Terms of Use

1. Introduction and Scope of Application

1.1 In accordance with Article 10 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI), the following information is provided:

1.2 The Nebeus Platform is operated by Rintral Trading, S.L.U., trading under the commercial name of Nebeus, a limited liability company incorporated in Spain with tax identification number B66096686, registered in the Commercial Registry of Barcelona, with registered office at C/ de la Llacuna 11, 08005, Barcelona, Spain, e-mail info@nebeus.com, authorised by the Comisión Nacional del Mercado de Valores (CNMV) as a crypto-asset service provider under Regulation (EU) 2023/1114 (“Rintral Trading”).

1.3 Certain services available through the Nebeus Platform are provided by Rintral Capital, S.L.U., a limited liability company incorporated in Spain, with tax identification number B21849609 and registered office at C/ de la Llacuna 11, 08005, Barcelona, Spain (“Rintral Capital”), and e-mail info@nebeus.com.

Rintral Trading and Rintral Capital are together referred to as the “Nebeus Companies”. References in these Terms to “Nebeus”, “we”, “our” or “us” are to the Nebeus Company that provides the relevant service, as set out in clause 2.

1.4 These Terms of Use (the “Terms”) govern access to and use of all services provided through the Nebeus platform, accessible via the website https://nebeus.com and the Nebeus mobile application (together, the “Nebeus Platform”), operated by Rintral Trading. These Terms also govern the services Nebeus provides to you through a Partner Application, in accordance with clause 2.11.

1.5 These Terms constitute a legally binding agreement between you (“User”, “you”, or “your”) and the relevant Nebeus Company, and govern your use of the Nebeus Platform, including any services, tools, or content provided directly or through third-party integrations. This includes, without limitation, services related to crypto-assets, payment functionalities, custody solutions, cryptocurrency-backed loans and other financial operations, some of which are delivered through regulated partners. The involvement of a regulated partner in the delivery of a service does not make that service regulated: the Other Services, including cryptocurrency-backed loans, are not regulated, as set out in clause 2.3.

1.6 Users must be of legal age and have full contractual capacity to enter into these Terms, and must have successfully completed our onboarding and Know Your Customer (“KYC”) process.

1.7 Where a User accesses the Nebeus Platform on behalf of and as a representative of a legal entity, the User accepts and declares that they hold sufficient authority to bind the legal entity or company they represent in the contracting of services. In such cases, any service request made by the User shall be attributable to the legal entity, and Nebeus will presume that such requests have been made by that entity.

1.8 Acquiring the status of a User entails the reading and express acceptance, without reservation, of the conditions set out in these Terms, which the User confirms having read prior to acceptance. These Terms may be stored and reproduced by the User. By clicking “Accept” when prompted, you acknowledge that you have read, understood, and agreed to be legally bound by these Terms, together with our Privacy Policy, Cookies Policy, and any Specific Terms applicable to the services you use.

1.9 The services provided under these Terms are available only to Users resident in the countries indicated as supported on the Nebeus website from time to time (the “Supported Countries”), and only to the extent that such services are legally available in the User’s jurisdiction. The crypto-asset services provided by Rintral Trading are provided in accordance with Regulation (EU) 2023/1114 to Users resident in the European Economic Area and, subject to clause 1.10, to Users resident in other Supported Countries. It is your sole responsibility to ensure that your use of the Nebeus Platform complies with all applicable local, national, and international laws, regulations, and restrictions. If local laws or regulations prohibit or restrict your access to certain services or the Nebeus Platform in general, you must refrain from using those services.

1.10 Where a User resident in a Supported Country outside the European Economic Area is accepted as a customer, the User acknowledges that: (a) the services are provided from Spain and governed by these Terms; (b) the User may not benefit from the protections afforded by the laws of the User’s country of residence, and Nebeus does not represent that the services comply with the requirements of those laws; and (c) the User is solely responsible for ensuring that the use of the services is lawful in that country. Nebeus may refuse, restrict or terminate the provision of services to Users resident outside the European Economic Area where required by applicable law or by its internal policies.

1.11 Nebeus shall not be liable for the unauthorised or unlawful use of the Nebeus Platform by Users in jurisdictions where such services are restricted or prohibited. By using the Nebeus Platform, you expressly confirm that your access is lawful in your jurisdiction and that you assume full responsibility for compliance with applicable laws.

1.12 Nebeus operates within the framework of applicable Spanish and European regulation, including, amongst others: MiCA (Regulation (EU) 2023/1114) for crypto-asset services; DORA (Regulation (EU) 2022/2554) on digital operational resilience; Law 10/2010 (Spain) and European Anti-Money Laundering and Counter-Terrorist Financing Directives; and the GDPR (Regulation (EU) 2016/679) on data protection.

1.13 In the event of conflict between these Terms and mandatory legal or regulatory provisions, the latter shall prevail.

1.14 Capitalised terms used in these Terms have the meaning given to them in Annex 1 (Definitions). Annex 2 (Specific Provisions for Business Clients) applies only to Business Clients.

2. Operational Model and Regulatory Structure (White-Label Provider Disclosure)

2.1 Rintral Trading acts as a crypto-asset service provider authorised by the CNMV in accordance with Regulation (EU) 2023/1114 on Markets in Crypto-Assets (“MiCA”), and provides directly under that framework the following crypto-asset services (the “Regulated Crypto-Asset Services”): (a) custody and administration of crypto-assets on behalf of clients; (b) reception and transmission of orders for crypto-assets on behalf of clients; and (c) transfer services for crypto-assets on behalf of clients. Orders to buy, sell or exchange crypto-assets placed through the Nebeus Platform are received by Rintral Trading and transmitted for execution to an Executing Venue.

2.2 Rintral Capital provides the following services: Renting, Staking and Loans (the “Other Services”). Each of the Other Services is governed by these Terms and by its own Specific Terms.

2.3 The Other Services are not regulated under Regulation (EU) 2023/1114 (MiCA) and Rintral Capital is not authorised or supervised by the CNMV, the Banco de España or any other financial authority in respect of them. Accordingly, Users of the Other Services do not have the same protections and safeguards as Users of the Regulated Crypto-Asset Services and are exposed to additional risks, as described in the applicable Specific Terms.

2.4 Crypto-assets that you allocate to any of the Other Services are held and used in accordance with the applicable Specific Terms. You will be asked to give your separate and express consent before activating any of the Other Services.

2.5 In parallel, certain services related to fiat money or payments may be provided by credit institutions, payment institutions, or electronic money institutions duly authorised under Directive (EU) 2015/2366 (“PSD2”) and its implementing regulation (“Third-Party Providers”). In such cases, Nebeus acts as a technological interface and distributor, whilst the provision of the regulated service rests with those authorised entities.

2.6 This distinction is reflected in the specific documentation for each service and in the corresponding regulatory disclosures.

2.7 An up-to-date list of external regulated service providers may be consulted on our website at <https://help.nebeus.com>. This list may be updated periodically to reflect operational or regulatory changes, without prejudice to the information obligations owed to the User.

2.8 Specific Terms and Disclosures

Certain services or features available through the Nebeus Platform may be governed by the specific terms and conditions of the Nebeus Company or Third-Party Provider that provides them (the “Specific Terms”). These Specific Terms are presented to the User at the time of activation or use of the relevant service and must be reviewed and accepted before proceeding.

By accepting these Terms of Use, you also agree to be bound by any applicable Specific Terms relating to the services you choose to activate, including, without limitation, those governing crypto-asset wallets, IBAN accounts, payment cards, staking, renting, loans, and mass payments.

Each service offered by a regulated third party will be accompanied by an information sheet detailing:

1. the providing entity;

1. its registration number;

1. a link to the relevant public register;

1. the scope of its liability;

whether the service is regulated and, if so, by which authority.

In the event of any inconsistency between these general Terms and any applicable Specific Terms, the Specific Terms shall prevail solely in relation to the relevant service. These Terms shall apply to all matters not expressly regulated in the Specific Terms.

2.9 Card Issuance and Fiat Currency Account Custody

Certain fiat and payment services accessible through the Nebeus Platform (such as payment cards, fiat currency accounts, or IBANs) are provided by electronic money institutions, payment institutions, or credit institutions duly authorised and established within the European Economic Area, in accordance with Directive (EU) 2015/2366 (“PSD2”) and its implementing regulation.

An up-to-date list of the regulated providers delivering these services is available here. In any case, the User will be informed of the identity of the applicable provider prior to the activation of the relevant service.

Always prior to service activation, the User will receive information on the identity of the applicable provider and the Specific Terms that will govern that service, which must be expressly accepted where required. These disclosures form part of the Specific Terms referred to in clause 2.8. Acceptance of such terms will be collected by electronic means.

All fiat funds associated with electronic money accounts, payment instruments, or card balances are held and safeguarded by the relevant Third-Party Provider in accordance with applicable regulation and its corresponding national transpositions.

Where such services are provided by a duly authorised electronic money institution or payment service provider, funds will be safeguarded by that entity in accordance with its own regulatory regime. In such cases, the User acknowledges that the authorised entity is acting as the provider of the relevant electronic money or payment service.

In all cases, funds are kept legally separate from Nebeus’s own assets and those of any affiliated entity.

Where fiat funds pass through Rintral Trading solely for the purpose of settling an order, they are safeguarded by Rintral Trading in accordance with Article 70 of Regulation (EU) 2023/1114. Payment services relating to e-money tokens, where applicable, are provided by an institution duly authorised for that purpose, whose identity will be communicated to you before activation of the relevant service.

2.10 Subcontracting and Change of Regulated Providers

Nebeus reserves the right to subcontract or delegate the performance of any part of its obligations under these Terms to third-party service providers, whilst always ensuring compliance with applicable obligations.

Where such subcontracting involves regulated services, Nebeus guarantees that the third party holds the relevant authorisation and is subject to the supervision of a competent authority. Users will be informed of any change in regulated provider in accordance with applicable regulation.

Such subcontracting or delegation shall not release Nebeus from its obligations towards the User under these Terms, without prejudice to Nebeus’s right of recourse, and except where otherwise provided by applicable legislation or specific service agreements.

In the event of a change of regulated service provider, Nebeus will ensure operational and contractual continuity of the service, informing the User with adequate prior notice, except in cases of justified urgency.

2.11 Services Provided Through a Partner Application

Some services are made available to you inside an application operated by a third party (the “Partner Application”, and the operator of it the “Technical Partner”). Where that is how you reached these services, the following applies in addition to the rest of these Terms.

(a) *Rintral Trading.* The crypto-asset services you receive (the custody and administration of crypto-assets on your behalf, the reception and transmission of your orders to buy, sell or exchange crypto-assets to an Executing Venue, transfers of crypto-assets on your behalf, and the operation of your Nebeus account) are provided solely by Rintral Trading under its authorisation, through a white-labelling arrangement with the Technical Partner. Your contract for those services is with Rintral Trading and with no one else. Rintral Trading decides whether to accept you as a customer, on its own assessment, and is responsible to you for the provision of those services.

(b) *The Technical Partner*. In its capacity as Technical Partner, the Technical Partner provides technical and interface services to Nebeus. It displays information to you, collects information from you and transmits your instructions. In that capacity, it provides no crypto-asset service, holds none of your crypto-assets, does not hold or receive funds due to you, is not Nebeus’s agent, and does not decide, advise or exercise any discretion in relation to the services Nebeus provides to you. It cannot vary these Terms, waive any of them, or make any commitment on Nebeus’s behalf.

