Global Privacy Policy

1. Who We Are

For the purposes of this Global Privacy Policy, “Goat Finance”, “we”, “us” or “our” means the Goat Finance multilateral organization and, where applicable, the specific Goat Finance legal entity responsible for the relevant processing activity.

The current principal operating entities are:

1. Goat Finance SAGL, Switzerland; and

2. Goat Finance LLC, United States.

Additional Goat Finance entities may be added to the organization from time to time.

The relevant controller will be identified in the applicable privacy notice, onboarding flow, entity terms, product terms, handoff notice, customer profile, transaction confirmation or other communication provided to you.

2. How This Policy Works

This Global Privacy Policy provides the general privacy framework for Goat Finance.

It explains:

1. how Goat Finance is organized from a privacy perspective;

2. how Phase 1 and Phase 2 onboarding work;

3. how data controllers are allocated;

4. how personal data is handed over from one controller to another;

5. what categories of personal data Goat Finance may process;

6. why Goat Finance may process personal data;

7. how Goat Finance may share personal data internally;

8. how Goat Finance may share personal data with providers, partners and authorities;

9. how Goat Finance uses shared resources while preserving entity-level responsibility;

10. how international transfers may occur;

11. how long personal data may be retained;

12. what privacy rights may apply;

13. how Goat Finance manages jurisdiction-aware website and onboarding controls;

14. how to contact Goat Finance about privacy matters.

3. Goat Finance’s Privacy Governance Model

Goat Finance applies a layered privacy governance model.

At a high level:

1. Global Privacy Policy explains the organization-wide privacy framework.

2. Phase 1 Privacy Notices explain the pre-onboarding, eligibility and routing process.

3. Entity Privacy Notices explain how a specific Goat Finance entity processes personal data when it becomes responsible for Phase 2 onboarding, service provision or customer relationship management.

4. Product-specific privacy notices or service-specific disclosures explain how personal data is used or shared for a specific product, service, partner-supported feature or transaction route.

5. Partner disclosures explain partner-specific processing or data-sharing requirements where applicable.

Goat Finance maintains internal controls designed to support appropriate controller allocation, need-to-know access, privacy notice delivery, data sharing, international transfer assessment, retention, recordkeeping and controller handoff between onboarding phases.

4. Phase-Based Privacy Model

Goat Finance uses a phase-based onboarding and privacy model.

4.1 Phase 1 — Pre-Onboarding, Eligibility, Screening and Routing

Phase 1 is the global pre-onboarding, initial screening, eligibility assessment, KYC initiation and routing phase.

Unless otherwise stated in the applicable Phase 1 Privacy Notice, Goat Finance SAGL acts as the controller for Phase 1 processing.

During Phase 1, Goat Finance may process personal data to:

1. receive your initial request;

2. identify you or your business;

3. understand the product or service you are requesting;

4. perform initial sanctions, jurisdiction, industry, occupation and risk screening;

5. assess whether you fall within Goat Finance’s risk appetite and eligibility criteria;

6. determine whether any Goat Finance entity may provide the requested product or service;

7. determine the relevant contracting entity, service route or partner-supported route;

8. determine whether additional documents, enhanced due diligence or partner review may be required;

9. prepare the handoff to the relevant Phase 2 controller.

Completion of Phase 1 does not create a customer relationship, account, right to transact or entitlement to any Goat Finance product or service.

4.2 Phase 2 — Product-Specific Onboarding and Service Delivery

Phase 2 begins when you are routed to the relevant Goat Finance entity for product-specific onboarding, service activation, transaction review, customer relationship management or partner-supported processing.

The Phase 2 controller will generally be the Goat Finance entity that contracts with you, provides the relevant service, arranges the relevant product route or determines the purposes and essential means of the relevant processing.

The applicable Phase 2 controller will be communicated to you before service activation, transaction execution, account opening or partner-supported product activation.

