GetOn - Terms and Conditions

GetOn is a brand and trading name of GETON PAYMENT LIMITED (formerly known as FASTLAYER FINTECH LTD), a money services business registered with FINTRAC (N300001212).

Version: 1.0 · Effective date: 29 October 2026

Preamble

These Terms and Conditions (the "Terms") form a legally binding agreement between you (the "Customer", "you") and:

GETON PAYMENT LIMITED (formerly known as FASTLAYER FINTECH LTD), trading as GetOn (the "Company", "GetOn", "we", "us", "our")

Who does what. The Services are provided under the GetOn brand. The roles of the companies involved are:

GETON PAYMENT LIMITED remains responsible to you for the Services and for the processing of your personal information, including the work carried out by BLOOMFI LABS - FZCO and our Partners on our behalf.

By opening an Account, clicking "I agree", or using any Service, you confirm that you have read, understood and accepted these Terms, the Fee Schedule, the GetOn Privacy Policy (Part 11) and any Product Terms of our Partners that we make available to you. If you do not agree, do not use the Services.

You may download and store a copy of these Terms at any time from the GetOn website or app, and we will provide a copy on request.

1. Definitions and interpretation

1.1 In these Terms:

• "Account" means the Customer's GetOn profile with the Company, through which the Services are accessed.
• "AML Laws" means the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations, the Criminal Code, Canadian sanctions legislation (including the Special Economic Measures Act, the Justice for Victims of Corrupt Foreign Officials Act and the United Nations Act), and any other anti-money laundering, counter-terrorist financing or sanctions law that applies to the Company or its Partners.
• "Banking Partner" means a bank, electronic money institution or other regulated financial institution that provides accounts, account identifiers, safeguarding or settlement services used by the Company to deliver the Services, as listed in clause 3.4.
• "Business Customer" means a Customer that is a legal entity, partnership, sole trader or other person acting for purposes relating to its trade, business or profession.
• "Business Day" means a day other than a Saturday, Sunday or public holiday in Ontario, Canada.
• "Card" means a Visa payment card (physical or virtual) issued to the Customer by the Card Issuer under the GetOn card programme.
• "Card Issuer" means Rain (Signify Holdings, Inc. and its affiliates, successors, assigns and subsidiaries, including Nimbus LLC, doing business as Third National and Third National LLC, Rain Liquidity LLC, Rain Payments Services, Inc. and Rain Products, Inc.), a principal member of Visa, which issues the Cards, as further described in the Card Terms.
• "Consumer" means an individual acting for purposes outside their trade, business, craft or profession.
• "Digital Asset" means a crypto-asset or virtual currency, as defined in the PCMLTFA regulations, that we support from time to time, including the value-referenced crypto-assets (stablecoins) USD Coin ("USDC") and Tether USD ("USDT").
• "Digital Asset Balance" means the Digital Assets that we hold on your behalf and record in your Account, as described in Part 7.
• "Digital Asset Services" means holding Digital Asset Balances for you, exchanging between fiat funds and Digital Assets or between Digital Assets, and sending and receiving Digital Assets to and from External Wallets, as described in Part 7.
• "External Wallet" means a crypto-asset wallet that is not provided or controlled by the Company and that is either self-hosted by the Customer or hosted by a third party chosen by the Customer.
• "Fee Schedule" means the GetOn schedule of fees and limits, as published on the GetOn website and in the GetOn app and amended from time to time.
• "GetOn app" and "GetOn website" mean the mobile application and website, operated under the GetOn brand, through which the Services are provided.
• "Infrastructure Provider" means BLOOMFI LABS - FZCO, which provides technical support and technology infrastructure to the Company and processes personal information on the Company's behalf.
• "KYC/KYB" means the identification, verification and due diligence on the Customer and, for Business Customers, its directors, authorised signatories, beneficial owners (25% or more) and controlling persons, as required by AML Laws and the Company's policies.
• "KYC Vendor" means Sum and Substance Ltd ("Sumsub") and any other third-party provider engaged by the Company to perform or support identity verification, document checks, biometric and liveness checks, business registry checks, sanctions, PEP and adverse-media screening, or transaction monitoring.
• "Liquidity Provider" means a regulated third party through which Digital Asset exchange orders are executed.
• "Onboarding" means the process from application until the Company confirms in writing (including in the GetOn app) that KYC/KYB has been successfully completed and the Account is activated.
• "Partner" means any Banking Partner, the Card Issuer, a Liquidity Provider, a KYC Vendor, the Wallet Infrastructure Provider or any other third party engaged by the Company to deliver the Services.
• "Services" means the Virtual IBAN and payment services, Card services and Digital Asset Services, and any related services the Company provides under these Terms.
• "Virtual IBAN" or "VIBAN" means a virtual International Bank Account Number, local account number and sort code, or other account identifier provided through a Banking Partner and allocated to the Customer for receiving and sending payments.
• "Wallet Infrastructure Provider" means Fireblocks (Fireblocks Inc.), which provides the technology the Company uses to create, secure and operate the wallets in which Digital Asset Balances are held.

1.2 Headings are for convenience only. "Including" means "including without limitation". A reference to a law includes that law as amended or replaced.

1.3 If there is a conflict between these Terms and specific Product Terms of a Partner (for example, the Card Terms), the Product Terms prevail for that product only, except for Parts 4, 8, 11 and 16, which always prevail.

2. Regulatory status and the Services

2.1 Regulatory status. The Company is registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a money services business (MSB), registration number N300001212, for foreign exchange dealing, money transferring and dealing in virtual currencies. The Company is registered with the Bank of Canada as a payment service provider under the Retail Payment Activities Act (RPAA). You can check our status on the FINTRAC MSB registry and the Bank of Canada PSP registry.

