Privacy Policy

Mellifera Operations Limited · Version 1.0 · Effective date: 28/09/2026

1. Who we are

This Privacy Policy is issued by Mellifera Operations Limited (“MOL”, “we”, “us” or “our”), a company registered in Malta under company number C 105114, with registered office at
ST Tower, Level 20, Testaferrata Street, Ta Xbiex XBX 1405, Malta.

MOL operates the COLIBRIX ONE brand and the website at https://colibrix.one, and hosts and operates the core banking technology platform. MOL is a member of the Mellifera Holding group. COLIBRIX ONE is a commercial brand and is not itself a legal entity or a regulated financial institution.

For the personal data and processing described in this Privacy Policy, MOL is the controller — meaning we determine why and how that personal data is processed.

2. What this Privacy Policy covers

This Privacy Policy explains how MOL, acting as controller, collects, uses, shares and protects personal data in connection with:

• the COLIBRIX ONE website and other MOL online presences;
• business, partnership and general enquiries you send us;
• our marketing and communications;
• recruitment and job applications (read together with our Candidate Privacy Notice); and
• our relationships with suppliers, service providers and business contacts.

2.1 What this Privacy Policy does not cover

Regulated financial products. The COLIBRIX ONE website is an informational website for financial services. Regulated services are provided by other companies in the group — Mellifera Kartiera Limited (Malta company C 107685, an electronic money institution authorised and regulated by the MFSA) and Colibrix Limited (a UK company regulated by the FCA) — each of which acts as controller for its own customers and publishes its own customer privacy notice. If you are (or are becoming) a customer of a regulated group entity, please refer to that entity’s customer privacy notice.

Processing we carry out on behalf of others. Where MOL processes personal data on the instructions of a group entity or client — for example when hosting or operating the core banking platform for Mellifera Kartiera Limited, Colibrix Limited or other — MOL acts as a processor, not a controller. That processing is governed by the relevant controller’s privacy notice and instructions and by the applicable data processing agreement, and is outside the scope of this Privacy Policy.

Related notices. This Privacy Policy operates alongside our Cookie Notice (which explains cookies and similar technologies) and, for job applicants, our Candidate Privacy Notice.

Applicable law. We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and the Data Protection Act (Chapter 586 of the Laws of Malta) and its subsidiary legislation, including the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01). Our lead supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC) in Malta.

3. How to contact us and our Data Protection Officer

We have appointed a Data Protection Officer (DPO). You can contact the DPO about anything to do with this Privacy Policy or how we handle your personal data, including to exercise your rights.

Data Protection Officer: Alina Čigrina, Group Data Protection Officer

DPO email: dpo@colibrix.one

Website: https://colibrix.one

4. The personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data. We only collect what we need for the purposes set out in section 6.

• Identity and contact data — Name, job title, employer/organisation, email address, telephone number, postal or business address.
• Business and relationship data — Details of your organisation, your role, our correspondence and dealings with you, contract and order details (for suppliers and partners).
• Communications — The content of enquiries, messages and correspondence you send us through the website, by email or otherwise, and our responses.
• Website, device and usage data — IP address, device and browser type, operating system, pages viewed, referring pages, dates/times of access and similar analytics data collected through cookies and similar technologies (see our Cookie Notice).
• Marketing and preferences — Your marketing preferences and consents, and your interactions with our communications.
• Recruitment data — Where you apply for a role: CV, cover letter, employment and education history, references and related information (see the Candidate Privacy Notice).
• Supplier and payment data — For suppliers and service providers: contact and, where relevant, bank/payment details needed to administer the relationship and make payments.

Special categories. We do not seek to collect special categories of personal data (such as data about health, race or ethnicity, political opinions, religious beliefs, trade-union membership, or data concerning sex life or sexual orientation) through this website. Please do not send us such data unless we specifically ask for it and explain the basis for collecting it.

5. How we collect your personal data

• Directly from you — when you contact us, submit an enquiry or form, correspond with us, apply for a role, or enter into or perform a contract with us.
• Automatically — when you use our website, through cookies and similar technologies (see our Cookie Notice).
• From third parties — for example from other companies in the Mellifera group, business partners and introducers, recruitment agencies and referees, and publicly available or professional sources (such as company registries and professional networking sites) where relevant to a business relationship.

