Privacy Policy

1.1Toyow Technologies (BVI) Ltd. (hereinafter the "Technology Provider", "we", "us", or "our") is a company incorporated and registered in the British Virgin Islands, whose registered office is at Suite 5, Oleander Building, Port Purcell, British Virgin Islands. The Technology Provider operates the Platform, a technology infrastructure and marketplace that facilitates the listing, discovery, and transactions of Tokenized Assets between Asset Owners and Token Owners.

1.2 For the purposes of this Privacy Policy, the Technology Provider acts as the data controller in respect of personal data collected directly from Users in connection with the operation of the Platform. In certain instances where the Technology Provider processes personal data solely on the instructions of Asset Owners, the Technology Provider may act as a data processor.

1.3This Privacy Policy is incorporated into and forms part of the Platform's Terms of Service ("Terms"/"Terms of Service"). Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Terms.

1.4 This Privacy Policy applies to all Users of the Platform, including Token Owners, whether accessing the Platform via website, mobile application, API, or any other interface. Third-party websites, services, or applications that may be linked to or integrated with the Platform are governed by their own privacy terms. Any embedded or linked third-party content, plug-ins, or applications made available through the Platform are likewise governed by the privacy terms of the relevant third party.

1.5The Technology Provider is committed to protecting the privacy and security of personal data in accordance with the Data Protection Act, 2021 of the British Virgin Islands ("BVI DPA"), any regulations and guidance issued thereunder, and applicable standards and best practices.

1.6Each Asset Owner is a separate legal entity from the Technology Provider. Where an Asset Owner processes personal data in connection with a Tokenized Asset listed on the Platform, that Asset Owner does so independently of the Technology Provider and is separately responsible for its own collection, use, storage, disclosure, and protection of such personal data. An Asset Owner may issue its own privacy notice describing how it processes personal data in connection with its Tokenized Asset, and such notice may apply to you in addition to this Privacy Policy. Where there is an inconsistency between this Privacy Policy and an Asset Owner's privacy notice, in each case relating specifically to personal data processed by that Asset Owner in connection with its Tokenized Asset, the Asset Owner's privacy notice shall prevail to the extent of that inconsistency. This Privacy Policy continues to govern, and is not superseded by any Asset Owner's privacy notice in respect of, personal data that the Technology Provider processes independently in its own capacity as operator of the Platform.

The Technology Provider collects personal data through various means in connection with the operation of the Platform and for providing the services. The categories of personal data collected are set out below. The specific data elements collected may vary depending on the nature of the User, the services requested, and our obligations under applicable law, including but not limited to applicable anti-money laundering and counter-financing of terrorism legislation. We will not collect more personal data than is necessary for the relevant purpose.

3.1Identity and Contact Information

We may collect personal data relating to the identity and contact details of Users as reasonably necessary for the purposes described in this Policy, including for the purposes of onboarding, identity verification, and compliance with applicable legal and regulatory obligations. The personal data collected under this category may include, without limitation, information that identifies or is capable of identifying a User as a natural person or legal entity, information that enables us to contact a User, and information collected in connection with our know-your-customer and know-your-business verification processes, whether conducted by us directly or through our designated third-party service providers.

3.2Corporate and Entity Information

For Users registering or operating as business entities, we may collect personal data and related information concerning the entity itself and the individuals associated with it, as reasonably necessary for onboarding, verification, and our ongoing regulatory compliance obligations. This may include information relating to the entity's legal status, structure, and governance, as well as information concerning those who own, control, direct, or are authorized to act on behalf of the entity. Where such individuals are identified, their personal data may be collected in the same manner as described in Section 3.1 above. The specific data collected will depend on the nature of the entity, its jurisdiction, and our obligations under applicable law.

3.3Financial and Transaction Information

We may collect financial and transaction-related data as reasonably necessary to operate the Platform and facilitate the services provided thereunder. This may include information relating to Users' payment methods and instruments, transactional activity conducted through the Platform, and records associated with the movement of fiat currency, digital assets, or tokenized assets. Where relevant, this may also include data necessary to investigate, process, or resolve disputes or irregularities arising in connection with transactions. The specific data collected will reflect the nature of the services used and applicable legal or operational requirements.

3.4Verification and Compliance Information

We may collect personal data as required to meet our obligations under applicable anti-money laundering, counter-financing of terrorism, sanctions, and other regulatory frameworks. This may include information necessary to assess and verify a User's identity, financial background, and risk profile, as well as records of the outcomes of such assessments. The scope of data collected under this category will be determined by the level of due diligence required in respect of a particular User or transaction and may be enhanced where circumstances warrant additional scrutiny under applicable law.