2.2 We are not a bank. The Company is not a bank, trust company, credit union or deposit-taking institution. Funds connected with your Account are not deposits and are not covered by the Canada Deposit Insurance Corporation (CDIC), any provincial deposit insurer, the UK Financial Services Compensation Scheme (FSCS) or any EU deposit guarantee scheme. This includes GBP funds received through Clear Junction Limited: Clear Junction Limited is an electronic money institution authorised by the UK Financial Conduct Authority (FRN 900684), not a bank, and funds it holds are protected by safeguarding, not by the FSCS. Digital Assets are not protected by any deposit insurance or compensation scheme.

2.3 Services. Subject to successful Onboarding, the Company may provide, through the GetOn app and website:

1. Virtual IBAN and payment services — receiving and sending payments in supported currencies through Banking Partners (Part 5);
2. Card services — Visa Cards issued by the Card Issuer, which spend your USDC Digital Asset Balance (Part 6);
3. Digital Asset Services — holding USDC and USDT balances for you in wallets controlled by the Company, exchanging between fiat funds and Digital Assets, and sending and receiving Digital Assets to and from External Wallets (Part 7).

2.4 Partners. Some Services are provided by or through Partners. Where a Partner has its own terms (for example, the Card Terms of the Card Issuer), we will make them available to you before you use that Service, and you agree to them.

2.5 Availability. Not all Services, currencies, Digital Assets or features are available to all Customers or in all jurisdictions. We decide at our discretion, acting reasonably and in line with our risk appetite, AML Laws and the laws that apply to us, which Services to offer you. We are not obliged to offer any Service.

2.6 No advice. We do not provide investment, tax, legal or financial advice. Any information we provide is general only. You should seek independent advice before using the Digital Asset Services.

3. Eligibility and cross-border access

3.1 Who may apply. You may apply for an Account if you are:

1. an individual of at least 18 years of age (or the age of majority where you live, if higher) with full legal capacity; or
2. a legal entity or other organisation duly incorporated or registered and in good standing, acting through a duly authorised representative.

3.2 Restricted jurisdictions and activities. We do not provide Services to persons who are resident, incorporated, located or operating in, or whose beneficial owners are nationals or residents of, a jurisdiction on the Company's list of prohibited jurisdictions, or who carry on an activity on the Company's list of prohibited businesses. These lists are maintained under our AML compliance programme and may change without notice. Summaries are published at [link]. We also do not provide Services to persons designated under Canadian, UN, UK, EU or US sanctions, or owned or controlled by such persons.

3.3 Québec. The Services are not currently offered to residents of, or businesses established in, the Province of Québec.

3.4 Supported markets and local accounts. We currently offer local (native) account details in the markets below. The Banking Partner for each market and the basis on which we serve customers there are:

The list of supported markets and Banking Partners shown in the GetOn app at the time you open or use an account identifier is the current list, and we will notify you before we change the Banking Partner for an account identifier you use.

3.5 Customers in the European Union and EEA — reverse solicitation. The Company is not authorised as a payment institution, electronic money institution or crypto-asset service provider in any EU or EEA Member State and does not hold a passport there. The Company does not market, advertise or solicit its Services in the EU/EEA. If you are established, resident or located in the EU/EEA, you confirm that:

1. you approached the Company on your own exclusive initiative, without any solicitation, promotion, advertising, referral, introducer or affiliate activity by or on behalf of the Company or the GetOn brand directed at you;
2. you understand that you will not benefit from the protections of EU financial services law that apply to clients of EU-authorised firms, including those under the Payment Services Directive, the Markets in Crypto-Assets Regulation (MiCA) and national deposit or investor protection schemes, except for mandatory protections that cannot be excluded by contract (see Part 16);
3. the Services you receive are limited to those you requested; the Company will not offer you new types of products or services except as permitted by Article 61(2) MiCA or other applicable rules; and
4. you will tell us promptly if any of the above becomes untrue.

We may record evidence of how you first contacted us and may refuse or end the relationship if we cannot establish that it was initiated by you.

3.6 Customers in the United Kingdom. The Company is not authorised or registered by the UK Financial Conduct Authority (FCA). The Company only communicates financial promotions, including cryptoasset promotions, to persons in the UK where they have been approved by an FCA-authorised person in line with UK law. UK Customers are accepted only where they approach the Company on their own initiative and where permitted by UK law. Our UK Banking Partner, Clear Junction Limited, is FCA-authorised, but your contract is with the Company and you will not have access to the Financial Ombudsman Service or the FSCS.

3.7 Customers in other countries. Where you are located or established outside Canada, the EU/EEA and the United Kingdom, the Company does not hold a local licence or registration in your country unless stated in clause 3.4. We accept you as a Customer only where you approached us on your own initiative and where local law permits us to provide the Services to you from Canada.

3.8 Your responsibility for local law. You are responsible for ensuring that using the Services is lawful where you are located or established. We may refuse or end Services where we reasonably believe that providing them would breach any law applicable to us or our Partners.

3.9 One Account. Unless we agree otherwise, you may hold one Account only. You must use the Account only for yourself (Consumers) or for the business disclosed during KYB (Business Customers), and never for or on behalf of any undisclosed third party.

4. Onboarding and KYC/KYB

4.1 No transactions before KYC/KYB. You may not receive, send, exchange or spend funds or Digital Assets, and no Card will be activated, until Onboarding is complete and we have confirmed activation of your Account. Any funds or Digital Assets received before activation may be held, returned to source or otherwise dealt with as required by AML Laws.

4.2 Information we will request. To comply with AML Laws we, directly or through our KYC Vendor, will request information and documents, which may include:

• for individuals: full name, date of birth, address, occupation, nationality, government-issued photo ID, a live selfie or video for biometric and liveness verification, tax residence, source of funds and source of wealth;
• for Business Customers: certificate of incorporation, articles, registers of directors and shareholders, proof of address, licences, ownership and control structure, beneficial owners holding 25% or more, directors and authorised signatories (each verified as an individual), nature of business, expected activity, counterparties and source of funds;
• PEP (politically exposed person), head of international organisation, family member and close associate status, and third-party determination;
• for Digital Asset Services: details and proof of ownership or control of each External Wallet you send Digital Assets from or to.