Phase 2 processing may include:

1. product-specific KYC/KYB;

2. customer due diligence;

3. enhanced due diligence;

4. source of funds and source of wealth review;

5. sanctions, PEP and adverse media screening;

6. fraud prevention;

7. transaction monitoring;

8. wallet and blockchain analytics screening;

9. payment, banking or settlement review;

10. partner onboarding or partner approval;

11. account, product or service activation;

12. customer support;

13. complaints handling;

14. recordkeeping;

15. audit;

16. legal, regulatory, tax, compliance and reporting obligations.

5. Controller Allocation

The controller of your personal data depends on the processing phase, entity, product, service, route and purpose.

At a general level:

A Goat Finance entity is not automatically a controller merely because it belongs to the Goat Finance organization, employs a person involved in the process, pays for a tool, hosts a system, provides technical support or has technical access to personal data.

Controller allocation is determined based on the actual purposes and essential means of the processing.

Where two or more entities jointly determine the purposes and essential means of a specific processing activity, those entities may act as joint controllers. Where this applies, the essence of the joint controller arrangement will be made available in the applicable privacy notice or disclosure.

6. Handoff Between Controllers

Where a case moves from Phase 1 to Phase 2, Goat Finance may transfer or make available relevant personal data from the Phase 1 controller to the Phase 2 controller.

This handoff may include:

1. identity and contact information;

2. onboarding form responses;

3. jurisdictional information;

4. product or service request information;

5. KYC/KYB information already collected;

6. screening results;

7. risk classification;

8. documents uploaded during Phase 1;

9. eligibility assessment results;

10. routing decision;

11. notes necessary to continue onboarding;

12. records of notices, terms or disclosures shown during Phase 1.

Before or during Phase 2, the relevant Phase 2 controller will provide or make available the applicable entity Privacy Notice and, where relevant, product-specific privacy or partner data-sharing disclosures.

The Phase 2 controller may request additional personal data, documents or confirmations beyond those collected during Phase 1.

7. Jurisdiction-Aware Website and Onboarding Controls

Goat Finance may process limited technical, location, declared-jurisdiction and website-interaction data to implement jurisdiction-aware website, onboarding and product-information controls.

This may include:

1. IP address;

2. approximate location derived from IP address;

3. browser language or locale;

4. country selected or declared by you;

5. country of residence;

6. country of incorporation;

7. product-interest selection;

8. product pages viewed;

9. legal notices, warnings or pop-ups shown to you;

10. timestamps and version records;

11. device and user agent information;

12. whether you acknowledged a jurisdictional notice;

13. onboarding route and eligibility outcome.

Goat Finance may use this information to:

1. avoid displaying product information that may not be appropriate for your jurisdiction;

2. comply with financial promotion, reverse solicitation, marketing, licensing, regulatory perimeter and product-availability controls;

3. determine whether you should be directed to a general information page, an eligibility assessment, a specific Goat Finance entity, a restricted flow or a blocked flow;

4. keep evidence of the notices, product information and legal documents shown to you;

5. support legal, compliance, audit and risk management controls.

This processing is designed to support Goat Finance’s compliance framework and does not, by itself, determine whether you are eligible for any product or service.

8. Personal Data We May Collect

Depending on your interaction with Goat Finance, we may collect the following categories of personal data.

8.1 Identity and Contact Data

This may include:

1. full name;

2. date of birth;

3. place of birth;

4. nationality;

5. country of residence;

6. residential address;

7. email address;

8. telephone number;

9. identity document details;

10. tax identification information;

11. government identification numbers;

12. signature;

13. selfie, liveness check or biometric verification data where required by the onboarding process.

8.2 Business and KYB Data

For legal entities, this may include:

1. company name;

2. registration number;

3. registered office;

4. principal place of business;

5. company formation documents;

6. constitutional documents;

7. ownership structure;

8. shareholder information;

9. beneficial ownership information;

10. directors, officers, signatories and authorized representatives;

11. business model;

12. industry and occupation information;

13. licenses and registrations;

14. tax status;

15. financial statements;

16. invoices, contracts or business evidence.

