Swiit Data Privacy Policy

1. Introduction

Welcome to Swiit, a global fintech service provided by the Sweet Intelligence group of companies. We value your privacy and are committed to protecting your personal data.This Data Privacy Policy ("Policy") explains how Swiit ("we," "us," or "our") collects, uses, discloses, and transfers personal data in connection with our services and mobile applications (the "Services"). It also outlines how we comply with various data protection laws, including the EU General Data Protection Regulation (GDPR), the Singapore Personal Data Protection Act 2012 (PDPA), U.S. laws like the Gramm-Leach-Bliley Act (GLBA) and Bank Secrecy Act (BSA), and other applicable regulations. We have structured this Policy to be clear and user-friendly, with sections addressing who we are, what data we collect, why and how we use it, how we share and transfer it across borders, your rights regarding your data, how long we retain data, and how we secure it.

By using Swiit's Services, you acknowledge that you have read and understood this Policy. We may update this Policy from time to time to reflect changes in our practices or legal requirements. If we make material changes, we will notify you by appropriate means (e.g. via our app or website). The current version of this Policy is always available through our app/website, and your continued use of the Services after an update indicates your acceptance of the revised Policy.

2. Who We Are

Swiit is a financial technology service application offered through a group of affiliated legal entities. These entities work together to provide the Swiit apps, website and related services, and each plays a specific role in handling your data. In this Policy, when we refer to "Swiit," we mean all entities collectively. Below is who we are and what each entity does:

Unified Privacy Commitment: For purposes of this Privacy Policy, "Swiit" refers collectively to SII, SIPTE, and SIL. All these entities work together to provide you with a seamless service. We have internal agreements and controls in place to ensure that regardless of which entity is handling your information, your data is protected consistently and lawfully. We present a unified approach under the Swiit brand, while each entity carries out its respective responsibilities in compliance with local regulations. (In practice, one entity may delegate certain data processing tasks to another under inter-company agreements, but your rights and protections remain the same.) This unified policy applies to all personal data collected by any Swiit entity in connection with our services.

3. Categories of Personal Data Collected

We collect various categories of Personal Data in order to provide and improve our Services, to comply with legal requirements, and for other purposes described in this Policy. In this Policy, "Personal Data" (or "personal information") means any information relating to an identified or identifiable individual, as defined under relevant privacy laws. Other capitalized terms may be defined within this Policy or under applicable law. This Policy covers all such Personal Data, whether collected from you directly, generated through your use of our Services, or obtained from third-party sources. The types of Personal Data we may collect include, but are not limited to, the following:

4. Purposes of Processing Personal Data

We collect and process Personal Data for a variety of purposes in connection with operating the Swiit Services and our business. Below we describe the key purposes for which we use your Personal Data, as well as the legal bases that make such processing lawful under applicable regulations (for example, GDPR, PDPA, and relevant U.S. laws or other relevant statutes). Depending on the context, more than one legal basis may apply to the same piece of Personal Data.

Lawful Bases Summary: Depending on your jurisdiction, the concept of "lawful basis" for processing may or may not apply in the same way. We have outlined above the common bases such as Consent, Contractual necessity, Legal Obligation, Legitimate Interests , and Public Interest. In all cases, we ensure that we have a permissible ground under relevant law to handle your Personal Data. If at any time you have questions about the legal basis for a particular processing activity, you may contact us for more information (see the "Contact Us" section below).

5. Disclosure of Personal Data to Third Parties

We treat your personal data with care and confidentiality. We will never sell or rent your personal information to third parties. However, in order to run the Swiit service and comply with our legal and contractual obligations, we do need to share your data with certain trusted parties. We disclose personal data only to the extent necessary and with safeguards in place. The key categories of parties with whom we share data are:

In all cases of third-party disclosure, we strive to share only the minimum necessary information to fulfill the purpose. We also ensure that any third party handling Personal Data on our behalf (i.e., our processors) are contractually obligated to implement adequate privacy and security measures to safeguard your data. Aside from the scenarios above, we will not disclose your Personal Data to any unauthorized third party without your consent.

6. Data Subject Rights and Choices

You have certain rights and choices regarding your Personal Data under applicable privacy laws. Swiit is committed to respecting and facilitating your rights. The availability of specific rights may vary depending on your jurisdiction. In general, subject to legal conditions and exceptions, you have the following rights:

How to Exercise Your Rights: Most rights can be exercised by sending us a request at our contact point (see Contact Us section). To protect your security, we will need to verify your identity (for example, by confirming ownership of your email or phone, or asking for certain identifying info) before fulfilling a request. We will respond as soon as possible, generally within 30 days or the timeframe required by law. If we need more time or cannot comply with a request, we will explain the reasons. For instance, if you request extensive data under access right, we might ask for a bit more time; if you request deletion of data we must keep, we will explain the legal obligation. We do not discriminate against users for exercising their privacy rights – the services and pricing you receive will remain the same.

