Privacy Policy

Last Updated and Effective Date: 13th of May 2025

Overview

1. Introduction

This Privacy Policy describes how Monta Platform Inc. and its affiliate Monta ApS (together, “Monta,” “we,” “our,” or “us”) collect, use and disclose personal data about you and your data privacy rights. Personal data is sometimes also referred to as personal information, personally identifiable information or other like terms that mean any information that directly or indirectly identifies you or is reasonably capable of being associated with you or your household. This Privacy Policy applies to personal data we collect from our customers, vendors, business partners, visitors to our website and other persons we interact with, including when they use our website, user portals and mobile applications in the United States. When we talk about our “Website,” we mean https://monta.com/en-us and the other sites and applications we own and operate. When we refer to “user portals” and “mobile applications,” we mean our product “Monta.”

2. Categories of personal data we collect, source of collection and processing purpose

2.1. Visitors on our Website, user portals and/or mobile applications, and newsletter recipients

When you visit our Website, user portals and/or mobile applications, Monta will process personal data about you, for instance, cookies, browser type and version, Internet Protocol (“IP”) address and length of visit. The purpose of using cookies is to improve your user experience on our Website, user portals and/or mobile applications; provide functionality; generate statistics and analytics; and remember your preferences. If you wish to receive a newsletter or book a demo, we also process the following information about you: name and surname, subject(s) of interest and your email address in order to tailor the content of and to send our newsletters to you. You may at any time with future effect unsubscribe from receiving our newsletter by using the opt-out link included in all newsletters or sending an email to privacy@monta.com.

2.2. Customers

When you register your profile, Monta will process personal data about you, including your name, email address, telephone number, your postal address, bank and payment information and information on the services purchased. The purpose of the processing of your personal data is to supply you with our services. When you use our services, Monta will further process information related to date and time, frequency, location and pattern of EV charging. Information related to purchases include name, contact details, address, cost and transaction details. We use Stripe as a credit card payment processing company to collect payment information. If you submit payment information, we will share with Stripe information, such as your debit/credit card number, billing address, phone number and installed application information in order to process payments. In such circumstances, the external provider, and not Monta, stores your payment information on our behalf acting as a data processor, in order to process payments to your wallet inside of the application. The payment processor also processes your phone number and installed application information.

2.3. Contact persons at a vendor or another business partner

As a contact person at a vendor or another business partner, Monta processes your personal data when you communicate with Monta, e.g., via emails in connection with Monta’s existing contractual relationship with the company you are employed with or in connection with the conclusion or termination of a contract. Monta processes ordinary personal data about you, including your name, email address, telephone number and position. Monta processes this personal data to fulfill our contractual obligations, maintain and enhance business relationships, invoice for the services your company provides to Monta and/or vice versa, communicate with you if you have any questions related to our services or vice versa and for documentation purposes in the event you agree on matters relating to our services in writing via email. In some cases, processing of personal data is necessary in order to comply with a legal obligation to which Monta is subject, for instance in relation to the obligation on the preservation of accounting records

2.4. Inquiries via chat function in our user portals and mobile applications

If you submit an inquiry relating to Monta’s services via Monta’s chat function, Monta will process personal data about you, such as your IP-address, geographic location and the personal data you include in your inquiry, e.g., name, email address and telephone number. In furtherance of data minimization and to protect your privacy, Monta requests that you not provide sensitive or other unnecessary personal data through the chat function. Monta engages in this processing activity to provide customer support by answering the inquiries and for business development.

3. Recipients of your personal data

Where relevant, Monta may disclose or transfer your personal data to affiliates of Monta, business partners or other collaborators for business purposes. Such parties also include social media providers, as described in section 5 below. Monta may disclose personal data if it believes that disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities and regulators. We may also disclose personal data if we believe that your actions are inconsistent with our user agreements or policies, if we believe that you have violated the law or if we believe it is necessary to protect the rights, property and safety of Monta, our users, the public or others. Monta uses external service providers and processors, such as managed hosting providers, credit card processors and technology partners to provide the software, networking, marketing, logistics, infrastructure and other services required to operate, develop, deliver and maintain our product and services, and fulfill our other purposes as defined in this Privacy Policy. When an external party processes personal data on our behalf, the processing is in accordance with documented instructions given by Monta and further terms and conditions stated in a data processor agreement entered into with Monta. These data processors are not permitted to process your personal data for their own purposes. Monta may disclose personal data in connection with, or during negotiations concerning, any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company. Monta may also disclose personal data with your consent or at your direction.