3.5Device, Technical, and Usage Data

When you access or use the Platform, we may automatically collect technical and usage data generated by your interaction with the Platform. This may include data relating to your device, network connection, and browsing behavior, as well as data generated by the systems and infrastructure that support the delivery of the Platform. This may include your Internet Protocol ("IP") address and the approximate geographic location derived from it, unique device and browser identifiers, and information relating to your visits to and interactions with the Platform's website, including pages viewed and time spent, whether or not you have registered for an Account. Such data is generally collected through automated means and is used for operational, security, and analytical purposes. Further information regarding the use of cookies and similar technologies is set out in Section 11 below.

3.6Communications Data

We may collect and retain records of communications between you and the Technology Provider, however initiated and through whichever channel(s), including communications made for the purpose of obtaining support, submitting feedback, or raising concerns. This may include the content of such communications and associated metadata. Communications data is retained to the extent necessary for operational, legal, and compliance purposes.

3.7Blockchain and On-Chain Data

Where the Platform facilitates interaction with public or permissioned blockchain networks, we may collect and process data generated by or associated with such interactions, including data relating to on-chain activity, smart contract engagement, and digital asset holdings or transfers linked to your Account (as and when applicable).

You acknowledge that transactions recorded on public blockchain networks are inherently transparent and permanently inscribed on a distributed ledger that is not controlled by the Technology Provider. The Technology Provider does not control and cannot alter or delete such on-chain records and accepts no responsibility for the privacy implications arising from the public nature of blockchain infrastructure.

3.8Information from Third Parties

We may receive personal data about you from third parties while operating the Platform and fulfilling our legal and regulatory obligations. Such third parties may include service providers engaged to assist with identity verification, compliance screening, payment processing, blockchain analytics, cybersecurity, and fraud prevention, as well as publicly available sources where lawfully accessible. The categories of data received from third parties will correspond to the purposes for which those third parties are engaged and will be handled in accordance with this Policy. Users represent that the Personal Data provided is accurate and lawfully obtained.

The Technology Provider processes personal data only where a lawful basis for doing so exists under the BVI Data Protection Act, 2021 and any other applicable data protection legislation. The principal legal bases upon which we rely are set out below. Where more than one basis applies to a particular processing activity, we may rely on more than one basis concurrently.

4.1Contractual Necessity

We process personal data where such processing is necessary for establishment, administration, and ongoing operation of the User's relationship with the Technology Provider through the Platform, and the delivery of the services provided thereunder.

4.2Legal Obligation

We process personal data where such processing is necessary for compliance with a legal obligation to which the Technology Provider is subject. This includes obligations arising under applicable anti-money laundering, counter-financing of terrorism, sanctions, tax, and financial regulation frameworks, as well as obligations arising from court orders, regulatory directions, and lawful requests from competent authorities.

4.3Legitimate Interests

We process personal data where necessary for legitimate interests pursued by the Technology Provider or a relevant third party, provided those interests are not overridden by the Data Subject's own interests, rights, or freedoms. These interests include matters such as Platform security, financial crime prevention, legal and operational risk management, and service improvement. Where we rely on this basis, we will have assessed that our interests are proportionate and not outweighed in the circumstances.

4.4Consent

Where required by applicable law, we rely on your explicit consent for certain processing activities, including but not limited to:

1. (a) The processing of Sensitive Personal Data;
2. (b) The use of non-essential cookies and similar tracking technologies (see Section 11 below);
3. (c) Marketing communications, where applicable.

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal. Please note that withdrawal of consent for processing activities necessary to operate the Platform may result in the suspension or termination of your Account.

Personal Data may be processed based on the legal basis for processing referred to in the previous section. The Technology Provider may process personal data as a Data Controller or a Data Processor may do so, for including but not limited to the following purposes:

5.1Platform Operation and Account Management

We process personal data as necessary to operate the Platform, deliver our services, manage User Accounts, and administer the ongoing relationship with Users.

5.2Identity Verification and Compliance

We process personal data to verify User identities, assess eligibility to access the Platform, and meet our obligations under applicable anti-money laundering, counter-terrorism financing, sanctions, and other regulatory frameworks, including ongoing monitoring and record-keeping requirements.

5.3Security and Fraud Prevention

We process personal data to protect the security and integrity of the Platform, detect and respond to threats or unlawful activity, verify information provided by Users, and enforce our Terms and policies.