Keep in mind that some of your information might be controlled by you directly – for example, you may delete or modify content you posted within the app, or change your settings – without needing to contact us. We encourage you to make use of those options as well.

7. International Transfers of Personal Data

Swiit is a global service and, as such, your Personal Data may be transferred to and stored in multiple countries. We understand that cross-border data transfers must be done in compliance with applicable data export and privacy regulations. This section outlines how we handle international transfers and the safeguards we implement to protect your Personal Data when it moves outside of its country of origin.

Global Operations & Data Locations: The personal data we collect from you may be processed outside of your home jurisdiction, including in countries that may not provide the same level of data protection as the laws in your country. In particular, Swiit's primary operations (including servers and support infrastructure) may be located in the United States and other locations. For example, if you are in Singapore or another country, your data will likely be transferred to our cloud servers in the U.S. (or other regions where our service providers maintain facilities) for processing. Additionally, as part of providing financial services, your data will be shared with Zenus Bank in the United States. This means Personal Data initially collected in your country will cross international borders in order to be used and stored by Zenus and by our systems.

Equivalent Protection: Regardless of where we process data, we apply consistent privacy safeguards. If Personal Data is transferred to a country with data protection standards different from those in your jurisdiction, we will take appropriate measures to ensure an equivalent level of protection for that data. For instance, we treat all Personal Data in line with the principles of this Policy and applicable law, no matter where it resides. Our employees and contractors across all locations are trained on confidentiality and data protection requirements.

Safeguards for EU/UK Personal Data: If we ever collect personal data directly from individuals in the European Economic Area ("EEA"), United Kingdom, or other regions with cross-border transfer restrictions, we will ensure that such data is transferred in compliance with those jurisdictions' requirements. Typically, this means that if we send EEA or UK personal data to a country not deemed "adequate" by the European Commission (such as the U.S.), we will rely on approved transfer mechanisms. The most common mechanism we use is the Standard Contractual Clauses (SCCs) adopted by the European Commission (and the UK International Data Transfer Addendum, as needed). These are contractual commitments between data transferors and transferees that obligate us and the recipient to protect the personal data to EU GDPR standards. We may also rely on other safeguards or derogations where appropriate, such as the necessity of transfer for performance of a contract with you, or obtaining your explicit consent for the transfer, in each case in accordance with EU/UK law. If you have questions about cross-border data pertaining to the EU/UK, you can contact us for more information.

Transfers from Singapore: For personal data collected in Singapore, we will abide by the PDPA's requirements for overseas transfers. This means that before transferring Singapore data out of Singapore, we will take reasonable steps to ensure the receiving organization is bound by legally enforceable obligations (such as contract terms or binding corporate rules) to provide a standard of protection to the data that is comparable to the protection under the PDPA. In practice, this often involves incorporating contractual clauses with foreign recipients that stipulate PDPA-level protections or ensuring the recipient country has an appropriate adequacy recognition (if applicable). By engaging with our Services, you understand that your data may be transferred overseas, but we will protect it as described.

Enhanced Regulatory Requirements in Certain Jurisdictions: We acknowledge that certain jurisdictions have enhanced regulatory requirements regarding international personal data transfer. In some countries, local laws or regulations may mandate specific procedures, certifications, or government approvals before personal data can be sent abroad. For example, some jurisdictions require a form of transfer risk assessment, registration with authorities, or even obtaining special export permits for personal data. Swiit is committed to complying with all such local rules requiring heightened export safeguards. If your personal data is subject to a jurisdiction that imposes additional controls on cross-border transfers, we will ensure those conditions are met prior to transferring your data. This could involve conducting and documenting a transfer impact assessment, implementing additional encryption or de-identification measures for data in transit, or processing certain data within a restricted environment when legally required to do so. We will do what is necessary to lawfully transfer data while preserving its privacy and security.

Your Consent to International Transfer: By using our Services and providing us with your information, you acknowledge and consent that your Personal Data may be transferred across international borders, including to countries outside your country of residence. We will only do so in accordance with this Policy and for the purposes outlined. If applicable laws require your explicit consent for a particular cross-border transfer, we will obtain that consent at the appropriate time (for instance, during account registration or when you initiate a transaction that involves overseas data processing).

Note on Partner Bank Transfers: When you instruct us to facilitate an account or transaction with Zenus Bank (or another financial partner in a different country), that action inherently involves transferring your data to that jurisdiction to fulfill your request. Such transfers are a necessary part of the service you have chosen, and we ensure that any partner receiving your data has committed to protecting it. Zenus Bank, for example, is subject to U.S. federal and state banking privacy laws which provide safeguards for your information. Additionally, our agreement with Zenus contractually obligates them to treat your personal data in line with strict confidentiality and security standards.