(c) You. You are Nebeus’s customer. Everything the Partner Application shows you about your Nebeus account, your deposit addresses, your conversions and your fees is displayed information about a service Nebeus provides to you.

(d) The Technical Partner’s own services. The Technical Partner may also provide you with its own services under its own separate terms. Those are not Nebeus services, are not covered by these Terms, and Nebeus is not responsible for them. Where the Technical Partner’s own services are not regulated, that is so whether or not they appear alongside Nebeus services in the same application.

(e) The Technical Partner is not authorised to describe itself as the provider of the services Nebeus provides to you, to describe itself as regulated in respect of them, or to give you advice or a recommendation about them. If anything in the Partner Application suggests otherwise, these Terms prevail and you should tell us.

(f) You instruct transactions; the Technical Partner transmits your instruction to us and cannot give an instruction on your behalf unless you have given a standing authority and we have accepted it. Where you give a standing authority, we will tell you what it covers, the fees that apply and how the rate will be obtained, how long it lasts, how you can withdraw it and what market movements you remain exposed to while it is in force. You may withdraw it at any time before an instruction given under it has been executed.

(g) Clause 2.10 applies to any arrangement with a Technical Partner: it does not release Nebeus from its obligations to you under these Terms.

(h) The Other Services provided by Rintral Capital are not available through a Partner Application.

(i) The Technical Partner, or a company in its group, may also be authorised in the European Economic Area to provide payment services and may provide such services to Nebeus in connection with the services Nebeus provides to you. In that separate capacity it acts as a Third-Party Provider within the meaning of clause 2.5, and not as Technical Partner, and you will be informed of its identity in accordance with clause 2.9. Any fiat funds due to you that are held in connection with those payment services are not its own funds and are safeguarded in accordance with applicable law. Any account or service it provides to you in your own name is governed by paragraph (d).

2.12 Embedded Widgets and Third-Party Integrations

Certain services may be accessed through third-party environments via widgets or other embedded interfaces. These integrations are subject to specific terms applicable to both the User and the integration partner. Where those services are made available to you through a Partner Application, clause 2.11 also applies.

By accessing the Nebeus Platform through a third-party widget or a Partner Application, you acknowledge that:

1. Nebeus carries out its own customer due diligence and makes its own decision on whether to accept you, and the integration partner or Technical Partner collects and transmits information to us but does not verify your identity and does not decide;
2. Nebeus is the controller of the personal data it processes for those purposes, as set out in clause 11.7;
3. transactional limits and service availability may differ from those of the main Nebeus Platform.

Integration partners undertake to comply with Nebeus’s technical specifications, branding requirements, and security policies. Nebeus reserves the right to suspend access to widgets in cases of non-compliance or technical non-conformity.

Nebeus shall not be liable for errors, omissions, or operational deficiencies attributable to the technology environment of the integration partner, provided that the integration partner has complied with the technical standards required by Nebeus. This does not limit Nebeus’s responsibility for the regulated services it provides to you, which is dealt with in clauses 2.11 and 13.10.

Nebeus reserves the right to periodically audit the regulatory and technical compliance of integration partners, and may revoke their access in the event of non-compliance.

3. Acceptance of Terms

3.1 By clicking “Accept”, registering for a Nebeus account (i.e. the unique user profile enabling access to the Nebeus Platform and its various services, including, where applicable, differentiated balances or sub-accounts by service), you expressly represent that:

• You have read and fully understood these Terms;

• You agree to be legally bound by these Terms and by any additional agreements incorporated by reference;

• You confirm that you have the legal capacity to enter into binding agreements under applicable law;

• Where acting on behalf of a legal entity, you represent and warrant that you are duly authorised to bind that entity to these Terms.

3.2 Your acceptance in accordance with clause 3.1 constitutes your full and unconditional acceptance of these Terms. If you disagree with any provision, you must immediately cease use of the Nebeus Platform and any associated services.

3.3 These Terms incorporate by reference the following documents, which shall be considered an integral part of this agreement:

• Privacy Policy, governing the collection and use of personal data;

• Cookies Policy, relating to online tracking technologies;

• The Specific Terms applicable to the services you activate, including those of Third-Party Providers;

• Regulatory policies applicable to crypto-asset services, including, without limitation, the Custody Policy, the Order Reception and Transmission Policy, and the Conflicts of Interest Policy.

3.4 You may also be required to expressly accept the applicable Specific Terms before accessing or activating certain services offered through the Nebeus Platform.

3.5 Such acceptance will be collected through dedicated electronic confirmation mechanisms, such as mandatory tick-boxes, disclosure pop-ups, dynamic consent forms, or explicit digital signature interfaces, at the point of onboarding, activation, or first use of the service.

3.6 Where the service is legally provided by a regulated provider other than Nebeus, acceptance of the Specific Terms will constitute the direct formation of a contract with that provider, in accordance with its own regulatory framework.

3.7 By confirming acceptance through these mechanisms, you acknowledge and agree that:

• The relevant Specific Terms become an integral and binding part of your contractual relationship with Nebeus and/or the applicable regulated service provider;

• Your consent is valid and enforceable and constitutes an electronic signature that shall not be denied legal effect solely on the grounds that it is in electronic form, in accordance with Regulation (EU) No 910/2014 (eIDAS);

• The Nebeus Platform may securely record and store the timestamp, IP address, device data, and other technical evidence of acceptance, in accordance with applicable legal obligations on data protection and record-keeping.

3.8 The User may decline to accept the Specific Terms of a given product without affecting the general availability of their basic account, unless those terms are essential for core use of the Nebeus Platform.

3.9 In the event of conflict between these Terms and mandatory applicable legal provisions (including the MiCA Regulation, eIDAS, or PSD2), the latter shall prevail in their interpretation and application.

3.10 Nebeus will confirm your acceptance of these Terms by electronic means in accordance with applicable law. You may store and reproduce these Terms at any time.

3.11 Where you access Nebeus services through a Partner Application, you accept these Terms by the acceptance mechanism presented to you in that application. Acceptance there forms a contract directly between you and Nebeus, on these Terms, notwithstanding that it was given in an application operated by a third party. The Technical Partner captures and timestamps your acceptance on our behalf and provides the record to us; the contract is nonetheless ours with you, and the Technical Partner is not a party to it and acquires no rights under it.

3.12 Right of withdrawal. If you are a consumer, you may withdraw from these Terms within fourteen (14) calendar days from their acceptance, without penalty and without giving any reason, by notifying Nebeus at <info@nebeus.com>. The right of withdrawal does not apply to transactions in crypto-assets already executed, the price of which depends on fluctuations in the market outside Nebeus’s control, in accordance with applicable law.

4. Digital Images, Electronic Signatures, and Facsimile Reproductions

4.1 You agree that any signature, acknowledgement, consent, or agreement provided through the Nebeus Platform (including via digital images, electronic signatures, click-to-accept mechanisms, or scanned/facsimile reproductions) shall not be denied legal effect or admissibility as evidence solely on the grounds that it is in electronic form, in accordance with Article 25 of Regulation (EU) No 910/2014 (eIDAS), which recognises the legal validity of electronic signatures.

4.2 This includes, without limitation:

1. service agreements, disclosures, or consent forms;

1. subscription conditions for products or services;

1. transaction confirmations and communications receipts;

identification and verification records.

4.3 Such technical records (including IP address, timestamp, device, and geolocation) may be used as valid evidence in administrative or judicial proceedings.

4.4 You acknowledge and agree that:

• Copies or reproductions of signed documents (including PDF scans, screenshots, or certified digital files) may be treated as originals for legal and evidentiary purposes;

• Nebeus may rely on such digital instruments for account management, compliance verification, and dispute resolution;

• You are responsible for ensuring that your digital signature tools (including email, devices, or login credentials) remain secure and are not used by unauthorised third parties. You must implement adequate security measures, such as two-factor authentication (2FA) where available. Nebeus shall not be liable for the misuse of your credentials except where the misuse results from a failure attributable to Nebeus.

4.5 Unless otherwise required by law, Nebeus is not obliged to provide physical copies of electronically signed agreements. You may request a PDF or printable copy at any time by contacting our support team.

4.6 Our records of your account, your balances, your crypto-assets, the instructions we receive and the time at which we receive them are evidence of those matters and are presumed to be correct, save in the case of manifest error or where you show them to be incorrect.

4.7 Where you use a Partner Application, what that application displays to you is a presentation of information we have provided to the Technical Partner, and it may not be current. If what the Partner Application shows you differs from our records, our records prevail. If you believe our records are incorrect, tell us and we will investigate under clause 21.

5. Eligibility and Registration

5.1 Access to the Nebeus Platform and use of Nebeus’s services is restricted to Users who meet the following eligibility requirements. The Nebeus Platform is not intended for use by persons under the age of 18. Any unauthorised registration may be considered void.

5.2 Access to the Nebeus Platform is permitted only to natural persons or legal entities residing in the Supported Countries and in jurisdictions not subject to international sanctions or regulatory restrictions applicable to the services offered.

5.3 Registration on the Nebeus Platform entails acceptance of identification (KYC) and due diligence (AML) procedures established by Nebeus or its regulated providers, in accordance with Law 10/2010 and applicable European regulation.

5.4 Nebeus reserves the right to reject or cancel registrations that do not meet these requirements, without any obligation to justify the decision, where there are reasonable grounds to suspect regulatory non-compliance or reputational risk.

5.5 Individual Users

To register as a natural person, you must:

1. be at least 18 years of age or have reached the legal age of majority in your jurisdiction;

1. have full legal capacity to enter into binding agreements under the laws of your country of residence;

5.6 Corporate Users (Business Clients)

To register as a legal entity, you must:

1. be duly incorporated and in good standing under the laws of your country of registration;

1. provide official documentation evidencing your legal existence, tax identification, and ownership structure;

5.7 Verification and Onboarding

All Users must successfully complete our onboarding and identity verification procedures, which include Know Your Customer (KYC) or Know Your Business (KYB) due diligence. These verifications are conducted through authorised verification providers, in compliance with Spanish Law 10/2010 on AML/CTF, the European Anti-Money Laundering Directives and MiCA, as applicable.

Nebeus reserves the right to:

• Reject any registration application at its sole discretion, including, without limitation, where the User appears on international sanctions lists (e.g. OFAC, EU, or United Nations) or is considered high-risk under internal compliance criteria;

• Request additional documentation at any time;

• Restrict or suspend access to any service;

• Close an account where inconsistencies or non-compliance are identified during or after the verification process.

These controls apply both during onboarding and throughout the entire account relationship. Failure to complete ongoing verifications, or refusal to provide updated documentation, may result in limited functionality or service suspension.

For transparency and regulatory compliance purposes, Nebeus will maintain an auditable record of all verifications carried out, including timestamps, verification methods, and external provider credentials. The results of such verifications may be shared with competent authorities, including SEPBLAC, in accordance with applicable law.

The retention of such records is carried out in a manner ensuring their availability for internal audits or inspections by competent authorities.

The User’s risk profile may be reassessed periodically at the discretion of Nebeus or its regulated partners, in response to the evolution of the commercial relationship or changes in regulatory requirements.

