PRIVACY POLICY

Introduction

CIRETA LIMITED, a company incorporated in the British Virgin Islands (BVI Company No. 2186774) (referred to as "Cireta," the "Company," "we," "us," or "our") is committed to protecting your privacy and handling your personal data with care.

This Privacy Policy outlines how we collect, use, share, and safeguard personal information when you use Cireta's platform and services. Cireta is the sole data controller, meaning we determine the purposes and means of processing your personal data. By registering an account or otherwise using our website and services (the "Platform"), you acknowledge that you have read and agree to this Privacy Policy. If you do not agree, please refrain from using the Platform.

Service Scope

Our Services are not directed to users in jurisdictions where our offerings are not permitted. If we become aware that we have collected information from a prohibited jurisdiction, we may restrict the account and handle data as required to comply with law and our Terms.

See our Terms of Service (Eligibility and Jurisdictional Restrictions section) for details.

Personal Data We Collect

We collect personal information at various points in your interaction with the Platform, particularly during account creation, user onboarding, and compliance procedures. The types of personal data we collect include:

• Identity Information: Full name, date of birth, nationality, and government-issued identification documents (such as passport, driver's license or other ID) for identity verification and Know-Your-Customer (KYC) checks.
• Contact Information: Email address, telephone number, residential address, and other contact details so we can communicate with you and provide our services.
• Financial Information: Details necessary for transactions and investment activities, such as bank account information, payment card details, cryptocurrency wallet addresses, and information about your source of funds or income (as required for compliance).
• Account & Authentication Data: Username, password, or other login credentials to secure your account, as well as any verification codes or security questions used for authentication.
• Usage Data: Information about how you use our website and Platform, e.g. your IP address, browser type, device identifiers, access times, and pages visited. We may collect this through cookies and similar tracking technologies (see Cookies and Tracking Technologies section below).
• Communication Records: Copies of communications you send to us or post on the Platform, including support requests, inquiries, feedback, or any correspondence between you and Cireta.
• Marketing Preferences: Your preferences for receiving marketing or promotional communications (e.g. newsletter sign-ups or opt-ins for updates).
• Other Information: Any other information you voluntarily provide to us in the course of using our services or during onboarding (for example, responses to questionnaires or additional verification information).

We collect personal data either directly from you (for instance, information you provide during registration or when completing identity verification steps) or indirectly through your interactions with the Platform (for example, via cookies or analytics tools tracking your usage). We only ask for information that is necessary for the purposes described in this Policy. You may choose not to provide certain information, but this could limit your ability to use some features of the Platform (for example, you cannot invest through the Platform without providing the information required by our compliance checks).

On-chain Data Notice. Public blockchains are transparent. Your wallet address, token holdings and transactions may be permanently visible to anyone and linkable through analytics. We do not control third-party indexing or reuse of public on-chain data.

Note: Our services are intended for lawful investors in real-world tokenized assets. During onboarding, we might collect additional data to ensure you meet eligibility criteria or regulatory requirements (for example, confirming your investor status or performing anti-money laundering screenings). We will handle any such sensitive data in accordance with this Policy and applicable law.

How We Use Personal Data

We use the collected personal data to conduct our business and provide you with secure, efficient, and compliant services. The main purposes for which Cireta processes your personal information include:

• Providing and Improving Services: To create and manage your user account, enable your access to the Platform, and facilitate your investments in tokenized real-world assets. This includes processing transactions, issuing or transferring tokens representing assets, and providing customer support. We also analyze usage trends to improve our Platform's functionality, performance, and user experience.
• User Identification and Compliance: To verify your identity and conduct necessary due diligence during account opening and before allowing investments. This is crucial for compliance with legal obligations (such as anti-money laundering (AML) laws, KYC regulations, and other financial industry requirements) and to ensure that only eligible users participate. We may use identity documents and other personal data to confirm your identity, screen for fraud or unlawful activity, and satisfy our regulatory compliance mandates.
• Communication: To contact you with service-related communications. We will send confirmations of your transactions, notifications of account activity, security alerts (for instance, if there are important changes or suspicious logins), and updates about the Platform. We may also respond to any inquiries or support requests you send us. Such communications are primarily service or account-related and not promotional in nature.
• Marketing (with Consent): If you have agreed to receive marketing communications, we may use your contact details to send you newsletters, product updates, industry news, promotions or special offers related to our services. You can opt out of marketing emails or messages at any time (see Marketing Choices below). We will not spam you -- marketing will be reasonable and relevant to the services we provide.
• Personalization: To customize the Platform for you. For example, we may use cookies to remember your preferences (such as language or region) and to provide content tailored to your interests, including showing you relevant token offerings or investment opportunities based on your activity.
• Security and Fraud Prevention: To protect the integrity of our Platform and users. We monitor and analyze data to prevent, detect, and investigate fraud, unauthorized access, security breaches, or violations of our Terms of Service. This includes using certain data (like device information, IP addresses, and usage patterns) to identify potential malicious activity and taking action to safeguard our users and business.
• Legal Obligations and Risk Management: To comply with applicable laws, regulations, court orders, or enforce our agreements. We may process and retain certain personal information to meet record-keeping requirements, respond to lawful requests by public authorities, or address disputes. Additionally, as a risk-managed investment platform, we use personal data to enforce our Terms of Service and to ensure users adhere to any investment restrictions or jurisdictional limitations. This helps us maintain a legally compliant and secure environment for all users.

Automated Checks and Your Options. We may use automated tools for identity, sanctions and fraud screening. You may request human review of decisions that materially affect your ability to use the Services, subject to legal and security constraints.

We will only use your personal data for the purposes described above or for purposes that are compatible with those original purposes. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis, unless we are required or permitted by law to use the data without consent.

Cookies and Tracking Technologies

Like most websites and online platforms, we use cookies and similar tracking technologies to enhance your experience and gather information about how you use our site:

• What Cookies Are: Cookies are small text files placed on your device (computer, smartphone, etc.) when you visit our site. They store information about your browsing activities and preferences. Other related technologies include pixels, web beacons, or local storage.
• How We Use Cookies: We use cookies to recognize you when you return to our site, to keep you logged in (for instance, remembering your session so you don't have to sign in repeatedly), and to remember your preferences (such as language or region settings). Cookies also help us understand how users navigate through our website, which pages are popular, or if there are technical issues, so we can improve our services. Some cookies are also used for marketing and analytics purposes – for example, to track aggregate usage statistics or to deliver relevant advertisements on third-party platforms.
• Types of Cookies:

  Essential Cookies: These are necessary for the website to function correctly (e.g., authentication cookies that keep you logged in or preserve your shopping cart). Without these, some services may not be available.

  Analytics and Performance Cookies: These allow us to collect information about how visitors use our site (which pages are visited, time spent, any errors encountered). This data is typically aggregated and helps us improve site performance and design.

  Functional Cookies: These remember your choices and preferences to provide a more personalized experience (e.g., remembering your account settings or display preferences).

  Marketing/Targeting Cookies: If used, these cookies track your browsing habits to enable us or third-party partners to show you content or ads that are more likely to interest you. (We currently have a minimal advertising presence, but if applicable, these cookies would be involved in that).

• Your Choices: When you first visit our site, you may be presented with a cookies notice or preferences center allowing you to accept or reject non-essential cookies. You can also control cookies through your browser settings. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies or alert you when a cookie is being placed on your device. Please note that if you disable certain cookies, parts of the Platform might become inaccessible or not function properly (for example, you may not be able to stay logged in). Our use of cookies and related technologies will always be in accordance with this Privacy Policy. For more details or to change your cookie preferences, you can refer to our Cookies notice or settings on our website.

Sharing and Transfer of Personal Data

Third-Party Service Providers: We may share your personal data with trusted third-party companies that provide services on our behalf. These include, for example:

• Infrastructure and Hosting: We may use cloud hosting providers or data center services to store and process data. Your information might be stored on servers in jurisdictions outside of the British Virgin Islands (for instance, in the United States or the European Union) depending on our infrastructure providers.
• Identity Verification and Compliance Partners: To fulfill our KYC/AML obligations, we sometimes rely on specialized third-party providers to verify identity documents, perform background checks, or screen against sanctions and politically exposed persons lists. These service providers will handle your personal data strictly for compliance screening as instructed by us.
• Payment and Wallet Services: If you fund investments via bank transfers, credit card, or cryptocurrency, your data may be shared with payment processors, banks, or cryptocurrency wallet/custody providers. For example, when you transact on the Platform, necessary financial details will be transmitted to our payment gateway or banking partners to execute the transaction. Similarly, if we integrate external digital wallet services for managing your tokenized assets, certain personal or transactional data might be processed by that wallet service.
• Analytics and Marketing Tools: We use analytics services (such as website analytics platforms) to understand usage of our Platform. These tools may receive some data like your IP address or browsing information (usually anonymized or aggregated). We may also use email service providers to send newsletters or updates, in which case your name and email address are used by that service on our behalf.

Whenever we engage third-party processors, we ensure that they are bound by contractual obligations to process your data securely and only for the purposes we specify. They are not permitted to use your data for their own unrelated purposes. Cireta remains accountable for the handling of your personal data and continues to be the data controller when third-party processors are involved.

Issuers and Project SPVs: Where you participate in an offering, we share the minimum necessary personal data with the independent project issuer or its special-purpose vehicle (SPV) to onboard you, perform eligibility and compliance checks, allocate tokens, and fulfil ongoing holder communications. Issuers/SPVs use such data under their own policies and regulatory obligations.

Affiliates and Corporate Transactions: We may share your information with affiliated companies (for example, subsidiaries or entities under common ownership with Cireta) if necessary for the purposes described in this Policy (such as internal administration, Platform functionality, or consolidated reporting). In the event of a business transaction such as a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred as part of that deal. If such a transfer occurs, we will require the receiving party to respect your personal data in a manner consistent with this Privacy Policy, or we will notify you and obtain consent if required by law.

Legal and Regulatory Disclosures: We may disclose personal information to courts, law enforcement agencies, regulatory bodies, or other government authorities if we believe disclosure is required by law or legal process. This includes responding to subpoenas, court orders, or regulatory requests, and disclosing information that is necessary to investigate or prevent fraud, security issues, or other illegal activities. We may also share information as needed to enforce our Terms of Service or to protect the rights, property, or safety of Cireta, our users, or others.

International Data Transfers: Because of the global nature of blockchain and digital asset transactions, as well as the international services we use (like cloud providers and payment networks), your personal data may be transferred to and processed in countries other than your own. These countries might have data protection laws that are different from those in your home jurisdiction. Regardless of where your data is processed, we will take appropriate safeguards to ensure your personal data remains protected. Such measures may include contractual clauses requiring the recipient to provide equivalent levels of data protection, or ensuring the third-party is certified under a recognized data protection framework. Our goal is to ensure that your privacy is respected worldwide, in line with the principles outlined in this Policy.

Marketing Communications and Choices

Marketing Communications: With your permission, we may use your personal data (like your name and email) to send you marketing and promotional communications. These may include updates on new tokenized asset offerings, newsletters, industry insights, or special promotions that we believe could be of interest to you as an investor on our Platform. We will either ask for your explicit consent to receive such communications (e.g., by having you check an opt-in box) or rely on an existing business relationship (where permitted by law) to send you relevant information.

Opting In or Out: You have control over whether you receive marketing from us. If you prefer not to receive promotional emails or messages, you can opt out at any time. You can do this by clicking the "unsubscribe" link in any marketing email we send, or by adjusting your preferences in your account settings if that feature is available. Alternatively, you may contact us at the support contact provided below to request removal from marketing lists. Please note that even if you opt out of marketing communications, we may still send you non-promotional messages related to your account or transactions (such as confirmation emails, account alerts, or customer service communications).

Third-Party Marketing: We do not sell or rent your personal data to third parties for their own marketing purposes. We will not share your personal information with third-party companies for marketing unless we have obtained your consent to do so. If our practices change in the future, we will update this Policy and provide appropriate notices/opt-in mechanisms as required.