4. Safeguards and retention of personal data

Monta will only store your personal data as long as it is deemed necessary to fulfill the purposes for the processing of your personal data. Monta maintains industry standard security safeguards to protect your data. We encrypt data in transit and at rest, where appropriate, to ensure that your information is kept private. Monta securely stores your data on our password- and firewall-protected servers. Payment information is encrypted and handled by PCI certified organizations. You acknowledge that the transmission of information over the internet is inherently insecure, and Monta cannot guarantee the security of data sent over the internet. Emails sent via the internet might not be encrypted, so we advise you not to include any confidential or sensitive information in your emails to us. Access controls are in place to limit access to your information to those who need it to perform their jobs. For example, information about you may be provided to our customer support team to help you with your requests.

4.1. Visitors on our Website, user portals and/or mobile applications, and newsletters recipients

Personal data related to your newsletter account is stored until you withdraw your consent and no longer wish to receive newsletters from us. Personal data collected via cookies through use of our Website, user portals, and/or mobile applications are stored for different periods depending on the type and purpose of the cookie in question. Personal data collected in relation to the use of social media will be erased when the content is deleted or when you withdraw your response to our content (likes, sharing, etc.). See more in section 5 below.

4.2. Customers

Personal data about customers are generally deleted when they are no longer necessary for the purpose of collection. Personal data is deleted 3 years after termination of the contractual relationship between Monta and the customer, if it is assessed that continued storage is not necessary for documentation purposes. If storage is not necessary for documentation purposes, the personal data will be deleted upon termination of the contractual relationship.

4.3. Contact person at a vendor or another business partner

If you are a contact person at a vendor or another business partner, Monta will store personal data about you as long as Monta communicates with you because you are Monta’s point of contact, 3 years after termination of the contractual relationship or until it is no longer necessary for the establishment, exercise or defense of a legal claim.

4.4. Inquiries via chat function in our user portals and mobile applications

The inquiries from potential customers will be deleted 3 years after the inquiry is resolved, unless it is deemed necessary to store such inquiries for documentation purposes, e.g., due to a dispute, including for the establishment, exercise or defense of legal claims. The inquiries from existing customers will be deleted 3 years from the termination of the contractual relationship, unless it is deemed necessary to store such inquiries for documentation purposes, e.g., due to a dispute, including for the establishment, exercise or defense of a legal claim.

4.5. Bookkeeping material

Monta will store your personal data to the extent it is necessary for bookkeeping purposes, such as personal data related to invoicing. Such personal data will be stored for a period of 5 years from the end of the financial year to which the accounting records relate. The purpose is to comply with our legal obligations.

5. Social media

Our Website uses social media plug-ins (“plug-ins”), including from the social networking sites Facebook, Instagram and LinkedIn. When you visit our social media sites on Facebook, Instagram and LinkedIn or our Website where social media plugins have been installed, social media providers collect and process your personal data using cookies. Such collection and processing take place even if you have no account on the social media. If you access our Website using such a plug-in, your browser will contact the server of the underlying social networking site, load the visual presentation of the plug-in and present it to you. While this is happening, the social networking site receives information concerning your visit to our Website, as well as further data such as your IP address. Monta receives demographic and geographic statistics from the social media company on the visitors to our Website and our social media sites.

6. Children

This Website is not intended for or directed at children under the age of 18. In addition, we do not knowingly collect personal data from children under the age of 18.

7. Categories of personal data collected and disclosed in the prior 12 months

In the preceding 12 months, we have collected the categories of personal data set forth in the table below. For details about the precise data points we collect, the categories of sources, and the business and commercial purposes for the personal data processing, please see section 2 above. In the preceding 12 months, we have disclosed the following categories of personal data for business purposes to the following categories of recipients, which we also describe in greater detail in section 3 above: Category of Personal Data We Collect Business

Category of Personal Data We Collect — Business Purpose for Disclosure and Processing — Categories of Recipients

Identifiers, such as name, address, phone number, unique personal identifier, online identifier, IP address, email address, account name or other identifiers. — We process these categories of personal data and disclose them for the reasons described in greater detail in sections 2 and 3 above. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above.