Where you hold more than one relationship with us (for example as a customer onboarded directly and as a customer onboarded through a Partner Application), we may link those relationships for the purposes of customer due diligence, transaction monitoring, sanctions screening, risk assessment and the application of limits, and may treat information obtained in one as obtained in all.

5.8 Use of the Nebeus Platform by Minors or Unauthorised Representatives

Access to and use of the Nebeus Platform is strictly limited to persons and entities meeting the eligibility criteria set out in these Terms. Users are prohibited from allowing third parties (whether family members, minors, or unauthorised individuals) to access or operate their account without Nebeus’s prior written consent or a legally valid delegation.

You represent and warrant that you are acting solely in your own name or, where applicable, with full legal authority to represent and bind a legal entity. Any unauthorised use may result in immediate account suspension or termination and will be reported to the competent authorities as required by applicable law.

The submission of false, altered, or unverifiable documents may be reported to the competent authorities and will result in immediate account cancellation.

6. User Responsibilities and Security

6.1 By registering on the Nebeus Platform and accessing Nebeus’s services, you undertake to act with integrity, diligence, and in full compliance with applicable laws and these Terms. You are responsible for ensuring that all information provided during registration and throughout your use of the Nebeus Platform is truthful, accurate, and up to date, including personal data, contact information, and, where applicable, corporate documentation. This responsibility also extends to the regulated service providers operating through the Nebeus Platform.

6.2 You must maintain the confidentiality and security of your account credentials, authentication methods, and devices used to access your account. It is your obligation to prevent unauthorised access and to notify Nebeus immediately at info@nebeus.com if you suspect or become aware of any security breach, including loss or theft of credentials, device compromise, or suspicious activity.

6.3 You must refrain from accessing the Nebeus Platform through unauthorised methods or unverified third-party applications. Nebeus accepts no liability for damages arising from the use of unofficial channels.

6.4 All activity carried out through your account will be deemed to have been carried out by you, unless you notify us of unauthorised use and we have had sufficient time to take action, or the loss results from an incident attributable to Nebeus. Nebeus accepts no liability for losses or damages arising from your failure to implement adequate security measures, such as the use of strong passwords or secured network environments, or from any misuse of the Nebeus Platform attributable to your negligence or omission.

6.5 Ongoing failure to comply with your obligations under this section may result in the restriction, suspension, or cancellation of your account and, where applicable, notification to the competent authorities.

6.6 Nebeus shall not be liable for losses, unauthorised access, or unwanted transactions resulting from the User’s failure to comply with these obligations, including the failure to activate available security mechanisms.

6.7 Prohibition on Account Sharing

Your Nebeus account is personal (or entity-specific, in the case of companies) and must not be shared, rented, or transferred to third parties without prior written authorisation. You are solely responsible for all activities carried out using your credentials. Unauthorised sharing may result in immediate account suspension or termination and, where fraud or misuse is suspected, may be reported to the competent authorities.

In the case of corporate accounts, the registered entity assumes full responsibility for the acts of its authorised representatives or employees, unless it notifies Nebeus in writing of the revocation of such authorisation.

6.8 Security and Unauthorised Use

You are solely responsible for safeguarding the confidentiality, integrity, and security of your login credentials, authentication methods (including two-factor authentication), and any device or software used to access the Nebeus Platform.

You must take all reasonable precautions to prevent unauthorised access, including:

• Creating and maintaining strong, unique passwords;

• Keeping your software, browser, and mobile applications up to date;

• Avoiding the use of public or insecure networks;

• Ensuring that devices are not rooted or compromised;

• Enabling biometric security where available.

Nebeus strongly recommends, and may in certain cases require, the use of two-factor authentication (2FA) to access certain features or carry out sensitive operations such as withdrawals or changes to login credentials.

Any unauthorised access, suspected compromise, or anomaly must be reported to Nebeus immediately through the designated channels. You acknowledge that any delay in such notification may limit Nebeus’s ability to contain and mitigate the incident.

Nebeus maintains proactive detection mechanisms for suspicious activity, automatic blocking upon anomalous behaviour, and continuous review of access logs. Where fraudulent activity is detected, the account may be preventively blocked and additional verification may be required to restore access.

All sessions are recorded and audited in accordance with our Information Security Policy and may be used as evidence in the event of a dispute, incident, or authority requirement.

Sharing of credentials is strictly prohibited. You will be held responsible for all activity carried out using your credentials, unless the contrary is duly evidenced.

6.9 Incident Reporting and Response

If you suspect that your account has been accessed without authorisation, that your credentials have been compromised, or that your device has been lost or breached, you must:

• Notify us immediately at <info@nebeus.com>;

• Change your login credentials;

• Cooperate fully with any investigation or forensic analysis we may initiate.

Nebeus may, on objectively justified grounds relating to the security of the account, suspected fraud or its legal obligations, suspend or restrict access to your account until the incident is resolved. This may include freezing funds, blocking transactions, or requiring additional identity verification.

6.10 Security Incidents and Liability

Nebeus shall not be liable for losses, damages, or unauthorised transactions resulting from your failure to comply with basic cybersecurity practices, such as:

• Use of weak or compromised passwords;

• Negligent sharing of credentials;

• Downloading malicious software or falling victim to phishing;

• Use of devices without adequate security measures.

This exclusion of liability also applies to damages arising from the use of unofficial versions of the Nebeus application or unauthorised third-party software.

Liability for unauthorised payment transactions relating to fiat services is governed by the terms of the relevant Third-Party Provider and by applicable payment services legislation.

Where you access your Nebeus account through a Partner Application, you authenticate yourself using the credentials and security methods that application provides. An instruction authenticated in that way is treated as given by you, and clauses 6.8 to 6.12 apply to those credentials as they apply to credentials issued by us. You must tell us, or the Technical Partner, as soon as you become aware that your credentials or your device have been compromised.

This does not make you responsible for a failure of the systems the Technical Partner operates. Where a transaction was not authorised by you and the cause was a failure in a system operated by the Technical Partner on our behalf, we will deal with your claim as though the failure were ours; our arrangements with the Technical Partner are a matter between us and it.

6.11 Nebeus Platform Resilience and Security Monitoring

Nebeus implements a comprehensive ICT resilience framework in accordance with Regulation (EU) 2022/2554 (DORA), including:

• End-to-end data encryption and secure communications protocols;

• Real-time transaction and session monitoring to detect anomalies;

• Periodic penetration testing and system audits;

• A formal incident response plan, comprising immediate containment, root cause analysis, user notification (where applicable), and regulatory reporting.

We also assess the cybersecurity of all external service providers with access to critical systems or data.

6.12 Absence of Absolute Security Guarantee

Whilst Nebeus applies industry-leading security measures, you acknowledge and accept that no system is completely immune to risk. By using the Nebeus Platform, you accept that:

• Security breaches, service interruptions, or data leaks may occur despite reasonable precautions;

• Nebeus will act promptly and transparently in response to any incident.

7. Compliance with Export Controls, Sanctions and Prohibited Uses

7.1 You represent and warrant that you are not subject to any sanctions imposed by the United Nations, the European Union, the United States (including the OFAC list), or any other relevant sanctions authority.

7.2 You further undertake not to permit the indirect use of the Nebeus Platform by natural or legal persons subject to international sanctions, including those acting on your behalf as intermediaries, ultimate beneficial owners, or agents.

7.3 You also warrant that you are not located in or resident of any country or territory subject to comprehensive trade embargoes. Nebeus reserves the right to restrict or terminate access to the Nebeus Platform where such access violates applicable export control or sanctions laws.

7.4 Nebeus may notify the competent authorities of any attempt to access, use, or conduct transactions that contravene applicable international sanctions or export control regulations, in accordance with its compliance policy.

7.5 In particular, Nebeus will not provide services where this is prohibited by restrictive measures adopted by the European Union, including restrictive measures applicable to crypto-asset services.

7.6 Screening of Transactions and Counterparties

We screen transactions, and the persons and crypto-asset addresses involved in them, against sanctions lists and our financial-crime controls. This includes persons who send funds or crypto-assets to you, and the persons and addresses to which you send them.

We may delay, refuse, freeze or return a transaction, and may suspend or restrict your account, where screening produces a result requiring us to act or where we reasonably suspect a link to sanctioned, unlawful or high-risk activity.

Where the law prevents us from telling you why we have acted, or from telling you that we have acted at all, we will not do so. Where we act in good faith under this clause to comply with our legal obligations, we are not liable for loss caused by a delay, refusal or return, including any change in the value of crypto-assets during the period concerned.

7.7 User Representations and Source of Funds

You represent and warrant that all funds, crypto-assets, and transactions carried out through the Nebeus Platform originate from legitimate sources and do not derive from criminal or unlawful activities. You further declare that you are not acting on behalf of or under the direction of third parties subject to financial sanctions, investigations, or enforcement actions.

You undertake to provide, upon request, documentary evidence of the legitimate origin of funds and to cooperate fully with any compliance review or investigation conducted by Nebeus or the competent authorities.

These obligations apply in compliance with Law 10/2010, Regulation (EU) 2023/1114 (MiCA), and other applicable anti-money laundering and counter-terrorist financing regulation.

7.8 Your Transactions Are Your Own (Legal Entities)

If you are a legal entity, each time you instruct a transaction you represent to us that:

• (a) the transaction is for your own account and in your own economic interest, and the funds and crypto-assets involved are beneficially your own;
• (b) you are not transmitting, collecting, holding, converting or paying away funds or crypto-assets for or on behalf of any other person, whether a customer, a member, a counterparty or any other third party;
• (c) you are not using your Nebeus account to provide, or as part of, any payment, collection, exchange, remittance or custody service to any other person; and

(d) no third party has funded, or will fund, the transaction, and no part of the proceeds is for the benefit of a third party.

You will not permit any other person to use your Nebeus account, and you will not operate it as a pooled, omnibus or client account.

We may ask you at any time to evidence compliance with this clause. If we are not satisfied, or if we reasonably believe a transaction is for or on behalf of a third party, we may refuse or reverse it, suspend your account and terminate these Terms.

7.9 Payments Involving Third Parties (Private Individuals)

If you are an individual, you may receive funds or crypto-assets from, and send them to, a person other than yourself, provided that you are acting on your own behalf and in your own interest. For fiat payments made through a Third-Party Provider in connection with services accessed through a Partner Application, only payments from and to an account held in your own name are permitted.

We may ask you who that person is, what the payment is for and what the source of the funds or crypto-assets is, and you must tell us. We may delay, refuse, return or reverse a payment where you do not, or where the payment does not pass our financial-crime controls.

You must not use your Nebeus account to provide a payment, collection, exchange, remittance or custody service to any other person, to operate it as a pooled or client account, or to allow any other person to operate it.

7.10 Transfers Involving Self-Hosted Addresses

Where you send crypto-assets to, or receive them from, a self-hosted address (an address that is not linked to a crypto-asset service provider or to an entity established outside the European Union that provides similar services), you must tell us whether the address is owned or controlled by you or by another person and, in all cases, provide the information we are required to obtain under Regulation (EU) 2023/1113.

(a) Where the address is owned or controlled by you, for transfers exceeding EUR 1,000 we will assess whether you own or control it and may require you to demonstrate that you do before we execute the transfer or credit it to your account.