6. How and why we use your personal data

We only use your personal data where the law allows us to. The table below sets out the purposes for which we process personal data and the legal bases we rely on under Article 6(1) GDPR.

• Operating, maintaining and securing the website. Data used: Website, device and usage data. Legal basis: Our legitimate interests in running a secure, functional website (Art. 6(1)(f)); strictly necessary cookies do not require consent.
• Measuring and improving website performance (analytics). Data used: Website and usage data. Legal basis: Your consent (Art. 6(1)(a)) and S.L. 586.01, obtained via the cookie banner. You can withdraw it at any time.
• Responding to enquiries and providing information you request. Data used: Identity, contact and communications data. Legal basis: Our legitimate interests in responding to you, and/or taking steps at your request before entering a contract (Art. 6(1)(f) / (b)).
• Managing supplier, partner and business relationships and contracts. Data used: Identity, business, communications and payment data. Legal basis: Performance of a contract or steps prior to a contract (Art. 6(1)(b)); our legitimate interests in managing our business (Art. 6(1)(f)).
• Sending marketing communications. Data used: Contact data and marketing preferences. Legal basis: Your consent, and/or our legitimate interests in promoting our services to business contacts where permitted (Art. 6(1)(a) / (f)); S.L. 586.01 governs electronic marketing. You can opt out at any time.
• Recruitment and assessing applications. Data used: Recruitment data. Legal basis: Steps prior to entering an employment contract and our legitimate interests in recruiting (Art. 6(1)(b) / (f)); consent for retention in a talent pool (Art. 6(1)(a)).
• Complying with legal, regulatory, accounting and tax obligations. Data used: As required by the relevant obligation. Legal basis: Compliance with a legal obligation to which we are subject (Art. 6(1)(c)).
• Protecting our business, and establishing, exercising or defending legal claims. Data used: As relevant to the matter. Legal basis: Our legitimate interests in protecting our rights, property, security and people, and in handling claims (Art. 6(1)(f)).

Legitimate interests. Where we rely on legitimate interests, we have weighed those interests against your interests, rights and freedoms. You can ask us for more information about that balancing exercise using the contact details in section 3.

Consent. Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Cookies and similar technologies

Our website uses cookies and similar technologies. Strictly necessary cookies are used to make the site work. Non-essential cookies (for example analytics) are used only with your prior consent, which you give through our cookie banner and can change or withdraw at any time. Full details — including the categories of cookies, their purposes and durations — are set out in our Cookie Notice.

8. Marketing communications

Where you have opted in, or where the law otherwise allows, we may send you information about our services. You can opt out of marketing at any time by using the unsubscribe link in our communications or by contacting us. We do not sell your personal data.

9. Who we share your personal data with

We share personal data only where necessary and with appropriate safeguards in place. We may share it with:

• Other companies in the Mellifera group — Mellifera Kartiera Limited, Colibrix Limited — for administration, support and group management, each acting as controller or processor as appropriate.
• Service providers and processors — who process personal data on our behalf under written contracts that meet Article 28 GDPR, such as providers of cloud hosting and infrastructure, website and analytics tools, email and communications, IT support and security, and professional advisers (legal, accounting, audit).
• Regulators, authorities and courts — where we are required or permitted by law to disclose personal data, or to establish, exercise or defend legal claims.

We do not sell personal data, and we do not share it for third parties’ own independent marketing without your consent.

10. International transfers

Personal data within the European Economic Area (EEA) may be transferred outside it — for example to group companies or service providers — only where an appropriate safeguard applies. Depending on the destination, we rely on one or more of the following:

• Within the EEA — No restricted transfer applies; Chapter V GDPR is not engaged.
• United Kingdom — The European Commission’s adequacy decision for the UK. Where it does not apply, EU Standard Contractual Clauses (SCCs) as a fallback.
• Canada — The EU adequacy decision covering commercial-sector transfers to recipients subject to PIPEDA; otherwise SCCs with a transfer impact assessment.
• United States — The EU–US Data Privacy Framework where the recipient is certified; otherwise SCCs with a transfer impact assessment and supplementary measures.
• Other third countries — EU SCCs (Commission Implementing Decision (EU) 2021/914) with a transfer impact assessment and, where needed, supplementary safeguards.