4.3 KYC Vendor and sharing your KYC with the Card Issuer. We use Sumsub as our KYC Vendor to verify your identity, check documents, perform biometric and liveness checks, check business registries, and screen against sanctions, PEP and adverse-media sources. Biometric data is used only for identity verification and fraud prevention. Because the Card Issuer must carry out its own customer due diligence before it issues a Card, we share your verified KYC/KYB information with the Card Issuer through Sumsub's secure token-sharing function, so that you do not have to go through verification again. The Card Issuer uses this information as an independent controller for its own legal obligations. See Part 11 and the GetOn Privacy Policy.

4.4 Accuracy. All information you provide must be true, complete, current and not misleading. You must tell us within 10 Business Days of any change, including changes in address, control, ownership, directors, business activity or PEP status.

4.5 Our decision. We may accept or decline any application at our sole discretion and are not required to give reasons, in particular where giving reasons would breach AML Laws.

4.6 Refusal to complete KYC/KYB. If you refuse to provide information or documents we request, or refuse to take part in any verification step, this is a material breach of these Terms. We may decline your application or immediately terminate the business relationship and close your Account.

4.7 Abandonment. If you start Onboarding but do not provide the requested information or complete a requested step within 30 calendar days of our request (including after one reminder sent to your registered e-mail), you will be treated as having refused to complete KYC/KYB, with the consequences in clause 4.6.

4.8 Ongoing due diligence. KYC/KYB is not a one-time event. We may at any time ask you to refresh or add to your information, explain a transaction, or provide evidence of source of funds, source of wealth or the purpose of a transaction. You must respond within the time we reasonably set (normally 10 Business Days, or less where required by AML Laws or a Partner).

4.9 Cooling-off. Where mandatory law gives a Consumer a right to cancel a distance contract within a set period, that right applies.

5. Virtual IBANs and payment services

5.1 Nature of VIBANs. A VIBAN is an account identifier provided by a Banking Partner and allocated to you for receiving and sending payments. The underlying account is held with the Banking Partner in your name. A VIBAN is not a bank account opened by you with the Company. The Banking Partner's name and jurisdiction are shown in clause 3.4 and in the GetOn app.

5.2 Safeguarding. Where the Company holds your funds, it holds them separately from its own funds, in a trust or safeguarding account with a Banking Partner, in line with the RPAA and the Company's safeguarding-of-funds framework, so that you have reliable access to your funds and they are protected if the Company becomes insolvent. Safeguarding is not deposit insurance, and you may still suffer loss if a Banking Partner fails.

5.3 No interest. We do not pay interest on any balance.

5.4 Payment orders. You give a payment order through the GetOn app by providing the information we request (including beneficiary name, account identifier, amount, currency and, where required, the purpose of payment and supporting documents). A payment order is authorised when you submit it using your security credentials. You are responsible for the accuracy of the information you provide. We are not liable for a payment executed in line with the account identifier you provided, but we will make reasonable efforts to recover the funds on your request (a recovery fee may apply).

5.5 Receipt and execution times. A payment order received after the cut-off time stated in the GetOn app, or on a day that is not a Business Day, is treated as received on the next Business Day. Execution times depend on the payment scheme and Banking Partner (for example SEPA, SWIFT, Faster Payments, EFT, Interac or wire). We will show the expected time in the GetOn app where available.

5.6 Incoming funds. We credit incoming funds once they are received from the Banking Partner and have cleared our compliance checks. We may hold, request information about, or return any incoming payment, including where the sender's name does not match, the payment is from an unexpected or high-risk source, or information required by the travel rule is missing.

5.7 Refusal of payment orders. We may refuse, delay or hold a payment order where: the order is incomplete or unclear; there is not enough balance to cover the amount and fees; it would exceed your limits; we suspect fraud, money laundering, terrorist financing, sanctions evasion or other illegal activity; a Banking Partner or payment scheme refuses it; or we are required by law. Where lawful, we will tell you of the refusal and, where possible, the reasons and how to correct any factual error.

5.8 Limits. We may set and change transaction, balance and volume limits based on your risk profile, the information you provided during KYC/KYB and Partner requirements.

5.9 Statements. Transaction information and statements are available in the GetOn app. You must check them regularly and tell us without undue delay of any error.

5.10 Currency conversion. Where a payment involves a currency conversion, we will show you the exchange rate and any mark-up before you confirm the order, or tell you how the rate is determined.

6. Cards

6.1 Issuer. Cards are issued by the Card Issuer, Rain, a principal member of Visa (the "Scheme"). The Company acts as programme manager under the GetOn brand. The Card remains the property of the Card Issuer. Rain is a financial technology provider, not a bank, and does not hold deposits. Separate Card Terms of the Card Issuer apply and will be provided in the GetOn app before activation.

6.2 How the Card is funded. The Card spends your USDC Digital Asset Balance. When you use the Card, the amount of the transaction, plus any fees, is converted from USDC to the transaction currency at the rate shown in the GetOn app and debited from your USDC Digital Asset Balance. The Card is not a credit card: you can only spend USDC available in your Account, and no credit is extended. Fiat balances and USDT cannot be spent with the Card.

6.3 Eligibility and cardholders. Cards are issued only after Onboarding and after the Card Issuer has accepted the KYC/KYB information shared with it (clause 4.3). A Business Customer may request Cards for its employees or officers ("Cardholders"); the Business Customer must ensure each Cardholder is identified as we require and complies with these Terms and the Card Terms, and remains responsible for all use of those Cards.

