This Policy explains how to submit a complaint, how it is routed and investigated, the target response times, possible outcomes, internal review and external rights. It forms part of the Multi-Party Terms of Use and should be read with the provider-specific Schedules, Privacy Notice and Refunds and Failed Transactions Policy.

1. Purpose and scope

1.1 This Policy applies to complaints about the Plumex Platform, the Custody Service provided by Capitalista S.A., the Exchange and Fiat Services provided by Innovate Payments Inc. (“IPI”), and the technical verification and routing experience supported by LMLP consulting s.r.o.

1.2 A complaint is an expression of dissatisfaction about a service, decision, delay, error, fee, restriction, communication, conduct or outcome where you request an explanation, correction, remedy or review.

1.3 A request for information, routine support question, transaction-status enquiry, privacy-right request, urgent fraud report or security incident may be handled under a specialist process. If it also expresses dissatisfaction, it will be recorded and handled as a complaint.

1.4 This Policy does not limit mandatory consumer, payment, privacy, court, law-enforcement or regulatory rights. You do not have to delay an urgent report to your bank, payment provider, police or another competent authority while a complaint is being considered.

1.5 Submitting a complaint is free of charge and will not, by itself, result in adverse treatment or loss of service.

2. How to submit a complaint

2.1 The preferred channel is complaints@plumex.io. You may also use the in-app support function where available or send written correspondence to the registered office of the provider responsible for the service.

2.2 Use the subject line “Complaint” and, where known, identify the relevant service: Platform, Custody, Exchange, Fiat, Verification, Privacy, Security or another category.

2.3 Complaints may be submitted in English or Ukrainian. Reasonable accessibility assistance will be provided where practicable.

2.4 You may complain personally or through an authorised representative. A provider may request evidence of identity and authority before disclosing confidential information or accepting instructions.

2.5 Anonymous information may be reviewed for risk or control purposes, but a substantive response or remedy may be impossible without sufficient information to identify the account, service or transaction.

2.6 Do not send passwords, private keys, seed phrases, one-time codes, full payment-card security data or other authentication secrets. Identity documents should be provided only through an approved secure channel when requested.

3. Urgent fraud, security and payment issues

3.1 If you suspect account takeover, phishing, an unauthorised payment, compromised credentials or an active scam, contact support@plumex.io without undue delay and use the subject “URGENT SECURITY”. Where applicable, also contact your bank, card issuer, wallet provider or payment provider immediately.

3.2 An urgent report is triaged separately from the ordinary complaint queue. A complaint may be opened in parallel to investigate responsibility, loss, remediation and service quality.

3.3 Submitting a complaint does not automatically stop a blockchain transaction, payment, legal hold, sanctions control, security restriction or compliance review. The responsible provider will take available and lawful protective steps where appropriate.

4. Provider and issue routing

4.1 Plumex support provides a single entry point and may route the complaint and relevant evidence to the responsible provider. Routing does not transfer legal responsibility from the provider that supplied the affected service.

4.2 If the complaint was sent to the wrong entity, it will be forwarded internally where lawful and practicable. You will not be required to restart the complaint solely because of an initial routing error.

4.3 Where more than one provider is involved, a lead provider may coordinate communications and issue a consolidated response. The response will identify which provider made each material finding or offers each remedy.

5. Information to include

• Your full name and the email address or identifier linked to the account.

• The relevant provider, service and App screen, where known.

• The transaction, order, custody or support reference; date; amount; asset or currency; network; bank reference; wallet address or transaction hash, where relevant.

• A clear description of what happened, when you became aware of it and why you are dissatisfied.

• The outcome you request, such as an explanation, correction, transaction trace, fee review, refund, account correction or another remedy.

• Relevant documents, screenshots or correspondence, with authentication secrets and unnecessary personal data removed.

5.1 The complaint will be assessed on the information reasonably available. If requested information is not provided, the provider may issue a response based on the existing record or explain why the matter cannot be determined.

6. Complaint handling process and target times

6.1 Time starts when the complaint is received through an available channel. Missing information does not erase the original receipt date, but may prevent or delay a complete determination.

6.2 A provider may need information from a bank, payment provider, blockchain analytics provider, technology provider, law-enforcement body or another third party. This may extend the investigation, but an interim update will be provided by the target date.

6.3 Where mandatory law prescribes a shorter or otherwise different period, that period applies.

7. Investigation standards

7.1 Complaints are handled fairly, objectively, consistently, confidentially and proportionately. Relevant evidence is considered whether it supports the user or the provider.

