1. Introduction

Xanthos Limited (“Xanthos Limited”, “Raidar”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data in line with applicable data protection laws. When we process personal data, we act as a data controller.

This Privacy Notice explains how we collect, use, disclose, store and protect your personal data when you:

• use our bot on Telegram (the “Bot”),

• visit our website at https://tokenscan.app (the “Website”), and

• access any other Raidar services that links or refers to this Privacy Notice,

(collectively, the “Services”).

Personal data is a term defined under applicable laws and is essentially information that relates directly or indirectly to an individual (such as name, address and contact information).

By using the Services, you acknowledge that you have read and understood this Privacy Notice.

If you do not agree with the terms of this Privacy Notice, please discontinue use of the Services.

Unless otherwise stated, terms used in this Privacy Notice have the meanings given to them in the Terms of Use.

2. Restricted Users and Jurisdictions

You may not use the Services if you are:

• a resident, national, or entity of a jurisdiction subject to comprehensive sanctions or trade restrictions;

• a person or entity listed on any sanctions list issued by the U.S., EU, UN, UK, or Switzerland; or

• acting for or on behalf of such a person or entity.

We do not knowingly collect personal data from Restricted Persons.

If we discover we have done so, we will delete such data where legally permitted.

3. Personal data we collect

We may collect personal data from the following sources:

3.1 Information you provide to us, including via the Bot

Personal data you provide to us, including:

• Wallet address (Identifier) / Social-media handles: When you connect a wallet or share your address/handle, we process your wallet address/social-media handle to provide the Services, including participation in Reward Programs (such as Raid2Earn).

• Telegram information (where applicable): If you interact with us via Telegram, we may process:

  • your public Telegram user ID (a unique numeric identifier provided by Telegram)

  • your public Telegram username (e.g., @JohnDoe) if you have set one

  • your public Telegram display name (e.g., “John Doe”)

• Other information: We may also handle other personal data that you choose to provide, including via our Website, or as part of user content (text, links, images, raid submissions, etc.). For example:

  • Social Media Information (e.g., Twitter username, profile picture)

  • Business and personal contact information (such as your name, e-mail, address, and contact number)

  • Information in pitch decks and other materials you share with us

  • Financial and other information you provide in connection with our Services, such as date of birth, banking information, and other financial data

  • Information from your electronic communications with us and/or our service providers (including by e-mail or other forms of electronic communication, such as support communications)

  • Government-issued identifiers and other information if/where required for identification and security checks, where necessary for us our interactions, products and/or services

  • Other information you provide to us (for example, in registering for events, e-mail alerts, or completing forms)

If you provide information to us about another person, you should provide that person with this Privacy Notice and comply with any legal obligations that apply to your provision of the information to us.

3.2 Information collected automatically

• Technical information: Browsing information, including IP address, internet connectivity data, network interaction history, operator and carrier data, browser type and version, device type category and model, time zone setting and location data, language data, application version, browser plug-in types and versions, operating system and platform, cookies and similar technologies, operating system, other information stored on devices you permit access to when visiting our Website and platforms.

• Basic usage data: We may collect minimal diagnostic information such as:

  • timestamps, including the first timestamp of your interaction with the Bot

  • pages/features accessed

  • connection status

• Raid Activity Data: Information relating to your participation in Reward Programs, including the specific raids a user participated in (interactions per tweet, e.g. "liked XYZ tweet post" & accrued XP for the given interaction).

• Exclusion Data: Information used for moderation purposes, including the groups where a user has been excluded from participating in raids.

• Analytics: We may use third-party web analytics services on our Website to help us analyse how visitors use the Website. We will process information such as your IP address and other information collected by automated means, which may be disclosed to, or collected by, these service providers.

• Third-party plugins and widgets on our Website, like social media sharing tools, may collect information regarding your use of our Website and platforms and interactions with these tools and plugins. This will be subject to the privacy notices of the providers of these tools and plug-ins.

3.3 Blockchain-related data

Blockchain networks are public and transparent. When you interact with blockchain networks through the Bot: your wallet address, transaction history and associated metadata may become publicly visible.

