This Privacy Policy of the COMMON application and the Shielder Service (the “Privacy Policy”) describes how Controller as defined in Section 4 (“we”, “our”, “us”, etc.) collects and uses your personal data and cookies or similar technologies in connection with your use of the COMMON mobile application (the “App”) and its services (the “App Services”).

We provide the App, the App Services and the Shielder Service subject to the Terms. Please read the Terms before accessing or using the App, the App Services and the Shielder Service.

The current version of the Privacy Policy has been adopted and is effective as of 29 April 2025.

We may change the Privacy Policy from time to time. For example, we may do this when it is necessary due to changes in the Terms, changes in legal requirements or changes in the way we use your personal data. We may also amend the Privacy Policy to make it clearer, more accessible, and/or easier for you to understand.

You should check the Privacy Policy before using the App, the App Services and/or the Shielder Service. If we change the Privacy Policy, we will give you access to previous versions of the Privacy Policy.

The App and App Services are restricted to persons who are at least 18 years of age. We do not knowingly collect personal data from people who are less than 18 years of age in connection with the App, the App Services and/or the Shielder Service.

All terms not defined in this Privacy Policy shall have the meaning as defined in the Terms or in the GDPR. The following terms used in this Privacy Policy shall have the meaning set forth below:

• Agreement – a contract entered by and between you and us subject to the relevant Terms.
• App – the App as defined in the App Terms.
• App Services – the App Services as defined in the App Terms.
• App Terms – the Terms of Service of the COMMON web application available at: [DIRECT LINK].
• Applicable Data Protection Law – any applicable laws, statutes, regulations, orders, regulatory requirements, bylaws, and other similar legal instruments in force from time to time relating to data protection, data security, privacy and/or the collection, use, disclosure and/or processing of personal data, including but not limited to the GDPR.
• Controller (“we”, “our”, “us”, etc.) – Justino II Mantilla Alngog, residing at: Unit 4425, Building 4, Cebu South Coastal Road, Sanremo Oasis, Città di Mare, Cebu City, Philippines.
  controller, processor, processing, and other terms relating to personal data not defined here have the meaning as defined in Art. 4 of the GDPR.
• DLT – distributed ledger technology.
• EEA – European Economic Area.
• GDPR – General Data Protection Regulation 2016/679 of 27 April 2016.
• ICT Systems – the ICT Systems as defined in the Terms.
  personal data – information about identified or identifiable natural person as defined in Art. 4(1) of the GDPR.
• Privacy Policy – this Privacy Policy of the COMMON mobile application.
• Shielder Service – the Shielder Service as defined in the Shielder Terms.
• Shielder Terms – the Terms and Conditions of the Shielder Service available at: .
• Terms – jointly the App Terms and the Shielder Terms.
• User (“you”, “your”, etc.) – the User as defined in the Terms.
• Wallet – the Wallet as defined in the Terms.

We are the controller of your personal data to the extent this Privacy Policy applies (you can find detailed information about us in Section 4).

You can contact us with any inquiries or complaints in respect of the personal data:

• by email at: [email protected].

We only collect your personal data if this is legally permitted and only to the extent necessary to achieve our purposes. We use the following sources of personal data:

• You and your devices – we collect data from you directly, for example when you contact us, and also from your devices, for example when you use the App installed on your device.
• Public sources – we collect your personal data from publicly available sources, such as blockchain networks, related to providing the App Services.
• Judicial authorities – we may receive your personal data from public authorities in connection with law enforcement data requests. We do not actively collect this data. For more information, consult Section 15.

We only use your personal data if this is legally permissible and only to the extent necessary to achieve our purposes as set out in Section 9. We collect and use the following categories of your personal data:

• Blockchain data – the blockchain data includes anonymous data and, in some cases, your personal data that we receive in connection with your use of some of the App Services, as well as our activity and the activity of third parties connected with rendering such App Services. This includes publicly accessible on-chain information (which can be personal data) and limited off-chain information of technical nature (anonymous data, as a rule). This also includes Wallet public address, which is a personal data when the Wallet can be linked to you (the User). In general, if blockchain data allows for your identification we treat it as personal data in compliance with the Applicable Data Protection Law. For example, this includes:
  • Wallet details (including custodial wallets)
  • Wallet transaction details (including crypto-assets, time of transfer, value of transfer, details of originator and beneficiary)
• Customer feedback data: The customer feedback data includes data collected and used in connection with your participation in our surveys or questionnaires or your other requests, questions, and queries. For example, this may include:
  Names and contact details (e.g. email address)
  Feedback on the App or App Services
  Your device and its operating system (optional)
  Other data provided when using the optional feedback channel Featurebase platform operated  by a third party (e.g. location data)
• Customer support data: The customer support data includes data collected and used in connection with customer support provided by us to you. For example, this may include:
  Information relating to compliments or complaints
  Names and contact details (e.g. email address)
  Records of meetings and decisions 
  App user information (including user journeys)
  Other data provided when using the optional feedback channel – Featurebase platform operated  by a third party (e.g. location data)
• Marketing data:  data collected and used in connection with our marketing activities, including marketing segmentation and conducting direct marketing in specific communication channels based on your marketing consents. For example, this includes:
  Your email address
• Technical data: The technical data includes data collected and used in connection with the ICT Systems to provide the Services. Most of this information is anonymous data. However, in some cases it may be used to identify you, for example in combination with other data. In such cases we treat it as personal data. For example, this includes:
  • IP addresses
  • Location data
  • User hardware and software data
  • App user information (including statistics about user journeys) 

We do not knowingly collect your personal data as defined in Articles 9 and 10 of the GDPR. Such data includes: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning that person's health, sexuality or sexual orientation, data concerning criminal convictions and offences or related security measures, data relating to administrative and criminal proceedings or sanctions, data relating to social assistance measures. As a rule, if we receive such personal data from you or accidentally collect it, we will delete it immediately and, where appropriate, ask you to give your express consent to its processing for a specific purpose before using it (if permitted by law).

We only process your personal data when it is lawful to do so. Each purpose for which we use your personal data has a specific basis for processing personal data in accordance with the table below.

We only store your personal data for as long as is necessary for the purposes for which we collected it. Each purpose for which we use your personal data has a specific maximum period of storage. We store your data depending on the purpose of processing in accordance with the table below.

After the end of the data retention period, we permanently delete or anonymise personal data. In certain situations, the period of data retention or use may be extended. For example, we may use your personal data related after the termination of the Agreement when required by law or in connection with judicial or administrative proceedings (e.g. your personal data constitutes evidence in a case affecting us). In such case, we will store your personal data for the period required by law or until the proceedings have been legally concluded.

As a rule, we do not share your personal data unless it is necessary. For example, we may share your personal data in connection with the provision of the App Services and/or the Shielder Service under the Terms. We may disclose your personal data to the following categories of recipients:

• our business partners (including service providers and contractors), such as analytical tools providers or data storage providers;
• Controller’s group entities, including our affiliates, subsidiaries and, in the event of a merger, acquisition or reorganisation, the involved third party;
• public authorities or other third parties when required by law and subject to statutory conditions and restrictions, for example when we are bound by the law to comply with a court order;
• professional advisors, such as lawyers, accountants, consultants, and tax advisors.

We are established outside of the EEA. The level of protection for the personal data outside the European Economic Area (EEA) differs from that provided by the EU law. For this reason, in general controllers transfer your personal data outside the EEA only when necessary and with an adequate level of protection. Such adequate level of protection is often secured primarily by cooperating with processors of the personal data in countries for which there has been a relevant European Commission decision finding an adequate level of protection for the personal data or be using the standard contractual clauses issued by the European Commission. If you want to learn more about the data transfer safeguards, obtain a copy of them or learn where they have been made available, contact us (Section 6).

In certain cases, the provision of your personal data is mandatory by law or necessary to manage your request or to perform a contract we have with you. If you don’t provide us with your personal data in such situations, we may not be able to carry out your request, perform a contract with you (or enter into it) or comply with the law. In some cases, this may mean that we will terminate the contract or stop our engagement with you. For example, if you do not provide your personal data necessary for the complaint procedure, we may not be able to process your complaint.

In other cases, the provision of your personal data is voluntary. If you don’t provide us with your personal data in such situations, we may not be able to carry out your request or achieve our goal. For example, if you do not share your contact details with us, we may not be able to contact you.

A blockchain network is an application of a distributed ledger technology (“DLT”). A distributed ledger is an information repository that keeps records of certain actions (e.g. transactions) and that is shared across, and synchronized between, a set of DLT network nodes using a consensus mechanism. Blockchains are governed by their protocols, i.e. set of rules describing how a network operates (e.g. how a consensus is reached as regards validating a transaction). Such blockchains are intended to immutably record transactions across a wide network of computers and computer systems. Public blockchains are networks that are publicly accessible. Many blockchain networks are decentralized which means that we do not control or operate them.