6.4 Activation and security. You must sign a physical Card on receipt (if applicable), keep your PIN and Card details secret, never share them with anyone (including anyone claiming to be from GetOn), and enable any security features we provide (such as 3-D Secure).

6.5 Authorisation. A Card transaction is authorised when you or a Cardholder use the Card, PIN, contactless function, card details, mobile wallet token or 3-D Secure. Once authorised, a Card transaction generally cannot be cancelled. The USDC needed for an authorised transaction may be reserved until the transaction settles.

6.6 Restrictions. Cards may not be used: for any illegal purpose; at merchants in prohibited jurisdictions; for the merchant categories we block, which currently include gambling and betting (MCC 7995, 7800, 7801, 7802), quasi-cash and crypto-asset purchases (MCC 6051), money transfer (MCC 4829), and adult content (MCC 5967); or to obtain cash beyond the ATM limits in the Fee Schedule. We may decline any transaction for the reasons in clause 5.7.

6.7 Lost, stolen or compromised Cards. You must freeze the Card in the GetOn app or tell us immediately through in-app support or at support@geton.xyz if a Card is lost, stolen, misused or its details may be known to someone else. Liability is as set out in Part 10 and the Card Terms.

6.8 Chargebacks and refunds. Where you dispute a Card transaction with a merchant, we will help you raise a chargeback under the Scheme rules where they allow it. Chargeback outcomes are decided under the Scheme rules and are not guaranteed. Merchant refunds and successful chargebacks are credited to your Account in USDC.

6.9 Expiry and cancellation. Cards expire on the date shown. We may cancel, suspend or not renew a Card in the cases in Part 13 or where the Card Issuer or Scheme requires it.

7. Digital Asset Services

7.1 What we do. Through the GetOn app, the Company:

1. holds USDC and USDT for you as a Digital Asset Balance;
2. exchanges fiat funds for Digital Assets, Digital Assets for fiat funds, and one Digital Asset for another, at a rate quoted to you before you confirm, with orders executed with or through Liquidity Providers; and
3. sends Digital Assets from your Digital Asset Balance to an External Wallet, and receives Digital Assets from an External Wallet into your Digital Asset Balance.

7.2 How we hold your Digital Assets. Your Digital Assets are held in wallets controlled by the Company, which are created and secured using technology provided by the Wallet Infrastructure Provider, Fireblocks. You do not hold the private keys to these wallets. In particular:

• the Company holds your Digital Assets on your behalf and records your Digital Asset Balance in your Account;
• your Digital Assets are held separately from the Company's own Digital Assets, in a wallet allocated to you, and are recorded in our books as belonging to you;
• we do not lend, pledge, rehypothecate or otherwise use your Digital Assets for our own purposes, and we do not pay interest or rewards on them;
• Fireblocks provides technology only; it does not hold your Digital Assets and has no contract with you. The Company remains responsible to you for safeguarding your Digital Asset Balance.

7.3 Supported Digital Assets. We currently support USDC and USDT on the networks shown in the GetOn app. We may add or remove supported Digital Assets or networks at any time, giving you reasonable notice before we stop supporting a Digital Asset you hold, so that you can withdraw or exchange it. Some Digital Assets may not be available to residents of certain jurisdictions, including Canada, because of local regulatory restrictions.

7.4 External Wallets. You must use an External Wallet that you own or control. We may require you to prove ownership or control of a wallet (for example by signing a message or making a micro-transfer) and may screen any wallet address with blockchain analytics tools. We may refuse to send to or accept from any wallet we consider high-risk, including wallets linked to mixers, darknet markets, sanctioned persons, fraud or ransomware. You are solely responsible for the security of your External Wallet, its private keys and seed phrases.

7.5 Travel rule. For Digital Asset transfers of CAD 1,000 or more (or a lower threshold required by law or a Partner), we must collect and transmit originator and beneficiary information. Where the External Wallet is hosted by another service provider, you agree that we may exchange this information with that provider through a travel-rule solution. Transfers without the required information may be delayed, returned or rejected.

7.6 Quotes and confirmation. A quote is valid for the time shown. Once you confirm an exchange order it is final and cannot be cancelled. If the quote expires before you confirm, a new quote will be given. If an order cannot be executed because of market disruption, a Liquidity Provider failure or a compliance hold, we will cancel it and restore your fiat or Digital Asset Balance, less any network fees already incurred, where lawful.

7.7 Withdrawals and wrong addresses. Blockchain transactions are irreversible. You are responsible for providing a correct address and selecting the correct network and token. We are not liable for loss caused by an incorrect address, network, memo or tag, or an unsupported token, provided by you. If you send an unsupported Digital Asset to us, it may be permanently lost. We will process withdrawals within the time shown in the GetOn app, subject to security and compliance checks.

7.8 Network fees. Blockchain network ("gas") fees are set by the network, not by us, and will be shown or deducted as stated in the order.

7.9 Forks, airdrops and network events. If a supported network forks, is attacked or is upgraded, we may suspend Digital Asset Services for that network. We are not obliged to support any new asset created by a fork or airdrop.

7.10 Digital Asset risk warning. By using the Digital Asset Services you confirm you understand that:

• stablecoins aim to keep a stable value against the US dollar, but they can lose that link (de-peg) and fall in value, temporarily or permanently;
• USDC and USDT are issued by third parties (Circle and Tether), not by the Company; their value depends on the issuer's reserves and its ability and willingness to redeem them, and you have no claim against the Company for an issuer's failure;
• Digital Assets are not legal tender in Canada, the UK or the EU, and are not backed by any government or central bank;
• Digital Assets are not protected by CDIC, the Canadian Investor Protection Fund, the FSCS or any other compensation scheme;
• because the Company controls the wallets, you are exposed to the Company's operational risk and, if the Company becomes insolvent, to delay or loss in recovering your Digital Assets;
• blockchain transactions are irreversible and errors may result in permanent loss;
• Digital Assets may be affected by forks, network outages, smart-contract failures, cyber-attacks and regulatory changes, including bans in some jurisdictions;
• the Company does not give investment advice and does not assess whether a Digital Asset is suitable for you; and
• you are responsible for any tax arising from your Digital Asset transactions.