You can request a copy of the relevant safeguards using the contact details in section 3.

11. How long we keep your personal data

We keep personal data only for as long as we need it for the purposes set out above, and to meet legal, regulatory, accounting and reporting requirements. Our main retention periods are:

• Business contacts and enquiries — Around 2 years after our last meaningful contact, unless an ongoing relationship or a legal reason requires longer.
• Supplier and contract data — For the duration of the relationship plus the applicable prescriptive period under the Civil Code (Chapter 16 of the Laws of Malta).
• Accounting and tax records — Accounting records for at least 10 years (Companies Act, Chapter 386); tax and VAT records for at least 6 years.
• Website analytics data — Around 2 years.
• Marketing preferences — Consent and suppression records are kept until you withdraw consent or become inactive, so we can honour your choices.
• Recruitment (unsuccessful applicants) — By default 6 months after the recruitment process concludes, to deal with any queries or claims; longer only with your consent to join a talent pool.
• CCTV (if operated) — Normally no more than 30 days, unless needed for a specific incident.

When we no longer need personal data, we securely delete or anonymise it.

12. How we protect your personal data

We maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage — including access controls, encryption where appropriate, logging and monitoring, supplier due diligence and staff training. For the technology platform we operate, we also apply operational-resilience measures consistent with our regulatory obligations.

If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the IDPC without undue delay and, where feasible, within 72 hours, and we will inform affected individuals where the breach is likely to result in a high risk to their rights and freedoms, in line with Articles 33 and 34 GDPR.

13. Automated decision-making

In the context covered by this Privacy Policy, MOL does not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing. Any automated checks connected with regulated financial products (such as identity, KYC or transaction-monitoring processes) are carried out by the regulated group controllers under their own customer privacy notices.

14. Your data protection rights

Subject to the conditions and exemptions in applicable law, you have the following rights in relation to your personal data:

• Access — To be told whether we process your personal data and, if so, to receive a copy of it and related information.
• Rectification — To have inaccurate personal data corrected and incomplete data completed.
• Erasure — To have your personal data deleted in certain circumstances (“right to be forgotten”).
• Restriction — To ask us to limit how we use your personal data in certain circumstances.
• Portability — To receive certain personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection — To object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Withdraw consent — Where we rely on your consent, to withdraw it at any time (without affecting processing already carried out).
• Automated decisions — Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to the exceptions in Article 22 GDPR.

15. How to exercise your rights

To exercise any of your rights, contact our DPO using the details in section 3. We may need to verify your identity before acting on a request. We will respond within one month of receiving a valid request; we may extend this by up to two further months for complex or numerous requests, and will tell you if we do. Exercising your rights is usually free, but we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

16. Your right to complain

We would like the chance to resolve any concern you have, so please contact our DPO first. You also have the right to lodge a complaint with a supervisory authority.

• Malta (our lead authority) — Office of the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, High Street, Sliema SLM 1549, Malta. Tel: +356 2328 7100. Email: idpc.info@idpc.org.mt. Web: https://idpc.org.mt
• United Kingdom (re Colibrix Limited) — Information Commissioner’s Office (ICO), for matters concerning the UK-regulated group entity.

17. Children

Our website and services are directed at businesses and adults and are not intended for children. We do not knowingly collect personal data from children under the age of 18. If you believe a child has provided us with personal data, please contact our DPO and we will take appropriate steps.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The version number and effective date at the top show when it was last updated. Where changes are significant, we will take reasonable steps to bring them to your attention. Please review this Privacy Policy periodically.

19. Definitions

Capitalised terms such as “controller”, “processor”, “personal data”, “processing”, “data subject”, “special categories of personal data”, “personal data breach” and “supervisory authority” have the meanings given to them in the GDPR.

‍