Commercial information, including records of products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above.

Internet or other electronic network activity information. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above.

Geolocation data. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above.

Professional or employment-related information, such as business contact information and position. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above.

Inferences drawn from any of the information identified herein. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above.

Sensitive information, such as precise geolocation data and bank, credit card and payment information, including as pro cessed by our credit card payment processor. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above. — These categories of personal data may have been disclosed to the recipients described in greater detail in section 3 above.

Our prior 12-month personal data handling practices are consistent with our current personal data handling practices described in sections 2 and 3 above.

8. Selling or sharing of personal data

We do not sell your personal data or share your personal data for targeted advertising and have not done so in the prior 12 months. We also do not knowingly sell or share the personal data of children under the age of 16 and have not done so in the prior 12 months.

9. “Do Not Track”

Some browsers have incorporated “Do Not Track” features. Most of these features, when turned on, send a signal or preference to the websites you visit indicating that you do not wish to be tracked. Because there is not yet a common understanding of how to interpret the do not track signal, we currently do not respond to the browser do not track signals.

10. Sensitive personal data

Monta collects precise geolocation data and bank, credit card and payment information, which may be considered “sensitive” personal data under US privacy laws. Where required by law, we will obtain your consent before processing sensitive personal data. You may withdraw your consent by emailing us at privacy@monta.com. We will also only use the sensitive personal data for certain permitted purposes, such as to provide the goods or services you requested; prevent, detect and investigate security incidents; resist malicious, deceptive, fraudulent or illegal actions and prosecute those responsible; verify or maintain the quality or safety of a product, service or device and ensure physical safety of natural persons. Because Monta uses sensitive personal data for these permitted purposes, we do not offer a limit use and disclosure of sensitive personal data right under the California Consumer Privacy Act.

11. Know Your Customer (KYC) and Anti-Money Laundering (AML) Compliance

In order to adhere to stringent legal and regulatory obligations under applicable Know Your Customer (KYC) and Anti-Money Laundering (AML) frameworks, Monta is required, in certain circumstances, to perform identity verification and risk assessment procedures on its customers.

These measures are implemented to prevent financial crimes, including money laundering and terrorist financing, and to ensure compliance with national and international laws governing financial transactions and customer due diligence.

To facilitate this process, Monta employs a combination of proprietary software developed in-house and specialized solutions provided by reputable third-party vendor Spektr.

The KYC verification process entails the collection of specific information from customers, which may include, but is not limited to:,

11.1. Identification Information

Full legal name Date of birth Nationality Personal identification number or national ID Identification document (e.g., passport, national ID, driver’s license) Facial image (as part of ID verification using eKYC providers)

11.2. Contact Details

Residential address (may include proof of address) Email address Phone number

11.3. Employment & Business Information (for business customers)

Company name, registration number, and legal form Corporate address Nature of business / industry sector Ultimate Beneficial Owners (UBOs) and their ownership percentages Directors and legal representatives Organizational structure and documentation (e.g., Articles of Association)

11.4. Transaction & Economic Profile Information (for business customers)

Intended use of the account Expected transaction volume and frequency Source of funds (e.g., income, investments, inheritance) Source of wealth (e.g., business proceeds, asset holdings) Purpose of the business relationship Details of credit line usage (if applicable)

11.5. Screening & Risk Assessment Data

Sanctions screening results (EU, UN, OFAC) Politically Exposed Person (PEP) status Adverse media or negative news mentions Geographic risk indicators (residency, nationality, business operations) Risk rating and profile classification (low, medium, high, prohibited)

11.6. Ongoing Monitoring Information

Transaction behavior and patterns (e.g., deposits, withdrawals, wallet usage) Internal risk reassessments or escalations Notes and outcomes from compliance reviews

Correspondence and communication records related to AML/CTF and other personal details as required by law from time to time.

Additionally, customers may be prompted to respond to a series of questions designed to assess their identity and transactional risk profile. As part of this procedure, customers will be requested to submit high-quality, legible photographs or scans of valid government-issued identification documents, such as passports, driver’s licenses, or national identity cards. We will ask for access to microphone and camera.

The information and documentation provided by the customer are processed through an automated system, which generates a risk score based on predefined criteria aligned with regulatory standards.