7.11 Large virtual currency transactions. Under AML Laws we must report to FINTRAC receipts of virtual currency equivalent to CAD 10,000 or more, including multiple receipts within 24 hours, and keep related records.

8. AML, counter-terrorist financing and sanctions

8.1 Our obligations. The Company is subject to AML Laws and must, among other things, identify Customers, monitor transactions, keep records, screen against sanctions lists, and report suspicious transactions, large cash and large virtual currency transactions, electronic funds transfers of CAD 10,000 or more crossing the Canadian border, and terrorist or listed-person property to FINTRAC and other competent authorities. Our Partners have similar obligations under their own laws.

8.2 Sanctions. You must not use the Services, directly or indirectly, for the benefit of, or to deal with, any person or territory subject to sanctions under Canadian law, United Nations measures, or the sanctions regimes of the United Kingdom, the European Union or the United States, where those regimes apply to us or our Partners.

8.3 Holds and freezes. We may suspend your Account, hold or delay a transaction, or freeze funds or Digital Assets (including your Digital Asset Balance) where we are required to by law, by a competent authority or court, or where we reasonably suspect a breach of AML Laws or these Terms. We may keep the hold for as long as is reasonably necessary to complete our review or as required by law.

8.4 No tipping-off. The law may prohibit us from telling you that we have made a report to, or received a request from, an authority, or the reasons for a hold or closure. In those cases we will not give reasons, and we will not be liable for not doing so.

8.5 Duty to cooperate. You must cooperate fully, promptly and in good faith with all requests we make in connection with AML, compliance, sanctions, fraud prevention, regulatory, audit or legal matters, including requests for information, documents, explanations, video calls or meetings. Refusal or failure to cooperate (including not responding within the time we set under clause 4.8, giving evasive or misleading responses, or withdrawing consent needed for checks required by law) is a material breach. It may lead to suspension and termination of the business relationship.

8.6 Your warranties. You confirm, and confirm again each time you use the Services, that: the funds and Digital Assets you use are from lawful sources; you act on your own behalf (or, for Business Customers, on behalf of the disclosed business); you are not a sanctioned person or acting for one; and all information you have given us is accurate and complete.

8.7 Third-party determination. If you act on behalf of, or under instructions from, a third party, you must tell us before the first transaction and provide information about that third party as we request.

9. Fees and charges

9.1 Fee Schedule. You agree to pay the fees in the Fee Schedule, which includes account maintenance fees, payment fees, Card fees, foreign exchange mark-ups, Digital Asset exchange spreads or commissions, withdrawal fees, recovery and investigation fees, and dormancy fees (if any).

9.2 Pre-transaction disclosure. Before you confirm a payment, currency conversion, Card-funding conversion or Digital Asset exchange, we will show you the applicable fees, exchange rate and total amount, or how they are calculated.

9.3 Deduction. We may deduct fees from your fiat balance or, if it is insufficient, from your Digital Asset Balance at the rate shown in the GetOn app, when due. If your balances are insufficient, you must pay the amount within 14 days of our request.

9.4 Third-party charges. Intermediary banks, payment schemes, blockchain networks and receiving institutions may charge their own fees, which we do not control.

9.5 Changes to fees. We will give you at least 60 days' (Consumers) or 30 days' (Business Customers) notice of any increase in fees or new fee, unless the change is required by law or a Partner and shorter notice is necessary (in which case we will give as much notice as we can). Changes in exchange rates and Digital Asset prices take effect immediately.

9.6 Taxes. Fees are stated exclusive of any applicable sales taxes (such as HST), which will be added where required. You are responsible for your own taxes.

10. Security, unauthorised and incorrect transactions

10.1 Your security duties. You must keep your login details, passwords, one-time codes, devices, PINs and Card details safe; enable two-factor authentication; not allow anyone else to use your Account; and log out of shared devices. GetOn will never ask you for your full password, your PIN or a private key or seed phrase.

10.2 Notify us immediately. You must tell us without undue delay, and in any case within 60 days of the transaction date (or within 13 months where mandatory law gives a Consumer that longer period), if you believe a transaction was unauthorised or incorrectly executed, or that your credentials have been compromised.

10.3 Unauthorised transactions — Consumers. Where a fiat payment or Card transaction was not authorised by you, we will, after investigation, refund the amount and restore your Account to the position it would have been in, unless:

1. you acted fraudulently;
2. you intentionally or with gross negligence failed to meet your security duties in clause 10.1; or
3. you did not notify us within the period in clause 10.2.

Before you notify us, your liability for losses from a lost or stolen credential is limited to CAD 50 (or a lower amount set by mandatory law), unless points 1 or 2 apply. After you notify us, you are not liable for further unauthorised transactions unless you acted fraudulently. We may delay a refund where we have reasonable grounds to suspect fraud and will tell the relevant authority where required.

10.4 Unauthorised transactions — Business Customers. To the extent permitted by law, Business Customers bear all losses from transactions made using their credentials or those of their users and Cardholders, unless the loss was caused by our gross negligence or wilful misconduct.

10.5 Incorrect or late execution. If we fail to execute, or incorrectly execute, a properly authorised payment order with a correct account identifier, we will, on your request, make immediate efforts to trace it and, where we are responsible, refund the amount and related fees.