7.2 The investigator will identify the applicable provider, contract, transaction, records and law; determine the facts; assess whether service standards, Terms, policies and legal duties were met; and consider an appropriate remedy.

7.3 A person with a material conflict of interest should not make the final decision. Where practicable, a complaint involving an employee or prior decision is reviewed by another person with suitable authority.

7.4 Automated risk or transaction outputs may be considered, but a complaint concerning a material restriction or outcome will receive human review where required by law, provider policy or the nature of the issue.

7.5 The provider may combine complaints arising from the same event or issue, but each complainant’s personal data, circumstances and requested remedy remain separately considered.

8. Final response

8.1 The final response will ordinarily identify the complaint, material facts, provider responsible, findings, reasons, whether the complaint is upheld in full or part, the remedy or corrective action, and available internal or external escalation.

8.2 Information may be withheld or summarised where disclosure would breach law, sanctions, anti-money-laundering restrictions, security, confidentiality, legal privilege, another person’s rights or an investigation obligation.

8.3 If the provider cannot verify an allegation, the response will explain the evidence considered and why the requested remedy cannot be granted, to the extent lawful.

8.4 A final response may be delivered by email, a downloadable in-app message or another durable electronic method. Keep a copy for your records.

9. Outcomes and remedies

9.1 Depending on the facts and law, a remedy may include an explanation, correction of records, restoration of access, transaction trace, reprocessing, release of an incorrectly applied restriction, fee refund, transaction refund, return of recoverable assets or funds, replacement confirmation, apology, compensation required by law, or a control or process improvement.

9.2 A refund or compensation is not automatic. It depends on responsibility, causation, applicable law, the relevant Schedule, transaction finality and the recoverability of funds or assets.

9.3 A provider will not require you to waive mandatory rights as a condition of receiving an amount that is already undisputedly due. A separate settlement may require written acceptance where lawful.

9.4 A remedy offered by one provider does not admit liability of another provider or create a guarantee of future service.

10. Internal reconsideration

10.1 If you disagree with a final response, you may request internal reconsideration within 30 calendar days, or later where you provide a reasonable explanation for delay.

10.2 State the parts you challenge, the reason and any new material evidence. Repeating the original complaint without identifying an error or new information may not require a full reinvestigation.

10.3 Reconsideration does not automatically suspend a legal hold, payment recall, blockchain finality, compliance restriction or deadline for exercising an external statutory right.

10.4 Where practicable, reconsideration is performed by a suitably authorised person who was not primarily responsible for the original final response.

11. Service-specific considerations

11.1 Custody and blockchain complaints. A transaction hash, wallet address, network, asset and time are usually necessary. Confirmed blockchain transactions may be irreversible. Recovery of assets sent to an unsupported address, asset, network or tag may be impossible or subject to a disclosed recovery fee.

11.2 Exchange complaints. A displayed quote or submitted order is not necessarily accepted. The accepted confirmation and reliable execution records are used to determine the rate, spread, fee, amount and settlement terms.

11.3 Fiat and payment complaints. IPI may need evidence from PSP (TBD), another payment provider, a correspondent bank, the payer or recipient bank. Payment recalls, chargebacks and returns remain subject to payment-system and legal rules.

11.4 Verification and compliance complaints. A provider may review whether accurate information and applicable policy were used, but may be prohibited from disclosing suspicious-activity reporting, confidential risk indicators, law-enforcement requests or sanctions intelligence.

11.5 Privacy complaints. A complaint about personal data is handled by the relevant controller under the Privacy Notice and applicable data-protection law. Statutory response periods and authority rights apply independently of this Policy.

11.6 Service outage complaints. The investigation will consider incident records, provider dependencies, communications, asset or payment impact and whether reasonable continuity and remediation steps were taken.

12. External rights and escalation

12.1 You may use any competent court, consumer-protection authority, data-protection authority, payment or financial authority, police, law-enforcement body or other mechanism available under applicable law. The competent body depends on your location, the provider, service and issue.

12.2 For a complaint connected with Ukraine, you may contact the competent Ukrainian consumer-protection authority or court where the matter falls within its jurisdiction. Use of this Policy does not remove mandatory Ukrainian consumer rights.

12.3 For an IPI payment-service issue, the Bank of Canada supervises compliance with the Retail Payment Activities Act, including operational risk and safeguarding requirements, but does not act as an ombudsman for individual contractual, fee or compensation disputes. FINTRAC supervises anti-money-laundering compliance and registration and cannot recover funds or resolve an ordinary consumer dispute.