As part of the Services, certain personal data will be made available ‘on-chain’. This means the information is recorded directly on a blockchain, where it is stored in a decentralised and immutable manner and cannot be modified or deleted by us. On-chain data may be accessible to anyone with access to the relevant blockchain network and may be further processed by third parties outside our control. This includes blockchain explorers and other participants in the network. We treat on-chain data as personal data when it relates to an identifiable individual, but our ability to fulfil data subject rights is technically limited. Please see section 8.2 for further details.

If you do not wish certain information to be made public or permanently recorded, you should not submit this to any blockchain platform.

Note that we may be required to collect and retain certain on-chain data to comply with legal obligations, such as anti-money laundering, anti-fraud and counter-terrorism requirements. This may include verifying ownership or control of a particular blockchain address.

3.4 Information collected from other sources

We may collect information about you from other third parties or publicly available sources. For example:

• Individuals or entities with whom you have interacted may provide us with details such as your contact information.

• Information from public websites, registers, or third party data providers.

• As the Bot operates on Telegram’s infrastructure, Telegram may collect technical and usage information about your use of the app. Such collection is subject to Telegram’s own privacy policy available https://telegram.org/privacy/gb.

• We may also rely on information from X Corp. (formerly Twitter) (“X”) to retrieve, display, or verify content, engagement metrics, or other information relating to raids or social-media activity.

4. How and why we use your personal data

We may use your personal data for the following purposes, including in connection with the purposes set out in the terms of use.

We, in particular, handle personal data for the following purposes:

Crime and risk prevention

We may also process your personal information described above where we believe it is necessary or appropriate to protect the rights, property, or safety of our business, our stakeholders, the Services, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection, anti-money laundering and credit risk protection, or suspension or cancellation of the Services. We may also share personal data with law enforcement authorities in the following scenarios: (1) upon receipt of an official law enforcement request (such as a subpoena or formal email); or (2) where we become aware of a suspected crime and voluntarily report it to the relevant law enforcement authorities.

Our lawful basis in these circumstances is: (i) our legitimate interests (or those of a third party) to monitor and implement controls regarding unlawful activities, to assist with the prevention of crime, or actioning suspension or cancellation of the Services; or (ii) compliance with a legal obligation (where the processing is required by applicable law).

We do not use your personal data for:

• targeted advertising;

• building user profiles; or

• automated decision making that has legal or similarly significant effects.

5. How we share personal data

We may share your personal data with our affiliates, group companies, service providers, transaction counterparties, professional advisors and your representatives, including:

• Service providers: This may include Telegram, blockchain infrastructure providers (such as RPC nodes and explorers), cloud hosting, wallet providers, and other vendors necessary for the operation and security of the Bot. For Reward Programs, we may share limited information (such as your wallet address, referral code, and aggregate reward amounts) with technical or accounting service providers that help us track, calculate, and deliver rewards.

• Affiliates or contractors: For internal operations and stability of the Services.

• Legal, law enforcement, governmental, regulatory authorities: Where required by law or legal process, including to enforce sanctions or investigate or prevent fraud, crime or other unlawful activities.

• Business transaction participants/stakeholders: In the event of a merger, restructuring, acquisition, or asset transfer of all or part of our business (including in the event of a reorganization, liquidation or dissolution).

Third-party providers who may process your personal data do so in accordance with their own privacy notices. We do not control, and are not responsible for, their independent data practices.

6. Cookies and similar technologies

The Bot itself does not use cookies. Our Website uses the following essential cookies, which may be stored on your device.

We use essential cookies to:

• to display the Website

• protect it from abuse.

Browsers may send do not track (DNT) signals. There is no industry standard, so we do not act on DNT signals.

We currently do not use non-essential analytics cookies on the Website.

7. International data transfers

The processing of your personal data described above may involve transferring your personal data overseas. We may transfer your personal data between different countries to recipients in countries other than the country in which the information was originally collected (including to our affiliates, group members, transaction counterparties, business partners, and third-party service providers). If you are dealing with us or located within the European Economic Area (the “EEA”), UK or Switzerland or other country which imposes data transfer restrictions outside of its territory, you should be aware that this may include transfers to countries outside the EEA, UK or Switzerland or that geographical area, to those countries where we, our affiliates, transaction counterparties, business partners, and third-party service providers operate. Some of these countries do not have similarly strict data privacy laws.

