Version 2026/1. Effective as of 2026.11.12

PRIVACY POLICY

ASTERRA ESTATE d.o.o.

This Privacy Policy explains how ASTERRA ESTATE d.o.o. collects, uses, discloses, stores and protects personal data when individuals visit or use its online platform, create an account, undergo identity verification, purchase contractual Claim Rights or otherwise communicate with the Company. It describes the rights available to individuals under Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applicable Croatian data protection law.

1. Data controller and scope

The controller of personal data covered by this Privacy Policy is ASTERRA ESTATE d.o.o., a company incorporated in the Republic of Croatia, with its registered address at Milutina Barača 62, 51000 Rijeka, Croatia, registration No. 040499234, OIB 17272700983 (the “Company”, “we”, “our” or “us”).

Privacy enquiries and requests: [email protected]

The Company operates an online platform at https://asterra.estate/ (the “Platform”) through which Users may acquire contractual rights of claim arising from loans previously issued to borrowers (the “Claim Rights”). The Company acts as the operator of the Platform and does not itself become the borrower under the loans giving rise to those Claim Rights. The online account area created for a registered User is referred to in this Privacy Policy as the “User Profile”.

This Privacy Policy applies to visitors to the Platform (“Visitors”), registered and prospective users of the Platform (“Users”), representatives and beneficial owners of legal-entity Users, and other individuals whose personal data we process in connection with registration, transactions, repayment redirection, migration arrangements or communications. Where another party independently determines the purposes and means of processing, it may act as a separate data controller and provide its own privacy information.

2. Categories of personal data we may process

The Company does not routinely seek special categories of personal data within Article 9 GDPR or criminal-offence data. If an identity verification solution involves biometric identification or other special-category processing, the Company will first assess the relevant legal basis, necessity, safeguards and notice requirements. The Company does not use additional financial, family or employment information merely because such information is collected by licensed investment firms.

3. How we obtain personal data

• Directly from you, including registration forms, document uploads, transaction instructions, communications and preferences.
• Automatically from the Platform and your device when you access or use the Platform, subject to applicable cookie rules.
• From contracted identity-verification, payment, security and technical service providers, where relevant to the service requested.
• From publicly accessible registers, sanctions lists, corporate registers and other lawful sources, where necessary and proportionate.
• From sellers or assignors of Claim Rights, other contractual counterparties, corporate representatives and other parties to a transaction, where their data are needed to perform or evidence the relevant arrangements.
• From Asterra Estate OÜ, the operator of the Estonian Platform, where relevant to a User-requested repayment redirection or migration. This may include limited Estonian and Croatian Platform User IDs, Estonian project and Target Claim Right references, Receiving Account and payment details, Migration Request and Migration Payment identifiers, and records of acceptance, termination or revocation under the Redirection Agreement or the Migration Terms. We may also disclose to Asterra Estate OÜ the corresponding information necessary to implement these arrangements, as described in Sections 7.2 and 8.

If we receive personal data about you from a source other than you, we provide the information required by Article 14 GDPR unless a lawful exception applies.

4. Purposes for which we use your personal data

The Company processes Users’ and Visitors’ personal data to provide, administer, maintain, protect and improve the Platform and its services, including facilitating the acquisition and administration of Claim Rights and, where requested by a User, repayment redirection and migration arrangements.

Specifically, personal data may be collected and processed for the following purposes:

4.1. Registering Users on the Platform and creating User Profiles;

4.2. Verifying Users' identities where necessary to ensure the security and integrity of the Platform, prevent fraud and unauthorized access, and comply with applicable legal requirements;

4.3. Performing appropriate User verification and due diligence checks where necessary to assess and prevent fraud, misuse of the Platform or other unlawful activities;

4.4. Creating, maintaining and administering User Profiles, including transaction records and Claim Rights portfolios;

4.5. Processing applications, instructions, requests and other communications received from Users;

4.6. Providing and administering the Platform's services, including facilitating the purchase, holding, assignment and administration of Claim Rights;

4.7. Administering User-requested repayment redirections under the Redirection Agreement and processing Migration Requests, Migration Payments and Migration Purchases under the separately accepted Migration Terms, including recording contractual acceptances and instructions, facilitating necessary data exchanges, reconciling redirected repayments, allocating eligible Migration Payments and maintaining related transaction records;

