PRIVACY NOTICE

Santiment GmbH with registered office at Dammstrasse 16, 6300, Zug, Switzerland (hereinafter the “Company”) collects personal data (as defined below) in compliance with applicable laws and regulations, in particular Swiss Federal Act on Data Protection (“FADP”).

1. Definitions

Pursuant to the FADP, the terms indicated below have the following meanings:

• “Personal data” any information relating to an identified or identifiable natural person.
• “Personal data requiring particular protection” personal data requiring particular protection: (i) data on religious, philosophical, political or trade union-related opinions or activities, (ii) data concerning health, the intimate sphere or racial or ethnic origin, (iii) genetic data, (iv) biometric data that uniquely identifies a natural person, (v) data on administrative and criminal proceedings or sanctions, (vi) data on social security measures.
• “Processing” any operation or set of operations, carried out with or without the aid of automated means, which apply to (groups of) personal data, including the collection, recording, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure, communication by transmission or any other form of making available, alignment or interconnection, limitation, erasure or destruction.
• “Controller” means a private person who or federal body which, alone or jointly with others, determines the purpose and the means of processing personal data.
• “Processor” means a private person or federal body that processes personal data on behalf of the controller.
• “Data subject” means a natural person whose personal data is processed.

2. Type of personal data acquired, purpose, legal basis and data storage

The Company uses the websites available at the following address: https://santiment.net/ and https://app.santiment.net/ (hereinafter the “Websites”) to provide the relevant services (hereinafter, the “Service”).

If you provide, for the performance of the contract with the Company, personal data relating to members of your family or other interested parties, you assume responsibility for the disclosure of such data to us and confirm that you have their consent to share the relevant data.

3. To whom will the collected data be communicated?

The Company will only disclose your personal data in compliance with the provisions of FADP, if the Company is obliged to do so to provide the Services or to comply with our legal or regulatory obligations, for business, administrative or contractual reasons or because you have instructed us to do so. When sharing Personal Data the Company complies with the principles of purpose limitation and minimization. In this regard, the recipients of Personal Data will act as data processors or data controllers. This also includes disclosure to:

• third-party providers of assistance and consulting services in the field of (without limitation) technology, accounting, administration, legal, insurance;
• within the Company; and
• entities and public authorities whose right to receive personal data is expressly granted by law, regulations or by an act issued by a competent authority.

To receive the list of all data processors, please contact us at the following address: [email protected].

4. How the Company processes Personal Data

The Company processes Personal Data by electronic means, according to the principles provided by the FADP including but not limited to honesty, transparency and fairness. The Company has adopted technical and organizational measures to ensure an adequate level of security, including against accidental or unlawful destruction, loss, alteration or unauthorized disclosure. Such measures are proportionate to the level of risk assessed by the Company in relation to the processing of personal data for the purpose of promoting and providing the Services.

With respect to the Services, the Company provides an AI assistant (“Chatbot”). This Chatbot uses large language models (“LLMs”), which may be operated in-house or provided by third-party suppliers, to process user queries, retrieve data from the Company’s databases, and generate responses. Such Chatbot operates through the Website and one or more instant messaging platform(s).

5. Can the Company transfer data to a third country and/or international organizations?

The Company may engage one or more third-party providers that transfer data out of Switzerland. In case the Company transfers data outside of Switzerland, it will make sure that all necessary and appropriate measures are taken. Such measures include official Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCR) or any other instrument to safeguard the data protection of the Data Subjects outside the EEA. Where applicable, the Company will ensure that third-party providers will rely on the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

Where the Company uses third-party LLM providers, user query data and relevant contextual information may be transmitted to such providers for processing. These providers are located outside Switzerland and the EEA. Such transfers are subject to appropriate safeguards, including standard contractual clauses pursuant to Art. 16 FADP.