5.4Customer Support and Communications

We process personal data to communicate with Users, handle enquiries and complaints, issue Platform notifications and updates, and facilitate dispute resolution, including communications required by law or arising from changes to our Terms or this Policy.

5.5Analytics and Platform Improvement

We process personal data, using aggregated or anonymized data where practicable, to understand Platform usage, improve our services, and support relevant research and analysis. This is carried out based on legitimate interests unless consent is required by law. Once personal data has been aggregated or anonymized such that it can no longer be used to identify an individual, it is no longer treated as personal data for the purposes of this Policy.

5.6Legal and Regulatory Compliance

We process personal data to comply with applicable laws and regulations, respond to lawful requests from courts and authorities, and protect and enforce our legal rights, including in connection with internal audit and risk management.

5.7Corporate Transactions

Personal data may be processed in connection with any proposed or actual merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality obligations and applicable law.

5.8Marketing

The Technology Provider may collect, use, store, and otherwise process the Data Subject's Personal Data for the purpose of promoting, marketing, and communicating information relating to the Company's products, services, events, and related offerings ("Marketing Purposes"), in accordance with applicable law.

Such processing, including marketing communication, shall be carried out on the basis of the Data Subject's consent and/or the Company's legitimate interests, where permitted by law.

The Data Subject shall have the right at any time to withdraw consent to the receipt of marketing communications and to object to the processing of Personal Data for Marketing Purposes by providing written notice to the Company or by using the opt-out mechanisms provided in such communications. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

The Technology Provider does not sell personal data to third parties. We may share personal data with the following categories of recipients in the circumstances described below:

6.1Service Providers and Data Processors

6.1.1 We may engage third-party service providers to assist in the operation of the Platform, including:

1. (a) Identity verification and KYC/KYB providers;
2. (b) Digital asset custodians engaged to hold Tokenized Assets or related virtual assets on behalf of Users;
3. (c) Payment processors and financial institutions;
4. (d) Cloud hosting and data storage providers;
5. (e) Blockchain analytics and compliance monitoring providers;
6. (f) Cybersecurity and fraud prevention service providers;
7. (g) Customer support and communication platforms;
8. (h) Legal, accounting, and audit advisors;
9. (i) Other service providers.

6.1.2We may engage third-party service providers ("Data Processors") to process, store, or otherwise handle personal data on our behalf for purposes including, but not limited to, hosting, infrastructure provision, customer support, analytics, security monitoring, and technical operations. These providers operate under independent privacy policies. The Technology Provider is not responsible for their practices.

6.1.3 All service providers are required to process personal data only on our documented instructions and in accordance with applicable data protection law. We take reasonable steps to ensure that such providers maintain appropriate technical and organizational security measures.

6.1.4 To the fullest extent permitted by applicable law, we shall not be liable for any loss, damage, unauthorized access, alteration, disclosure, or destruction of personal data caused by the acts, omissions, or failures of any independent third-party Data Processor, except to the extent that such liability cannot be excluded under applicable law or arises directly from our failure to exercise reasonable care in selecting or instructing such Data Processors.

6.2Regulatory Authorities and Law Enforcement

We may disclose personal data to governmental authorities, regulatory bodies, and law enforcement agencies where required or permitted by applicable law, including:

1. (a) Financial intelligence units and AML/CTF reporting authorities;
2. (b) Tax authorities;
3. (c) Securities regulators;
4. (d) Law enforcement agencies and courts;
5. (e) Any other governmental authority with lawful authority to request such information.

6.3Asset Owners

To the extent strictly necessary to facilitate Transactions on the Platform, we may share relevant User information with Asset Owners. Asset Owners are independently responsible for their own data protection compliance in respect of personal data so received. Each Asset Owner is a separate entity from the Technology Provider and may separately process such information in accordance with its own privacy notice; see Section 1.6 above for how this Privacy Policy interacts with an Asset Owner's privacy notice.

6.4Other Users

Certain information, such as transaction records and Tokenized Asset holdings, may be visible to other Platform Users to the extent necessary to facilitate Transactions, subject always to the blockchain transparency considerations described in Section 10 below.

6.5Professional Advisors

We may share personal data with legal advisors, auditors, and other professional advisors where necessary for the conduct of our business, subject to appropriate duties of confidentiality.

6.6Corporate Transactions

In connection with any merger, acquisition, restructuring, sale of assets, or insolvency proceedings involving the Technology Provider, personal data may be transferred to relevant counterparties and their advisors, subject to appropriate confidentiality obligations. We will notify you of any change of ownership or use of your personal data resulting from such a transaction.

