Privacy Policy

1. Who We Are

This Privacy Notice explains how Assetize Issuer PCC (a protected cell company incorporated in Jersey, Channel Islands with its registered office at 2nd Floor, The Le Gallais Building, 54 Bath Street, St Helier, Jersey JE1 1FW) ("we", "us" or the "Issuer") collects, uses, shares and protects personal data in connection with the website at https://issuer.assetize.xyz/ (the "Site") and any related issuance, investor on-boarding, ongoing service and corporate-action activities undertaken by the Issuer.

Where the Issuer determines the purposes and means of processing personal data, it acts as a controller. Where the Issuer processes personal data on instruction from a third-party controller (for example, an introducing intermediary or a financial-services provider), it acts as a processor and the controller's privacy notice will additionally apply.

2. Scope of this Privacy Notice

This Privacy Notice applies to your interactions with the Site and to personal data that we collect about you in connection with that interaction. It supplements (and does not replace) any product-specific privacy notice that may be issued in connection with a specific token, cell, portfolio or offering, and any privacy notice issued by Cavenwell Group entities providing services to the Issuer (including Cavenwell (Jersey) Limited and Cavenwell Group's administration, compliance and AML functions) (together, "Service Providers"). Where a more specific notice is in place, that notice prevails to the extent of any conflict.

3. Categories of Personal Data We Process

We process the following categories of personal data:

• Identification data: name, date of birth, nationality, residential address, country of residence, photographs of identity documents, signature.

• Contact data: email address, telephone number, correspondence address, language preferences.

• Eligibility data: declarations about jurisdiction, U.S. Person status, professional or qualified-investor status, sanctions-screening results, sophistication self-assessment, source of wealth and source of funds disclosures.

• On-chain data: blockchain wallet addresses, on-chain transaction history relevant to your holdings, screening signals from third-party blockchain analytics providers.

• Compliance data: anti-money-laundering and counter-terrorist-financing checks, sanctions and politically-exposed-persons screening results, information about the source and beneficial ownership of funds.

• Tax data: tax residency, tax-identification numbers, FATCA and CRS self-certifications.

• Financial data: bank-account details, settlement instructions, holdings, distribution and redemption records (we do not collect or store full payment-card primary account numbers).

• Site usage data: IP address, device identifiers, browser type and version, operating system, referrer URL, pages viewed, time stamps, cookies and similar identifiers.

• Communications data: emails, support tickets, recordings of telephone calls (where notified), web-form submissions and meeting minutes involving you.

• Special categories of data: we do not seek special categories of personal data (for example, data revealing health, racial or ethnic origin, political opinions, religion, biometric or genetic data) but may receive such data incidentally where it is contained in identification documents or sanctions-screening results. Where this happens we rely on substantial-public-interest, legal-claim or explicit-consent grounds, as applicable, for the processing.

4. Where We Collect Personal Data From

We collect personal data:

• directly from you when you visit the Site, complete an investor gate, contact us, register for updates or apply for an investment;

• from your devices, via cookies and similar technologies, as described in our Cookie Notice;

• from third parties acting on your behalf (for example, advisers, intermediaries, custodians or wallet providers);

• from public sources (for example, the published Companies Registry, sanctions lists, court records, news media and corporate-information databases);

• from blockchain analytics, anti-fraud, anti-money-laundering and identity-verification service providers; and

• from our affiliates and Service Providers in the course of providing services to the Issuer.

5. Purposes for Which We Process Personal Data and Lawful Bases

We process personal data only where we have a lawful basis to do so. The lawful bases on which we rely depend on the jurisdiction in which you are located. Where you are in the European Economic Area or the United Kingdom, we identify the lawful basis under the EU General Data Protection Regulation ("GDPR") and the UK GDPR; where you are in Jersey or the British Virgin Islands, we identify the equivalent basis under local law:

Investor on-boarding and KYC

Lawful basis: contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) (including Money-Laundering Order obligations); legitimate interest (Article 6(1)(f)) in mitigating financial-crime risk.

Sanctions, AML, CFT and CPF screening

Lawful basis: legal obligation (Article 6(1)(c)); substantial-public-interest condition under Schedule 2 paragraph 11 of the Data Protection (Jersey) Law 2018 / Article 9(2)(g) GDPR for any incidental special-category data.

Site administration, fraud prevention and security

Lawful basis: legitimate interest (Article 6(1)(f)) in operating, securing and improving the Site.

Marketing and investor relations

Lawful basis: consent (Article 6(1)(a)) where required by law; legitimate interest (Article 6(1)(f)) in marketing to professional, qualified or sophisticated investors who are existing contacts.

Tax, regulatory and corporate reporting

Lawful basis: legal obligation (Article 6(1)(c)) under FATCA, CRS, the Common Reporting Standard, prospectus and offering-document obligations and reporting obligations under the regulatory framework.

Defence of legal claims

Lawful basis: legitimate interest (Article 6(1)(f)) in establishing, exercising or defending legal claims.