4.8. Facilitating and administering payments relating to Claim Rights transactions, including purchase payments, principal repayments, interest payments and other amounts payable to Users, in cooperation with relevant payment service providers and contractual counterparties;

4.9. Identifying, preventing, detecting and investigating fraud, unauthorized transactions, misuse of the Platform and other potentially unlawful activities, including carrying out appropriate security checks;

4.10. Maintaining the Platform's functionality, security, availability and continuous provision of services;

4.11. Monitoring, analyzing, developing and improving the quality, functionality, performance and usability of the Platform and its services;

4.12. Fulfilling obligations arising under applicable laws and regulations, including accounting, taxation, record-keeping, data protection and other applicable legal requirements;

4.13. Contacting Users and prospective Users regarding services requested or provided, Platform changes, contractual relationships, Claim Rights transactions, repayment redirections, Migration Requests and other service-related matters;

4.14. Sending commercial and non-commercial communications, including service notifications, transaction confirmations, Platform updates, newsletters and promotional offers, where permitted under applicable law and, where required, based on the User's or Visitor's consent;

4.15. Administering loyalty programs, referral programs, promotional campaigns and other User benefits, including determining eligibility for loyalty levels, bonuses, additional interest or other benefits in accordance with the applicable program terms. Such eligibility and benefits may be calculated automatically using the Platform's systems;

4.16. Establishing, exercising and defending legal claims, protecting the legitimate interests of Asterra Estate, and receiving, investigating and responding to complaints and disputes;

4.17. Maintaining records of agreements, electronic acceptances, transaction and payment instructions, Claim Rights purchases, assignments, repayments and redirection or migration activities as necessary for Platform administration and the protection of legal rights;

4.18. Providing information, responding to inquiries and fulfilling other requests submitted by Users or Visitors;

4.19. Carrying out other specific and lawful processing activities that are compatible with the purposes described above or for which an appropriate legal basis has been established, subject to applicable data protection requirements.

5. Legal basis for processing personal data

The Company processes personal data only where an appropriate legal basis applies under Article 6 of Regulation (EU) 2016/679 (the “GDPR”). The applicable basis depends on the purpose and circumstances of the processing.

5.1. Performance of agreements

We process personal data where this is necessary to take steps at a User’s request before entering into a contract or to perform an agreement with that User, including the Platform Terms of Use and, where applicable, the Redirection Agreement and Migration Terms.

Personal data may be processed to:

• register Users and create, maintain and administer User Profiles;
• provide Users with access to the Platform and its services;
• facilitate the purchase, holding and administration of Claim Rights offered on the Platform;
• record and administer the acceptance and performance of the Redirection Agreement and the separately accepted Migration Terms; process User-requested repayment redirections, Migration Requests, Migration Payments and Migration Purchases; exchange necessary data with the parties involved and retain relevant contractual and transaction records;
• facilitate payments related to the purchase of Claim Rights and the distribution of repayments, interest and other amounts due to Users, in cooperation with relevant payment service providers and other involved parties;
• maintain records of Claim Rights transactions, User Profile balances and payment histories;
• provide Users with information, statements and notifications regarding their Claim Rights and transactions;
• communicate with Users regarding the performance of agreements and the provision of Platform services;
• perform, manage and terminate contractual relationships with Users.

Legal basis: Article 6(1)(b) GDPR – processing necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract.

5.2. Compliance with legal obligations

Asterra Estate processes personal data where necessary to comply with applicable legal obligations arising under European Union and Croatian legislation.

Such processing may include:

• maintaining accounting records and supporting financial documentation;
• complying with applicable tax reporting and record-keeping obligations;
• responding to lawful requests from courts, public authorities and other competent institutions;
• maintaining records and documentation required under applicable legislation;
• fulfilling other statutory obligations applicable to Asterra Estate's business activities.

Legal basis: Article 6(1)(c) GDPR – processing necessary for compliance with a legal obligation to which Asterra Estate is subject.

5.3. Legitimate interests

Asterra Estate may process Users' and Visitors' personal data where such processing is necessary for its legitimate business interests or those of third parties, provided that such interests are not overridden by the rights and freedoms of the individuals concerned.

Such processing may include:

• protecting the Platform, User Profiles and information systems against unauthorised access, fraud, misuse and other unlawful activities;
• verifying Users' identities where reasonably necessary to prevent fraud and protect the security and integrity of the Platform;
• monitoring, identifying and investigating suspicious or potentially fraudulent activities;
• maintaining and improving the functionality, reliability, security and performance of the Platform;
• analyzing the use of the Platform to improve services and user experience;
• managing business relationships and responding to User inquiries and complaints;
• establishing, exercising or defending legal claims;
• protecting the legal and commercial interests of Asterra Estate and its Users.