8.3 Financial, Wallet and Transaction Data

This may include:

1. bank account details;

2. payment account details;

3. wallet addresses;

4. blockchain transaction data;

5. source of funds;

6. source of wealth;

7. income, revenue or asset information;

8. expected transaction volume;

9. transaction history;

10. payment references;

11. settlement information;

12. transaction purpose;

13. counterparty information;

14. invoices, contracts or supporting documents.

8.4 Compliance, Risk and Screening Data

This may include:

1. sanctions screening results;

2. politically exposed person screening results;

3. adverse media screening results;

4. fraud risk indicators;

5. transaction monitoring alerts;

6. blockchain analytics results;

7. wallet risk scores;

8. jurisdictional risk assessment;

9. industry or occupation risk assessment;

10. internal risk rating;

11. enhanced due diligence information;

12. compliance notes;

13. regulatory, partner or law enforcement correspondence, where applicable.

8.5 Technical, Device, Website and Usage Data

This may include:

1. IP address;

2. device identifiers;

3. browser type;

4. operating system;

5. login data;

6. cookies and similar technologies;

7. user agent;

8. session data;

9. platform activity;

10. website page views;

11. product page interactions;

12. security logs;

13. access logs;

14. communication metadata.

8.6 Communications and Relationship Data

This may include:

1. emails;

2. support requests;

3. chat messages;

4. platform messages;

5. forms submitted by you;

6. call notes;

7. meeting notes;

8. transaction instructions;

9. complaints;

10. customer support records;

11. records of terms accepted;

12. records of privacy notices, disclosures or warnings shown or acknowledged.

9. Sources of Personal Data

We may collect personal data from:

1. you directly;

2. your authorized representative;

3. your employer or company;

4. beneficial owners, directors, officers, controllers, shareholders or business representatives;

5. onboarding forms;

6. KYC/KYB providers;

7. identity verification providers;

8. sanctions screening providers;

9. politically exposed person and adverse media providers;

10. blockchain analytics providers;

11. fraud prevention providers;

12. payment providers;

13. banking partners;

14. liquidity providers;

15. settlement providers;

16. partner-supported service providers;

17. public registries;

18. company registries;

19. public websites and databases;

20. government, regulatory, court or law enforcement sources;

21. business partners, introducers or referral sources;

22. internal Goat Finance systems, records and shared operational resources.

10. Why We Process Personal Data

Goat Finance may process personal data for the purposes described below.

10.1 Onboarding, Eligibility and Routing

We may process personal data to:

1. receive your application or request;

2. verify your identity or business;

3. assess eligibility;

4. determine whether Goat Finance can support the requested product or service;

5. determine the applicable contracting entity;

6. determine the applicable controller;

7. determine the applicable partner route;

8. assess jurisdictional, product, customer, industry, occupation and risk eligibility;

9. conduct Phase 1 to Phase 2 handoff;

10. provide the appropriate terms, privacy notices and disclosures.

10.2 Compliance, KYC, KYB, AML/CFT and Sanctions

We may process personal data to:

1. comply with anti-money laundering requirements;

2. comply with counter-terrorist financing requirements;

3. comply with sanctions, asset-freezing and restricted-party controls;

4. verify identity and beneficial ownership;

5. understand source of funds and source of wealth;

6. conduct PEP and adverse media screening;

7. monitor transactions;

8. investigate alerts;

9. detect suspicious activity;

10. respond to regulator, bank, partner, court or law enforcement requests;

11. maintain compliance records.

10.3 Product and Service Provision

We may process personal data to:

1. provide requested and approved products or services;

2. process transaction instructions;

3. execute or settle approved transactions;

4. support payment or settlement flows;

5. support partner-enabled service routes;

6. provide platform or portal access;

7. communicate with you;

8. provide customer support;

9. manage disputes, complaints or investigations;

10. manage service status.

10.4 Risk, Fraud and Security

We may process personal data to:

1. detect fraud;

2. prevent unauthorized access;

3. protect accounts and systems;

4. investigate suspicious activity;

5. monitor wallets and counterparties;

6. identify transaction anomalies;

7. prevent misuse of Goat Finance services;

8. protect Goat Finance, customers, partners and the financial system;

9. maintain cybersecurity and operational resilience.