(b) Where the address is owned or controlled by another person, and the transfer is permitted under these Terms, you must provide that person’s name and any other information required under Regulation (EU) 2023/1113. For transfers exceeding EUR 1,000, we may apply additional verification measures.

Where you do not provide the information or evidence we require, we may decline an outgoing transfer, and an incoming transfer will be dealt with in accordance with clause 12.12.

7.11 Prohibited Uses and Activities

You undertake not to use the Nebeus Platform or its services in any manner that violates these Terms, applicable law, or the rights of third parties. Prohibited activities include, without limitation:

• Participating in or facilitating money laundering, terrorist financing, fraud, or other unlawful financial activities;

• Attempting to gain unauthorised access to other users’ accounts or Nebeus’s systems;

• Distributing malware, ransomware, or engaging in phishing or other cyberattacks;

• Market manipulation or activities designed to defraud, deceive, or mislead;

• Using the Nebeus Platform for unlawful, abusive, defamatory, obscene, or otherwise objectionable purposes;

• Circumventing or attempting to circumvent security or authentication measures;

• Creating multiple accounts using false or unverified identities;

• Employing spoofing, wash trading, or pump-and-dump techniques;

• Providing false information or manipulated documents during the KYC/KYB verification process;

• Offering or promoting pyramid schemes, Ponzi schemes, or similar arrangements through the Nebeus Platform;

• Operating unauthorised third-party services, such as unregistered custodians or brokers.

These activities are prohibited, as applicable, under Title VI of Regulation (EU) 2023/1114 (MiCA) on market abuse, Law 10/2010 on the prevention of money laundering and terrorist financing, and other applicable national and international regulation.

Breach of this section may result in immediate account suspension or termination and, where necessary, referral to the competent authorities.

Nebeus will cooperate fully with the competent authorities, including the CNMV, SEPBLAC, Europol, or any international regulatory body, providing information and documentation as required by law.

8. Fees, Charges, Refunds and Set-Off

8.1 Use of the Nebeus Platform may be subject to fees, commissions, and service charges, depending on the type of service used, the transaction method, and the applicable pricing plan. A full and up-to-date Schedule of Fees is published on the Nebeus website and mobile application, and may be consulted on our website at <https://help.nebeus.com>.

8.2 This fee policy is established in accordance with the principle of transparency, ensuring that Users are aware of the costs applicable to the services used in advance.

8.3 Nebeus reserves the right to update or modify its fees at any time to reflect changes in operating costs, regulatory requirements, or market conditions. Any modification will be communicated via the Nebeus Platform or by email with at least fifteen (15) calendar days’ notice, or such longer period as may be required by applicable law, unless such changes are necessary to comply with legal obligations, in which case they may take effect immediately. You may terminate the affected service free of charge before the modification takes effect. Changes to fees are governed by this clause 8.3, by way of exception to the notice period set out in clause 20.2.

8.4 You are solely responsible for reviewing the applicable fees before using any service. By initiating a transaction or continuing to use a service after having been notified of a change, you accept the fees in force at the time of execution.

8.5 The User acknowledges that certain operations (such as blockchain transactions) may involve additional costs not charged directly by Nebeus (e.g. network fees or gas fees), the estimated amount of which will be displayed, where possible, prior to confirmation of the operation. Further information on these additional charges may be consulted on our website at https://help.nebeus.com.

8.6 Additionally, certain services may be offered as Paid Services, which include subscription- or usage-based pricing. Where applicable, billing terms and service conditions will be communicated clearly prior to activation.

8.7 Upon subscribing to any Paid Service, you agree to the applicable payment terms, including:

• Recurring billing cycles (e.g. monthly or annual);

• Automatic renewals, unless cancelled before the end of the current period;

• Accepted payment methods and any applicable taxes or third-party charges.

8.8 You may cancel a subscription at any time from your account settings. Unless otherwise indicated, cancellations take effect at the end of the current billing cycle, with no pro-rated refunds for unused periods.

8.9 Nebeus reserves the right to modify fees, including those associated with Paid Services, in accordance with the foregoing criteria. Failure to pay any applicable fee may result in service suspension or account termination.

8.10 In the event of partial non-payment or delay in recurring charges, Nebeus may restrict access to non-essential features until the outstanding balance is settled, without prejudice to the possible definitive termination of the account.

8.11 Where you use a Partner Application, the fees you pay to Nebeus for Nebeus services are set and charged by Nebeus and are disclosed to you before you confirm each transaction or, where the transaction is executed under a standing authority given under clause 2.11(f), when you give that authority; they are also shown in the record of each transaction executed under it. The Technical Partner receives no part of them and adds nothing to them. Any charge the Technical Partner makes to you for its own services is separate, is made under its own terms, and is shown to you separately.

8.12 Refunds

Owing to the operational characteristics of the services provided through the Nebeus Platform (including the execution of crypto-asset transactions, loan disbursements, and transfers), operations are considered final once confirmed and are not eligible for a refund. This applies to payments made by card, bank transfer, or crypto-assets.

Refunds will not be issued in cases of market volatility, user error (such as an incorrect wallet address), or delays caused by third-party systems or blockchain congestion. Users are responsible for reviewing all transaction details prior to confirmation.

Nebeus accepts no liability for execution failures arising from external events such as blockchain network congestion, third-party custody errors, technical outages, or force majeure. In such cases, no refund will apply, unless otherwise required by law.

Where payment is made by card or bank account, the User acknowledges that certain refund rights (such as chargeback rights) may not apply to crypto-asset services, without prejudice to your statutory rights as a payer.

A refund will be made where a technical error attributable to Nebeus is demonstrated. In such cases, the User must submit a formal written request with supporting documentation. Refunds, if approved, will be processed using the same payment method as the original transaction, unless otherwise agreed.

8.13 Chargebacks

All card transactions initiated on the Nebeus Platform are subject to our Chargeback Policy and the rules established by card networks (such as Visa or Mastercard) and our acquiring banks. Users are expected to attempt to resolve any dispute directly with Nebeus before initiating a chargeback through their card issuer.

Chargebacks may be considered valid in cases of unauthorised charges, technical errors, or confirmed fraudulent activity. However, unjustified or abusive chargebacks may result in account suspension, service restrictions, and recovery of costs associated with the dispute.

Nebeus reserves the right to deduct from or charge the User the documented processing fees and charges actually incurred by Nebeus in connection with chargebacks considered unfounded or submitted in bad faith.

Each chargeback is reviewed in accordance with Spanish financial legislation, Royal Decree-Law 19/2018. In the case of cryptocurrency transactions, owing to their decentralised and irreversible nature, chargebacks are only considered under exceptional circumstances and may entail remedies other than monetary reimbursement.

The submission of a chargeback may trigger a reassessment of account activity, additional verification procedures, and, where applicable, notification to the competent authorities if patterns associated with fraud or abuse are identified.

Users wishing to dispute a transaction must follow the procedures set out in the Chargeback Policy, which forms an integral part of these Terms and is available on our website or upon request.

8.14 Right of Set-Off

To the extent permitted by law, Nebeus may set off any amount that is due and payable by the User to Nebeus under these Terms, such as fees and commissions, against the User’s balance held with Nebeus, without prejudice to the User’s right to submit a complaint to the competent authority.

Nebeus may exercise this right only after notifying the User of the amount due and granting a reasonable period for payment, by setting off such amounts against the User’s available balance, including the liquidation of crypto-assets or the withholding of disbursements, unless prohibited by law. These actions will be recorded and notified to the User once executed.

The User may request a review of the exercise of this right through the complaints procedure described in clause 21.

This right may only be applied to assets whose ownership has been previously verified in accordance with our KYC/KYB policies. This right does not apply to funds held by Third-Party Providers.

9. Inactive and Dormant Accounts

9.1 To ensure compliance with applicable regulation and to maintain the operational integrity of the Nebeus Platform, Nebeus monitors user activity and may classify accounts as inactive or dormant where no login, transaction, or communication has occurred over a continuous period of twelve (12) months.

9.2 Once an account is designated as dormant, certain service limitations may apply, such as temporary suspension of access, withdrawal restrictions, or a request for additional identity verification. Where applicable, a maintenance fee may be deducted from the available balance in accordance with the published Schedule of Fees.

9.3 If an account remains inactive for a prolonged period and the account holder cannot be contacted despite repeated attempts, any remaining balance will continue to be held for the User and will be dealt with in accordance with applicable law. Users retain the right to request restitution, subject to appropriate verification and provided no legal or regulatory impediment exists.

9.4 Nebeus may only deduct the fees set out in the Schedule of Fees. Funds will be returned to the rightful holder upon verified request, provided no legal restrictions apply.

9.5 Prior to classification as dormant, Nebeus will make reasonable attempts to contact the User by email and other registered means of contact, with at least 30 days’ notice. This will include:

1. warning of the change of status;

1. instructions for reactivating the account;

details of possible charges or consequences.

9.6 Where applicable, funds may be transferred to officially held accounts as provided for under current Spanish legislation.

9.7 To reactivate a dormant account, Users must:

1. successfully log in to the Nebeus Platform;

1. complete any outstanding KYC/KYB update requests;

confirm their intention to continue using the services.

9.8 Once successfully reactivated, any accrued dormant account fees will be disclosed and deducted, if applicable. Nebeus reserves the right to waive such fees at its sole discretion. The up-to-date detail of these fees is available in the Schedule of Fees published on the Nebeus Platform.

9.9 Unclaimed or Investigated Funds

Nebeus may block or retain the funds held in an account, in accordance with applicable law, in particular where:

• There are indications of suspicious activity;

• Regulatory obligations require the blocking or reporting of assets;

• An investigation is ongoing by a competent authority (e.g. SEPBLAC).

Nebeus will act in accordance with its internal procedures and applicable Spanish legislation (Law 10/2010). Funds may:

1. be frozen without prior notice for the duration of the investigation;

1. be reported to SEPBLAC or other competent financial authorities;

1. be held securely in a segregated account until resolution;

be subject to seizure or forfeiture where their illicit origin is established by legal ruling.

Nebeus will maintain full cooperation with law enforcement authorities and financial regulators. Further information is available upon request, to the extent permitted by applicable law.

These actions will be carried out without prejudice to the custody, safeguarding, and segregation obligations set out in Article 75 of Regulation (EU) 2023/1114 (MiCA).

The User may request the restitution of retained funds upon sufficiently demonstrating ownership, provided no legal restrictions or contrary orders issued by competent authorities exist.

Where permitted by applicable regulation and without compromising an ongoing investigation, Nebeus will make reasonable efforts to notify the User before executing any definitive transfer, retention, or reporting of funds.

10. Intellectual Property and Confidentiality

10.1 All intellectual property rights in the Nebeus Platform, including but not limited to its content, design, logos, trade marks, text, graphics, icons, images, audio clips, software, and source code (together, the “Materials”), are the exclusive property of Rintral Trading, S.L.U., trading as Nebeus, or have been duly licensed from third-party providers, in accordance with the Consolidated Text of the Intellectual Property Law (Royal Legislative Decree 1/1996) and other applicable European Union regulation.

