Privacy Policy

RWA is committed to safeguarding your privacy with industry-leading standards. This Privacy Policy complies with GDPR, CCPA, and local data protection laws.

• Data Collection:
  • Personal Data: Full name, email, phone, government ID (e.g., passport), utility bill, selfie for facial recognition, and tax ID for KYC.
  • Transaction Data: Token purchases, sales, dividends received, wallet addresses, and IP logs.
  • Technical Data: Device type (e.g., iPhone 14), browser (e.g., Chrome 125), geolocation, and session duration via cookies and analytics tools (e.g., Google Analytics).

• Data Usage:
  • Used for account setup, KYC/AML compliance, transaction execution, customer support, and platform enhancements.
  • Aggregated data (e.g., average investment size) informs marketing strategies, anonymized to prevent identification.
  • Example: Your ID verifies ownership; transaction data tracks a $500 investment in a Dubai property.

• Data Sharing:
  • Disclosed to regulators (e.g., SEC, HKMA) for compliance, auditors (e.g., Armanino) for reserve checks, or law enforcement with a valid subpoena.
  • Partners (e.g., Fireblocks for custody, Jumio for KYC) access data under strict data processing agreements (DPAs).
  • No data sales; third-party analytics (e.g., Mixpanel) use anonymized datasets.

• User Rights:
  • Access: Request a data report within 30 days via [Your Email], including all stored information.
  • Correction: Update inaccurate details (e.g., address) through the dashboard or support.
  • Deletion: Request data erasure (subject to 5-year AML retention) with a 15-day processing period.
  • Opt-Out: Disable non-essential cookies or marketing emails in settings; unsubscribe links in emails.

• Security Measures:
  • Data encrypted with AES-256 and stored on AWS with ISO 27001 certification.
  • Bi-annual penetration tests by [Security Firm, e.g., Hacken] and quarterly audits ensure zero breaches (record since [Year]).
  • MFA with email or authenticator apps, plus cold storage for sensitive backups.

• Data Retention and Deletion:
  • Personal data retained for 5 years post-account closure or per AML laws (e.g., FinCEN requires 5 years).
  • Inactive accounts (no login in 2 years) are flagged, with a 30-day reactivation notice before archiving.
  • Deleted data is overwritten with random bits, certified by [Auditor Name].

• International Transfers:
  • Data may transfer to [Country, e.g., USA] for processing, complying with Privacy Shield or equivalent frameworks.
  • Users in the EU can object; contact [Privacy Officer Email] for details.

• Children’s Privacy:
  • Not designed for <18 users; any collected data (e.g., via error) is deleted within 48 hours upon detection.

• Last updated:
  • July 08, 2025. Changes notified 30 days in advance.