10.5 Website, Jurisdiction and Reverse-Solicitation Controls

We may process personal data to:

1. identify your approximate location or declared jurisdiction;

2. apply jurisdiction-aware content controls;

3. avoid showing product content where it may not be appropriate;

4. manage financial promotion, reverse solicitation, licensing and product-availability controls;

5. record which notices, warnings, pop-ups, terms or disclosures were shown to you;

6. support legal, compliance, audit and risk evidence.

10.6 Legal, Regulatory, Audit and Governance

We may process personal data to:

1. comply with applicable laws and regulations;

2. comply with court orders, regulator requests or law enforcement requests;

3. maintain records;

4. conduct audits;

5. manage internal governance;

6. comply with contractual obligations;

7. manage legal claims;

8. enforce terms, policies and controls;

9. implement global governance, routing, access, transfer and privacy control frameworks.

10.7 Communications and Relationship Management

We may process personal data to:

1. respond to inquiries;

2. send service notices;

3. send legal, privacy or policy updates;

4. provide transaction confirmations;

5. manage customer relationships;

6. conduct customer support;

7. handle complaints.

10.8 Marketing

Where permitted by applicable law, we may process limited personal data to send marketing, product updates, educational materials or commercial communications.

Where consent is required, we will request consent separately.

You may opt out of marketing communications where required or permitted by applicable law.

Goat Finance may restrict or suppress marketing or product communications in certain jurisdictions to support compliance with applicable financial promotion, reverse solicitation, licensing or product-availability controls.

11. Legal Bases and Lawful Grounds

The legal basis or lawful ground for processing depends on the jurisdiction, processing activity and applicable law.

Where EU GDPR or UK GDPR applies, we may rely on one or more of the following legal bases:

1. performance of a contract;

2. steps taken before entering into a contract;

3. compliance with legal obligations;

4. legitimate interests;

5. consent, where required;

6. substantial public interest or other applicable grounds for sensitive data, where relevant;

7. establishment, exercise or defense of legal claims.

Where Swiss data protection law applies, we process personal data in accordance with applicable Swiss privacy principles, including transparency, proportionality, purpose limitation, security, accuracy and lawful disclosure requirements.

Where U.S. privacy laws apply, we process personal information for the purposes disclosed in this Global Privacy Policy, the applicable entity Privacy Notice, any U.S. privacy notice or module, and any product-specific notice or service-specific disclosure.

Where we rely on consent for optional processing, consent will be requested separately and may be withdrawn according to the process described in the applicable notice.

We do not rely on blanket mandatory consent where processing is necessary for onboarding, eligibility, compliance screening, AML/CFT controls, sanctions screening, service provision, transaction monitoring, fraud prevention, legal obligations, legitimate operational purposes, jurisdiction-aware website controls or risk management.

12. Special Category Data, Sensitive Data and Criminal-Offence Related Data

Goat Finance does not intentionally seek to collect sensitive or special category data unless it is necessary, permitted or required for identity verification, onboarding, KYC/KYB, AML/CFT, sanctions screening, fraud prevention, regulatory compliance, legal claims, security or product-specific requirements.

Depending on the jurisdiction, this may include:

1. biometric data used for identity verification, selfie checks or liveness checks;

2. politically exposed person information;

3. adverse media information;

4. criminal-offence related information or allegations;

5. sanctions-related information;

6. sensitive personal information under applicable U.S. privacy laws.

Where EU GDPR or UK GDPR applies, Goat Finance processes special category data or criminal-offence related data only where an applicable legal basis and condition permit such processing.

Where Swiss law applies, Goat Finance processes sensitive personal data only where permitted and subject to appropriate safeguards.

Where U.S. privacy laws apply, Goat Finance does not use sensitive personal information to infer characteristics unless stated in a specific notice and permitted by applicable law.