10.2 You are granted a limited, non-exclusive, non-transferable, and revocable licence to access and use the Nebeus Platform and its Materials solely for personal or internal business purposes, subject to the following conditions:

• You may not reproduce, distribute, publicly display, translate, reverse-engineer, decompile, or otherwise exploit the Nebeus Platform or any of its Materials, in whole or in part, without the prior written consent of Nebeus;

• You may not use Nebeus’s trade marks, commercial identifiers, or any other proprietary elements without express authorisation;

• All third-party trade marks appearing on the Nebeus Platform are the property of their respective owners and are used under licence or with permission.

10.3 Unauthorised use of the Materials may infringe copyright, trade mark, and other laws, and may give rise to civil or criminal liability.

10.4 You acknowledge and agree that:

1. the Nebeus Platform and its content are provided ‘as is’, without any warranty of fitness for a particular purpose, without prejudice to your statutory rights as a consumer;

1. Nebeus does not grant you any proprietary rights in the Materials;

any suggestions or feedback you voluntarily provide may be freely used by Nebeus without compensation or restriction.

10.5 In the case of informational materials or technical documents disclosed to the public, such as white papers or other pre-contractual communications, applicable regulation shall apply, including Regulation (EU) 2023/1114 (MiCA) in respect of crypto-asset white papers; their reproduction or redistribution without express authorisation is prohibited.

10.6 Confidentiality and Protection of Proprietary Information

You undertake not to disclose, reproduce, or use for any purpose other than use of the Nebeus Platform, any confidential information or proprietary material to which you gain access during your relationship with Nebeus. Confidential information includes, without limitation: business models, source code, APIs, architecture, processes, security systems, non-public financial information, and any technical, commercial, or contractual data provided by Nebeus or accessible through the Nebeus Platform.

This obligation extends to all information considered confidential, including crypto-asset disclosure documents, operational policies, and regulatory communications.

This confidentiality obligation applies indefinitely, including after the termination of your account or interruption of the service, unless disclosure is required by law, regulation, or a valid court order, in which case you undertake to notify Nebeus in advance, to the extent permitted by law.

Nebeus retains all intellectual property rights over any documentation, software, processes, and service structures presented through the Nebeus Platform. You must not modify, copy, distribute, transmit, display, perform, reproduce, publish, licence, create derivative works, transfer, or sell such information without prior written consent.

Any attempt to decompile, data-mine, scrape, reverse-engineer, or systematically extract content or operational structures from the Nebeus Platform is likewise prohibited, unless expressly authorised.

Access to such information does not imply any transfer, implied licence, or conveyance of any intellectual property or ongoing use rights, unless expressly stated otherwise.

Breach of this clause may result in immediate termination of access to the Nebeus Platform and give rise to civil or criminal liability, including claims for damages and interim injunctive relief.

11. Data Protection and Privacy

11.1 Nebeus is committed to protecting your personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and current Spanish data protection legislation. All personal data collected through the Nebeus Platform is processed lawfully, fairly, and for explicit and legitimate purposes.

11.2 We process your data solely for the purposes of:

1. providing our services;

1. complying with legal obligations (including KYC/AML);

1. preventing fraud;

ensuring transaction security.

11.3 Nebeus implements technical and organisational security measures commensurate with the level of risk, including data encryption, secure access management, and incident response procedures. Personal data is retained only for as long as necessary or as required by applicable law, including anti-money laundering regulations, and is securely deleted once that period expires.

11.4 Users have the right to:

1. access their personal data;

1. rectify inaccurate data and request the erasure of their data;

1. restrict or object to processing;

request data portability, subject to applicable legal limitations.

11.5 Requests may be sent to the Data Protection Officer at <dpo@nebeus.com>. Users also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

11.6 Further information is available in our Privacy Policy and Data Deletion Policy, which form an integral part of these Terms.

11.7 Where You Use a Partner Application

*How your data reaches us*. The Technical Partner collects your information and documents in its application and transmits them to us, including any identity-verification token generated by our verification provider. The Technical Partner does not verify your identity for us and does not decide whether you are accepted. Nebeus carries out its own customer due diligence, on its own file, and makes its own decision.

*Our role*. Nebeus is the controller of the personal data it processes to onboard you, to operate your account and transactions, and to meet its legal, regulatory and anti-money-laundering obligations. The Technical Partner is a separate controller in respect of its own relationship with you and of any service it provides you under its own terms, and is our processor only in respect of anything it does on our instructions. Nebeus and the Technical Partner are not joint controllers.

*What we send back*. We tell the Technical Partner what it needs to operate its application and to meet its own legal obligations: whether you have been accepted or declined, the status of your account and of your transactions, and the references needed to identify them. We do not share with it the reasons for a compliance decision, the content of your verification file, the documents you provided, or the substance of any report we make to an authority.

*Your information*. Before you give us data through the Partner Application, the Technical Partner must tell you that it will be shared with and processed by Nebeus and must have a lawful basis for providing it. Our Privacy Policy applies to our processing and is available to you within the Partner Application. Where the Technical Partner is established outside the European Economic Area, any transfer of your personal data to or from it is made in accordance with Chapter V of the GDPR, as described in our Privacy Policy.

11.8 Information Accompanying Transfers of Crypto-Assets

When you send or receive crypto-assets, we are required by Regulation (EU) 2023/1113 to collect information about you and to transmit it to the crypto-asset service provider at the other end of the transfer. That information includes your name and your account number or crypto-asset address, together with, depending on the transfer, your address, your official personal document number, your customer identification number or your date and place of birth. We must transmit it whether or not the other provider is established in the European Union.

This is a legal obligation. It does not depend on your consent and you cannot ask us not to comply with it. If you are unwilling for that information to be transmitted, we will not be able to carry out the transfer.

We will also receive equivalent information about persons who send crypto-assets to you, and will process it for the purposes set out in this clause 11.

12. Crypto-Asset Services: Custody, Orders and Transfers

12.1 All crypto-assets deposited by the User on the Nebeus Platform will be effectively, continuously, and verifiably segregated from Nebeus’s own assets. Crypto-assets may be held in omnibus wallets on behalf of Users, separate from Nebeus’s own assets, with a dedicated deposit address allocated to each User. This segregation is implemented through a register of positions opened in the name of each User, individualised accounting records, and automated control systems, in accordance with the principles of non-commingling, permanent identifiability, and operational reversibility. Separation applies at the legal, operational, accounting, and technological levels, and is periodically reviewed through internal controls and independent audits, in strict compliance with Regulation (EU) 2023/1114 (MiCA).

12.2 Absent express, informed, individualised, documented, and revocable consent granted by the User for a specific transaction, Nebeus is absolutely prohibited from reusing, lending, pledging, or transferring the crypto-assets held in custody. This prohibition covers any direct or indirect use for the benefit of Nebeus or third parties, save for the exceptions provided under applicable regulation, which will be duly communicated to the User. Crypto-assets allocated to any of the Other Services are dealt with in accordance with clause 2.4.

12.3 Nebeus maintains immutable, redundant, and cryptographically protected digital records enabling the complete, continuous, and detailed identification of the crypto-assets held in custody for each User, including their movement history, operational status, fiat equivalent value, and exact correspondence with segregated assets. These records are available for immediate inspection by the CNMV or other competent authorities.

12.4 The User acknowledges and accepts that custody services entail risks inherent to the crypto ecosystem, including:

1. loss or theft of private keys;

1. technological vulnerabilities;

1. cyberattacks;

1. operational and human risks;

1. regulatory changes;

counterparty risk from third-party custodians.

12.5 Nebeus proactively discloses these risks through clear and up-to-date pre-contractual information, and applies strict controls to mitigate them, including network segmentation, access controls, regular audits, and advanced encryption in accordance with DORA and MiCA.

12.6 Assets are held exclusively in Nebeus’s own infrastructure or in that of crypto-asset service providers authorised under MiCA, of which the User will be informed. Nebeus performs daily automated reconciliations, monthly manual cross-reconciliations, and periodic verifications by an external auditor. The entire process is supervised by the Chief Compliance Officer.

12.7 In the event of Nebeus’s insolvency, segregated crypto-assets will not form part of the insolvency estate, will not be subject to attachment, and will be returned to their holders in accordance with the procedure set out in insolvency regulation and MiCA.

12.8 The service provided by Nebeus is one of technical, non-discretionary custody, without investment advice. Subject to these Terms, the User retains at all times full ownership, control, and availability of their crypto-assets, which may be recovered or transferred in accordance with the contractual conditions. Nebeus assumes no risk in respect of their value development, acting solely as a responsible and neutral depository in accordance with the principles of integrity, professional diligence, and client protection established under MiCA.

12.9 Nebeus will provide you, in electronic format, at least once every three months and whenever you request it, with a statement of position of the crypto-assets held in custody in your name, showing the crypto-assets concerned, their balance, their value and the transfers of crypto-assets made during the relevant period. Nebeus will also inform you as soon as possible of any operation on crypto-assets that requires a response from you. Upon your instruction, Nebeus will return your crypto-assets, or the means of access to them, as soon as possible.

12.10 Nebeus is liable to you for the loss of any crypto-assets or of the means of access to them as a result of an incident that is attributable to Nebeus, up to the market value of the crypto-assets lost at the time the loss occurred. Incidents not attributable to Nebeus include any event in respect of which Nebeus demonstrates that it occurred independently of the provision of the relevant service or of its operations, such as a problem inherent in the operation of a distributed ledger that Nebeus does not control.

12.11 Orders and Quoted Rates

When you place an order to buy, sell or exchange crypto-assets, Rintral Trading receives your order and transmits it for execution to an Executing Venue, in accordance with its Order Reception and Transmission Policy. Except where your order is placed under a standing authority given under clause 2.11(f), before you confirm, we will show you the rate obtained for your order, the fees applying to it and the total amount payable, together with the period during which that rate is valid. If that period expires, you must request a new rate.

Any rate, price or indicative amount displayed to you before that point (including anything displayed in a Partner Application) is indicative only and does not bind us. In conditions of high market volatility, the final rate may differ from the indicative rate displayed to you immediately beforehand, owing to rapid market price movements (commonly referred to as slippage).

Orders under a standing authority. Where you have given a standing authority under clause 2.11(f):

• (a) when you give it, we will tell you the crypto-assets and amounts it covers, any limits that apply, how the rate will be obtained, the fees that apply, when orders will be placed under it and the market movements you remain exposed to while it is in force;
• (b) each order placed under it is transmitted in accordance with our Order Reception and Transmission Policy at the rate obtained at the time of execution, which may differ from any rate previously displayed to you; and

(c) after each order has been executed, we will make available to you a record of it showing the rate obtained, the fees applied and the net amount.

12.12 Incoming Crypto-Asset Transfers We Cannot Accept

Where crypto-assets are sent to an address we have allocated to you but we are unable to credit them to you (because the transfer does not pass our financial-crime controls, because the crypto-asset or network is not one we support, or because we are required to act under clause 7.6 or 7.10) we will not credit them to your account.

Where we are able and permitted to return them, we will return them to the address from which they were sent, less the network fee payable to transmit them. That network fee is determined by the relevant blockchain and is not set by us. Where return is not possible or not permitted, we will hold them and deal with them in accordance with clause 9.9 and our legal obligations.

We are not liable for any change in the value of the crypto-assets between the time they were sent and the time they are returned.

12.13 Forks, Airdrops, and Unsupported Crypto-assets

Nebeus does not guarantee support for forks of crypto-assets, airdrops, or protocol changes initiated by third parties. Where such events occur, Nebeus will assess on a case-by-case basis whether support is technically feasible and compliant with applicable regulation.

