Privacy and Data Protection Policy

FENIX360 is an artist centred social platform. Fans and artists meet in one place through a personalised feed, live broadcasts, direct messaging, official merchandise, ticketed events, and a wallet that holds FENIX360 digital assets.

Every one of those features works differently, and each one touches different data. This policy explains all of them together so you do not have to read a separate document for every part of the app.

Read this policy alongside our Terms of Use, our Cookie Notice and any other notice we give you at the moment we collect your data. If you use FENIX360, you are agreeing to the practices described here. Where the law requires your consent rather than your agreement, we ask for it separately and you can withdraw it at any time.

FENIX360 Pte. Ltd. (“FENIX360”, “we”, “us”) is a company incorporated in Singapore, with its registered office at #08-10A (Lobby B), 111 Somerset, Singapore 238164. It is the controller of the personal data described in this policy. Our group companies operate the service in different markets, and where a group company determines how your data is used it does so under this same policy.

You can reach us at hello@fenix360.com or through the in-app support screen. Section 18 has our full contact details.

Artists, labels and event promoters use FENIX360 to reach their audiences. In most cases they act as independent controllers of the data they collect from you directly, for example when you subscribe to an artist or buy a ticket from them. Section 7 explains what they see and what they do not.

3.1 Data you give us

Account and profile

Creating an account requires three things: a display name, an email address and a password. Nothing else is required to sign up. You may then add profile and cover images, a biography, links, a location and the artists or genres you follow, and we ask you to confirm your age where a country we operate in requires it. If you sign up through Apple, Google or a social account, we receive the basic profile fields that provider shares with us.

Artist and creator accounts

Artists, managers, labels and promoters give us additional information so we can verify the account and pay out earnings. This includes legal name or business name, business address, tax identifiers, payout details, and identity or rights-holder verification documents where we are legally required to check them.

Content you post

Posts, photos, video, audio, comments, replies, reactions, polls, captions, hashtags, stories and messages you send. Content carries metadata such as the time it was created, file and formatting information and, if your device adds it, a geotag. You can strip location data from media before uploading in your device settings.

Live broadcasts

If you go live we process your camera and microphone feed for the duration of the broadcast, along with the stream title, thumbnail, scheduling, viewer chat, reactions, tips and gifts, and technical quality data such as bitrate and dropped frames. If you watch a live stream we record that you attended, how long you stayed, and anything you send in chat. Recordings are kept only where you or the broadcaster choose to save or replay the stream.

Messages

Direct messages between you and other members, and messages between you and an artist’s team. We process message content to deliver it, to run safety and spam checks, and to respond when something is reported to us.

Merchandise orders

When you buy merchandise we collect the items ordered, sizes and options, delivery and billing address, contact details for delivery updates, order history, returns and any customer service correspondence about the order.

Merchandise sold on FENIX360 is currently made and shipped by the artist or their team, not by us. We pass them the delivery name, address, contact detail and order detail they need to send your order and to handle a return. They are an independent controller of that information and their own privacy notice governs what they do with it after the sale. If we introduce third party print or fulfilment providers in future, we will update this policy before any order data is sent to them.

Events and ticketing

Tickets and passes you buy or claim, attendee name where the promoter requires it, seat or tier, entry scans and check-in time, and where you opt in, an event reminder tied to your calendar or notifications.

Wallet and digital assets

Where you use FENIX360 digital asset features we process your token balances, the rewards you earn through engagement, and your transaction history. Not every transaction is written to a blockchain. Smaller movements, including engagement rewards and balance changes inside the app, are recorded only in our own systems. Where a transaction is settled on a blockchain we also process the wallet address involved and the record that appears on that chain. Where the law requires identity verification for anti money laundering purposes, we collect identity documents, proof of address and screening results. Section 8 explains the difference between the two kinds of record.