Before relying on legitimate interests as a legal basis, Asterra Estate assesses whether the processing is necessary and whether its interests are outweighed by the rights and freedoms of the individuals concerned.

Users and Visitors have the right to object to processing based on legitimate interests in accordance with Article 21 GDPR.

Legal basis: Article 6(1)(f) GDPR – processing necessary for the purposes of legitimate interests pursued by Asterra Estate or a third party.

5.4. Consent

In certain circumstances, Asterra Estate processes Users' or Visitors' personal data based on their freely given, specific, informed and unambiguous consent.

Consent-based processing may include:

• sending newsletters, promotional communications and direct marketing messages where consent is required by applicable law;
• using non-essential cookies and similar tracking technologies for analytics, personalization or marketing purposes;
• carrying out other optional processing activities for which specific consent has been obtained.

Where processing is based on consent, Users and Visitors may withdraw their consent at any time through the available Platform settings, unsubscribe mechanisms or by contacting Asterra Estate.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Legal basis: Article 6(1)(a) GDPR – consent of the data subject.

6. Identity verification and sanctions-related checks

To reduce fraud and ensure that contractual rights are allocated to the correct person, the Company may verify your identity through a specialist verification provider. Depending on the verification method, this may involve identity document images, a facial image, liveness checks, information obtained from registers, and verification status or results. The Company seeks to receive only information reasonably necessary for its purposes.

The Company may perform proportionate sanctions and fraud-prevention checks and may request explanations or supplementary documents if information is inconsistent or a transaction gives rise to a legitimate concern. These checks are performed for the purposes described in this Privacy Policy and do not, in themselves, mean that the Company is subject to mandatory anti-money laundering or counter-terrorist financing obligations.

7. Claim Rights, transaction administration and migration arrangements

7.1. Claim Rights and counterparties

When a User purchases a Claim Right, the Company processes the User’s identity and User Profile identifiers, the relevant Claim Right, contractual documents, allocation information, payments, repayments and related correspondence. This processing is necessary to conclude, evidence and administer the relevant arrangements and provide access to Platform functionality.

The Company may share limited personal data with the relevant seller or assignor of Claim Rights, including NEXASSET OÜ (Estonia), where objectively necessary to document or perform an assignment, identify the person entitled to receive payment, maintain records, handle a dispute or enforce a contractual right. Disclosures will generally be limited to identity or User identifiers and relevant contract, transaction and payment details. Full identity-document files or biometric images are not routinely provided to an assignor merely because it offers Claim Rights on the Platform.

Where an assignor, borrower or payment service provider independently determines the purposes and means of processing, it acts as a separate data controller. Whether any party instead acts as a data processor or joint controller depends on the actual processing arrangements and applicable GDPR requirements.

A User Profile on the Croatian Platform is separate from the User’s account on the platform operated by Asterra Estate OÜ (the “Estonian Platform”). Registration on the Croatian Platform does not in itself authorise the transfer or reuse of an entire Estonian Platform account or verification file. Any exchange of personal data must have a valid legal basis, be limited to what is necessary and be explained to the User.

7.2. Repayment redirection and migration arrangements

Under the Redirection Agreement between the User (referred to as the Lender in that agreement), Asterra Estate OÜ and the Company, the User may authorise Asterra Estate OÜ to redirect repayments under existing agreements on the Estonian Platform to the payment account designated by the User on the Croatian Platform (the “Receiving Account”). The Company processes the information necessary to identify, reconcile and administer those redirected repayments. The Redirection Agreement does not itself authorise any purchase of Claim Rights or alter the underlying Estonian loan agreements.

Separately, the Automatic Purchase Terms for Migration (the “Migration Terms”) govern User-requested Migration Requests, Migration Payments and Migration Purchases. A Migration Purchase requires acceptance of the Migration Terms and a specific User instruction under those terms. Where applicable, the Company processes the relevant Estonian project, Migration Request, Target Claim Right, Migration Payment, Receiving Account and transaction references to match the payment, facilitate the instructed purchase and administer the corresponding Assignment Agreement.