6.7With Your Consent

We may share personal data with other parties where you have provided your express consent to such sharing.

7.1 The Technology Provider is incorporated in the British Virgin Islands and operates a global Platform. In providing the Platform, personal data may be transferred to, stored, or processed in countries or territories outside the British Virgin Islands.

7.2 The Technology Provider uses contractual safeguards and recognized transfer mechanisms to protect data. Users consent to international transfers by using the Platform.

8.1 The Technology Provider retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, having regard to the nature of the data, the purpose for which it is processed, and any applicable legal, regulatory, reporting or contractual obligations requiring its retention.

8.2 Different categories of personal data may be subject to different retention periods depending on the context in which they were collected and the obligations applicable to them. In particular, data processed in connection with identity verification, transaction records, and regulatory compliance may be subject to mandatory minimum retention periods prescribed by applicable law, which will take precedence over any shorter period that might otherwise apply.

8.3 Where personal data is no longer required for any applicable purpose, it will be securely deleted, anonymized, or otherwise disposed of in a manner designed to prevent unauthorized access or reconstruction.

8.4 The Technology Provider periodically reviews the personal data it holds to assess whether continued retention remains justified.

9.1 The Technology Provider implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction. The measures applied will reflect the nature, scope, and sensitivity of the personal data processed, and will be reviewed and updated as necessary to remain appropriate in light of evolving risks and applicable standards.

9.2 Such measures may encompass controls relating to data transmission security, storage security, access management, authentication, security testing and assessment, incident detection and response, personnel training, and the imposition of appropriate security obligations on third-party service providers engaged by the Technology Provider.

9.3 Notwithstanding the foregoing, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. The Technology Provider does not warrant or guarantee the absolute security of personal data and is not liable for security breaches that are beyond its reasonable control.

9.4 In the event of a personal data breach that is likely to result in a risk to the rights of Data Subjects, the Technology Provider will notify the relevant supervisory authority and, where required by applicable law, affected Data Subjects, in accordance with applicable legal requirements.

9.5Users are responsible for maintaining the security of their Account credentials and Digital Wallet private keys (if applicable). The Technology Provider does not have access to any private key and cannot recover lost access to Digital Wallets. Users must notify the Technology Provider immediately upon becoming aware of any unauthorized access to their Account. Where a Tokenized Asset is held via a third-party custodian, the relevant issuer's and/or custodian's own security, safekeeping, and key-management arrangements govern the custody of the relevant assets, and are separate from the Technology Provider's systems and controls described in this Section.

The Platform may facilitate interaction with public blockchain networks, including Base and other supported blockchain networks. Users should be aware of the following privacy considerations specific to blockchain technology:

10.1Inherent Transparency of Blockchain

Public blockchain networks are designed to be transparent and immutable. Transaction data, including Digital Wallet addresses, Tokenized Asset holdings, and on-chain transaction records, may be recorded on publicly accessible distributed ledgers. Such information may be viewed by any person with access to the relevant blockchain and is not within the control of the Technology Provider.

10.2Pseudonymity

While blockchain addresses are pseudonymous rather than directly linked to a User's identity on the blockchain itself, such addresses may be associated with a User's identity through the Account registration and / or KYC/KYB process or any other processes. Accordingly, Users should be aware that their on-chain activity may be traceable to their identity.

10.3Immutability

Blockchain transactions are, by their nature, irreversible and cannot be deleted or amended. The Technology Provider is unable to erase or rectify personal data that may be recorded on a public blockchain. Users' rights in respect of such data are therefore limited by the technical characteristics of blockchain technology.

10.4Third-Party Blockchain Analytics

The Technology Provider may engage third-party blockchain analytics and monitoring service providers to assist with AML/CTF compliance, fraud detection, security monitoring, and to fulfil other business needs. Such providers may have access to on-chain data associated with User Accounts.

10.5Smart Contract Data

Data processed by Smart Contracts deployed on public blockchains may be permanently and publicly recorded. Users are encouraged to review the terms and technical documentation of any Smart Contract before interacting with it.

Users are responsible for avoiding submission of unnecessary Personal Data to blockchain systems. The Technology Provider is not responsible for blockchain privacy risks.

The Technology Provider uses cookies and similar tracking technologies (including pixel tags, web beacons, and local storage) to operate and improve the Platform. This Section describes our use of such technologies.