This risk score determines whether the customer has successfully fulfilled the KYC requirements. Should the automated assessment result in a determination that further review is necessary—such as an inconclusive or elevated risk score—a trained employee of Monta will intervene to provide assistance. This additional step may involve direct communication with the customer to request supplementary information, clarify discrepancies, or guide the customer through further verification procedures to ensure compliance with KYC and AML obligations.

Monta is fully committed to safeguarding the confidentiality, integrity, and security of all personal data collected during this process. Such data will be handled in strict accordance with applicable data protection and privacy laws, as outlined elsewhere in this Privacy Policy. For a comprehensive understanding of how we collect, process, store, and protect your personal information, please refer to the relevant sections of this document. Should you have any questions or require further clarification regarding our KYC and AML procedures, please do not hesitate to contact us at privacy@monta.com.

Data relating to this will be stored for a minimum period of 7 years or such longer period that certain legal requirements dictate.

12. Data privacy rights and instructions

12.1. Your rights

Data privacy laws may afford consumers residing in the United States certain rights with respect to their personal data, subject to certain exceptions. If you reside in the United States, this section may apply to you. Subject to certain limitations and depending on your state of residence, you may have the following rights:

• (1) Right to Delete. You may have the right to request us to delete the personal data we have collected about you.

• (2) Right to Correct. You may have the right to request us to correct inaccurate personal data we maintain about you.

• (3) Right to Confirm Processing, Know and Access. You may have the right to confirm whether we are processing your personal data and know and access the personal data we have collected about you, including the categories of personal data; the categories of sources from which the personal data is collected; the business or commercial purpose for collecting, selling or sharing personal data; the categories of personal data and service providers, contractors and third parties to whom we disclosed personal data and the specific pieces of personal data we have collected about you.

• (4) Right to Data Portability. You may have the right to receive the information under right (3) in a format, to the extent technically feasible, that is portable, usable and allows you to transmit the personal data to a person without impediment or hindrance.

• (5) List of Specific Third Parties. You may have the right, at our option, to receive a list of the specific third parties, other than natural persons, to which we have disclosed either (a) your personal data or (b) any personal data.

• (6) Right to Opt-Out of Profiling. US privacy laws may provide the right to opt out of the processing of your personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Please note, however, that we currently do not engage in this practice.

• (7) Rights Related to Sharing for Targeted Advertising or Sale. We do not share your personal data for targeted advertising or sell your personal data. As such, you do not need to submit an opt-out of sale or sharing for targeted advertising request.

• (8) Rights Related to Sensitive Personal Data. Data privacy laws may afford additional rights related to sensitive personal data. Please see section 10 above for more information.

• (9) Right to No Discrimination. You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services and (e) retaliating against you for exercising your privacy rights.

• (10) Right to Appeal. If we decline to take action in response to your exercise of a privacy right, we may inform you of the reason for denying your request and provide you instructions on how to appeal the decision.

12.2. Instructions on how to exercise your privacy rights

You may exercise your privacy rights by calling our toll-free phone number at (888) 426-4947 or emailing us at privacy@monta.com. In some instances, such as for a right to delete, correct and access, we will need to verify your identity before honoring your privacy right request. We will verify your identity by asking you to provide personal data related to your recent interactions with us. We will honor your privacy rights request within 45 calendar days of receipt, unless we request an extension as permitted by data privacy laws.

12.3. Appealing a denial of a privacy right request

You may appeal a denial of your privacy right request by calling us at our toll-free phone number at (888) 426-4947 or emailing us at privacy@monta.com. We will inform you in writing of any action taken in response to the appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may have a right to submit a complaint to the Attorney General or other regulator of your state.

12.4. Authorized agents

If permitted or required by applicable law, you may exercise your privacy rights through an authorized agent (which may include a guardian or conservator). If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, you may call us at (888) 426-4947 or email us at privacy@monta.com.

12.5. “Shine the Light” disclosure for California residents

California law permits residents of California to request certain details about how their information is shared with third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please call us at (888) 426-4947 or email us at privacy@monta.com.

13. Questions

If you have any questions relating to this Privacy Policy, please contact us at privacy@monta.com.

14. Amendments to this privacy policy

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this Privacy Policy. We may also provide you with an additional notice in connection with making material changes to this Privacy Policy. We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.