This Privacy Policy or “Policy” explains how Grayscale Investments, LLC and its subsidiaries, including the investment products it sponsors or manages from time to time (collectively, “Grayscale”, “we”, “our”, and “us”) collect and protect Personal Information (as defined below). If you have any questions that this Policy does not address, please contact us at the email address listed below. By creating an account on any Grayscale site, including without limitation www.grayscale.com (the “Grayscale Sites”) or by otherwise submitting Personal Information to us, you give your consent to the collection and use of your Personal Information as explained in this Policy. This Policy is part of our Terms of Service and all capitalized terms used but not defined in this Policy have the meaning given to them in the Terms of Service.

Grayscale’s Policy applies to current and former Grayscale clients and any other users of the Grayscale Sites. The term “Personal Information” refers to non-public information that personally relates to or identifies you as an individual or entity.

Updates and Changes to Our Privacy Policy

Please note that, in the event of a change in policy, a revised Policy will promptly be posted to the Grayscale Sites. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible. You agree to accept posting of a revised Policy electronically on the Grayscale Sites as actual notice to you. Any dispute over our Policy is subject to this notice.

How and Why We Gather Information

When you sign up to participate on the Grayscale Sites, you may be asked to provide information such as your full legal name, address and date of birth, along with other Personal Information that is required to verify your identity and fulfill our legal and regulatory requirements. This information will also be used to transact your business and communicate with you. From time to time, we may request additional information to help us further assess your needs and preferences. We, or our marketing partners acting on our behalf, may gather your Personal Information from the activities of our partner advertising services.

We gather and process your Personal Information for a variety reasons, depending on how you interact with our services, including:

• To facilitate account creation and authentication and otherwise manage your accounts. We may process your information so you can create and log into your account, as well as keep your account in working order.
• To deliver and facilitate delivery of our services to you. We may process your information to provide you with a requested service.
• To respond to user inquiries/offer support. We may process your information to provide you with the requested service.
• To send you administrative information. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To manage our working relationship with you. We may process your information to manage our working relationship with you and the provision of our services.
• To request feedback. We may process your information as necessary to request feedback and to contact you about your use of our products and services.
• To send you marketing and promotional communications. We may process your Personal Information for our marketing purposes. You can opt out of our marketing emails at any time.
• To deliver targeted advertising to you. We may process your information to develop and display personalized content and advertising tailored to your location, interests, and more.
• To protect our services. We may process information as part of our efforts to keep our services safe and secure, including fraud monitoring and prevention.
• To identify usage trends. We may process information about how you use our services to better understand how they are being used so we can improve them.
• To determine the effectiveness of our marketing and promotional campaigns. Grayscale or certain of its subsidiaries may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.

Types of Information We Collect

The information we or our business partners, on our behalf, collect and maintain about you is provided during the course of using your device, the Grayscale Sites, or third-party websites, your signing up to receive additional information, or your entering into transactions with private issuers who have engaged Grayscale to provide certain services in the context of a private securities transaction through Grayscale. Personal Information may come from the following sources:

• Information you provide to us when you fill out documents, complete a form or make a request for services, including, but not limited to, your name, address, age, investment objectives, job title, investment experience, assets and liabilities and/or income details and confidential documentation used to verify those details, telephone number, e-mail address and similar information; and information from your transactions with us, such as your sale proceeds or investment amount. We may collect certain sensitive information, including your social security number or and/or taxpayer identification number, and certain other financial information.
• Automatically collected information when using or navigating the Grayscale Sites. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our services, and other technical information. Like many companies, we collect information through Cookies (as defined below) and similar technologies. This information is primarily needed to maintain the security and operation of our services and for our internal analytics and reporting purposes.
• In order to enhance our ability to provide relevant marketing, offers, and services to you and update our records, Grayscale and certain subsidiaries may obtain information (including without limitation Personal Information) about you from other sources, such as public databases, joint marketing partners, affiliate programs, data providers, and from other third parties.

How We Protect Your Information

Keeping Information Safe

We limit access to the Personal Information you provide us to those employees who need access to that information in order to provide you with services related to the transactions or potential transactions you are entering into through the Grayscale Sites. In keeping with industry standards and practices, we maintain appropriate physical, electronic and procedural safeguards, and controls designed to protect your Personal Information.

We have invested in software, systems and procedures aimed at offering you a safe and secure transaction environment and protecting your personal, financial and historical transaction information. While no security system is absolutely impenetrable, we aim to review, refine and upgrade our security technology as new tools become available.

The Importance of Being Accurate

We have security standards and procedures in place designed to prevent unauthorized access to your Personal Information. A key part of this process helps ensure that the Personal Information we have about you is accurate and up-to-date. If you ever discover inaccuracies in our data or if your Personal Information changes, we urge you to notify us immediately. We only use your Personal Information as appropriate to provide you with quality services and to ensure security. For example, we may use the information collected from you to verify your identity and contact information.

