WORLDCOIN

DATA CONSENT FORM v2.2

Consent to Process Personal and Sensitive Data for Transfer to Another Country

By agreeing to this Data Consent Form, you allow us to collect images of your iris and other Sensitive Data through the Orb and
transfer the Sensitive Data to our facilities in Germany and other countries for the purposes such as training of our neural network
for the recognition of human irises, as further described below. You also agree that the neural network is not error-free.

IMPORTANT: PROVIDING YOUR CONSENT AND PARTICIPATING IN THE WORLDCOIN PROJECT DESCRIBED BELOW IS
COMPLETELY VOLUNTARY, AND YOU ARE UNDER NO OBLIGATION TO GIVE US YOUR CONSENT. HOWEVER, IF YOU DO NOT GIVE
US YOUR CONSENT, YOUR ABILITY TO PARTICIPATE IN THE WORLDCOIN PROJECT AT THIS TIME MAY BE LIMITED. YOU MAY
CHANGE YOUR MIND AND WITHDRAW YOUR CONSENT AT ANY TIME.

Tools for Humanity Corporation, a Delaware corporation located at 548 Market St, PMB #49951, San Francisco, CA 94104 in the United
States and its wholly-owned subsidiary Tools For Humanity GmbH, located at Allee am Röthelheimpark 41, 91052 Erlangen, Germany
(collectively, “Worldcoin”, “we”, “our”, or “us”) would like your consent to: (a) collect and process certain personal information from you
(your “Data”), and (b) to transfer your Data from the country where you live to another country, solely for the purposes described in this
consent form (“Consent Form”).

Your consent and our use of your Data is also subject to the terms of our Privacy Statement, available at getworldcoin.com/Privacy.
The Privacy Statement generally describes the Data we collect, how we process your Data, what we use the Data for, how we store your
Data, with whom we share your Data, and your rights under applicable privacy laws (“Privacy Laws”). This Consent Form concerns
specific types of Data that by their nature are considered more sensitive than other Data (“Sensitive Data”; described in more details in
Section 4 below). To comply with certain Privacy Laws, we are required to obtain your formal written consent before we collect and
process any Sensitive Data from you, or transfer your Sensitive Data from one country to another country.

1. THE WORLDCOIN PROJECT

We are developing a software algorithm (the “Algorithm”) that can distinguish minute differences among human irises using a special
device called an Orb. The Orb is capable of taking extremely detailed images of a participant’s face and eyes, including the iris, sclera,
eyelashes and other parts of the eye. We would like to train the Algorithm to get better at recognizing the differences between
participants’ irises, and therefore we need to collect and process as many images of irises as we can. We need to differentiate among
participants’ irises because we are trying to develop a global software protocol and cryptocurrency using blockchain technology, called
Worldcoin, that will permit every person on the planet to receive a fair share of Worldcoin tokens. The Algorithm is an automated
decision-making process and we plan to use the Algorithm and the Orbs to prevent anyone from claiming more than their fair share of
Worldcoin. The Algorithm is necessary to ensure that people aren’t claiming more than their fair share. We use images of the iris
because the iris is even more provably unique than the human face or fingerprints.

If you give us your consent to collect your Sensitive Data by photographing your iris, your face, and your body using the Orb, we will
transfer your Sensitive Data to our teams in in the United States, India, Japan, the United Kingdom, and Germany because: (a) our
research and development facilities are located in those countries, and (b) we are unable to operate the software we use to process
your Sensitive Data where you live. As a result, we may transfer to, and store your Sensitive Data in part in the United States or
elsewhere, where Privacy Laws may be less protective of your Data than the Privacy Laws in the European Union (the General Data
Protection Regulation or “GDPR”), and which such Privacy Laws may also be less protective than the Privacy Laws where you live.
Furthermore, like all software, the Algorithm is not error free and may make an incorrect decision, such as determining that you have
already claimed your Worldcoins when you haven’t. By agreeing to this Data Consent Form, you also agree that your only recourse is to
stop the sign-up process if you disagree with the Algorithm’s decision.
 2. RISKS OF TRANSFER

Below is a list of possible risks that may arise if we transfer your Sensitive Data to the United States, the European Union, or another
country (Please note that this list contains examples, but may not include all possible risks to you):

Because we are located in the United States, we are not directly subject to the jurisdiction of the Data Privacy Laws of the
European Union or any other jurisdiction, including your country. If you are a resident of the European Union and you share your
Data with us, we are required to comply with the GDPR, but it may be more difficult to assert your privacy rights in court in the
United States if we do not comply.

