Privacy Policy

1. Introduction

Qwilon Ltd ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our platform.

Data Controller: Qwilon Ltd
Contact: privacy@qwilon.com

2. Information We Collect

2.1 Information You Provide

• Identity Data: Name, date of birth, nationality, government ID
• Contact Data: Email address, phone number
• Documents: ID copies, proof of address, selfies for verification
• Financial Data: Investment amounts, wallet addresses, source of funds
• Business Data: Company name, registration details (for creators)

2.2 Information Collected Automatically

• Device Data: IP address, browser type, operating system
• Usage Data: Pages visited, features used, timestamps
• Wallet Data: Public wallet address, transaction history (on-chain)
• Cookies: Session cookies, preference cookies

2.3 Information from Third Parties

• KYC verification results from identity providers
• Blockchain transaction data (publicly available)
• Analytics data (aggregated, anonymized)

3. How We Use Your Information

3.1 Service Delivery

• Process tokenization applications
• Verify your identity (KYC/AML)
• Execute investments and transactions
• Provide customer support

3.2 Legal Compliance

• Comply with KYC/AML regulations
• Screen against sanctions lists
• Report to authorities as required
• Prevent fraud and financial crime

3.3 Platform Improvement

• Analyze usage patterns
• Fix bugs and improve features
• Develop new products

3.4 Communications

• Send transaction confirmations
• Provide important updates and security alerts
• Marketing communications (with consent)

4. Legal Basis for Processing (GDPR)

• Contract: Processing necessary to provide our services
• Legal Obligation: KYC/AML compliance
• Legitimate Interest: Security, fraud prevention, improvement
• Consent: Marketing communications

5. Information Sharing

We share your information with:

• KYC Providers: Identity verification services (under data processing agreements)
• Cloud Providers: Infrastructure services (encrypted storage)
• Blockchain Networks: Transaction data is public by design
• Legal Authorities: When required by valid legal request
• Professional Advisors: Legal, audit services (under confidentiality)

We do not sell your personal data. We do not share data for unauthorized marketing purposes.

6. International Transfers

Your data may be transferred outside your country. We protect transfers using:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions
• Binding Corporate Rules
• Your explicit consent

7. Data Retention

8. Your Rights

Under GDPR and similar laws, you have the right to:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Request deletion ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdraw Consent: Revoke consent for marketing

To exercise your rights, email privacy@qwilon.com. We respond within 30 days and may require identity verification.

9. Security

We protect your data using:

• TLS 1.3 encryption in transit
• AES-256 encryption at rest
• Strict access controls
• Regular security audits
• Intrusion detection systems
• Staff security training

10. Cookies

We use:

• Essential Cookies: Required for Platform operation (cannot be disabled)
• Preference Cookies: Remember your settings (1 year)
• Analytics Cookies: Understand usage patterns (2 years)
• Security Cookies: Fraud prevention (session)

Manage cookie preferences through your browser settings.

11. Special Notices

11.1 Children

The Platform is not intended for users under 18. We do not knowingly collect data from minors. If discovered, such data will be deleted.

11.2 Blockchain Data

Blockchain transactions are permanent and publicly visible. We cannot delete on-chain data. Your wallet address may be linked to your identity through KYC records.

11.3 Automated Decisions

We use automated systems for KYC screening, fraud detection, and risk scoring. You may request human review of automated decisions.

12. Policy Updates

We may update this policy and will notify you of material changes via email and Platform notification. Changes are effective 30 days after posting.

13. Contact Us

Privacy Questions: privacy@qwilon.com
Data Protection Officer: privacy@qwilon.com

If unsatisfied with our response, you may lodge a complaint with your local data protection authority.

14. Regional Provisions

• EEA/UK: Full GDPR rights apply
• California (CCPA): Right to know, delete, opt-out of sale (we don't sell data)
• Brazil (LGPD): Rights similar to GDPR
• Nigeria (NDPR): Rights per Nigerian regulations