability company organized under the laws of the Republic of the Marshall Islands (“Uruk”, “we”, “us” or “our”), collects, uses, shares and protects information processed in connection with access to and use of the Uruk protocol, the Uruk application programming interface and the web interface available at uruk.finance (collectively, the “Services”).

Capitalized terms not defined in this Policy have the meanings given to them in Uruk's Terms and Conditions. This Policy applies only to the Services operated by Uruk. It does not apply to third-party applications, interfaces or services, including those of Partners.

By accessing or using the Services, you acknowledge that you have read and understood this Policy.

Uruk is a non-custodial software infrastructure. We collect the minimum data necessary for the proper functioning of the Services, their security and compliance with our legal obligations. In particular:

• we do not require any personally identifiable information (name, postal address, email address, telephone number) to use the Interface;
• we do not use cookies for advertising or behavioral targeting;
• we do not link any wallet address to an off-chain identity, unless you provide that information yourself;
• we do not sell, rent or monetize any User data.

2.1 Uruk

Uruk acts as data controller for the data processed in connection with the Interface and the contractual relationship with Partners, as described in Article 3.

2.2 Partners

Each Partner is solely responsible for processing the personal data of its own customers, including for customer onboarding, know-your-customer (KYC) checks and anti-money laundering purposes. In accordance with the Terms and Conditions, Uruk does not require and does not receive any personal data of Partners' customers. For any question about such data, a Partner's customers should contact that Partner directly and consult its own privacy policy.

3.1 Public blockchain data

When you connect a compatible wallet to the Interface, we may process:

• your public wallet address;
• your interactions with the Smart Contracts (minting, redemption, liquidation, pool participation);
• blockchain event logs and transaction identifiers.

This data is public by nature and permanently recorded on the blockchain. We use it to display your positions and Collateral, show transaction history, produce aggregate statistics on Protocol usage and screen addresses associated with sanctioned or illicit activity. For this purpose, we may use blockchain analytics providers.

3.2 Technical data

When you visit the Interface, we may collect limited technical data:

• your IP address, used for security, abuse prevention and enforcement of the geographic restrictions set out in the Terms and Conditions;
• browser type and version, device type and operating system;
• language preferences, referring pages and timestamps;
• approximate location, at country or regional level.

Audience measurement data is processed in aggregate form, using privacy-preserving tools, and is not linked to your wallet address.

3.3 Data you provide to us

If you contact us, submit a form or subscribe to a mailing list, we may store your email address, your name if provided, the content of your message and your responses to any surveys. We use this information only for the purpose for which you provided it and do not link it to your on-chain activity.

3.4 Data of Partner representatives

In connection with our relationship with Partners, we process the business contact details of their representatives (name, position, business email address, telephone number) and the information needed to verify their licenses, manage the Partner Agreement and secure access to the API.

We process data for the following purposes:

• Operation of the Services: enabling interaction with the Smart Contracts, displaying Protocol data and ensuring the reliability of the Services, based on our legitimate interest in providing functional Services or on the performance of a contract.

• Security and abuse prevention: detecting unauthorized use, attacks and abnormal behavior, based on our legitimate interest.

• Compliance: enforcing geographic restrictions, screening addresses against sanctions regimes and responding to lawful requests from authorities, based on our legal obligations and our legitimate interest.

• Partner relationship: entering into and performing Partner Agreements, based on the performance of a contract.

• Improvement of the Services: analyzing usage in aggregate to improve the Interface and prioritize development, based on our legitimate interest.

• Communication: sending you the information you have subscribed to, based on your consent, which you may withdraw at any time.

We do not process your data for advertising profiling or for automated decision-making producing legal effects concerning you.

The Interface only uses cookies and similar technologies that are strictly necessary for its operation and security. Audience measurement tools are configured without cookies or, where required by law, are only activated with your consent. You can block cookies through your browser settings, although this may limit certain features.

We do not sell or share your data for commercial purposes. We may, however, disclose it in the following limited circumstances:

6.1 Service providers

We use technical service providers (hosting, blockchain nodes and endpoints, analytics tools, blockchain analytics providers, email services) that process data on our behalf, only to the extent necessary to operate the Services. These providers are contractually required to use the data only for our purposes and to protect it.

6.2 Legal obligations and protection of our rights

We may disclose limited data to comply with a legal obligation, a court order or a request from a competent authority, to respond to a regulatory inquiry, or to investigate and prevent fraud, abuse or breaches of the Terms and Conditions.

6.3 Corporate transactions

In the event of a restructuring, merger, acquisition or sale of all or part of Uruk's business, data may be transferred to the relevant entity, which will be required to honor privacy commitments equivalent to those in this Policy.

Uruk and its service providers may process data in countries other than your country of residence, whose laws may offer a different level of protection. Where required by law, these transfers are subject to appropriate safeguards, such as standard contractual clauses.

• Blockchain data: it is permanently recorded on a public ledger that Uruk does not control.

• Technical data and security logs: they are retained for a maximum of twelve (12) months, then deleted or anonymized. Aggregate, anonymous statistics may be retained indefinitely.

• Data you provide to us: it is retained for as long as necessary to handle your request, or until you unsubscribe.

• Data of Partner representatives: it is retained for the term of the Partner Agreement and thereafter for the applicable limitation period.

These periods may be extended where required by law or for the establishment, exercise or defense of legal claims.

In accordance with the Terms and Conditions, the Services are not offered to U.S. Persons, to persons located in a Restricted Jurisdiction, or to persons listed on a sanctions list of the United States, the United Nations, the European Union or the United Kingdom. The processing of IP addresses and the screening of wallet addresses serve in particular to enforce these restrictions.

Subject to applicable law, including the General Data Protection Regulation where it applies, you have the following rights regarding your personal data: the right of access, rectification, erasure, restriction of processing, objection and portability, as well as the right to withdraw your consent at any time where processing is based on it.

You can exercise these rights by writing to contact@uruk.finance. We may ask you for information to verify your identity. You also have the right to lodge a complaint with the data protection authority of your country of residence.

You can disconnect your wallet at any time: no personal account or profile is created on the Interface. Due to the nature of public blockchains, Uruk cannot modify or delete data recorded on the blockchain.

We implement reasonable, industry-standard technical and organizational measures to protect the data we process. As no system is perfectly secure, however, we cannot guarantee absolute security.

You are solely responsible for the security of your wallet, private keys and recovery phrase. Uruk has no access to them and will never ask you for them.

The Services are not intended for persons under the age of 18. We do not knowingly collect data relating to them. If we learn that such collection has occurred, we will delete that data as soon as possible.

We may amend this Policy to reflect changes in the law, our practices or the Services. The current version is published on uruk.finance with its date of last update. Material changes are announced on the Interface or through our official channels.

For any question or request regarding this Policy or your data: contact@uruk.finance.