13. How We Share Personal Data Within Goat Finance

Goat Finance operates through separate entities, shared systems, shared personnel, shared compliance functions, shared technology and shared operational resources.

Goat Finance may share personal data within its multilateral organization where necessary for:

1. onboarding;

2. eligibility assessment;

3. routing;

4. Phase 1 to Phase 2 handoff;

5. customer due diligence;

6. enhanced due diligence;

7. sanctions screening;

8. transaction monitoring;

9. fraud prevention;

10. customer support;

11. technology operations;

12. security;

13. payment or settlement support;

14. CRM;

15. audit;

16. reporting;

17. legal and regulatory compliance;

18. governance;

19. service administration;

20. recordkeeping;

21. internal controls.

Personal data is not made available to all Goat Finance entities by default.

Access is granted on a need-to-know basis, taking into account:

1. the relevant product or service;

2. the relevant Goat Finance entity;

3. the relevant processing phase;

4. the role of the person requesting access;

5. the purpose of access;

6. case assignment;

7. applicable law;

8. transfer requirements;

9. security controls;

10. the applicable access matrix or equivalent internal control.

The use of shared resources does not automatically change controller status.

14. How We Share Personal Data With Third Parties

We may share personal data with third parties where necessary or permitted for the purposes described in this Global Privacy Policy, the applicable entity Privacy Notice, product-specific privacy notice, partner disclosure or service-specific data-sharing section.

Third parties may include:

1. KYC/KYB providers;

2. identity verification providers;

3. sanctions screening providers;

4. PEP and adverse media providers;

5. blockchain analytics providers;

6. fraud prevention providers;

7. banks;

8. payment providers;

9. settlement providers;

10. e-money institutions;

11. liquidity providers;

12. exchanges or execution providers;

13. custodians or custody-connected providers, where applicable;

14. technology providers;

15. cloud providers;

16. CRM providers;

17. communication providers;

18. customer support tools;

19. professional advisers;

20. auditors;

21. insurers;

22. regulators;

23. law enforcement authorities;

24. courts;

25. tax authorities;

26. government authorities;

27. business partners, introducers or referral sources;

28. commercial partner, where the commercial partner-supported route applies;

29. other partners or service providers required to provide, review, approve, monitor or support the relevant product or service.

We may also share personal data where necessary to:

1. comply with legal obligations;

2. respond to lawful requests;

3. enforce our terms;

4. protect Goat Finance’s rights;

5. investigate fraud or misconduct;

6. prevent financial crime;

7. protect customers, partners and the public;

8. support audits, examinations or regulatory reviews;

9. complete a corporate transaction, restructuring, merger, acquisition, sale, financing or transfer of business assets, where legally permitted.

Product-specific privacy notices or service-specific data-sharing disclosures will describe partner-specific sharing where required or appropriate.

15. Partner-Supported Services

Some Goat Finance services may be supported by banking, payment, settlement, liquidity, infrastructure, compliance, KYC/KYB, blockchain analytics, technology or other partners.

Where a partner-supported service applies, Goat Finance may share personal data with the relevant partner and its service providers where necessary to:

1. review eligibility;

2. conduct onboarding;

3. verify identity or business information;

4. conduct due diligence;

5. conduct sanctions, fraud, AML/CFT or risk review;

6. open, support or administer the relevant product or service;

7. process payments, settlements or transactions;

8. monitor transactions;

9. manage partner risk;

10. respond to partner, regulator, court or law enforcement requests;

11. suspend, restrict or terminate the service.

Partner-supported services may involve partners acting as processors, independent controllers, joint controllers or regulated providers, depending on the facts and the applicable partner framework.

The applicable product-specific privacy notice, partner disclosure or service-specific data-sharing section will provide additional information where relevant.

16. International Transfers

Goat Finance operates internationally. Your personal data may be processed in, accessed from or transferred to countries other than the country where you are located.

International transfers may occur because:

1. Goat Finance entities are located in different countries;

2. shared personnel or global roles may support operations from different locations;

3. vendors and service providers may operate internationally;

4. cloud, CRM, communication, KYC/KYB, blockchain analytics, payment, banking, partner and compliance systems may involve cross-border access;

5. applicable partners or providers may be located outside your jurisdiction.

