# Privacy Notice

Reale Assets Limited (the "**Company**", "**we**", "**us**" or "**our**") is committed to protecting the privacy of individuals whose personal data it collects and processes in connection with its activities in relation to the Tokens and operation of the Protocol.

This privacy notice explains how and why we, as a data controller, collect, use, retain, disclose, and safeguard your personal data as a prospective or current holder of the Tokens ("**Tokenholders**") or website user. In this privacy notice, capitalised terms shall have the meanings given in the terms and conditions for the issue, holding and redemption of the Tokens issued by the Company (the "**Terms and Conditions**"). For the purposes of this privacy notice, the terms "data controller" and "personal data" have the meanings given to them under the Data Protection Act, 2021 (as revised) of the British Virgin Islands (the "**DPA**").

#### Categories of Personal Data Collected

We may collect and process personal data about you including:

* Name, home address, date of birth, nationality, contact details
* Identity verification documents (e.g. passport/driving licence)
* KYC/AML information (including source of funds/wealth, sanctions screening data)
* Personal data relating to you, your agents, your beneficial owners or controllers, or any other individuals affiliated with you who are relevant for investor due diligence or regulatory purposes;
* Transaction-related information, including stablecoin wallet addresses, transaction hashes, subscription/redemption amounts relating to Tokens
* Bank account details (for USD receipt/payment)
* Communications and correspondence with the Company

We may also collect limited technical data from visitors to our website, such as IP address, browser type, and device details (see our cookie policy for more information).

Much of the personal data will typically be provided by you through written/ electronic requests, other documentation, calls, email, or through use of our website/protocol, but we may also obtain information from third party sources, such as public registers, publicly available databases, credit reference agencies, or sanctions lists. If you provide us with personal data relating to third parties (such as agents, beneficial owners, or other individuals affiliated with you), you must ensure that such individuals are made aware of this privacy notice and you have the right to provide their data to us.

#### Purpose and Legal Basis for Processing

We process your personal data for the following purposes:

* To process, execute, and manage your subscriptions to, and redemptions of, Tokens and to carry out Activities as described above, including any minting, burning, or redemption requests.
* To maintain our register of Tokenholders in accordance with applicable corporate and regulatory requirements.
* To conduct anti-money laundering, counter-terrorist financing, sanctions screening, and other due diligence processes required by law.
* To comply with our legal, regulatory and contractual obligations, or to respond to lawful requests from regulatory, supervisory or law enforcement authorities.
* To communicate with you regarding your holdings, transactions and relevant operational or technical updates.
* For purposes of risk management, fraud prevention, IT administration, website security and audit.

Our legal basis for processing includes your consent (where given), the necessity to perform our contract with you as a Tokenholder, and compliance with legal obligations. Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time. P Where we rely on your consent as the legal basis for processing, you may withdraw your consent at any time. Please note that withdrawal of consent may limit our ability to provide you with certain services or to process your requests.

#### Disclosure of Personal Data

We may share your personal data with:

* Professional advisers, agents, banks, payment providers, OTC vendors and exchanges as necessary to facilitate the Activities, including conversion of virtual assets and payment of redemption proceeds in accordance with your instructions.
* Technology and IT service providers supporting our website and token protocol administration.
* Regulatory, supervisory or governmental authorities where required by law or regulation (e.g. for the purposes of compliance, audit, or crime prevention).
* Auditors, legal counsel and tax advisers in connection with our operations, transactions or dispute resolution.
* Other recipients as necessary to give effect to your requests, or with your explicit consent.
* Potential buyers or transferees (and their professional advisers) in the event of any proposed sale, restructuring or transfer of any part of the Company or its business.

We do not sell, rent, or otherwise commercially exploit your personal data.

#### Overseas Data Transfers

Where personal data is transferred outside the British Virgin Islands (e.g. to service providers, exchanges or cloud systems located outside the territory), we ensure that adequate safeguards are in place as required under the DPA, or seek your express consent for such transfers. These safeguards may include contractual terms, technical protections, or reliance on adequacy findings. Please note that personal data transferred to overseas jurisdictions may not be subject to the same data protection regime as in the British Virgin Islands.

#### Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected, including for legal, regulatory, accounting or reporting requirements, after which it will be securely deleted or anonymised in accordance with our data retention policy. As a general rule, we will retain your personal data for a minimum of five years following the end of our relationship with you, or longer if required by law or regulation. We will not retain your personal data for longer than is necessary for the purposes for which it is processed, and for any period required by law.

#### Data Integrity

We take reasonable steps to ensure that your personal data is accurate, complete and up to date. Please inform us promptly of any changes to your data.

#### Your Rights

Under the DPA, you have rights to:

* Request access to the personal data we hold about you
* Request correction of inaccurate or incomplete data
* Withdraw consent for processing at any time (without affecting the lawfulness of past processing)
* Request erasure of your data or object to certain processing
* Request transfer of your data in a portable form (where applicable)
* Lodge a complaint with the BVI Information Commissioner if you have concerns about our handling of your data

Further rights include the right to receive information regarding: (i) the purposes and legal basis for processing; (ii) any recipients or classes of recipients of your data; (iii) whether providing data is obligatory or voluntary and the consequences of not providing, if applicable; and (iv) your right to complain to the Information Commissioner of the British Virgin Islands. Please note that if you do not wish to provide us with requested personal data, or subsequently withdraw your consent, we may not be able to provide our services to you or process your request. We may require evidence of your identity before we can respond to your request to exercise any of your data subject rights.

Please contact us at <support@reale.finance> to exercise your rights or seek further information.

#### Security

We have implemented appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, alteration, or disclosure. This includes encryption of sensitive data, secure storage, access controls, and contractual requirements for service providers to adopt equivalent protections.

#### Automated Decision-Making

We do not engage in automated processing or profiling that produces legal or similarly significant effects for data subjects. Where a process is fully automated (such as smart contract execution), it is performed solely for technical or transactional purposes, and does not involve any profiling or automated decision-making with significant effects on you.

#### Policy Updates

We reserve the right to update this privacy notice from time to time. The most recent version will be posted on our website with the date of last update. We encourage you to review this notice periodically.

#### Contact Us

For questions, concerns, or to exercise your rights under this notice, please contact:

Reale Assets Limited

Email: <support@reale.finance>