11.1Essential Cookies

Essential cookies are necessary for the Platform to function and cannot be disabled. They are used to:

1. (a) Authenticate Users and maintain session security;
2. (b) Remember your preferences and settings;
3. (c) Facilitate navigation and core Platform functionality.

11.2Analytics Cookies

With your consent, we use analytics cookies to understand how Users interact with the Platform, including which pages are visited most frequently and how Users navigate the Platform. This information is used to improve Platform design and functionality.

11.3Security Cookies

Security cookies are used to detect and prevent fraudulent activity, bot activity, and other abusive behavior on the Platform.

11.4Your Choices

You may control non-essential cookies through the cookie preferences settings available on the Platform. Please note that disabling certain cookies may affect the functionality of the Platform. You may also manage cookies through your browser settings, although this may not prevent all cookies from being set.

Subject to applicable law, you may have the following rights in respect of your personal data:

12.1Right of Access

You have the right to request confirmation of whether we process personal data about you and, if so, to obtain a copy of such personal data and related information about how it is processed.

12.2Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data about you. We encourage Users to notify us promptly of any changes to their personal data so that our records remain accurate and current.

12.3Right to Erasure

You may have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn your consent (and no other legal basis applies), or where the data has been unlawfully processed. Please note that the right to erasure is subject to important exceptions, including where retention is required by law (including AML/CTF record-keeping obligations) or where the data is necessary for the establishment, exercise, or defense of legal claims. Furthermore, as described in Section 10, personal data recorded on public blockchain networks cannot be erased.

12.4Right to Restriction of Processing

You may have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or object to processing based on legitimate interests, however, please note that such restriction may impact the availability of certain services.

12.5Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. However, please note that such restrictions may impact the availability of certain services. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

12.6Rights related to Automated Decision Making

Automated systems may be used for fraud detection, risk assessment, and compliance screening. Such processing is limited to legitimate operational and regulatory purposes.

Data Subjects have the right to object to, or request not to be subject to, automated decision-making. However, where such processing is necessary for the provision of the Technology Provider's services or for compliance with applicable legal and regulatory obligations, the Technology Provider may be unable to provide certain / all products or services to the Data Subject if they choose to exercise this right.

12.7How to Exercise Your Rights

To exercise any of the above rights, please submit a request via the Platform or by contacting us at [email protected]. We may require verification of your identity before responding to your request. We will endeavor to respond to all requests within a reasonable time. In complex cases or where we receive a high volume of requests, we may extend this period, in which case we will notify you accordingly. Where we are unable to fulfil your request, we will provide reasons for our decision.

12.8Right to Lodge a Complaint

If you believe that the Technology Provider has not complied with its obligations under applicable data protection law, you have the right to lodge a complaint with the relevant data protection supervisory authority. In the British Virgin Islands, data protection matters may be directed to the relevant governmental authority responsible for data protection. We encourage you to contact us in the first instance so that we may endeavor to resolve your concern directly.

The Platform is not intended for and does not knowingly collect personal data from individuals under the age of eighteen (18) years (or the age of legal majority in the relevant jurisdiction, whichever is greater). If we become aware that personal data has been collected from a minor without appropriate parental or guardian consent, we will take reasonable steps to delete such data.

14.1 For all questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us using the details below:

Data Controller: Technology Provider referred to above
Attention: Compliance Team
Email: [email protected]

14.2 Where you are located in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority. We encourage you to contact us in the first instance so that we may address your concern directly.

14.3 We endeavor to respond to all data protection enquiries promptly and in accordance with applicable law.

15.1 The Technology Provider reserves the right to amend or update this Privacy Policy at any time, including reflecting changes in applicable law, regulatory guidance, or our data processing practices.

15.2 Material changes to this Privacy Policy may be notified to you by one or more of the following means:

1. (a) Posting the updated Privacy Policy on the Platform with a revised "Last Updated" date;
2. (b) Sending notice to your registered email address; or
3. (c) Displaying a prominent notification on the Platform.

15.3 Your continued use of the Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Privacy Policy, you must cease using the Platform and may terminate your Account in accordance with the Terms.

15.4 Past versions of this Privacy Policy may be obtained by contacting us using the details set out in Section 14.

16.1 This Privacy Policy is governed by and construed in accordance with the laws of the British Virgin Islands.

16.2 Any disputes arising in connection with this Privacy Policy shall be subject to the dispute resolution provisions set out in the Terms.

BY ACCESSING OR USING THE PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED HEREIN.