10.6 Digital Asset transactions. Clauses 10.3 to 10.5 do not apply to blockchain transfers to an External Wallet that you authorised and that have been broadcast to the network, which cannot be reversed. Where Digital Assets are lost from wallets controlled by the Company because of a security breach of our systems or our failure to safeguard them, and not because of your breach of clause 10.1, we will restore the affected Digital Asset Balance. Card transactions funded from your USDC Digital Asset Balance are covered by clause 10.3.

10.7 Investigation. You must cooperate with our investigation, which may include providing a police report or statutory declaration.

11. Data protection and privacy

11.1 Controller. GETON PAYMENT LIMITED, trading as GetOn, is the organisation responsible for (and, under the EU and UK GDPR, the controller of) your personal information. Our Privacy Officer can be reached at privacy@geton.xyz. The GetOn Privacy Policy, available on the GetOn website and in the GetOn app, forms part of these Terms and gives full details.

11.2 Applicable laws. We process personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply to our processing of information about individuals in the EU/EEA or the UK, Regulation (EU) 2016/679 (EU GDPR) and the UK GDPR with the Data Protection Act 2018 (together, "Data Protection Laws").

11.3 What we collect. Identification and contact data; KYC/KYB documents and their contents; biometric data (facial images and liveness data) for verification; business, ownership and control information; financial, transaction and payment data; Digital Asset Balances, wallet addresses and blockchain data; sanctions, PEP and adverse-media screening results; device, IP, geolocation and log data; and communications with us.

11.4 Why we use it and legal bases.

Under PIPEDA, we rely on your consent, given by accepting these Terms and the GetOn Privacy Policy, and on the exceptions to consent in PIPEDA (including disclosures required by law or to comply with a subpoena, warrant or order).

11.5 Automated decisions. Our KYC Vendor and screening tools use automated processes for document authentication, face-matching and screening. A transaction that matches a sanctions list may be blocked automatically while we review it. Where an automated result would lead to refusal of your application or closure of your Account, a member of our compliance team reviews it before the decision is made. You may ask for human review, give your point of view and contest the decision.

11.6 Who we share data with. We share personal information only as necessary and only with:

1. BLOOMFI LABS - FZCO (United Arab Emirates) — our parent company and Infrastructure Provider, which provides technical support and hosts and operates the GetOn technology infrastructure. It acts as our processor, only on our documented instructions, under a written data processing agreement, and may not use your information for its own purposes;
2. Banking Partners, including Clear Junction Limited (United Kingdom), and the Card Issuer, Rain — to open and operate VIBANs, issue Cards, process and settle payments, and meet their own AML obligations. They act as independent controllers;
3. Sumsub, our KYC Vendor — acting as our processor to verify your identity and screen you. With your request for a Card, Sumsub also shares your verified KYC/KYB data with the Card Issuer through its token-sharing function;
4. Fireblocks, our Wallet Infrastructure Provider, Liquidity Providers, travel-rule providers and blockchain analytics providers — to operate the wallets that hold Digital Asset Balances, execute exchanges and meet travel-rule and screening obligations;
5. Card schemes, payment schemes and correspondent banks — to process transactions;
6. State officials and authorities — including FINTRAC, the Bank of Canada, the Canada Revenue Agency, police, courts and other competent authorities in Canada, only where required or permitted by Canadian law (for example under the PCMLTFA, the Income Tax Act, the Criminal Code, a court order or a warrant), and foreign authorities only where required by law applicable to us or our Partners, or ordered by a Canadian court;
7. Professional advisers and auditors — under confidentiality duties;
8. A successor or acquirer — in a merger, acquisition or reorganisation, under confidentiality and only for the same purposes.

We do not sell your personal information.

11.7 International transfers.

• From the EU/EEA to Canada: The European Commission has decided that Canada provides an adequate level of protection for personal data transferred to recipients subject to PIPEDA (Commission Decision 2002/2/EC, confirmed in the Commission's 2024 review). As a commercial organisation subject to PIPEDA, the Company receives EU personal data on the basis of that adequacy decision (Art. 45 EU GDPR).
• From the UK to Canada: The UK recognises Canada as adequate for recipients subject to PIPEDA, and the Company receives UK personal data on that basis.
• Onward transfers from Canada, including to BLOOMFI LABS - FZCO in the United Arab Emirates: Where we transfer data to a Partner or to BLOOMFI LABS - FZCO outside Canada, we do so under PIPEDA's accountability principle, with contractual protections at least equivalent to those in these Terms. The United Arab Emirates does not have an EU or UK adequacy decision. Where data originating from the EU/EEA or the UK is transferred to a country without an adequacy decision, we use the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism, together with a transfer risk assessment and supplementary measures such as encryption. You may request a copy of the relevant safeguards from our Privacy Officer.
• Information transferred outside Canada may be accessible to the courts, law enforcement and national security authorities of that country.

11.8 Retention. We keep your personal information and records for at least five (5) years from the end of our business relationship with you (or from the date of the relevant transaction or record, whichever is later), as required by the PCMLTFA and its regulations, and longer where required by law, by a competent authority, or for the establishment, exercise or defence of legal claims. Where an application is declined or abandoned and no business relationship was established, we keep the information for at least five years from that date if we verified your identity, if the decision was made for AML, sanctions or fraud reasons, or if we made a report to an authority; otherwise we delete it 12 months after the last activity on the application. After the retention period, information is securely deleted or anonymised. The GetOn Privacy Policy sets out other retention periods.

11.9 Security. We use appropriate technical and organisational measures, including encryption, access controls, logging, vendor due diligence and incident response procedures consistent with the RPAA risk-management requirements. We will notify you and the relevant regulator of a breach of security safeguards where the law requires.

11.10 Your rights. Subject to legal limits, you may: access your personal information; correct it; withdraw consent (which may mean we cannot continue the Services); and, where EU or UK GDPR applies, request erasure, restriction, portability, object to processing based on legitimate interests, and not be subject to solely automated decisions. Erasure and objection rights do not override our legal duty to keep AML records for the retention period, and access requests may be limited where disclosure would breach AML Laws (for example, tipping-off).