Unless Nebeus expressly communicates its decision to support a specific event, you expressly acknowledge and accept that we will not facilitate the exercise of any rights that may arise from such an event. We will communicate our decision to you with as much advance notice as possible, so that you may withdraw the affected crypto-assets beforehand.

Any operational incident or interruption related to such events (including its duration, root cause, and corrective measures) will be recorded and managed in accordance with Nebeus’s internal incident management and operational resilience framework.

12.14 Processing Times for High-Value Withdrawals

For reasons of security, regulatory compliance, and liquidity management, Nebeus reserves the right to apply extended processing times to withdrawal requests exceeding certain thresholds, whether in fiat or crypto-assets. These thresholds may vary depending on risk factors, transaction type, jurisdiction, or account history. By submitting a high-value withdrawal request, you acknowledge and accept that:

• Additional identity or security verifications may be required prior to approval;

• Processing may take longer than standard transactions, up to five (5) Business Days, unless a longer period is required to comply with applicable law or with a request from a competent authority;

• We may request supporting documentation to verify the source of funds or the intended recipient;

• Delays may occur owing to external service providers, blockchain network congestion, or compliance review.

You will be notified by email or via Nebeus Platform messages if your request requires additional verification or falls within the extended processing protocol. Nebeus shall not be liable for losses, penalties, or third-party fees occasioned by these timeframes.

12.15 Blockchain Disruptions and Asset Recovery Limitations

By using Nebeus’s services, you acknowledge that crypto-assets are subject to risks related to blockchain protocols, including but not limited to:

1. hard or soft forks;

1. smart contract vulnerabilities;

network congestion, delays, or failures.

In such cases, the User accepts and acknowledges that support in relation to forks is governed by clause 12.13, and that Nebeus will determine, at its sole discretion, whether and how to provide support in relation to asset recovery. Not all events are technically or legally recoverable. Nebeus is not obliged to provide support or compensation for tokens, forks, or features that arise without prior notice or market consensus.

The User acknowledges that participation in blockchain networks involves operational risks beyond Nebeus’s control, and that Nebeus shall not be liable for the loss of assets arising from forks, network bugs, incompatibilities, or unilateral protocol changes. This is without prejudice to Nebeus’s liability under clause 12.10.

12.16 Supported Crypto-Assets and Networks

The crypto-assets and networks supported by Nebeus are indicated on the Nebeus Platform. You must not send to Nebeus crypto-assets, or use networks, that are not supported, as this may result in their loss. Where Nebeus decides to stop supporting a crypto-asset, it will notify you with reasonable prior notice, unless a shorter period is required by law or by a competent authority, so that you can withdraw or sell it.

13. ICT Resilience, Nebeus Platform Availability and Third-Party Services

13.1 Nebeus maintains an internal digital operational resilience framework in accordance with Regulation (EU) 2022/2554 on Digital Operational Resilience for the financial sector (“DORA”). This framework ensures the continuity, availability, and security of our ICT systems, with particular emphasis on the prevention, detection, mitigation, and recovery from risks.

13.2 The Nebeus Platform is supported by robust infrastructure and is subject to continuous risk assessments, penetration testing, and system audits. We implement secure coding practices, access controls, data encryption, and backup protocols to mitigate risks related to data loss, corruption, or unauthorised access.

13.3 Nebeus operates a formal incident response plan, which includes real-time monitoring, root cause analysis, communication to affected Users, and regulatory notification procedures. Any major ICT incident will be reported to the relevant competent authority in accordance with applicable legal obligations and timelines. Incidents are classified in accordance with a standardised typology by severity level and impact.

13.4 Nebeus also conducts periodic operational continuity tests, disaster recovery exercises, and crisis simulations, including the involvement of relevant teams and validation by independent third parties.

13.5 Any significant change to ICT infrastructure, processes, systems, or providers is subject to internal change management policies, which include risk assessment, version control, and reversibility measures.

13.6 The ICT governance framework is overseen by the designated Head of Technology, who forms part of senior management and is accountable to the Board for digital strategy, in accordance with Article 5 of DORA.

13.7 We assess and monitor external ICT service providers, including cloud infrastructure, custody systems, and payment processing platforms, to ensure compliance with applicable standards on security, continuity, and outsourcing. These providers are subject to rigorous onboarding, audit, and ongoing assessment processes in accordance with our Third-Party Risk Management Policy.

13.8 By using the Nebeus Platform, you acknowledge and accept that no system is entirely free from risk. Whilst Nebeus strives to ensure secure and uninterrupted operations, we do not guarantee that access to the Nebeus Platform will be free from errors, delays, or interruptions caused by factors beyond our control.

13.9 Where a major ICT-related incident occurs that has an impact on the financial interests of Users, Nebeus will inform the affected Users without undue delay of the incident and of the measures taken to mitigate its adverse effects.

13.10 Third-Party Services and Disclaimer of Liability

The Nebeus Platform may include integrations with external service providers for functions such as identity verification, payment processing, custody, or communications.

In accordance with the service categorisation set out in clause 2 (Operational Model and Regulatory Structure), for those services in respect of which Nebeus acts as a technological interface and distributor, Nebeus does not guarantee, and shall not be liable for, the continuous availability, security, or performance of such third-party services. To the extent permitted by law, you agree that Nebeus shall not be liable for direct or indirect damages arising from the use, unavailability, or malfunction of services provided by third parties, except as required by consumer protection laws.

For the avoidance of doubt, this clause does not apply to the crypto-asset services Nebeus provides to you, including where those services are made available to you through a Partner Application. Nebeus’s responsibility for those services is not reduced by the fact that you access them through a third party’s application, and Nebeus does not rely on the Technical Partner for the performance of its regulated obligations.

13.11 Third-Party Service Interruptions and Continuity Measures

In the event that one of Nebeus’s regulated providers (through which Nebeus acts as a technological interface or distributor), such as IBAN issuers, payment card providers, or liquidity providers, ceases operations or is unable to fulfil its obligations, Nebeus will:

• Initiate a migration plan to an alternative partner to ensure service continuity;

• Notify affected Users of any changes to their access or service features;

• Facilitate the transfer or return of funds or crypto-assets in accordance with applicable law.

Whilst Nebeus endeavours to maintain continuous access through alternative partners, certain services may be suspended, modified, or discontinued, with reasonable prior notice where possible, provided this is legally and operationally viable.

Your contract with Nebeus does not depend on the Partner Application. If the Technical Partner ceases to make the Partner Application available, or our arrangement with it ends, your Nebeus account and these Terms continue. We will contact you directly, tell you how to access your account and your crypto-assets, and give you a reasonable period to withdraw or transfer them or to continue with us by another means.

13.12 Scheduled Maintenance and Nebeus Platform Outages

Nebeus may carry out periodic maintenance or emergency updates to the Nebeus Platform to ensure the integrity and security of the service. During such periods, access to the Nebeus Platform or certain features may be temporarily suspended. Scheduled maintenance will be communicated in advance where possible.

13.13 Nebeus Platform Availability and Service Continuity

Whilst Nebeus endeavours to ensure the continuous availability of the Nebeus Platform, you acknowledge and accept that its functionality depends on external systems, including blockchain networks, payment processors, and telecommunications infrastructure.

Transactions may experience delays owing to blockchain congestion or third-party network issues, for which Nebeus assumes no liability.

Nebeus does not guarantee uninterrupted access and shall not be liable for service interruptions caused by failures or delays in such systems, provided reasonable mitigation efforts are applied.

The User understands that certain events, such as forks, network attacks, or severe congestion, may affect the execution or settlement of operations without this implying any negligence on the part of Nebeus.

14.1 Voluntary Closure by the User

You may request the closure of your Nebeus account at any time, provided the account is in good standing and the following conditions are met:

1. all transactions are completed and settled;

1. there are no outstanding commissions, debts, or charges;

the account is not subject to legal blocks, compliance reviews, or regulatory investigations.

A closure request may be initiated from the “Account Settings” section of the Nebeus Platform or by contacting Nebeus Support by email (support@nebeus.com). In both cases, your identity will be verified through security protocols, including two-factor authentication and, if required, additional documentation.

If you do not use the mobile application, you will be required to submit a valid identity document and a recent utility bill or financial correspondence (issued within the last three months) confirming your full name and address.

In the case of legal entity accounts or legal representations, documentation evidencing the formal termination or revocation of the representation must be provided.

Following verification, you will receive written confirmation of the closure. Any remaining funds or crypto-assets must be withdrawn within the reasonable period indicated in that confirmation. After that period, and after notice to you, Nebeus will transfer them to an account or address in your name that you have previously indicated or, failing that, they will continue to be held for you and will be returned upon request, in accordance with applicable law.

Once closure is finalised, your access to the Nebeus Platform and associated services will be revoked. You are solely responsible for notifying third parties of the closure of your account.

Nebeus will retain account-related data for a period of ten (10) years in accordance with applicable anti-money laundering legislation, and will process it in accordance with the GDPR. Such data will be stored securely and used exclusively for legal, regulatory, and audit purposes.

14.2 Suspension or Termination by Nebeus

Nebeus reserves the right to suspend, restrict, or terminate your access to the Nebeus Platform and associated services without prior notice in the following circumstances:

1. breach of these Terms or applicable laws or regulations;

1. failure to complete verification procedures or outstanding document requests;

1. reasonable suspicion of fraudulent, unlawful, or unauthorised activity; or

legal, regulatory, or judicial obligation to act.

Nebeus may also terminate these Terms without cause by giving you at least one (1) month’s notice.

If your account holds a balance at the time of termination, funds or crypto-assets will be returned in accordance with applicable law, less any outstanding fees due under these Terms.

Where permitted by law, Nebeus will inform you of the reason for the action and may, at its sole discretion, offer you the opportunity to remedy the situation. However, in cases involving legal restrictions or instructions from competent authorities, this information may be withheld.

Termination for cause may result in the forfeiture of rewards, benefits, or promotions not yet accrued. Nebeus reserves the right to freeze or restrict access to remaining assets in compliance with AML/CTF regulations and in response to legal investigations.

We may freeze or restrict access to your account in response to court orders, tax authority requirements, or legitimate government requests.

The User may submit any complaint relating to the suspension or closure of their account in accordance with the procedure described in these Terms.

14.3 Death of the User

Upon receipt of sufficient evidence of the death of a User, Nebeus will block the account. The assets held in the account will be made available to the User’s heirs or legal successors once they have provided the documentation required by applicable law and completed Nebeus’s due diligence procedures.

15. Notices, Language, Interpretation, and Reference Time Zone

15.1 Unless otherwise indicated, all communications, notices, or disclosures under these Terms will be made in English or Spanish and may be delivered by email, through the Nebeus Platform, or by any other means Nebeus deems appropriate. In the event of a formal dispute or conflict, the primary email address registered on the User’s account will be considered the official notification channel. It is your responsibility to keep your contact information up to date and to review all communications.

15.2 All deadlines, due dates, and contractual time periods set out in these Terms will be determined by reference to Coordinated Universal Time (UTC), unless expressly stated otherwise. Any ambiguity relating to the computation of time periods or temporal determinations will be resolved exclusively by reference to UTC.