In summary, we take the security and legality of international data transfers seriously. We have implemented measures like contractual safeguards, internal policies, and technical protections (encryption, access controls, etc.) to secure your data when it travels abroad. If you have questions about the countries to which your data has been transferred or the safeguards in place, you may contact us as described in the Contact section. We will do our best to provide you with additional information, taking into account both transparency and our own security obligations.

8. Data Security and Retention

Data Security

Swiit employs a comprehensive information security program to safeguard your Personal Data against loss, misuse, unauthorized access, disclosure, alteration, or destruction. We implement industry-standard technical and organizational measures appropriate to the sensitivity of the data. These measures include, but are not limited to:

While we strive to protect your Personal Data, it's important to note that no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security. You also play a role in keeping your data safe: we urge you to maintain the confidentiality of your account credentials, use unique and strong passwords, and notify us immediately if you suspect any unauthorized access to your account.

Data Retention: We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with legal or business requirements. Because Swiit is a financial service subject to strict regulations, our retention periods may be influenced by laws such as anti-money laundering regulations, tax laws, and other compliance rules. Below are some key points about retention:

In plain terms, we aim not to keep personal data longer than we absolutely need to. When data is no longer needed, we dispose of it in a secure manner. "Secure" means that if in physical form (paper), it's shredded/incinerated, and if electronic, it's permanently erased (or thoroughly anonymized such that it cannot be linked back to an individual). We also periodically review the data we hold and delete or anonymize records that are no longer necessary.

If you have specific questions about how long a certain type of data is retained, or if you want us to delete something sooner (and believe there's no legal need for us to keep it), please contact us – we will address requests on a case-by-case basis.

9. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. Users must be at least 18 years old (or the age of majority in your jurisdiction) to create an account with Swiit and use our financial services. If you are a parent or guardian and believe that your child under 18 may have provided personal data to us, please contact us immediately. We will take steps to promptly delete the information and terminate the child's account if we discover personal data from a minor. We also do not knowingly "sell" or "share" the personal information of minors under any definitions in applicable law.

In jurisdictions where a higher age threshold applies (for example, under 21 for certain financial activities), we will abide by those requirements. We reserve the right to ask for proof of age if we suspect a user is underage.

10. Governing Law

This Privacy Policy, and any disputes or claims arising out of or in connection with it (including non-contractual disputes or claims), are governed by the laws of the State of Colorado, USA, as the primary jurisdiction of Sweet Intelligence Inc.. By using our services, you agree that any issues regarding personal data or privacy will be resolved under Colorado law.

However, if you are located in a jurisdiction with mandatory data protection laws, those laws (such as GDPR in the EU, PDPA in Singapore, PIPL in China, etc.) will still apply to our handling of your personal data regardless of Colorado law for other aspects. Governing law in this context mainly affects interpretation of this Policy and any legal proceedings. We chose Colorado law for consistency, but we also comply with applicable local privacy laws as described throughout this Policy.

In the event of a dispute, we hope to resolve it amicably. But if it proceeds to formal resolution, unless prohibited by law, the courts of Colorado would have jurisdiction. (If you are an EU resident, you retain the right to seek action in your home country under GDPR; nothing in this section is meant to limit rights granted under local law.)

11. Contact Us

We welcome any questions, concerns, or requests you may have about this Policy or about how we handle your Personal Data. Our Compliance Officer (CO) is responsible for overseeing Swiit's data protection strategy and compliance. You may reach out to our CO as follows:

We will endeavor to respond to your inquiries promptly – generally within a few business days for simple queries, and within the applicable statutory timeframe for formal requests. If you are contacting us to exercise a specific legal right, please clearly state the right you wish to exercise and the scope of the request (for example, "I am requesting access to my personal data."). This will help us process your request more efficiently.

Language: This Policy is provided in English. If we provide translations in other languages, the English version will control in case of any discrepancies, as this is our official version.

12. Changes to this Policy

We may update this Data Privacy Policy from time to time to reflect changes in law, changes in our business or Services, or for other operational reasons. When we make changes, we will revise the "Last Updated" date at the top of the Policy and post the updated Policy through our app and website. If the changes are significant, we will provide a more prominent notice (such as an email notification or in-app alert) to inform you of the update.

We encourage you to review this Policy periodically to stay informed about how we are protecting your Personal Data. Your continued use of the Swiit Services after any changes to this Policy will be deemed acceptance of those changes, unless applicable law requires explicit consent. If required by law, we will seek your affirmative consent to material changes that impact how we handle previously collected Personal Data.

Last Updated: December 18, 2025.

By using Swiit's Services, you agree to this Policy. Thank you for entrusting Swiit with your personal data – we are committed to keeping that trust through our robust privacy and security practices. If you have any questions or feedback regarding this Policy, please do not hesitate to contact us. Your privacy is important to us, and we will do our utmost to address any concerns you have.