For these arrangements, the Company may record the User’s acceptance of the Redirection Agreement and, separately, the Migration Terms, including the date, time and applicable document version; the User’s instructions and transaction references; relevant payment amounts, dates and reconciliation records; completed Migration Purchases and Assignment Agreements; and notices of termination or revocation. The Company and Asterra Estate OÜ may exchange the limited identifiers, acceptance information and payment data necessary to execute and reconcile transfers, investigate failed, returned or unidentified payments and handle related communications.

Contractual acceptance of the Redirection Agreement or Migration Terms is not, in itself, consent to unrelated personal-data processing under Article 6(1)(a) GDPR. The processing described above relies on Article 6(1)(b) GDPR where necessary for the requested contractual service, Article 6(1)(c) GDPR where specific legal obligations apply, and Article 6(1)(f) GDPR where appropriate for proportionate fraud prevention, payment reconciliation, security and dispute handling. The processing of data relating to representatives of legal-entity Users is assessed separately, including under Article 6(1)(f) or 6(1)(c) GDPR where applicable.

Asterra Estate OÜ and the Company act as independent data controllers to the extent that each independently determines the purposes and means of processing for its own Platform. Any additional exchange of identity documents, verification records or unrelated Estonian transaction history requires a separate assessment of necessity, legal basis and appropriate transparency. If the parties jointly determine the purposes and means of particular processing, their GDPR responsibilities must be assessed and arranged accordingly.

8. Recipients and sharing of personal data

Personal data may be disclosed, strictly as needed for the stated purposes, to:

• Identity-verification, cybersecurity, fraud-prevention, customer support, cloud hosting, email, analytics and other IT service providers acting under appropriate terms.
• Banks, payment institutions or other payment-processing parties involved in payments or disbursements, acting as processors or separate controllers depending on their role.
• The relevant seller or assignor of Claim Rights, other contractual counterparties and parties involved in repayment or recovery, where necessary to evidence or perform a Claim Right transaction.
• Professional advisers, auditors, accountants, legal representatives, insurers, service continuity providers and debt recovery specialists where lawful and necessary.
• Courts, law enforcement, tax authorities and other competent public authorities when disclosure is legally required or otherwise lawfully justified.
• Asterra Estate OÜ (Estonia), as operator of the Estonian Platform, where necessary to administer the Redirection Agreement or the Migration Terms, exchange acceptance, instruction, termination or revocation information, identify and reconcile redirected repayments and Migration Payments, resolve unsuccessful transfers, and evidence Migration Requests and related transactions.
• Other group or affiliated companies, only where a valid legal ground exists and appropriate data-sharing arrangements are in place.

We do not sell personal data to third parties for their independent marketing. Processors are subject to GDPR-compliant contractual instructions and appropriate confidentiality and security obligations. We limit disclosures to the minimum data reasonably necessary for the purpose.

9. International transfers

The Company aims to process data within the European Economic Area (“EEA”) where possible. If personal data is transferred outside the EEA, it will do so only where an appropriate GDPR transfer mechanism is available, such as an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, including Standard Contractual Clauses where appropriate. Where required, we assess the circumstances of the transfer and implement supplementary protections.

You may request information about the safeguards used for a particular international transfer using the contact details in Section 1.

10. Data storage, retention and deletion

User-related information, including information stored in the User Profile, records of Claim Rights purchased through the Platform, Assignment Agreements, Redirection Agreement and Migration Terms acceptances, repayment redirection and migration instructions, payment and repayment transactions, and communications, may be retained where necessary as evidence of the User’s identity, contractual arrangements, Claim Rights and transactions, and the fulfilment of legal or contractual obligations.

Personal data is retained only for as long as necessary for the purposes for which it was collected, taking into account the duration of the contractual relationship, the existence of outstanding Claim Rights, applicable statutory retention requirements, and the relevant limitation periods for legal claims under Croatian law.

Below is a summary of the key principles governing the retention of personal data.

Following the termination of the User's contractual relationship with the Company, we will cease actively processing personal data for ordinary service provision as soon as it is no longer necessary for that purpose. Personal data may continue to be retained and processed to the extent necessary to comply with applicable legal obligations, administer any outstanding contractual rights or obligations, resolve disputes, or establish, exercise or defend legal claims.

We will generally retain contractual and transaction records for the period required by applicable Croatian law. In particular, accounting documents and supporting transaction records falling within the scope of the Croatian Accounting Act (Zakon o računovodstvu) are generally required to be retained for at least 11 (eleven) years, calculated in accordance with the applicable statutory requirements.