15.3 These Terms are available in Spanish and English. In the event of any discrepancy between the two versions, the Spanish version shall prevail. Notwithstanding the foregoing, where the User is a Consumer, the interpretation most favourable to the User shall prevail.

15.4 Section headings are for reference only and do not affect interpretation. The singular includes the plural and vice versa, and references to persons include legal entities.

15.5 Where you use a Partner Application, we may give you notices through that application as well as by the contact details we hold for you. A notice displayed to you in the Partner Application is treated as given when it is first made available to you there. We will always hold contact details for you directly and may contact you using them at any time, including if the Partner Application ceases to be available to you.

15.6 Use of SMS and Text Communications

By registering an account, you agree to receive SMS or text messages from Nebeus for service-related purposes, such as:

• 2FA codes for login and transaction approval;

• Identity verification;

• Security alerts and account notifications;

• Service updates, policy changes, or emergency communications.

You must ensure that your mobile number is correct and up to date. Nebeus accepts no liability for undelivered messages owing to incorrect information, telecommunications issues, or device settings.

Message or data rates may apply in accordance with your network operator. You are responsible for any such charges.

You may opt out of non-essential messages from your account settings. However, you cannot deactivate essential messages without closing your account or changing your authentication method.

15.7 Communications Monitoring and Consent

For quality, security, and compliance purposes, Nebeus may record and store all communications made by telephone, live chat, email, or Nebeus Platform internal messaging.

By using these channels, you are informed that such monitoring and storage will be carried out in accordance with applicable data protection regulations and retained for the legally required period.

This practice is based on Nebeus’s legitimate interest in ensuring service quality and compliance with its obligations pursuant to Article 6(1)(f) of the GDPR.

16. Absence of Fiduciary or Advisory Relationship, Conflicts of Interest and Risk Warnings

16.1 You acknowledge and agree that use of the Nebeus Platform and the services provided does not create any fiduciary, advisory, or representative relationship between you and Nebeus. Nebeus does not act as your agent, fiduciary, or financial adviser, and owes you no fiduciary duty, unless the service provided expressly entails advice under the relevant regulation.

16.2 All services are provided on an execution-only basis, unless expressly stated otherwise in the applicable Specific Terms. You are solely responsible for assessing the suitability and legal implications of any transaction carried out through the Nebeus Platform.

16.3 The User acknowledges that all decisions relating to the purchase, sale, or custody of crypto-assets are made autonomously and at their own risk. Any information provided by Nebeus is for informational or operational purposes only and does not constitute investment advice.

16.4 Nebeus acts honestly, fairly and professionally in accordance with the best interests of its clients and transmits your orders in accordance with its Order Reception and Transmission Policy.

16.5 Except where we expressly agree to provide you with advice as a separate regulated service, no person provides you with advice or a recommendation in relation to the services Nebeus provides to you. That includes any Technical Partner through whose application you access those services. Nothing displayed to you in a Partner Application (including the ordering, highlighting, default settings or presentation of options) is advice or a recommendation by Nebeus or by the Technical Partner, and you should not treat it as such.

16.6 Conflicts of Interest and Absence of Inducements

We maintain a conflicts of interest policy and take steps to identify, prevent, manage and disclose conflicts arising in the provision of our services. Rintral Trading and Rintral Capital belong to the same group; where you use services of both, our Conflicts of Interest Policy explains how conflicts between them are managed.

Where you access our services through a Partner Application, the Technical Partner has a commercial relationship with us. The Technical Partner receives no part of the fees you pay us, and we pay it no commission or other benefit for introducing or acquiring you as a customer or in return for the orders you place.

Separately, the Technical Partner, or a company in its group, may provide services to us, such as technical services or, where duly authorised, payment services. We pay for those services on commercial terms agreed between us, and some of those charges may be calculated per transaction or by reference to the amounts processed. Those charges are separate from the fees you pay us, which are disclosed to you in accordance with clause 8. The Technical Partner may also pay us fees in connection with the integration of our services into the Partner Application. Further information is set out in our Conflicts of Interest Policy.

We do not receive any remuneration, discount or non-monetary benefit in return for routing your orders to any particular trading platform or to any other crypto-asset service provider.

16.7 Cryptocurrency Volatility and Market Risks

By using the Nebeus Platform and transacting in crypto-assets, you acknowledge and accept the risks inherent to crypto-asset markets, including, without limitation:

• High volatility and price fluctuations;

• Rapid changes in market liquidity and depth;

• Risk of partial or total loss of asset value;

• Regulatory uncertainty and potential changes in applicable law.

These risks are disclosed in compliance with Regulation (EU) 2023/1114 (MiCA) and are made available to the User before the use of the relevant service.

Crypto-assets are not backed by any central authority and may not be subject to the same consumer protections as traditional financial instruments. Their value may be affected by speculation, technological changes, hard forks, or decisions of external networks beyond Nebeus’s control.

Furthermore, crypto-assets are not covered by deposit guarantee schemes or investor compensation schemes within the European Economic Area, meaning that in the event of loss, the compensation mechanisms applicable to banking products do not apply.

Nebeus does not offer investment advice, portfolio management, or financial recommendations. You are solely responsible for assessing whether a crypto-asset transaction is appropriate for your financial situation and risk tolerance.

Use of the Nebeus Platform does not guarantee profits or prevent losses. Past performance is not indicative of future results. You should never invest or transact more than you can afford to lose.

By accepting these Terms, you acknowledge having read and understood this risk warning clause and expressly declare that you are not relying on any representation, warranty, or promise made by Nebeus in relation to the profitability of crypto-assets or market performance.

For further information relating to the risks associated with crypto-assets, please refer to the following link.

The Other Services provided by Rintral Capital are not regulated under Regulation (EU) 2023/1114 (MiCA). Accordingly, the protections afforded under MiCA in respect of the Regulated Crypto-Asset Services do not apply to the Other Services.

17. Disclaimer of Warranties, Limitation of Liability, Indemnification and Force Majeure

17.1 To the maximum extent permitted by applicable law, Nebeus disclaims all liability for direct, indirect, incidental, special, punitive, or consequential damages, including, without limitation, loss of profits, revenue, data, business opportunities, reputation, or anticipated savings, arising from or related to:

• Use of, or inability to use, the Nebeus Platform;

• Delays or performance failures not directly attributable to Nebeus;

• Errors, omissions, or misrepresentations made by Users or third parties;

• Unforeseen technical failures, software malfunctions, or service interruptions beyond Nebeus’s reasonable control;

• Transactions carried out on the basis of incorrect information provided by the User, including, without limitation, incorrect wallet addresses or beneficiary details.

17.2 Nebeus provides the Nebeus Platform and its services “as is” and “as available”, without warranties of any kind, whether express, implied, statutory, or otherwise, including, without limitation, warranties of merchantability, fitness for a particular purpose, or non-infringement, and without prejudice to the non-waivable rights available to consumers under applicable law.

17.3 Nothing in these Terms limits Nebeus’s liability for wilful misconduct or gross negligence, for the loss of crypto-assets held in custody in accordance with clause 12.10, or where such limitation is not permitted by applicable law. The limitation of liability applicable to Business Clients is set out in Annex 2.

17.4 Nebeus likewise does not guarantee the suitability, profitability, or outcome of any operation carried out through the Nebeus Platform, in particular those relating to risk products, volatile crypto-assets, or unregulated markets.

17.5 This limitation of liability will apply only to the extent it does not conflict with consumer protection regulation, including the Consolidated Text of the General Law for the Defence of Consumers and Users. The User acknowledges that use of the Nebeus Platform entails acceptance of the risks inherent to crypto-assets, in accordance with the general risk warning published by the CNMV and the Banco de España.

17.6 Nothing in these Terms shall operate to exclude or limit liability where such exclusion or limitation is prohibited by applicable law.

17.7 Where you access our services through a Partner Application, our responsibility to you is as follows. We are responsible for the crypto-asset services we provide to you, and that responsibility is not reduced by our having outsourced any operational or technical function to the Technical Partner: an outsourcing transfers neither our regulatory obligations nor our responsibility to you. We are not responsible for the Technical Partner’s own products and services, which it provides to you under its own terms, nor for the availability of the Partner Application itself.

17.8 Indemnification

You agree to defend, indemnify, and hold harmless Nebeus, its affiliates, directors, employees, agents, and service providers from and against any claim, damage, loss, liability, cost, or expense (including reasonable legal fees) arising from or related to:

• Breach of these Terms or applicable law;

• Misuse of the Nebeus Platform;

• Negligent use of the Nebeus Platform or failure to meet your duty of care obligations;

• Infringement of third-party rights, including intellectual property or privacy rights;

• Any activity carried out through your account, whether by you or by third parties acting on your behalf.

This indemnification obligation shall survive the termination of your account or your relationship with Nebeus.

This obligation applies to the extent permitted by Regulation (EU) 2023/1114 (MiCA), Regulation (EU) 2016/679 (GDPR), and other applicable Spanish and European regulation.

17.9 Force Majeure

Nebeus shall not be liable for any failure or delay in the performance of its obligations under these Terms where such failure is caused by circumstances beyond its reasonable control, including but not limited to:

• Natural disasters, pandemics, or public health emergencies;

• War, terrorism, civil unrest, or political instability;

• Acts or omissions of governmental or regulatory authorities;

• Failures in telecommunications networks, blockchain systems, banking infrastructure, or public utilities;

• Strikes, labour disputes, or shortages of qualified personnel or materials;

• Cyberattacks, system failures, or force majeure events affecting external service providers.

In such cases, Nebeus will take reasonable steps to mitigate the impact and resume the service as soon as possible. If the event persists for more than thirty (30) consecutive days, it may suspend or terminate the affected service without liability, without prejudice to the return of your crypto-assets and funds. Incidents affecting Nebeus’s systems or those of its ICT service providers that could reasonably have been prevented through Nebeus’s ICT risk management framework shall not be considered force majeure.

Such events do not release the User from their pending obligations, including the payment of fees or completion of verifications.

18.1 General Tax Obligations

You are solely responsible for determining, declaring, and meeting any tax obligation arising from use of the Nebeus Platform, including but not limited to income tax, capital gains tax, VAT, or other applicable taxes depending on your country of residence or other relevant jurisdictions.

Nebeus does not provide tax advice and assumes no liability in respect of your individual tax obligations. We recommend consulting a qualified tax adviser to assess your obligations arising from digital asset transactions, loan interest, renting programme income, staking rewards, or other financial activities carried out through the Nebeus Platform.

Where the law requires Nebeus to withhold or report tax information (e.g. under Spanish, European, or international standards such as the Common Reporting Standard (CRS) or DAC8), you undertake to provide all necessary information and documentation. This includes, without limitation, your tax identification number (NIF), certificates of residence, or beneficial ownership declarations.

Where required by law, Nebeus may:

1. withhold taxes on payments or interest generated under specific programmes (such as renting or lending);

1. report your activity to the tax authorities;

issue annual tax withholding certificates.

Failure to comply with these obligations or to cooperate may result in service restrictions, account suspension, or notification to the authorities.

These obligations are interpreted in accordance with the European framework for automatic exchange of tax information established by Council Directive (EU) 2023/2226 (DAC8) and the Common Reporting Standard (CRS).