11.11 Complaints about privacy. You may contact our Privacy Officer first. You may also complain to the Office of the Privacy Commissioner of Canada, the data protection supervisory authority in your EU/EEA Member State, or the UK Information Commissioner's Office.

11.12 EU and UK representatives. Our representatives in the EU under Article 27 EU GDPR and in the UK under Article 27 UK GDPR can be contacted at privacy@geton.xyz.

12. Your obligations and prohibited use

12.1 You must use the Services only lawfully, in line with these Terms, and for the purposes declared during Onboarding.

12.2 You must not use the Services:

• for money laundering, terrorist financing, proliferation financing, sanctions evasion, fraud, tax evasion, bribery or any other crime;
• for any activity on the Company's prohibited businesses list (clause 3.2), including unlicensed gambling, unlicensed financial services, shell banks, weapons, illegal adult content and darknet trading;
• to receive or send funds or Digital Assets on behalf of undisclosed third parties, or to provide payment or exchange services to others (nesting) without our prior written consent;
• to structure transactions to avoid reporting thresholds or limits;
• to interfere with, reverse-engineer, attack or overload the GetOn app, website or systems, or to access them by automated means we have not approved;
• in breach of the rules of a card scheme, payment scheme or Partner.

12.3 Business Customers must hold all licences required for their activities, keep us informed of changes in their business model, and ensure their users, employees and Cardholders comply with these Terms.

12.4 You will indemnify us for losses, fines and costs we incur because of your breach of this Part 12 or Part 8, to the extent permitted by law (see clause 14.4).

13. Term, suspension and termination

13.1 Term. These Terms apply from your acceptance until terminated.

13.2 Termination by you. You may close your Account at any time by giving notice through the GetOn app or to support@geton.xyz, subject to completing any pending transactions and any compliance review. Closing your Account is free of charge after 6 months; within that period a closure fee may apply as set out in the Fee Schedule, where permitted by law.

13.3 Termination by us on notice. We may terminate these Terms, or any Service, by giving you at least 60 days' notice (Consumers) or 30 days' notice (Business Customers).

13.4 Immediate suspension or termination. We may suspend or terminate the Services immediately, with or without notice and without giving reasons where the law prevents it, if:

1. you refuse, abandon or fail to complete KYC/KYB (Part 4);
2. you refuse or fail to cooperate on AML, compliance, sanctions or legal matters (clause 8.5);
3. you commit a material or repeated breach of these Terms;
4. we suspect fraud, money laundering, terrorist financing, sanctions breaches or other illegal activity;
5. you become a sanctioned person, or move to or start operating in a prohibited jurisdiction;
6. you provided false, incomplete or misleading information;
7. a Banking Partner, the Card Issuer, a Liquidity Provider, the Wallet Infrastructure Provider or a scheme requires it or stops supporting your Account or product;
8. we are required to by law, a regulator, a court or another competent authority;
9. you become insolvent, bankrupt, or (for Business Customers) are wound up or struck off; or
10. continuing the relationship would expose us or our Partners to legal, regulatory or reputational risk beyond our risk appetite.

13.5 Consequences. On termination: all Cards are cancelled; pending payment orders may be cancelled; you must pay all amounts owed; and, subject to any hold or freeze required by law (Part 8), we will return your remaining balances, less fees and amounts owed, within 30 days or as soon as legally permitted: fiat balances to an account in your name that we verify, and your Digital Asset Balance to an External Wallet you control that we verify (or, if you ask, converted to fiat at the rate then quoted). If you do not tell us where to send your Digital Asset Balance within that period, we may convert it to fiat and return it to your verified account. We may require additional information before returning funds or Digital Assets.

13.6 Survival. Parts 8, 11, 14, 15 and 16, and any accrued rights and obligations, survive termination. Our record-keeping obligations continue for the retention period in clause 11.8.

13.7 Dormant accounts. If there is no Customer-initiated activity for 12 months, we may treat the Account as dormant, contact you, and, if you do not respond, close it and deal with any balance as required by law, including any unclaimed property rules.

14. Liability, indemnity and force majeure

14.1 What we are responsible for. We are responsible for providing the Services with reasonable care and skill and in line with these Terms and applicable law.

14.2 Exclusions. To the extent permitted by law, we are not liable for:

• loss caused by your breach of these Terms, your negligence, or incorrect information you provide;
• loss caused by a Partner, payment scheme, stablecoin issuer, blockchain network or External Wallet provider, except to the extent caused by our own failure;
• loss caused by our compliance with AML Laws, sanctions, a court order or a regulator's direction, including any hold, freeze, delay, refusal or termination under Parts 4, 8 or 13;
• changes in the market value of Digital Assets or currencies, including a stablecoin de-peg;
• indirect or consequential loss, loss of profit, business, goodwill, opportunity or data.

14.3 What we do not exclude. Nothing in these Terms limits or excludes our liability for fraud, gross negligence, wilful misconduct, death or personal injury caused by our negligence, our obligation to refund unauthorised or incorrectly executed payments as set out in Part 10, our obligation to return safeguarded funds and Digital Assets we hold for you, or any other liability that cannot be limited or excluded by law. For Consumers, clause 14.2 applies only to the extent permitted by applicable consumer protection law.

14.4 Indemnity. Business Customers indemnify us against losses, fines, penalties, chargebacks and reasonable legal costs arising from their breach of these Terms or of law. Consumers are liable for such losses only to the extent permitted by applicable consumer protection law.

14.5 Force majeure. We are not liable for any failure or delay caused by events beyond our reasonable control, including natural disasters, epidemics, war, terrorism, civil unrest, government action, sanctions, failures of payment or card schemes, Banking Partners, Liquidity Providers or blockchain networks, cyber-attacks (despite reasonable security measures), or power or telecommunications failures. We will take reasonable steps to limit the effect on you and resume the Services.

