1. PURPOSE
This Privacy Policy explains how the International Digital Securities Exchange ("IDSX", "we", "us" or "our") collects, uses, stores, protects and discloses personal information in connection with its websites, systems, market infrastructure and related services.
IDSX recognises the importance of protecting personal information and is committed to handling it responsibly, transparently and in accordance with applicable privacy and data protection laws.
This Privacy Policy should be read together with the IDSX Website & Platform Terms of Use and other applicable IDSX policies and notices.
2. SCOPE
This Policy may apply to information about website visitors; investors; Issuer, Broker, Sponsor, Underwriter, Market Maker, Custodian and Settlement Provider representatives; applicants; directors, officers, employees and beneficial owners; advisers; service providers; persons associated with IDSX wallets; and other persons interacting with IDSX. Additional notices may apply to particular services, jurisdictions or activities.
3. PERSONAL INFORMATION
"Personal Information" means information relating to an identified or identifiable individual, or an equivalent concept under applicable privacy law. It includes information that directly identifies someone and information reasonably associated with an identifiable person.
4. INFORMATION WE MAY COLLECT
Depending on the relationship, IDSX may collect name, date of birth, nationality, address, email, telephone, identity and government identification, tax details, occupation, employment, company and organisational information, directorships, beneficial ownership, source of funds or wealth where required, investor classification or eligibility, financial and transaction information, wallet addresses, blockchain transactions, account, device and technical information, communications, and other information reasonably required for IDSX activities or compliance.
5. IDENTITY VERIFICATION INFORMATION
For identity checks, IDSX or an authorised provider may collect legal name, birth date, nationality, address, passport, national identity card or driving licence details, photographs, verification images or recordings, address evidence, company registration, director and beneficial ownership details, and other information needed to verify identity or legal status. Requirements determine the information collected.
6. KYC AND KYB INFORMATION
IDSX may collect or receive Know Your Customer (KYC) and Know Your Business (KYB) information, including identity, corporate registration, ownership and control, directors, officers, authorised representatives, beneficial owners, business activities, regulatory status, finances, source of funds, relevant source of wealth, expected activity and supporting documents. Website visitors are not all required to provide KYC or KYB information.
7. AML/CFT AND FINANCIAL CRIME INFORMATION
Where required or appropriate, IDSX may collect, generate or receive information for anti-money laundering, countering terrorism financing, sanctions and other financial crime controls. This may include sanctions and politically exposed person screening, relevant adverse information, transaction monitoring, wallet screening, blockchain analytics, suspicious activity indicators, risk classifications and legally required records. Access, disclosure and notification may be legally restricted.
8. INVESTOR INFORMATION
Information about investors may include identity, residence jurisdiction, investor category and eligibility, account and Broker relationships, holdings, transaction history, settlement, corporate action entitlements, restrictions and wallet information. IDSX's receipt of it depends on market structure and the functions performed by IDSX, Brokers, Custodians and other participants.
9. WALLET INFORMATION
For Digital Securities or blockchain services, IDSX may process wallet address and network, eligibility, associated identity where applicable, whitelisting, transfer restrictions, transactions and identifiers, screening results and compliance information. A wallet address may be Personal Information if linked or linkable to an individual.
10. BLOCKCHAIN INFORMATION
Public blockchain transactions may remain visible independently of IDSX, and IDSX may not be able to alter or delete them. IDSX will seek, where practicable, to avoid placing unnecessary Personal Information directly on public blockchains. Off-chain systems may keep identity, KYC, eligibility and other Personal Information separate from public records.
11. INFORMATION FROM ISSUERS AND MARKET PARTICIPANTS
IDSX may receive Personal Information from Issuers, Brokers, Sponsors, Underwriters, Market Makers, Custodians, Settlement Providers, advisers and other participants for admission, trading, settlement, compliance, corporate actions, investigations or other IDSX activities.
12. INFORMATION FROM THIRD PARTIES
IDSX may obtain information from identity verification, sanctions screening, AML/CFT and blockchain analytics providers; public registers; regulators; advisers; data and fraud prevention services; and public sources. It will use that information for legitimate purposes and subject to applicable law.
13. WEBSITE AND DEVICE INFORMATION
When a person accesses an IDSX website or digital service, technical information may be collected automatically, including IP address, browser, operating system, device, language, access times, pages viewed, referrers, session data, security logs and other technical information. It may support security, system administration, analytics and improvement.
14. COOKIES AND SIMILAR TECHNOLOGIES
IDSX websites may use cookies and similar technologies to operate functionality, maintain sessions, remember preferences, protect accounts, detect threats, understand usage, improve performance and support other legitimate functions. Where law requires, users will have appropriate choices about non-essential cookies.