Payments

Card and payment details are collected and stored by our payment providers, not by FENIX360. We receive a payment reference, the amount, the currency, the outcome and the last digits and type of the instrument used, which is what we need to service your order and detect fraud.

Support and surveys

What you tell us when you contact support, report content, appeal a moderation decision, enter a competition or take part in research.

3.2 Data we collect as you use FENIX360

• Engagement. Artists you follow, posts you view and for how long, likes, saves, shares, comments, searches, streams watched, merchandise viewed and events browsed. This is what makes the feed and recommendations work.
• Device and technical data. Device model, operating system, app version, language, time zone, network type, mobile carrier, crash logs, performance diagnostics, IP address and device identifiers.
• Approximate location. Derived from your IP address, used for currency, tax, event and content relevance, and to meet regional legal restrictions.
• Precise location. Only if you turn it on, for example to find events near you or to check in at a venue. You can switch it off at any time in your device settings.
• Cookies and similar technologies. Described in section 9.

3.3 Data from third parties

We work with business partners, technical and delivery subcontractors, payment and fraud providers, advertising networks, analytics providers and, where relevant, identity verification providers. We use data from them only where you have given consent to them or to us, or where we have a legitimate interest in using it and that interest is not outweighed by your rights.

We only use your personal data where we have a legal basis to do so. The table below sets out each purpose and the basis we rely on. Where the basis is consent, you can withdraw it at any time without affecting anything we did before you withdrew it.

Parts of FENIX360, including artist pages and the feed, carry advertising. Advertising is how artists earn from free content, so this matters to the people you follow as much as it matters to you.

We and our advertising partners use engagement and device data to decide which advertisements to show, to cap how often you see the same one, and to measure whether a campaign worked. Where the law requires consent for this, we ask before any advertising identifier is set, and you can change your answer later in Settings.

Reporting we give to advertisers and to artists is aggregated. An artist can see that a campaign reached a certain number of people in a certain country or age band. They do not receive a list of who saw it.

You can limit advertising personalisation at any time in Settings, and also through the advertising controls built into iOS and Android. Turning personalisation off does not remove advertising, it makes it less relevant to you.

We share personal data with group companies we rely on to operate FENIX360, including our subsidiaries, our ultimate holding company and its subsidiaries, for the purposes set out in this policy.

We share with parties outside our group only in these situations:

• You have asked us to. For example when you connect a social account, cross-post to Instagram, YouTube, Facebook, TikTok or X, or link an external wallet. Unless you have expressly consented, we do not share your personal data with third parties for their own marketing.
• Service providers acting for us. Hosting, content delivery, live video infrastructure, ticketing, payments, customer support tooling, moderation, analytics and security. They act on our instructions under contract, they may not use your data for their own purposes, and we remain responsible for it.
• Artists and promoters. Limited to what section 7 describes.
• Billing. Your payment credentials sit with the relevant payment provider and not with FENIX360.
• Disputed charges. If you dispute a charge we may share what is needed with your card issuer or bank to help resolve it.
• Legal obligations and safety. To comply with the law, to enforce our Terms of Use, or to protect the rights, property or safety of FENIX360, our members, artists or the public. This includes sharing what is needed for fraud prevention and credit risk assessment.
• Corporate transactions. If FENIX360, or substantially all of its assets, is acquired, personal data held about our members is one of the transferred assets. We will tell you before your data becomes subject to a different privacy policy.

We also produce aggregated and anonymised statistics that cannot identify you, and we may share those. For example, we might tell an advertiser that 500 men under 30 clicked their advertisement on a given day.

Some of our affiliates and providers are in countries whose laws may not offer the same protection as your own. Before your data goes to them we put contractual or other appropriate safeguards in place so that it is handled in line with this policy. Section 15 has more detail.