15. Complaints

15.1 How to complain. Send your complaint through in-app support in the GetOn app, with your name, Account details, a description of the issue and any supporting documents.

15.2 Our process. We will acknowledge your complaint within 3 Business Days, keep you informed, and send a final written response within 15 Business Days. In exceptional cases, where we need more time for reasons beyond our control, we will explain why and respond within 35 Business Days of receipt.

15.3 Escalation. If you are not satisfied with our final response, you may:

• for privacy matters, contact the authorities listed in clause 11.11;
• bring proceedings under Part 16; and
• where available to you under your local mandatory law, use an out-of-court dispute resolution body in your country of residence.

15.4 Complaints about a Card transaction may also be handled under the Card Issuer's complaint procedure and the Scheme's dispute rules.

16. Governing law, jurisdiction and your mandatory rights

16.1 Governing law. These Terms, and any dispute or claim (including non-contractual disputes) arising out of or in connection with them, are governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario.

16.2 Jurisdiction. The courts of the Province of Ontario, sitting in Toronto, have jurisdiction to settle any dispute. For Business Customers this jurisdiction is exclusive.

16.3 Your mandatory domestic rights are preserved. Nothing in these Terms deprives you of the protection of any provision of the law of the country or province in which you habitually reside that cannot be excluded or limited by agreement. In particular:

1. if you are a Consumer habitually resident in the EU/EEA, you keep the protection of the mandatory consumer law of your country of residence (Article 6(2), Regulation (EC) 593/2008 (Rome I)), and you may bring proceedings in the courts of your country of residence where Regulation (EU) 1215/2012 so allows;
2. if you are a Consumer habitually resident in the UK, you keep the protection of mandatory UK consumer law, including the Consumer Rights Act 2015, and you may bring proceedings in the courts of the part of the UK where you live;
3. if you are a Consumer in Ontario or another Canadian province, you keep all rights under the Consumer Protection Act, 2002 (Ontario) or your province's consumer protection law. Nothing in these Terms prevents you from bringing a claim in court or joining a class proceeding where that law gives you this right;
4. if you are a Consumer habitually resident in any other country, you keep the protection of any mandatory consumer law of that country that applies to you.

16.4 Voluntary departure from domestic protections. Where a protection under your domestic law can lawfully be waived or excluded by agreement, and you choose to receive Services from the Company (a Canadian firm not authorised in your jurisdiction) on your own initiative, you accept that the Services are provided under Canadian law and regulation, and that you will not benefit from regulatory protections that apply only to clients of firms authorised in your jurisdiction (for example local ombudsman schemes, deposit or investor compensation schemes, or local licensing protections), as described in clauses 2.2, 3.5, 3.6 and 3.7. You confirm that you have accepted these risks voluntarily. This clause does not affect any right that cannot be waived by law.

16.5 Business Customers. To the fullest extent permitted by law, Business Customers agree that only the laws and courts in clauses 16.1 and 16.2 apply, and that any statutory provisions of other jurisdictions that may be excluded by agreement are excluded.

16.6 Language. These Terms are concluded in English, and you confirm that you have chosen to contract in English and understand it. Where a mandatory law of your country of residence requires these Terms or any pre-contractual or other information to be given to you in a local language, we will provide a translation on request, and that version prevails to the extent the mandatory law requires. Otherwise, any translation is for convenience only and the English version prevails.

17. Changes, communications and general provisions

17.1 Changes to these Terms. We may change these Terms by giving you at least 60 days' (Consumers) or 30 days' (Business Customers) notice by e-mail or in the GetOn app. If you do not agree, you may close your Account free of charge before the change takes effect. If you do not object, you are treated as having accepted the change. We may make changes immediately where required by law, a regulator or a Partner, or where the change is in your favour.

17.2 Communications. We communicate with you in English by e-mail, in the GetOn app or on the GetOn website, unless a mandatory law described in clause 16.6 requires us to use another language for a particular communication. You agree to receive these Terms, notices, statements and disclosures electronically. You must keep your contact details up to date. A notice is treated as received when sent to your registered e-mail or posted in the GetOn app.

17.3 Recording. We may record and monitor calls, video calls and messages for security, training, quality and compliance purposes, and keep them for the periods set out in the GetOn Privacy Policy.

17.4 Assignment. You may not transfer your rights or obligations without our written consent. We may transfer our rights and obligations to another regulated entity on 30 days' notice, provided your rights are not reduced; you may close your Account free of charge if you object.

17.5 Subcontracting. We may use Partners, BLOOMFI LABS - FZCO and other subcontractors to provide the Services, but we remain responsible to you for the Services we provide under these Terms.

17.6 Set-off. We may set off any amount you owe us against any balance we hold for you, to the extent permitted by law.

17.7 Entire agreement. These Terms, the Fee Schedule, the GetOn Privacy Policy and any Product Terms are the entire agreement between us about the Services.

17.8 Severability. If any provision is invalid or unenforceable, the rest of these Terms remain in force, and the provision is applied to the maximum extent permitted.

17.9 No waiver. A delay in exercising a right is not a waiver of it.

17.10 Third-party rights. No person other than you and us has any right to enforce these Terms, except Partners where expressly stated.

17.11 Intellectual property. The GetOn name and brand, the GetOn app and website, and all related content belong to the Company, BLOOMFI LABS - FZCO or their licensors. We grant you a limited, revocable, non-transferable licence to use them for the Services only.

GetOn is a brand and trading name of GETON PAYMENT LIMITED (formerly known as FASTLAYER FINTECH LTD) · 219-6705 Tomken Road, Mississauga, Ontario, Canada, L5T 2J6 · Corporation No. 1001362200 · FINTRAC MSB No. N300001212