15. PURPOSES FOR WHICH INFORMATION MAY BE USED
IDSX may use Personal Information to provide and operate services; manage website and platform access; process applications; assess Issuer admission and participant applications; verify identity; conduct KYC, KYB, AML/CFT and sanctions checks; assess investor and wallet eligibility; operate whitelisting; support trading, settlement and Digital Securities; maintain ownership and transaction records; administer corporate actions; conduct surveillance and investigate unusual or prohibited activity; prevent fraud and financial crime; manage complaints; enforce IDSX Rules; meet legal duties; maintain cybersecurity; improve systems; communicate; and protect market integrity.
16. LEGAL BASES FOR PROCESSING
Where law requires a legal basis, IDSX may process information for contract performance; pre-contractual steps requested by a person; legal compliance; legitimate interests of IDSX or another person; consent; legal claims; or another basis permitted by law. The basis may vary by information, purpose and jurisdiction.
17. LEGITIMATE INTERESTS
Where permitted, IDSX may process information as reasonably necessary to operate secure market infrastructure, protect investors and Client Assets, prevent fraud, maintain integrity, improve services, manage relationships, maintain cybersecurity and establish, exercise or defend legal rights. Where required, IDSX will consider effects on individuals' rights and interests.
18. CONSENT
Where processing relies on consent, an individual may withdraw it subject to law. Withdrawal does not affect prior lawful processing. Some services may be unavailable if information necessary to provide them cannot lawfully be processed.
19. REGULATORY AND LEGAL OBLIGATIONS
IDSX may process information as reasonably necessary to meet financial markets, securities, company, AML/CFT, sanctions, financial crime, surveillance, reporting, recordkeeping and tax requirements, court orders, and lawful requests from competent authorities.
20. MARKET SURVEILLANCE
IDSX may process trading, transaction, account, wallet and related information to identify or investigate unusual trading, manipulation, wash or coordinated trading, misleading orders, suspicious transfers, potential insider conduct, IDSX Rule breaches and other activity affecting integrity.
21. AUTOMATED SYSTEMS AND ANALYTICS
Automated systems, algorithms or analytical tools may assist fraud detection, AML/CFT monitoring, sanctions and wallet screening, cybersecurity, surveillance, risk assessment and operational monitoring. They may flag activity for authorised personnel to review. IDSX will meet legal requirements for decisions based solely on automated processing.
22. DISCLOSURE TO MARKET PARTICIPANTS
IDSX may disclose information to Brokers, Issuers, Sponsors, Custodians, Settlement Providers and other authorised participants as reasonably necessary for legitimate market functions. Disclosure is limited to what is reasonably required and subject to law.
23. DISCLOSURE TO SERVICE PROVIDERS
IDSX may use providers for cloud infrastructure, hosting, cybersecurity, identity, KYC/KYB, sanctions screening, blockchain analytics, communications, software, professional services and operational support. They may process Personal Information only for authorised purposes and under appropriate contractual or legal safeguards where required.
24. DISCLOSURE TO REGULATORS AND AUTHORITIES
IDSX may disclose information to financial regulators, government agencies, courts, tribunals, law enforcement, tax or sanctions authorities and other competent bodies where law requires or permits. It may also provide information for lawful investigations, supervision or enforcement.
25. CORPORATE TRANSACTIONS
Information may be disclosed or transferred in a merger, acquisition, restructuring, financing, business or asset sale, or similar transaction, subject to applicable privacy and data protection requirements.
26. INTERNATIONAL DATA TRANSFERS
In an international market, information may be transferred to, accessed from or processed in jurisdictions other than the individual's location, with different privacy laws. IDSX will use transfer safeguards required by applicable law.
27. DATA MINIMISATION
IDSX seeks to collect and process only information reasonably necessary for the relevant purpose and to avoid unnecessary information, particularly information associated with public blockchain infrastructure.
28. ACCURACY
IDSX takes reasonable steps to keep information accurate, complete and current where necessary. Individuals and participants should notify IDSX when material information becomes inaccurate or outdated.
29. DATA SECURITY
IDSX maintains technical and organisational measures reasonably designed to protect information from unauthorised access or disclosure, misuse, loss, alteration, destruction and other unauthorised processing. Measures may include access controls, authentication, encryption, monitoring, logging and network security.
30. ACCESS CONTROLS
Access is restricted to people who need it for legitimate business, operational, regulatory or legal purposes. Controls may include role-based permissions, privileged access management, multi-factor authentication, logs, access reviews and other safeguards.
31. DATA BREACHES
IDSX maintains procedures to identify, assess and respond to Personal Information breaches. Where law requires, it will notify affected individuals or authorities of qualifying breaches; timing and content follow applicable law.
32. DATA RETENTION
IDSX retains information as long as reasonably necessary for its purposes and any additional legally required period. Retention may account for financial markets, AML/CFT, regulatory records, contracts, complaints and disputes, investigations, tax, litigation, cybersecurity and audit. Information may be retained longer for an investigation, regulatory matter, dispute or legal proceeding.
33. DELETION AND ANONYMISATION
When information is no longer needed and retention is not legally required, IDSX may securely delete, destroy or anonymise it. Legal retention duties may limit deletion, so some information cannot be removed immediately on request.