Where required by applicable law, Goat Finance will use appropriate safeguards for international transfers.

These may include:

1. adequacy decisions;

2. standard contractual clauses;

3. UK international transfer mechanisms;

4. Swiss-recognized transfer safeguards;

5. contractual safeguards;

6. technical and organizational measures;

7. access restrictions;

8. minimization;

9. encryption;

10. pseudonymization;

11. transfer assessments;

12. other lawful mechanisms.

Where a specific transfer route applies to your product, onboarding route, partner-supported service or contracting entity, additional information may be provided in the applicable entity Privacy Notice, product-specific privacy notice or service-specific disclosure.

17. Retention

Goat Finance retains personal data for as long as necessary for the purposes described in this Global Privacy Policy, the applicable privacy notice or as required or permitted by law, regulation, contractual obligation, audit requirement, dispute resolution, AML/CFT recordkeeping, tax, accounting, security, partner requirement or compliance obligation.

Retention periods may vary depending on:

1. the type of personal data;

2. the product or service;

3. the relevant Goat Finance entity;

4. the relevant jurisdiction;

5. whether you become a customer;

6. whether your application is rejected, declined or incomplete;

7. AML/CFT and sanctions obligations;

8. legal limitation periods;

9. regulatory expectations;

10. partner requirements;

11. audit and governance requirements;

12. whether there is an ongoing dispute, investigation, review, legal hold or regulatory inquiry.

Unless a shorter or longer period applies under applicable law or a specific retention notice, onboarding, customer due diligence and transaction records may generally be retained for up to 10 years after the end of the relationship or the relevant decision, subject to applicable legal requirements and documented exceptions.

Where your application does not proceed to Phase 2, the relevant Phase 1 controller may retain your data in accordance with the applicable retention period for rejected, incomplete or declined applications.

18. Security

Goat Finance uses technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure or destruction.

These measures may include:

1. access controls;

2. role-based permissions;

3. system-level restrictions;

4. need-to-know access;

5. authentication controls;

6. logging and monitoring;

7. encryption where appropriate;

8. segregation of data where appropriate;

9. vendor due diligence;

10. internal governance controls;

11. incident escalation procedures;

12. audit and review controls;

13. transfer controls;

14. data minimization controls;

15. secure document handling procedures.

No system or method of transmission is completely secure. Goat Finance cannot guarantee absolute security, but it takes reasonable steps designed to protect personal data according to the nature of the data and the processing activity.

19. Automated Screening, Profiling and Risk Assessment

Goat Finance may use automated or semi-automated tools to support:

1. onboarding;

2. identity verification;

3. document verification;

4. liveness checks;

5. sanctions screening;

6. PEP screening;

7. adverse media screening;

8. fraud prevention;

9. transaction monitoring;

10. blockchain analytics;

11. wallet screening;

12. risk scoring;

13. eligibility assessment;

14. routing;

15. jurisdiction-aware website controls;

16. product-availability controls.

These tools may help identify:

1. identity verification issues;

2. sanctions exposure;

3. prohibited jurisdictions;

4. prohibited industries;

5. prohibited occupations;

6. wallet risk;

7. transaction risk;

8. fraud indicators;

9. adverse media;

10. inconsistencies in onboarding information;

11. product route mismatches;

12. jurisdictional restrictions.

Decisions may be reviewed by authorized personnel where required or appropriate.

Where applicable law gives you rights regarding automated decision-making or profiling, those rights will be described in the relevant entity Privacy Notice, product-specific privacy notice or jurisdiction-specific notice.

20. Your Privacy Rights

Depending on your jurisdiction and applicable law, you may have rights in relation to your personal data.