Other personal data, including identification and verification records, User Profile information, redirection and migration records, communications and technical records, will be retained only as long as necessary for their respective purposes, applicable legal requirements or the Company’s legitimate interests, including fraud prevention, transaction security and the establishment, exercise or defence of legal claims.

Where personal data is retained for the establishment, exercise or defence of legal claims, the retention period will be determined by reference to the applicable statutory limitation periods under Croatian law and any relevant ongoing proceedings.

Once the applicable retention period expires and no other lawful basis for retention exists, the relevant personal data will be securely deleted or irreversibly anonymised.

The termination of the User's contractual relationship or closure of the User's Profile does not automatically result in the deletion of personal data that must be retained to comply with applicable legal obligations or to establish, exercise or defend legal claims.

11. Profiling and automated decision-making

Technical systems may automatically validate data, flag potentially fraudulent behaviour, detect security anomalies or support identity-verification checks. Such processes are designed to assist the Platform’s operations and risk assessments. Where a verification result is contested, the Company will provide an appropriate route for review.

The Company does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals within the meaning of Article 22 GDPR. The Company reviews the configuration of identity verification, fraud-screening and onboarding tools to assess whether any processing falls within Article 22 GDPR. If Article 22 decision-making is introduced, the Company will provide the notices and safeguards required by law.

Where the Platform offers an automatic Claim Right purchase strategy, technical selections are used to determine Claim Right allocations according to the User’s instructions. This is a service-execution mechanism and is not intended to profile the User for access to financial services or to evaluate creditworthiness.

12. Cookies and similar technologies

The Platform uses strictly necessary cookies and comparable technologies for operation, security, user sessions and user-selected settings. Subject to applicable laws, optional performance/analytics, functional and targeting cookies may be used only when a valid lawful basis, including consent where required, has been obtained.

You can accept, reject or change optional cookies through the “SELECT COOKIES” settings available on the Platform. Strictly necessary cookies remain active where genuinely essential to provide a requested service. Further information, including cookie providers and lifetimes, is provided in the separate Cookie Policy.

13. Data security

We apply technical and organisational measures proportionate to the nature of the data and risk, including access restrictions, authentication controls, encrypted communication where appropriate, backup and recovery procedures, monitoring, confidentiality requirements, staff awareness measures and vendor due diligence. Access to personal data is restricted to authorised persons with a legitimate need to know.

No internet-based service can guarantee absolute security. We investigate suspected security incidents and make notifications to competent authorities and individuals where required under Articles 33 and 34 GDPR.

14. Your GDPR rights

Subject to applicable conditions, you may:

• Request access to your personal data and a copy of the data being processed (Article 15).
• Request rectification of inaccurate data or completion of incomplete data (Article 16).
• Request erasure when the relevant legal conditions are met (Article 17).
• Request restriction of processing in the cases specified by GDPR (Article 18).
• Request portability for eligible data processed by automated means on the basis of consent or contract (Article 20).
• Object to processing based on legitimate interests, and object at any time to direct marketing (Article 21).
• Withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing (Article 7).
• Exercise any rights applicable to automated decision-making under Article 22 GDPR.

To exercise your rights, email [email protected]. We may ask for information necessary to verify your identity before responding; we will not request more than is reasonably needed. We will reply without undue delay and generally within one month, subject to extensions permitted by Article 12(3) GDPR. Requests are normally free of charge, except where GDPR allows a fee or refusal for manifestly unfounded or excessive requests.

Erasure may be declined or limited where retention is needed to comply with a legal obligation or to establish, exercise or defend legal claims. Where possible, data no longer needed for active service delivery will be deleted or access-restricted even if some records must be retained.

15. Complaints to the supervisory authority

If you believe your personal data has been processed unlawfully, you may complain to the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, “AZOP”), or to a supervisory authority in another EU/EEA Member State where you habitually reside, work or where the alleged infringement occurred.

AZOP — Ulica Metela Ožegovića 16, HR-10000 Zagreb, Croatia; email: [email protected]; website: https://azop.hr/.

AZOP is the competent personal data protection authority; this does not mean that the Company is licensed or supervised as an investment firm.

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our processing activities, legal requirements or Platform functionality. The current version will be published on the Platform with an effective date. If a change materially affects users, we will provide additional notice where required. The applicable version does not retroactively legitimise processing undertaken without a lawful basis.