6. Cookies, Local Storage and Similar Technologies

We use cookies and similar technologies to (a) operate the Site and remember the declarations you have made at the investor gate, (b) measure how the Site is used, (c) protect the Site from fraud and abuse, and (d) where you have consented, deliver tailored content and measure marketing effectiveness. Strictly necessary cookies do not require consent. Other categories are deployed only where you give consent through the cookie banner or another applicable method. You can change your cookie preferences at any time via the Site settings.

7. Sharing Your Personal Data

We may disclose your personal data to:

• Service Providers in the Cavenwell Group, including the trust company, fund administrator, compliance officer and money-laundering reporting officer engaged in respect of the Issuer;

• professional advisers (legal, tax, audit, regulatory) and Cavenwell's independent auditors;

• payments, KYC, identity-verification, transaction-monitoring and blockchain-analytics providers;

• issuers and operators of distributed-ledger infrastructure (for example, custodians, validators, transfer agents and oracles);

• financial-services intermediaries you have authorised to interact with the Issuer on your behalf;

• competent authorities (including Jersey Financial Services Commission ("JFSC"), tax authorities, courts and law-enforcement agencies) where required by law or where we believe in good faith that disclosure is necessary; and

• counterparties to a corporate-action, restructuring, merger, acquisition or sale, subject to confidentiality obligations.

8. International Transfers of Personal Data

We are based in Jersey and process data with affiliates and Service Providers based in the United Kingdom, the European Economic Area, the United States and other jurisdictions. Where we transfer personal data outside the EEA, the United Kingdom, Jersey or the BVI to a country that has not been recognised as offering an adequate level of protection, we put in place appropriate safeguards, which may include EU Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum, and supplementary measures (for example, encryption, pseudonymisation and contractual restrictions). A copy of the relevant safeguard is available on request from privacy@assetize.xyz.

9. How Long We Keep Personal Data

We keep personal data only for as long as is necessary for the purposes for which it was collected, taking into account legal, accounting, tax and regulatory record-keeping obligations. Indicative retention periods are:

• investor on-boarding records, KYC and AML records: at least five years from the end of the business relationship, in line with the Money-Laundering Order and applicable local law (and longer where required to defend legal claims);

• transaction and accounting records: at least ten years from the date of the transaction, in line with applicable financial-record-keeping obligations;

• marketing records: until you withdraw consent or object, plus a short administrative period to give effect to your request;

• Site usage and cookie data: ranging from a single session to up to 24 months, as detailed in our Cookie Notice; and

• communications data: for the duration of the business relationship and for an additional period to defend legal claims.

10. Your Rights

Depending on your jurisdiction, you may have the following rights in respect of your personal data:

• the right to be informed about how we process your personal data;

• the right of access to your personal data and to receive a copy of it;

• the right to rectification of inaccurate or incomplete personal data;

• the right to erasure ("right to be forgotten") in certain circumstances, subject to our overriding legal obligations to retain records;

• the right to restrict processing in certain circumstances;

• the right to data portability for personal data you have provided to us, where processing is based on consent or contract and is carried out by automated means;

• the right to object to processing carried out on the basis of legitimate interests, including for direct-marketing purposes; and

• the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you (we do not currently make such decisions in relation to the Site).

You may exercise any of these rights by contacting us using the details in clause 13. We may need to verify your identity before responding. We will respond within the period required by applicable law (typically one month, extendable in limited circumstances).

11. Security

We take appropriate technical and organisational measures to protect personal data against accidental loss, alteration, unauthorised disclosure or access, including the use of access controls, encryption, network monitoring, regular review of suppliers, employee training and incident-response procedures. No method of transmission or storage is 100% secure, but we work to ensure that our security practices match the sensitivity of the data we hold.

12. Children

The Site is not directed at, and is not intended to be used by, persons under the age of 18 (or the age of majority in their jurisdiction, if higher). We do not knowingly collect personal data from such persons. If you believe a minor has submitted personal data to us, please contact privacy@assetize.xyz so that we can take appropriate action.

13. Contact and Complaints

Any privacy question, request or complaint should be sent to privacy@assetize.xyz or to: Compliance, Privacy, c/o Assetize Issuer PCC, 2nd Floor, The Le Gallais Building, 54 Bath Street, St Helier, Jersey JE1 1FW.

If you believe we have not adequately addressed your concern, you have the right to complain to your local data-protection supervisory authority. The competent regulator for the Issuer is the Jersey Office of the Information Commissioner ("JOIC"). EEA / UK individuals may also contact the supervisory authority in the country in which they live or work.

Representative for EEA / UK individuals: Cavenwell Group (London), privacy@assetize.xyz

14. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in law, our processing activities or operational practice. The Effective Date below indicates when this Privacy Notice was last updated. We encourage you to review this Privacy Notice periodically.

15. Issuer Details

Legal name: Assetize Issuer PCC

Form: protected cell company (Jersey)

Registered office: 2nd Floor, The Le Gallais Building, 54 Bath Street, St Helier, Jersey JE1 1FW

Data-protection law: Data Protection (Jersey) Law 2018 ("DPJL"), and the Data Protection Authority (Jersey) Law 2018

Supervisory authority: Jersey Office of the Information Commissioner ("JOIC")

Privacy contact: privacy@assetize.xyz

Compliance contact: legal@assetize.xyz