12.4 For a Capitalista consumer-service issue, you may contact the competent Panamanian consumer authority, including the Autoridad de Protección al Consumidor y Defensa de la Competencia (ACODECO), or a competent court where the matter falls within its jurisdiction.

12.5 For privacy matters, you may contact the authority identified in the Privacy Notice. For suspected crime or urgent fraud, contact the competent police or law-enforcement authority and, where relevant, your bank or payment provider.

12.6 External authorities may have jurisdiction limits and may not be able to reverse a blockchain transaction, recover funds or decide a dispute governed by another provider’s contract.

13. Communications, accessibility and representatives

13.1 Communications will be clear, respectful and provided in English or Ukrainian where reasonably available. A translation may be used for other languages, but the official English and Ukrainian documents govern as stated below.

13.2 Tell us if you require a reasonable communication adjustment because of disability, vulnerability or another accessibility need. We will consider a proportionate alternative channel or format.

13.3 A representative must provide sufficient authority. The provider may communicate directly with the user where necessary to verify identity, protect the account or comply with law.

13.4 Keep your contact details current. A provider is not responsible for delay caused solely by an incorrect or inaccessible address that you failed to update.

14. Records, confidentiality and personal data

14.1 Complaint records may include communications, identity and authority checks, account and transaction data, bank and blockchain references, system logs, investigation notes, decisions and remedies.

14.2 Information is shared among Plum Labs, Capitalista, IPI, LMLP and supporting providers only to the extent reasonably necessary to route, investigate, decide, remediate, audit or comply with legal obligations, subject to their respective data roles and the Privacy Notice.

14.3 Records are retained for as long as reasonably necessary and required by applicable law, including for transaction, anti-money-laundering, payment, tax, accounting, fraud, security, audit, litigation and regulatory purposes. Related records may be retained after account closure.

14.4 Complaint information is confidential but may be disclosed where required by law, court, regulator, payment provider, insurer, auditor, professional adviser or for the establishment, exercise or defence of legal claims.

15. Provider changes and legacy complaints

15.1 A provider change does not automatically transfer an existing complaint or liability. A migration notice will identify who handles open and historical complaints, records and remedies.

15.2 A complaint concerning conduct before a provider change is ordinarily handled by the provider responsible when the conduct occurred, unless a lawful transfer or assumption of responsibility states otherwise.

15.3 Plumex support may continue as the communication channel during migration, but no entity becomes a successor or guarantor merely by receiving or routing the complaint.

16. Misuse of the complaint process

16.1 You must not use the process to threaten, harass, extort, submit knowingly false evidence, disclose another person’s confidential information without authority or interfere with a lawful investigation.

16.2 A provider may limit repetitive, abusive or manifestly unfounded communications after giving a reasonable warning, while preserving the substance of a genuine complaint and mandatory rights.

16.3 Good-faith complaints, criticism or regulatory reports will not be treated as misuse merely because the provider disagrees with them.

17. Document hierarchy, changes and language

17.1 Mandatory applicable law prevails over this Policy. The Multi-Party Terms of Use and the provider-specific Schedule govern contractual rights and liability for the relevant service. This Policy governs complaint procedure.

17.2 A material change to the complaint channel, provider responsibilities or user rights will be notified through the App, email, website or another durable electronic method. A change does not reduce rights already accrued under mandatory law.

17.3 This Policy is published in English and Ukrainian. For the Ukraine Service Route, the Ukrainian version prevails in the event of inconsistency, unless mandatory law requires otherwise.

18. Contact details

18.1 Current official details for external authorities should be obtained from their official websites before submission. Plumex does not control an external authority’s jurisdiction, process or response time.

19. Definitions

“Business Day” a day other than Saturday, Sunday or a public holiday in the place of the responsible provider’s registered office, unless mandatory law defines it differently.

“Complaint” an expression of dissatisfaction requesting an explanation, correction, remedy or review.

“Final Response” the written communication that concludes the provider’s ordinary investigation and states findings, reasons, remedy and available escalation.

“Lead Provider” the provider designated to coordinate a complaint involving more than one provider, without assuming another provider’s legal obligations.

“Responsible Provider” Plum Labs, Capitalista or IPI according to the service or conduct concerned.

“Durable Electronic Method” email, a downloadable in-app message or another electronic format that allows the recipient to retain and reproduce the information.