Rintral Trading is a reporting crypto-asset service provider for the purposes of Council Directive (EU) 2023/2226 (“DAC8”) and the OECD Crypto-Asset Reporting Framework. Rintral Trading is required to obtain from you a valid self-certification of your tax residence and tax identification number, to check it against the other information it holds about you, and to report your reportable crypto-asset transactions to the competent tax authority, which exchanges that information with the tax authority of each Member State in which you are resident.

You must provide the self-certification requested, and must tell us promptly of any change in your circumstances that makes it incorrect or unreliable. If you do not provide a valid self-certification, we will remind you, and if we have not received it after two reminders and more than 60 days have passed since our first request, we are required to prevent you from carrying out any transaction until we receive it.

18.2 Withholding under Specific Programmes

Certain income generated through the Nebeus Platform is subject to tax withholding in Spain under Law 26/2014 (amending Law 35/2006 on Personal Income Tax). A withholding rate of 19% may apply to gross income generated. Nebeus will deduct and remit this tax to the Tax Agency (Agencia Tributaria) in accordance with current regulation.

A Tax Withholding Certificate, valid for submission to the Agencia Tributaria (AEAT), will be issued upon request. To obtain one, please contact info@nebeus.com with your account details and relevant information. The standard processing time is five (5) to seven (7) Business Days.

In all other cases where no withholding is applied, Nebeus will make available to Users an Annual Income Report, setting out the amounts generated through the Nebeus Platform during the relevant tax year, for informational and voluntary filing purposes only.

This withholding and reporting framework does not exempt the User from their general tax obligations; the User remains in all cases responsible for complying with any additional declaration or filing requirements in their jurisdiction.

Nebeus assumes no liability for tax obligations arising in jurisdictions other than Spain. The User is fully responsible for reporting and complying with such obligations in their country of residence or where they have a tax obligation. Any document issued by Nebeus is provided solely for informational purposes and at the User’s responsibility.

19.1 Assignment and Entire Agreement

These Terms, together with all policies, Specific Terms, notices, and disclosures incorporated herein by reference, constitute the entire agreement between you and each Nebeus Company in relation to access to and use of the Nebeus Platform. They supersede and replace any prior agreement, representation, or understanding (oral, written, or implied) on the same subject matter.

You acknowledge that no information or advice obtained from Nebeus or through the Nebeus Platform shall give rise to warranties or representations not expressly contained in these Terms. No party shall be bound by statements not formally incorporated herein.

Nebeus may assign or transfer its rights and obligations under these Terms to any affiliate, legal successor, or partner involved in the provision of regulated services, including white-label arrangements. Such assignments may be made with prior notice to you, provided they do not prejudice your legal rights under applicable law.

You may not assign or transfer your rights or obligations without the prior written approval of Nebeus. Any attempt to do so shall be void.

The version of these Terms published on the Nebeus Platform is deemed to be the most current and legally binding. Clause 15.3 applies to the language versions of these Terms.

Electronic communications, records, and consents associated with use of the Nebeus Platform shall not be denied legal effect solely on the grounds that they are in electronic form, in accordance with Regulation (EU) No 910/2014 (eIDAS).

In the event of conflict between these Terms and applicable regulation, the mandatory provisions of Regulation (EU) 2023/1114 (MiCA) and other applicable rules for crypto-asset service providers in Spain shall prevail.

Nothing in these Terms limits Nebeus’s right to comply with its legal or regulatory obligations under Spanish law, MiCA, or other applicable regulatory frameworks.

19.2 Severability

If any provision of these Terms is found to be invalid or unenforceable under applicable law, that provision will be deemed not to form part of these Terms, without affecting the validity of the remaining provisions.

This provision shall be interpreted in accordance with Articles 1281 et seq. of the Spanish Civil Code, preserving, to the extent possible, the original intention of the parties.

19.3 Waiver

Any failure or delay by Nebeus in exercising any right under these Terms shall not constitute a waiver of that right. No waiver shall be valid unless made in writing.

19.4 Survival

Any provision of these Terms which by its nature should survive the closure of an account or termination of the agreement shall remain in force. This includes, without limitation, provisions on data retention, confidentiality, intellectual property, limitation of liability, and dispute resolution.

19.5 Record of Terms and Contractual Versions

These Terms, together with the Specific Terms or service agreements, are version-controlled and archived for audit and compliance purposes. Nebeus may register these Terms in the Spanish Registry of General Contracting Conditions (Registro de Condiciones Generales de la Contratación) in accordance with Law 7/1998.

Users may request access to previous versions or certified copies for use as evidence in legal disputes.

20. Amendments to the Terms

20.1 Nebeus reserves the right to amend, update, or replace these Terms of Use at any time to reflect changes in applicable law, regulatory guidance, technological developments, service offerings, risk policies, or operational requirements.

20.2 Any material amendment will be communicated in advance by means of a prominent notice on the Nebeus Platform, by email, or through any other appropriate communication channel. Save for changes to fees, which are subject to the notice period set out in clause 8.3, and unless otherwise required by law or regulation, such changes will take effect no sooner than thirty (30) calendar days following their communication, or such longer period as may be required by applicable law. You may terminate these Terms or the affected service free of charge before the amendment takes effect.

20.3 Notwithstanding clauses 20.2 and 20.4, where an amendment to these Terms or a modification of any service is made solely in order to comply with a change in applicable law or regulation, or with a requirement of a competent authority, Nebeus may give a shorter period of notice than that set out in clause 20.2 or, where immediate implementation is required, may implement it without prior notice. In the latter case, the User will be informed as soon as reasonably practicable after the change takes effect. The User’s right to terminate under clause 20.2 shall remain unaffected.

20.4 Nebeus reserves the right to modify, suspend, or permanently discontinue any specific service, feature, or product at any time, owing to regulatory changes, market conditions, or strategic considerations. Where feasible, affected Users will be notified in advance. Nebeus shall not be liable for inconvenience, lost opportunities, or claims arising from the discontinuation of a service, provided the decision is taken in good faith and in accordance with applicable law.

20.5 Where you accepted a previous version of these Terms, that version shall continue to govern your relationship with Nebeus until these Terms take effect in respect of you in accordance with clauses 20.2 and 20.3. Transactions and operations executed before that date shall remain governed by the version of the Terms in force at the time of their execution.

21. Complaints, Dispute Resolution and Governing Law

21.1 Nebeus is committed to providing high standards of customer service. If you are dissatisfied with any aspect of the services provided, you may submit a formal complaint by contacting us at info@nebeus.com or by raising a support ticket on the Nebeus Platform, selecting “Product: Nebeus Account” and “Request Type: Complaint”.

21.2 To facilitate a prompt resolution, please ensure your complaint includes:

1. your full legal name and valid contact details;

1. your Nebeus account identifier;

1. a clear description of the issue and relevant dates;

1. any supporting evidence (e.g. receipts, screenshots);

the resolution sought.

21.3 Nebeus will acknowledge receipt of your complaint without undue delay and will communicate its decision to you as soon as possible and in any event within two (2) months of the date on which the complaint was received. Where a complaint is submitted through a Partner Application, it is treated as received by Nebeus on the date you submit it there. Complaints may be filed free of charge, and in any of the languages in which the service was marketed to you or in which we have communicated with you, as well as in the official languages of Spain.

21.4 In exceptional cases, where the matter is complex or additional information is required, the resolution period may be extended within the maximum period permitted by applicable law. In such cases, the customer will be informed in writing of the reasons for the delay and the estimated timeframe for resolution.

21.5 Complaints are handled by the Customer Support and Service team in accordance with our Internal Complaints Resolution Policy and applicable law. In escalated cases, the Chief Legal Officer (CLO) may intervene directly.

21.6 All complaint-related data will be retained securely for three (3) years, or longer if required by law or a regulatory investigation. After this period, the data will be securely deleted or anonymised.

21.7 Nebeus undertakes to handle all complaints impartially and in good faith, providing clear information on the status and outcome of each case.

21.8 If you are not satisfied with Nebeus’s response, you may refer the matter to the competent supervisory authority or alternative dispute resolution body, where applicable, or to the competent courts in accordance with clause 21.10.

21.9 Support and Complaints Where You Use a Partner Application

Day-to-day support (questions about how the Partner Application works, and help using it) is provided by the Technical Partner through the support channels it offers you.

Anything concerning the services Nebeus provides to you is handled by Nebeus. That includes your Nebeus account and balances, a transaction or conversion, a fee charged by Nebeus, your onboarding, a restriction on your account, and any complaint.

You may raise any such matter, and may make a complaint, either through the Partner Application or directly with Nebeus at info@nebeus.com, whichever you prefer. You are never required to go through the Technical Partner to reach us. The Technical Partner passes complaints to Nebeus and does not decide them.

Nebeus’s complaints-handling procedure and complaint form are available on the Nebeus website and within the Partner Application. Complaints are handled free of charge and are subject to the time limits set out in this clause 21.

21.10 Governing Law and Jurisdiction

These Terms shall be governed by and construed in accordance with the laws of the Kingdom of Spain, without regard to its conflict of laws principles. Unless a consumer protection law provides otherwise, any dispute, claim, or controversy arising from or related to these Terms, the Nebeus Platform, or the services provided shall be submitted to the exclusive jurisdiction of the Courts of Barcelona, Spain. The jurisdiction applicable to Business Clients is set out in Annex 2.

Nothing in this clause shall prevent Nebeus from seeking interim or provisional measures in any jurisdiction where necessary to protect its rights or prevent irreparable harm.

22. Promotional Programmes and Campaigns

22.1 Nebeus may offer optional promotional initiatives, such as referral programmes, loyalty schemes, or special campaigns. Participation in such programmes will be entirely voluntary and subject to their own terms and conditions, which will be made available to the User in advance.

22.2 Acceptance of these specific terms is a prerequisite for benefiting from the promotions. Nebeus reserves the right to modify or cancel such initiatives without prior notice where there are legal, technical, or business reasons justifying such action. Any such modification or cancellation shall not affect benefits already earned.

Annex 1: Definitions

In these Terms, the following capitalised terms have the meanings set out below:

Annex 2: Specific Provisions for Business Clients

A2.1 This Annex 2 applies only to Business Clients and supplements the remaining provisions of these Terms. In the event of conflict between this Annex 2 and the remaining provisions of these Terms, this Annex 2 shall prevail in respect of Business Clients.

A2.2 Save in cases of gross negligence or wilful misconduct, and without prejudice to Nebeus’s liability for the loss of crypto-assets held in custody under clause 12.10, Nebeus’s total aggregate liability towards a Business Client for claims arising under these Terms shall not exceed the lesser of the following amounts:

• The amount of fees paid by the User to Nebeus in the twelve (12) months preceding the event giving rise to the claim; or

• One thousand euros (€1,000).

A2.3 Any dispute between Nebeus and a Business Client arising from or related to these Terms, the Nebeus Platform, or the services provided shall be submitted to the exclusive jurisdiction of the Courts of Barcelona, Spain.

A2.4 If any provision of these Terms is found to be invalid or unenforceable in respect of a Business Client, that provision will be modified to the minimum extent necessary to make it enforceable or, if that is not possible, will be removed without affecting the validity of the remaining provisions.

A2.5 Clauses 5.6, 6.7 and 7.8 apply to Business Clients. The right of withdrawal provided for in clause 3.12 does not apply to Business Clients.