These may include:

1. the right to access personal data;

2. the right to receive information about processing;

3. the right to correct inaccurate personal data;

4. the right to request deletion;

5. the right to restrict processing;

6. the right to object to processing;

7. the right to data portability;

8. the right to withdraw consent where processing is based on consent;

9. the right to lodge a complaint with a supervisory authority;

10. the right to appeal or challenge certain decisions, where applicable;

11. the right to opt out of certain uses, where applicable under U.S. state privacy law;

12. the right not to be discriminated against for exercising applicable privacy rights.

These rights may be subject to limitations, including where processing is required or permitted for AML/CFT, sanctions, fraud prevention, regulatory compliance, legal claims, recordkeeping, security, tax, audit, partner requirements, transaction monitoring or other lawful purposes.

To exercise your rights, contact:

[email protected]

We may need to verify your identity before responding to your request.

The applicable entity Privacy Notice may provide additional entity-specific or jurisdiction-specific rights information and contact details.

21. U.S. Privacy Framework

Where U.S. privacy laws apply, Goat Finance may process personal information for the purposes disclosed in this Global Privacy Policy, the applicable entity Privacy Notice, any product-specific privacy notice and any notice at collection.

Depending on the applicable U.S. state law, personal information may include:

1. identifiers;

2. contact information;

3. government identification information;

4. financial information;

5. commercial information;

6. internet or network activity information;

7. approximate geolocation information;

8. professional or employment information;

9. business representative information;

10. sensitive personal information where required for compliance, identity verification, sanctions screening, security, legal obligations or service provision;

11. inferences used for risk, fraud or eligibility assessment;

12. communications and support information.

Goat Finance does not sell personal information for money.

Unless a specific notice states otherwise, Goat Finance does not share personal information for cross-context behavioral advertising as those terms may be defined under applicable U.S. state privacy laws.

Where applicable, U.S. residents may have rights to know, access, delete, correct, obtain a portable copy, opt out, limit certain uses of sensitive personal information, appeal a privacy rights decision and not be discriminated against for exercising applicable privacy rights.

Additional U.S.-specific disclosures may be provided in the applicable entity Privacy Notice or notice at collection.

22. Cookies and Similar Technologies

Goat Finance may use cookies, pixels, tags, analytics tools and similar technologies on its website, platform and communications.

These technologies may be used for:

1. website functionality;

2. security;

3. authentication;

4. analytics;

5. user experience;

6. fraud prevention;

7. preference management;

8. compliance;

9. jurisdiction-aware content controls;

10. product-availability controls;

11. marketing, where permitted.

Further information is available in the Goat Finance Cookie Policy

23. Children

Goat Finance services are not intended for children.

Goat Finance does not knowingly provide financial services to minors.

If you believe that a child has provided personal data to Goat Finance, please contact:

[email protected]

24. Notice Delivery and Evidence

Goat Finance may record evidence that privacy notices, product notices, service disclosures, partner disclosures, pop-ups or jurisdictional warnings were made available to you.

This may include:

1. document name;

2. document version;

3. date and time;

4. user ID;

5. customer ID;

6. IP address;

7. user agent;

8. country detected;

9. country declared;

10. onboarding route;

11. product route;

12. notice text shown;

13. acknowledgement records;

14. session information;

15. communication channel.

This information may be used for legal, compliance, audit, risk, dispute-resolution, regulatory and recordkeeping purposes.

25. Updates to This Global Privacy Policy

Goat Finance may update this Global Privacy Policy from time to time.

Updates may be made to reflect:

1. changes in law;

2. regulatory requirements;

3. new products or services;

4. changes in Goat Finance’s structure;

5. new entities;

6. changes in partners or vendors;

7. changes in systems;

8. operational changes;

9. security or compliance requirements;

10. updates to onboarding, routing or privacy governance controls.

The updated version will be published on https://goatfinance.io and will indicate the effective date.

Where required by law, Goat Finance will provide additional notice of material changes.

26. Contact

For privacy questions, requests or complaints, contact:

Goat Finance Privacy Contact
Email: [email protected]

Where applicable, the relevant entity Privacy Notice may identify additional entity-specific, jurisdiction-specific, representative, supervisory authority or complaint contact details.