Data Security

We take data security seriously and implement robust measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Technical Safeguards: We employ industry-standard security technologies such as encryption, firewalls, and secure socket layer (SSL/TLS) protocols to protect data during transmission and storage. For example, any sensitive information you submit through our website (like identification documents or payment details) is encrypted in transit.
• Organizational and Physical Security: Access to personal data is restricted on a need-to-know basis to trained staff and trusted service providers who require the information to perform their duties. Our employees and contractors are subject to confidentiality obligations. We maintain physical security controls in any facilities (or use reputable hosting providers with strict security certifications) where personal data is stored.
• Monitoring and Testing: We monitor our systems for possible vulnerabilities and attacks, and we regularly assess and update our security practices. This includes applying security patches and updates to software, and periodically reviewing our procedures to guard against new threats. If we detect any security breach that affects your personal data, we will act swiftly in accordance with our incident response plans. Where legally required, we will notify you and relevant authorities of certain data breaches.
• Risk Management: As a platform dealing with financial assets and token transactions, we continuously evaluate the security of our operations. We may employ fraud detection systems and additional verification steps for sensitive actions (for example, requiring multi-factor authentication for account access or withdrawals) to reduce the risk of unauthorized activity on your account.

Despite our efforts, no method of transmission over the internet or method of electronic storage is completely secure. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. You also play a role in keeping your data safe: please use a strong, unique password for your account, keep your login credentials confidential, and notify us immediately if you suspect any unauthorized access to your account.

Data Retention

We will retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of providing services to you, satisfying any legal, accounting, or reporting requirements, and resolving disputes.

• Active Accounts: If you are a registered user, we will keep your personal information for as long as your account is active or as needed to provide you with the Platform services.
• Closed Accounts: If you close your account or it becomes inactive, we may still retain certain data for a period of time. Typically, we will retain data to comply with law (for example, records of transactions may be kept for financial reporting or anti-money laundering regulations), to enforce our agreements, or to resolve any disputes that may arise. The retention period will vary depending on the nature of the data and the purposes for which it was collected. For instance, basic account information and transaction history might be kept for a number of years as required under financial regulations, whereas web analytics data may be retained for a shorter period or anonymized.
• Deletion and Anonymization: When personal data is no longer necessary for the purpose for which it was collected, and we are not otherwise legally required to retain it, we will either delete, destroy, or anonymize the information. We take care to ensure that deletion is conducted securely to prevent any unauthorized access to the information even after it is no longer in use.
• Backup and Residual Copies: Even after we delete data from our active systems, it may persist in backup or archive files for a short duration until those are overwritten or deleted in accordance with our data backup policies. We maintain backup data to ensure we can recover information in the event of emergencies or system failure; however, access to backups is tightly controlled.

We retain KYC/AML and transactional records for as long as necessary to meet legal, audit and risk-management requirements, including applicable statutory limitation periods and record-keeping obligations. Non-compliance data received from users in restricted locations may be retained only as needed to comply with law or enforce our Terms, and otherwise deleted.

If you have any specific questions about data retention for certain types of information, you can contact us for more details. In some cases, if law permits, you may also request that we delete your personal data (see Your Rights below), and we will accommodate such requests as far as we are required and able to (bearing in mind some data must be retained as noted).

Children's Privacy

Our Platform is not intended for use by children or minors under the age of 18. We do not knowingly collect personal information from anyone under 18 years old. If you are under 18, you must not use our services or provide any personal information to us.

If we discover that we have inadvertently collected personal data from a child, we will take prompt steps to delete such information from our records. If you believe that we might have any information from or about a minor, please contact us immediately (see Complaints and Contact Information section below) so that we can investigate and address the issue. We may ask for proof of age if we suspect an account is being used by a minor.

If we verify an account is used by a minor, we will close or disable the account and delete associated personal data, subject to legal retention requirements.

Parents or guardians should supervise their children's online activities and consider using parental control tools available from online services and software manufacturers to help provide a child-friendly online environment. We encourage parents and guardians to talk to their children about safe and responsible use of their personal information online.