When you use the App Services and/or the Shielder Service, some of your data may be recorded on public blockchain networks, depending on the particular service and the blockchain protocol. This means that your personal data could be determined directly, when combined with other data, or when anonymous data is de-anonymized. As a result, third parties may potentially access your personal data. For example, many public blockchain networks are open to forensic analysis or other blockchain analytics operations which can lead to the unintentional disclosure of your personal data such information about your transactions. This is due to the way blockchain technology works, where the transparency and immutability of the data stored on the chain is one of the fundamental principles of the technology. 

15.1. What are cookies?
Cookies are small text files installed on your device that collect information which, generally, facilitates use of the App and the Services. For example, cookies may remember your language preferences or other settings of your Internet browser. In most cases the information used in connection with cookies is personal data.

We may use our own cookies. We may also use third-party cookies, i.e. cookies from a domain other than the domain of the visited website, primarily for analytical activities. We may also use other technologies similar to cookies, for example HTML5 local storage, Local Shared Objects or tracking pixels. Where we refer to cookies in this Section 15 and its subsections, we also mean such technologies.

The cookies are used only when it is admissible by law.

15.2. Types of cookies
The following types of cookies are used in connection with your use of the App and the Services.

• Necessary cookies: The necessary cookies are a type of cookies that are required by the App and the Services to function properly. For example, these types of cookies are installed to recall your login sessions and privacy settings. They are set by us. They are mandatory because they are necessary for the provision of the App and the Services.

15.3. Description of used cookies
Each cookie has a specific provider (e.g. us or a third party), a specific purpose and a maximum service life. The service life of cookies depends on their type and purpose. Generally, there are two types of cookies: session cookies and persistent cookies. Session cookies expire after the end of a browser session. Persistent cookies are stored on a device for a longer period of time. They do not expire when the browser session ends. As a rule the maximum period after which our cookies expire is 12 months.

15.4. Access of third parties to the cookies
We do not allow third parties to access cookies for which we are responsible unless it is necessary. For example, we may allow such access when it is necessary to perform third-party analytics services. In addition, some of our service providers’ solutions involve storing or accessing information on your end device, including the use of cookies. Below we describe in greater detail tools of our partners used for analytical or marketing purposes:

15.4.1. PostHog analytics solutions
PostHog analytics solutions are a group of tools to analyse use of the App and to produce statistics and reports on its operation (e.g. PostHog Product Analytics). The PostHog analytics solutions enabled in the App operate in a cookieless mode. The solution provider is PostHog Inc., address: 2261 Market Street #4008, San Francisco, California 94114, USA. More information about PostHog analytics solutions can be found at: https://posthog.com. You can find more information about the processing of your personal data by PostHog Inc. at: https://posthog.com/privacy.

15.5. Your cookie choices
There are several ways in which you can manage cookies on your device.

Your consent: Necessary cookies do not require your consent. Optional cookies are used only with your consent. You can withdraw your consent at any time. You can do this through your browser settings.
Web browser: You can also manage cookies through your web browser. For example, you can delete all or some cookies from your device or block them. Please note that deleting or blocking cookies may cause the App or the Services to not function properly or to stop functioning altogether. To manage cookies through your web browser, refer to the instructions provided by your browser provider. For example, some of such instructions for the relevant web browsers can be found on the websites of their operators: Microsoft (Internet Explorer, Edge), Google (Chrome), Apple (Safari), Mozilla (Firefox), Opera (Opera).

To exercise your rights, please contact us (Section 6).

• Your right of access – You have the right to ask us for copies of your personal data.
• Your right to rectification – You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete data you think is incomplete.
• Your right to erasure (right to be forgotten) – You have the right to ask us to erase your personal data in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal data in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances. This right applies where we use your data based on your consent or a contract and if the processing of your data is carried out by automated means.
• Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances. You can do this at any time. If you raise an objection, we will stop using your personal data where the basis for processing is our legitimate interest. In exceptional circumstances, we may continue to use your data despite your objection. This exception does not apply when you object to the processing of data for direct marketing purposes, i.e., if you object to it, we will stop processing your personal data on this basis.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent. You can do this at any time. If you withdraw consent, we will stop using your personal data where the basis for processing is consent. Withdrawal of consent does not affect the lawfulness of processing your data based on consent before withdrawal.

You do not usually need to pay a fee to exercise your rights. If you make a request, we have one calendar month to respond to you as a rule. To make a data protection rights request, contact us using our contact details (Section 6).

If you have any concerns about our use of your personal data, you can make a complaint to us using our contact details (Section 6).

You have the right to lodge a complaint with a competent supervisory authority dealing with personal data protection.