34. BLOCKCHAIN IMMUTABILITY
Some blockchains have permanent or effectively immutable records. IDSX may lack the technical ability to change or delete validly recorded data. Where appropriate it may update off-chain records, restrict future use, correct IDSX-controlled systems, disassociate identity where lawful and technically possible, or take other lawful measures. IDSX therefore seeks to avoid unnecessary identifying data on public chains.
35. INDIVIDUAL RIGHTS
Depending on law, individuals may request access, correction, deletion, restriction, object to processing, request portability, withdraw consent where applicable, or complain to a privacy authority. Rights vary by jurisdiction and circumstances.
36. ACCESS REQUESTS
Individuals may request access where law provides that right. IDSX may reasonably verify identity. Access may be restricted where law allows or requires, including to protect others' rights, security, investigations or legally protected information.
37. CORRECTION REQUESTS
Individuals may request correction of inaccurate information. IDSX may require supporting evidence for material changes. Correcting an IDSX record does not necessarily change an immutable historical blockchain transaction.
38. DELETION REQUESTS
Individuals may request deletion where law provides the right. IDSX may retain information when required or permitted for regulatory, AML/CFT, sanctions, surveillance, records, fraud prevention, legal claims, dispute resolution or other legal duties.
39. MARKETING COMMUNICATIONS
Individuals may opt out of marketing communications as law permits. Necessary operational, regulatory, security and service communications may still be sent and are not marketing solely because someone opted out.
40. CHILDREN
IDSX services are not intended for children unless law and an approved IDSX service or arrangement expressly permit this. IDSX does not knowingly seek children's Personal Information through general market services. If it learns that such information was collected unlawfully or without permission, it will take appropriate lawful steps. This does not prevent processing about a minor where legally required or otherwise lawful, including for ownership, inheritance, corporate actions or regulatory duties.
41. CONFIDENTIALITY
IDSX maintains arrangements to protect confidentiality. Information is disclosed only with authority or consent; as reasonably needed to provide services or operate the market; as required or permitted by law; for regulatory, supervisory or enforcement purposes; to protect IDSX, investors or participants; or as otherwise described here. Persons with access are subject to appropriate confidentiality obligations.
42. MARKET TRANSPARENCY AND PUBLIC INFORMATION
Law or IDSX Rules may require public information about Issuers, participants, securities or transactions, including directors, officers, substantial or controlling shareholders, beneficial ownership where required, announcements, corporate actions, securities data and permitted or required regulatory or disciplinary information. Privacy rights may be subject to these duties. IDSX seeks not to publish information unnecessary for the market or legal purpose.
43. COMPLAINTS ABOUT PRIVACY
A person may complain through IDSX contact details or complaint channels about its handling of Personal Information. IDSX reviews complaints under law and its complaint procedures. Where possible, identify the complainant, information, conduct or decision, dates and outcome sought. IDSX may request information needed to investigate. This does not prevent a complaint to a competent privacy authority where law provides that right.
44. CONTACTING IDSX ABOUT PERSONAL INFORMATION
Requests may be sent through the privacy contact channel on the IDSX website, including access, correction, applicable deletion, objection or restriction, consent withdrawal, privacy complaints and questions. IDSX may verify identity and request details needed to locate records and understand the request.
45. CHANGES TO THIS PRIVACY POLICY
IDSX may amend this Policy for changes in law, regulation, market structure, services, technology, Digital Securities infrastructure, processing, cybersecurity or operations. The current version will be published on the relevant IDSX website or service. Where required, IDSX will give additional notice of material changes.
46. RELATIONSHIP WITH OTHER IDSX RULES AND POLICIES
Read this Policy with, as relevant, IDSX Website & Platform Terms of Use, Market Rules, KYC & AML Rules, Client Assets & Recordkeeping Rules, Wallet & On-Chain Transfer Rules, Risk Disclosure Rules, Complaints & Dispute Resolution Rules, Market Surveillance Rules and other policies or procedures. A service-specific notice may supplement it. Mandatory law prevails over an inconsistent provision to the extent of the inconsistency.
47. APPLICABLE LAW AND REGULATORY REQUIREMENTS
IDSX handles information under privacy laws applicable to each processing activity. Requirements may depend on the individual's, IDSX entity's or participant's location, processing location, service and financial regulation. Nothing limits duties under financial markets, AML/CFT, sanctions, securities, corporate, tax, regulatory, judicial or law enforcement requirements. Legally required retention, processing or disclosure may take precedence over an individual request to the extent permitted by law.
48. CONTACT INFORMATION
Questions, requests or complaints may be submitted through privacy contact details on the official IDSX website. IDSX will publish the responsible legal entity, registered address and other required contact details, including any required privacy or data protection officer or representative. For security, do not send private keys, passwords, authentication credentials or sensitive account access information. This Policy does not require anyone to waive rights under privacy or data protection law.