Your Rights

We respect your rights to your personal data. Depending on the laws that apply to your situation, you may have some or all of the following rights regarding the personal data we hold about you:

• Right to Access: You have the right to request confirmation of whether we are processing your personal data, and if so, to request a copy of the personal data we hold about you. We will provide you with the relevant information in a reasonable time, typically in a commonly used electronic form.
• Right to Rectification: If any of your personal information is inaccurate or incomplete, you have the right to ask us to correct or update it. We encourage you to keep your account information up-to-date, and you may make certain changes directly through your account settings. For other corrections, contact us and we will make the corrections as needed.
• Right to Erasure: You can request that we delete your personal data under certain circumstances (for example, if the data is no longer necessary for the purposes it was collected, or if you withdraw consent and no other legal basis for processing exists). We will review such requests and, if warranted, will erase the data. Note that we cannot delete information that is required to comply with legal obligations or that is stored in backup archives, which will be deleted according to our retention schedule. We will inform you of the outcome of your deletion request.
• Right to Restrict Processing: You have the right to ask us to restrict or suspend processing of your personal data in certain scenarios. This might apply if you contest the accuracy of the data or if you want to restrict processing while an objection to processing is resolved. When processing is restricted, we can still store your data, but we will not use it for other purposes until the restriction is lifted.
• Right to Object: You have the right to object to our processing of your personal data when such processing is based on our legitimate interests (or those of a third party) and you have a particular situation which makes you want to object. You also have an absolute right to object to your personal data being used for direct marketing purposes at any time. If you object to direct marketing, we will stop using your data for that purpose immediately. For other objections, we will consider your request and only continue processing if we have compelling legitimate grounds that override your interests, rights, and freedoms or if continuing is necessary for legal claims.
• Right to Withdraw Consent: If we rely on your consent for any specific processing of personal data, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, and it won't affect processing that is based on other legal bases. However, it may mean we cannot provide certain services to you. For example, if you withdraw consent to our processing of required onboarding information, we may need to suspend or terminate your account.
• Data Portability: In some cases, you may have the right to request a copy of your personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted to another service provider (this generally applies when data is processed by us by automated means and based on your consent or on a contract you have with us). If applicable, we will help in transferring this data directly to the other provider if it is technically feasible.

Exercising Your Rights: To exercise any of the above rights, please contact us using the information in the Complaints and Contact section. We may need to verify your identity before fulfilling your request, to ensure that we do not disclose data to the wrong person or make incorrect changes. For example, we might ask you to provide certain account information or identification to confirm who you are. We will respond to valid requests within a reasonable timeframe as required by applicable law.

Please note that some rights may not be absolute. There are circumstances where we may legally refuse your request (for example, denying a request for erasure if we have to keep the data to comply with law, or refusing to provide data that would infringe on another individual's privacy). We will always explain to you the justification if we do refuse any request.

Exercising your privacy rights is free of charge. However, if a request is unfounded or excessive (for instance, repetitive requests), we may either charge a reasonable fee or refuse to act on it, as permitted by law.

Complaints and Contact Information

We value our users and their privacy rights. If you have any questions, concerns, or complaints about how we handle your personal data, please let us know – we want to help.

Contacting Cireta: The best way to reach us with privacy-related inquiries is via email at [email protected]. You may also contact us through our customer support channels on the Platform or via our online Contact Form at: https://cireta.com/contact-us.

When you contact us, please provide sufficient information for us to identify you (e.g., your name, email address associated with the account) and to understand your inquiry. We may follow up to ask for additional information if needed to process your request or complaint.

Handling Complaints: We will acknowledge and investigate any privacy complaints promptly. Our aim is to address your concerns and find a satisfactory resolution. If you have lodged a complaint, we will keep you informed of the progress and the outcome of the investigation.

If you believe we have not resolved your complaint adequately, and depending on your jurisdiction, you may have the right to lodge a complaint with a data protection authority or regulator. For example, if you reside in the British Virgin Islands, you can contact the BVI Information Commissioner's Office (once established) or relevant supervisory authority. Similarly, individuals in other countries may contact their local data protection regulator. We ask that you please attempt to resolve any issues with us first, but you are entitled to seek assistance from authorities if you are not satisfied with our response.

Changes to This Privacy Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes, we will post the updated Policy on our website and update the "Last Updated" date at the top or bottom of this Policy. If changes are significant, we may also provide a more prominent notice or seek your consent as required by law (for example, by email notification or a notice on our homepage or user dashboard).

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of the Platform after any updates to this Policy constitutes your acceptance of the changes. If you do not agree with the changes, you should discontinue use of the Platform and can request deletion of your data as outlined above.