Your Rights Over Personal Information

Subject to applicable laws, rules, and regulations you have rights regarding your Personal Information, including: access, rectification, erasure and blocking, restriction of use, objection to use, data portability, and the lodgement of a claim to your local data protection authority,as applicable.

If you would like to discuss or exercise the above rights, as applicable, please contact us using the details set out at the end of this Privacy Policy.

An Ongoing Commitment to Your Privacy

We are just as committed to protecting the privacy of our former clients as we are our current clients. If you choose to become an inactive client, your Personal Information will continue to be protected by the privacy policies and principles described in the then-current version of this Policy. Should you dispose of your investments with us in any way, Grayscale will retain your information as required pursuant to our regulatory compliance, internal record-keeping and other legal purposes.

How Information Helps Both You and Us

Our mission is clear: to build transparent, familiar investment products that facilitate access to the digital asset class. Information about you and your accounts plays a key role in our ability to succeed in this mission. For example, we use information about you to:

• Respond more accurately and efficiently to your requests for assistance; and
• Secure your investments and help protect you and Grayscale from fraud.

Sharing Your Information with Unaffiliated Third Parties

We Limit the Sharing of Information

To protect your privacy, we limit the sharing of your Personal Information outside of Grayscale. We conduct our business with great respect for the confidential nature of the information being provided. We will not share Personal Information about you except as outlined below:

• To help us provide our services to you and/or to improve our services, we engage qualified and reputable third parties to help us to carry out certain functions such as account processing, client services and/or data collection relevant to our business. For example, though not with limitation, in each case where you invest through the Grayscale Sites, we share your Personal Information with Third Party Service (as defined herein) providers in order to perform regulatory-required background checks, with certain technology providers to facilitate document execution, and with third parties that perform execution and clearing services on your behalf.
• As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution or similar event, Personal Information may be part of the transferred assets.
• Grayscale may share information with our subsidiaries if the information is required to provide the services you request. A subsidiary is a company that we own or control.
• Grayscale also reserves the right to disclose your Personal Information where required by law to federal or state regulatory bodies, law enforcement, self-regulatory organizations or other government authorities, including during routine regulatory examinations. We may also disclose your information as necessary to credit reporting or collection agencies, or to protect our rights or property.
• Notwithstanding the foregoing, all Personal Information shall be dealt with in accordance with any local legislation, including but not limited to the General Data Protection Regulation, to the extent Grayscale is or becomes subject to such regulation.

Reviewing, Changing or Correcting Information

You are responsible for helping us to maintain the accuracy and completeness of your Personal Information and other data. We urge you to review your information regularly to ensure that it is correct and complete. If you would like to review your Personal Information or if you believe that any of your Personal Information is incorrect, or if you have any questions regarding your Personal

Information, or this Privacy Policy, please contact us at [email protected].

Third Party Sites

If at any time you choose to purchase a product or service offered by another company, any Personal Information you share with that company will be subject to the privacy policies of the applicable third party companies and will not be controlled by our Privacy Policy. Other than as described above, we are not responsible for the privacy policies or the content of third party sites and/or services (each, a “Third Party Service”) we link to, and have no control of the use or protection of information provided by you or collected by those Third Party services. Whenever you elect to hyperlink to a Third Party Service, you may be asked to provide registration or other information. Please note that the information you are providing is going to a third-party, and you should familiarize yourself with the privacy policy provided by that party.

Privacy and the Internet

The following additional information will be of interest to you if you access the Grayscale Sites and/or one of its subsidiaries’ products or services through one or more of the Grayscale Sites:

• The Grayscale Sites are built upon an infrastructure with multiple layers of protection. Within the Grayscale Sites, we use industry standard encryption technologies to help safeguard your information.
• Security is a cooperative effort between us and the users of the Grayscale Sites. Please remember that your user identification and password are personal to you and should not be made available to any other person. You are responsible for your personal privacy and security practices, including but not limited to management of identification and passwords. Also, you should discontinue their use and notify us if you have any reason to suspect that someone else may be using them.
• “Cookies” are small text files that may be placed on your web browser when you visit the Grayscale Sites. Cookies make it easier for you to navigate the Grayscale Sites by, among other things, “remembering” your identity so that you do not have to input your password multiple times as you navigate between the Grayscale Sites and/or access our services. Authentication (i.e., verifying that you are who you say you are) is an essential component of site security. You can set your web browser to inform you when cookies are set, or to prevent cookies from being set. Please note that if you decline to use cookies, you may experience reduced functionality, slower site response times, and declining to use our authentication-related cookies may prevent you from using the Grayscale Sites altogether.
• Web surfing data (e.g., information regarding which of our web pages you access, the frequency of such access, and your product and service preferences) may be collected by Grayscale, or by our service providers. This may be accomplished by using cookies, web beacons, page tags or similar tools that are set when you visit the Grayscale Sites. Web surfing data and similar information may be shared internally within Grayscale and used: for administrative purposes; to assess the usage, value and performance of our online products and services; to improve your experience with the Grayscale Sites; and as otherwise permitted by applicable law or regulation. If you are a user, this information helps us suggest products or service offerings that may be of interest to you. This information may be processed by us for the purposes described above, or on our behalf by Third Party Services, solely in accordance with our instructions.
• The Grayscale Sites may include social media features (“Features”), such as the Facebook Like button and widgets, such as the “Share This” button or interactive mini-programs that run on this Site (“Widgets”). These Features and Widgets may collect your IP address, which page you are visiting on the Grayscale Sites, and may set a cookie to enable the Feature or Widget to function properly. Features and Widgets are either hosted by a third party or hosted directly on the Grayscale Sites. Your interactions with these Features and Widgets are governed by the privacy policy of the company providing it.