Following an artist does not hand them your personal file. This is what an artist or their team sees:

• Your public profile: display name, profile image, biography and anything else you have chosen to make public.
• Your public interactions with them: comments, reactions, posts you tag them in, and chat you send during their live streams.
• Direct messages you send them, and messages their team sends you.
• Aggregated audience statistics: follower counts, growth, broad age bands, countries and cities, and how content performed. These are group level figures, not individual profiles.
• Order and ticket information where you buy from them. Because artists fulfil their own merchandise orders, this includes the delivery name, address and contact detail for that order, along with the items and any return. They are an independent controller of it and their own privacy notice applies.

Artists do not receive your email address, your phone number, your payment details, your wallet balance, your date of birth, your precise location or your browsing behaviour elsewhere on FENIX360.

Your FENIX360 balance is not the same thing as a blockchain record, and the difference matters for your privacy.

• Off-chain records. Most activity, including engagement rewards and smaller balance movements, is recorded only in our own systems. These records behave like any other data described in this policy. We can correct them, and we can delete them when you ask us to.
• On-chain records. Some transactions are settled on a public blockchain. Everything below applies to those, and only to those.
• Public ledger. Transactions written to a public blockchain, including wallet addresses, amounts and timestamps, are visible to anyone and are recorded permanently.
• We cannot delete on-chain records. No participant, including FENIX360, can alter or erase data once it is confirmed on a public chain. A request to delete your data reaches everything we hold in our own systems, but it cannot extend to the chain itself.
• Pseudonymous, not anonymous. A wallet address does not carry your name, but it can be linked to you by analysis of on-chain activity or by information you publish yourself.
• Identity checks. Where regulation requires verification before you can hold, transfer or convert digital assets, we collect identity documents and screening results. We retain those records for the period the relevant financial regulations require, which is usually longer than the retention period for an ordinary account.
• External wallets. If you connect a wallet from another provider, that provider’s own terms and privacy notice apply to it. We see the address and the transactions relevant to FENIX360.

Nothing in this section is investment advice or a statement about the status of any digital asset. Those points are covered in our Terms of Use and in the documentation for the relevant asset.

On our websites we use cookies, and in our apps we use software development kits and device identifiers that do a similar job. We group them as follows:

• Strictly necessary. Sign-in, session security, load balancing, fraud prevention and remembering your privacy choices. These cannot be turned off without breaking the service.
• Functional. Language, region, playback quality and interface preferences.
• Analytics. How features are used, which screens people reach, where errors happen.
• Advertising. Delivering, capping and measuring advertisements, on FENIX360 and on partner platforms.

Where the law requires it, we ask for your consent to anything beyond the strictly necessary category before we set it. You can change your choices at any time through the cookie settings link in our website footer, or in the privacy section of the app. Browser and device level controls also apply and we honour Global Privacy Control signals where we are required to.

Information you give us is held on secure servers. Traffic to and from FENIX360 is encrypted in transit, payment transactions are encrypted, and sensitive data is encrypted at rest. Access by our staff is limited to people who need it to do their job, and that access is logged.

Where you have chosen a password, keeping it confidential is your responsibility. Do not share it with anyone, do not reuse it on other services, and turn on two factor authentication in Settings. If you use FENIX360 wallet features, treat your recovery phrase the same way. Nobody at FENIX360 will ever ask you for a password or a recovery phrase.

Transmission of information over the internet is never completely secure. We do our best to protect your personal data, but we cannot guarantee the security of data you send to us, and any transmission is at your own risk. Once we have your information we apply strict procedures and security controls designed to prevent unauthorised access.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, within the time limits the law sets.

Under the General Data Protection Regulation, the UK GDPR and comparable laws elsewhere, you have rights over the data we hold about you. Except where local law limits them, these include the right:

• to be told what data we have collected about you and why;
• to receive a copy of that data in a portable digital format, and to have it sent to another provider where that is technically feasible;
• to have inaccurate data corrected or updated;
• to have your data deleted, or to have us stop processing all or part of it;
• to restrict processing while a dispute about accuracy or legitimate interest is resolved;
• to object to processing for direct marketing, or on other grounds specific to your situation;
• to withdraw consent at any time where consent is the basis we rely on;
• to lodge a complaint with your data protection authority if you believe we have broken the rules.

