Privacy policy
Last updated: May 2026
1. Scope
This privacy policy describes how RWA Compliance processes personal data when you use our tokenized asset compliance platform. It applies to the web application, BFF layer, and linked compliance API services operated under applicable EU and international data-protection law.
2. Data we process
We may process account identifiers (email, role), optional wallet addresses, MFA verification data, KYC/AML document references (hashes and metadata — not raw document files unless explicitly uploaded to your configured provider), session cookies, audit logs, and operational telemetry required to deliver regulated onboarding and lifecycle services.
3. Off-chain PII and on-chain proofs
Personal data and source documents remain off-chain by design. Only cryptographic document hashes and identity-registry eligibility state are synchronized to the blockchain, in line with GDPR data-minimization and security-token industry practice.
4. Cookies, analytics & lawful basis
Strictly necessary session cookies support authentication and security. Optional analytics load only when configured by the operator. Processing is based on contract performance, legitimate interest in platform security, and — where required — consent for non-essential cookies.
5. Retention, security & subprocessors
Data is retained according to your organization's compliance policy and regulatory obligations. We apply access controls, encryption in transit, rate limiting, and immutable audit events. KYC, oracle, and custody integrations may involve vetted subprocessors under appropriate data-processing agreements.
6. Your rights
Depending on jurisdiction, you may request access, rectification, erasure, restriction, portability, or object to processing. Contact your data controller or platform operator to exercise GDPR or equivalent rights.