Further, if we share your Data with any third parties outside your country with or without your permission, that third party may
not be subject to the GDPR or the Data Privacy Laws of your country, and if the third party decides to use or share your Data for
purposes not described in this Consent Form or in our Privacy Statement against your will, it might be difficult or even
impossible to assert your privacy rights against that third party.

It is possible that your rights under the GDPR or the Privacy Laws in your country are in conflict with the Privacy Laws in the
United States, and courts in the United States may interpret your rights differently from courts in the European Union or in your
country.

Naturally, we will do everything possible to ensure that these risks do not materialize, and you should know that we voluntarily comply
with the GDPR as a matter of policy. We fully support your right to understand your rights and risks under this Consent Form and the
GDPR and you should feel free to ask us any questions you may have before you sign. If you sign this Consent Form, we will be
contractually required to use your Sensitive Data exclusively for the Worldcoin Project in the manner described above, but the terms of
this contract may not be sufficient to fully protect your rights.

3. NO FINDING OF ADEQUACY OF UNITED STATES PRIVACY LAWS

The European Union Commission responsible for making determinations of the adequacy of the Privacy Laws of other jurisdictions in
comparison to the GDPR has not yet positively established that the country-specific level of personal data protection in the United
States, where part of your Data is processed, provides the same level of protection as the Privacy Laws in the European Union.

In addition, we have not adopted a board-approved data privacy and security policy describing the means and the methods by which we
plan to protect your Data to meet the standards prevalent in the GDPR, nor have we submitted our Privacy Statement or any of our
internal policies and procedures to any regulatory authority to determine whether they meet GDPR standards of protection. Therefore,
there is a possibility that our policies and procedures will not be sufficient to meet GDPR requirements.

4. CONSENT

In order to carry out the objectives of the Worldcoin Project, we are asking for your consent to process (collect, store and use) your
Sensitive Data and to transfer it to our teams in the United States, India, Japan, the United Kingdom, and Germany, including employees
and contractors of Worldcoin.

We will collect the following Sensitive Data:

High-definition video and photographs of your body, face, and eyes, including your irises (visible and infrared)

Contactless doppler radar detection of your heartbeat, breathing, and other vital signs; and

Three-dimensional mapping of your body and face.

Please note that the image of your iris may fall under “Special Categories of Personal Data” under the GDPR and may be considered
“Sensitive Data” in certain other jurisdictions, and is therefore afforded special protections under the Law.
First, the Algorithm analyzes the raw images of your iris to create a digital file containing a purely numeric representation of the unique
characteristics of your iris. Second, the Algorithm uses cryptographic hashing techniques to encrypt the file into a secure code (the “iris
code”). Once generated by the Algorithm, your iris code cannot be reversed to expose the precise characteristics of your iris to any
computer system or to anyone else. Third, the Algorithm compares your iris code to the iris codes in the Worldcoin database to
determine whether we have already scanned your iris. If your iris code matches another iris code in the Worldcoin database, then we
can determine that you have already scanned your iris using the Orb. Absent you re-presenting yourself to our Orb, however, we are not
able to use the Worldcoin database to determine whether you have already scanned your irs.

We process the above-mentioned Sensitive Data exclusively for the following purposes:

Calculation of your iris code

Comparison of your iris code with other iris codes

Optimization of the calculation of the iris code

Internal trainings and evaluations

Training and development of our neural network for the recognition of human irises

Training and development of generative models to synthesize artificial iris images

Training and development of our fraud-detection system

You acknowledge that you can revoke your Consent at any time to the responsible entity by contacting us at:

The Worldcoin Request Portal,

[email protected],

Tools For Humanity Corporation, 548 Market Street, PMB 49951, San Francisco, CA 94104 USA, or

Tools for Humanity GmbH, Allee am Röthelheimpark 41, 91052 Erlangen, Germany

Revocation by you of your consent shall not affect our legal basis for the processing and transport of your Sensitive Data carried out by
us on the basis of the consent given by you to us prior to such revocation. Thus, our legal basis for processing your Sensitive Data is
Art. 6 para. 1 sent. 1 lit. a, Art. 7 read in conjunction with Art. 9 para. 2 lit. a, Art. 49 para. 1 sent. 1 lit. a of the GDPR.

By taking the action of checking the box below, I hereby explicitly consent to the processing and transmission of my Sensitive Data to
the Worldcoin teams in the United States, India, Japan, the United Kingdom, and Germany.