If you are in California

You may also request the specific categories and pieces of personal information we have collected, the categories of sources, the business purpose, and the categories of third parties we disclose to. You may opt out of the sharing of personal information for cross-context behavioural advertising, limit the use of sensitive personal information, and you will not be treated differently for exercising any of these rights.

If you are in Singapore, Hong Kong or elsewhere in Asia

Local laws including the Personal Data Protection Act and the Personal Data (Privacy) Ordinance give you rights of access and correction, and the right to withdraw consent. Contact us using the details in section 18 and we will apply whichever framework gives you the stronger protection.

How to exercise your rights

Most of what you need is in the app. Settings gives you access to a copy of your data, correction of your profile, marketing and notification controls, advertising preferences, and account deletion. For anything else, write to hello@fenix360.com. We respond within one month, and we will tell you if we need longer because the request is complex. We may need to verify who you are before we act, which protects you as much as us. There is no charge unless a request is manifestly unfounded or excessive.

We only pass your data to third parties who protect it to a standard equal to or better than the one set out in this policy, and who meet the requirements of the Apple App Store Review Guidelines and the Google Play Developer Policy. That obligation is written into our contracts with them and we assess it before we onboard a provider.

FENIX360 contains links to and from the sites of partner networks, advertisers, artists and affiliates, and artists may link out to their own stores, streaming profiles and ticketing pages. Those sites have their own privacy policies and we do not accept responsibility or liability for them. Check their policy before you give them any personal data.

We keep your personal data only as long as we need it to run the service and meet our legal obligations. In deciding how long, we weigh:

• the amount, nature and sensitivity of the data;
• the potential harm from unauthorised use or disclosure;
• whether the purpose can be achieved without keeping the data;
• whether we need it for legal, tax or accounting reasons.

In practice that means transaction, order and ticket records are kept for the period tax and consumer law requires, identity verification records for the period financial regulation requires, moderation and safety records for as long as needed to keep repeat offenders off the platform, and ordinary account and engagement data for the life of your account.

You can delete your account at any time from Settings. Deletion removes your profile and your content from FENIX360 and starts an irreversible deletion or anonymisation of your personal data across our systems, subject to the exceptions above and to backups, which cycle out on a fixed schedule. Content you sent to other people, and anything already settled on a public blockchain, cannot be recalled. See section 8.

FENIX360 operates worldwide, so data we collect from you may be transferred to and stored at a destination outside your country, including outside the European Economic Area. It may be processed by staff working for us or for one of our suppliers, for example in payment processing, live stream delivery and support. Artists who fulfil merchandise orders may also be based outside your country.

Where we transfer personal data out of the EEA or the UK we rely on an adequacy decision where one exists, or on Standard Contractual Clauses together with any additional measures the transfer needs. You can request a copy of the safeguards we use by writing to hello@fenix360.com.

FENIX360 is not intended for children under 16. Stricter age limits apply in some countries, and our Terms of Use set those out.

We do not knowingly collect personal data from children under 16. If you are under that age, please do not use FENIX360 and do not give us any personal data. If we learn that we have collected data from a child, we take all reasonable steps to delete it, and that may mean closing the account without notice.

If you are a parent or legal guardian and you believe a child in your care has given us personal data, contact us urgently through the app or by using the details in section 18.

We update this policy as FENIX360 changes. When we do, we show the new version when you next open the app, publish it on our website and, where the change is significant, tell you by email or push notification before it takes effect. The effective date at the top of the page tells you which version you are reading. Previous versions are available on request.

Questions, comments and requests about this policy are welcome.

• By email: hello@fenix360.com
• By post: FENIX360 Pte. Ltd., #08-10A (Lobby B), 111 Somerset, Singapore 238164