When transferring personal data to other countries, we make sure that appropriate safeguards are in place as required under applicable data protection law. We will transfer your personal data in compliance with applicable data protection laws, including, where necessary by incorporating a valid data transfer mechanism (such as the European Commission approved model clauses and the UK Addendum).

You may request further details by contacting us at our Telegram handle @TokenScanSupport.

8. Your privacy rights

Under data protection laws, you may have certain rights regarding your personal data. However, please note that blockchain technology creates an immutable record which means:

• data stored cannot be rectified, altered, or deleted; and

• as a result, some rights that normally apply under law may be limited in practice.

As blockchain transactions are publicly available, you can access and transfer your transaction data directly using blockchain explorers such as Solscan, without needing to contact us.

If you do not wish certain information to be made public or permanently recorded, you should not submit this to any blockchain platform.

8.1 Right under the applicable data protection laws

• Right of access – to know whether we process your personal data and to obtain a copy.

• Right to rectification – to request correction of inaccurate personal data.

• Right to erasure – to request deletion of your personal data in certain circumstances.

• Right to restriction – to request that we limit processing of your personal data in certain circumstances.

• Right to data portability – to receive certain personal data in a structured, commonly used and machine-readable format and transmit it to another company.

• Right to object:to processing based on our legitimate interests, on grounds relating to your particular situation; and

• to processing for direct marketing. We do not use your data for direct marketing purposes.

• Right to withdraw consent – where we rely on consent to process your personal data, you can withdraw it at any time.

Please send us a message at our Telegram handle @TokenScanSupport at any time if you have any questions about your data protection rights or wish to exercise them.You also have the right, at any time, to lodge a complaint about our processing of your personal data with the relevant body regulating data protection in your country:

• European Union: details are available here.

• UK: the office of the UK Information Commissioner (www.ico.gov.uk).

8.2 On-chain data limitations

On-chain data is pseudonymous and does not directly identify individuals unless a person voluntarily associates themselves with a wallet address or blockchain transaction. Both wallet addresses and transaction identifiers are permanently recorded on the blockchain and cannot be erased or altered. In respect of personal data held on-chain, our ability to fulfil data subject rights is therefore technically limited. In particular, we cannot:

• delete, modify, or erase it

• alter blockchain records linked to your wallet address

However, we will seek to:

• stop further off-chain processing of your personal data whenever possible

• unlink identifiers internally

• minimize further storage

• respect rights related to data we control off-chain.

8.3 How to exercise your rights

To exercise your rights, please contact us at our Telegram handle @TokenScanSupport.

We may need to verify your identity before processing a request. We will respond within the timeframes required by law.

9. Data retention

We retain personal data only for as long as necessary for the purposes described above, to perform our contractual obligations, and in accordance with applicable law and our retention policies.

On-chain data is retained permanently on the blockchain (not controlled by us).

As a general principle, we will delete or anonymise your personal data when it is no longer required for the above purposes and there is no longer any legal or regulatory requirement or business purpose for retaining your personal data.

10. Data security

We implement appropriate technical and organizational measures to protect your personal data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for securing your Telegram account, your own wallet keys, seed phrases and devices. We cannot recover lost private keys or seed phrases.

11. Children’s privacy

The Services are not intended for individuals under 18 years old.

We do not knowingly collect personal data from minors. If you believe we have collected personal data from a child under 18, please contact us at our Telegram handle @TokenScanSupport.

12. Changes to this privacy notice

We may update this Privacy Notice from time to time. If we make any material changes to the Privacy Notice, we will:

• update the “Last Updated” date; and

• provide notice through the Bot, Website, or other official channels, where appropriate.

13. Contact us

If you have any questions about this Privacy Notice or processing of your personal data or rights requests, please contact us at our Telegram handle @TokenScanSupport.