The Company has concluded the relevant agreement with the third-party data processors and providers of these third-party LLM providers, which to the best of Company’s knowledge guarantee data protection, data security and confidentiality. The Company does not use any data to train or develop any AI algorithms. The Company currently uses the following LLM providers:

• PostHog
• OpenRouter
• OpenAI

6. No automated individual decision-making, including profiling

Notwithstanding the other sections of this Notice, the Service of the Company does not take any decision based solely on automated processing which has a legal consequence for or a considerable adverse effect on the data subjects, including profiling which produces legal effects on such data subjects, therefore the data subjects are not subject to any automated individual decision-making, including profiling under Art. 21 of the FADP.

AI Disclosures

As the Chatbot is powered in whole or in part by third-party LLM providers, queries and associated data may be transmitted to those providers for processing. All such providers act as data processors under a data processing agreement and are bound by appropriate safeguards.

Users are advised to refrain from including sensitive personal data or personal data of third parties in queries submitted to the Chatbot.

Where a user inputs personal data relating to one or more individuals, the Company shall act solely in its capacity as data processor and not as data controller, and any responsibility for identifying and relying upon an appropriate legal basis for the processing of such personal data shall rest exclusively with the controller. The Company shall act, to the extent materially possible in light of the current state of the art of Chatbot and AI and related tools, to ensure compliance with FADP and, in particular, to ensure that data is processed on the basis of adequate legal grounds. However, the Company cannot be held liable for any processing of personal data within the Chatbot over which it has no control, including, for example, the input of personal data without, or on the basis of an inadequate, legal basis for processing.

Third-party LLM providers may be located outside Switzerland. Any such transfers are carried out in accordance with the safeguards described in section 5 above, including standard contractual clauses where applicable.

The Chatbot is designed to provide information and analysis based on available and proprietary information. The Chatbot does not autonomously make decisions with legal or similarly significant consequences for users. All outputs are informational only. Users should exercise their own judgement when acting on any information provided through the Chatbot.

Responses generated by the Chatbot are produced by automated systems. While Santiment takes reasonable steps to ensure the quality and accuracy of the underlying data, AI-generated responses may contain errors, limitations, or outdated information. The Company does not guarantee accuracy, completeness, or fitness for any particular purpose of AI-generated content.

When using the Chatbot, users are interacting with an automated system, not a human representative of the Company. This disclosure is made in accordance with applicable transparency requirements.

Query data and interaction logs generated through the Chatbot are retained for a period consistent with the applicable retention periods set out in the table in Section 2 above or in accordance with the data processing agreement in force between the Company and the relevant data processor where applicable, and in any event for no longer than is necessary for the purposes described in this section, or as required by applicable law.

7. Children personal data

The Company does not address our Services to children under the age of 16. The Company does not intend to, or knowingly, collect or solicit personal information from children under the age of 16. Furthermore:

• if a data subject, a user of the Services or a prospect is under the age of 16, such individual shall not use the Service or the Websites, otherwise provide us with any personal data either directly or by other means.
• if a minor has provided personal data to us, the Company encourages the child’s parent or the legal representative of such child to contact us and request the deletion of the personal data from our systems.
• if the Company learns that any personal data the Company collects has been provided by a child under the age of 16, the Company will promptly delete that personal information.

8. Rights of Data Subjects

Under data protection law, you have a number of rights in relation to your personal data. You have the right to request access, rectification or deletion of such information, the right to limit or object to processing and, in certain circumstances, the right to data portability (right to receive personal data in a commonly used electronic format or have it transferred to another controller). If your consent is necessary, you can revoke it at any time. If you wish to exercise the above rights, you can send a communication to:

Santiment GmbH, Dammstrasse 16, Zug, 6300, Switzerland.

e-mail: [email protected]

The Company will try to answer them within 30 days, as provided by the law, although the Company reserves the right to extend this period for more complex requests. The Company reserves also the right to charge a reasonable administrative fee for any requests that are manifestly unfounded or excessive, and for any additional copies of the personal data requested.

You may also contact the Federal Data Protection and Information Commissioner (FDPIC) if our response does not satisfy you: https://www.edoeb.admin.ch/edoeb/en/home/deredoeb/kontakt.html tel. +41 58 464 94 10, [email protected].

The Company may amend this privacy notice, also as a consequence of amendments in the applicable law, including the FADP. In this case, the Company may provide you with prior notice in case of any amendments to this privacy notice.