What Legal Bases Do We Rely On to Process Your Information?

If you are located in the EU or UK, this section applies to you.

We rely on the following legal bases to process your Personal Information:

• Consent. We may process your information if you have given us consent to use it for a specific purpose. You may withdraw consent at any time.
• Performance of a Contract. We may process your Personal Information as we believe is necessary to perform according to any contract with you, including providing our services or at your request prior to entering a contract with you.
• Legitimate Interests. We may process your information as we believe is reasonably necessary to achieve our legitimate business interests, so long as those interests do not outweigh your fundamental rights and freedoms. For example, we may process your Personal Information in order to:
• Send users information about our products and services;
• Analyze how our services are used so we may improve them to engage users;
• Support our marketing activities;
• Diagnose problems and/or prevent fraudulent activities;
• Understand how our users use our products and services so we can improve our user experience.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

Statutory Disclosures

What categories of Personal Information do we collect?

We have or our business partners have collected the following categories of Personal Information in the past twelve (12) months:

We may also collect other Personal Information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our support channels;
• Participation in customer surveys; and
• Facilitation in the delivery of our services and to respond to your inquiries.

Grayscale has not sold any Personal Information to third parties for a business or commercial purpose in the preceding twelve (12) months. Grayscale has disclosed the following categories of Personal Information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• Category A. Identifiers, such as contact details like your real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name.
• Category B. Personal Information, as defined in the California Customer Records law, such as your name, contact information, education, employment, employment history, and financial information.
• Category C. Characteristics of protected classifications under California or federal law, such as gender or date of birth.
• Category D. Financial information, such as net worth, banking information, portfolio allocations, investment goals, investment experience, annual income, tax documents, or proof of accreditation.
• Category F. Internet or other electronic network activity information, such as browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements.
• Category G. Geolocation data or other information related to your device’s geographic location.
• Category I. Professional or employment-related information, such as business contact details in order to provide you our services at a business level or job title, work history, and professional qualifications.

Your rights with respect to your Personal Information

Right to request deletion of the data — Request to delete

You can ask for the deletion of your Personal Information. If you ask us to delete your Personal Information, we will respect your request and delete your Personal Information, subject to certain exceptions provided by law, rule, or regulation, such as (but not limited to) the exercise by another consumer of his or her right to free speech, our compliance requirements resulting from a legal or regulatory obligation, or any processing that may be required to protect against illegal activities.

Right to be informed — Request to know

Depending on the circumstances, you have a right to know:

• whether we collect and use your Personal Information;
• the categories of Personal Information that we collect;
• the purposes for which the collected Personal Information is used;
• whether we sell your Personal Information to third parties;
• the categories of Personal Information that we sold or disclosed for a business purpose;
• the categories of third parties to whom the Personal Information was sold or disclosed for a business purpose; and
• the business or commercial purpose for collecting or selling Personal Information.

In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified in response to a consumer request or to re-identify individual data to verify a consumer request.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

We will not discriminate against you if you exercise your privacy rights.

Verification process

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with information you have previously provided us. For instance, depending on the type of request you submit, we may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g., phone or email) that you have previously provided to us. We may also use other verification methods as the circumstances dictate.

We will only use Personal Information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

Other privacy rights

• You may object to the processing of your Personal Information.
• You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the information.
• You can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with legal requirements.
• You may request to opt out from the future selling of your Personal Information to third parties. Upon receiving an opt-out request, we will act upon the request as soon as feasibly possible, but no later than fifteen (15) days from the date of the request submission.

To exercise these rights, you can contact us at the email address listed below. If you have a complaint about how we handle your data, we would like to hear from you.

CalOPPA Disclosures

Do Not Track Signals

We do not currently respond to web browsers’ “Do Not Track” signals that provide a method to opt out of the collection of information about visitors’ activities on the Grayscale Sites, and across other websites. If we do so in the future, we will provide all relevant information in this Privacy Policy.

Minors

We do not knowingly solicit data from or market to children under 18 years of age. By using the services, you represent that you are at least 18. If we learn that Personal Information from users less than 18 years of age has been collected, we will take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at the email address listed below.

Third Party Data Collection

We may authorize certain third parties, including, without limitation, Google Analytics, to track usage and collect information about users and their activities on the Grayscale Sites or with other Grayscale assets.

Contact Us

For any questions or comments regarding this Policy, please email us at [email protected].