Privacy policy

Digital Asset Operational Services ISAC Ltd. ("DAOS Ltd.", "we", "our") provides institutional chain-agnostic infrastructure and related products and services through the T-REX Network. This policy describes how DAOS Ltd. handles personal information when you interact with T-REX websites, marketing pages, application programming interfaces, developer documentation, events, communications and other services provided directly by DAOS Ltd. (together, the "Services").

This policy is intended to provide information about DAOS Ltd.’s handling of personal information in accordance with the Bermuda Personal Information Protection Act 2016 ("PIPA") and other privacy and data-protection laws that may apply to particular processing activities. Depending on the product, service or contractual relationship, additional or supplementary notices may apply.

1. Who is the controller of your data

Digital Asset Operational Services ISAC Ltd., c/o Apex Corporate Services Ltd., Vallis Building, 4th Floor, 58 Par-la-Ville Road, Hamilton HM 11, Bermuda, is the organisation responsible under Bermuda PIPA for personal information collected through the public T-REX websites and marketing communications and, where applicable, acts as controller under the GDPR or UK GDPR.

Where DAOS Ltd. processes personal information on behalf of an institutional client or other third party, the allocation of data-protection roles will be governed by the relevant agreement and any service-specific privacy notice.

Third-party applications, issuers, trusted claim issuers, regulated operators and other independent service providers may act as separate controllers for processing they determine and carry out, in which case their own privacy notices apply.

2. What data we collect

We collect data in three main ways:

• Data you provide to us
  • Contact form submissions, including your name, work email, employer, role, and message content.
  • Event and webinar registrations, including seniority, country, and topics of interest.
  • Newsletter sign-ups.
  • Applications to partner programmes, listing programmes, or the developer network.
• Data we collect automatically
  • Usage information such as pages viewed, links clicked, referrer URL, timestamps, and approximate location derived from IP address.
  • Device information such as device type, browser, operating system, and viewport.
  • Cookie and similar-technology identifiers, described in our cookie notice below.
• Data from third parties
  • We may receive contact and firmographic data from professional data providers, event partners, or referrers in order to reach the right technical and commercial contacts at institutions we are speaking to.
  • Where we obtain personal information from a third party, we assess the lawful basis or condition applicable to our own use of that information and provide the information required by the applicable privacy law. Where appropriate, we also carry out reasonable due diligence regarding the source and collection of the information.

Blockchain and on-chain data

The T-REX architecture is designed so that raw KYC/AML documentation and other directly identifying personal information are not intended to be stored on-chain. Where identity or eligibility information is represented on-chain, the Network is designed to use cryptographic claims, identifiers or attestations rather than the underlying verification documents.

Blockchain records may be public, persistent or technically immutable. Identity verification and the issuance of claims may be performed by third-party trusted claim issuers, issuers or other authorised providers, which are responsible for the underlying personal information they process in accordance with their own legal obligations and privacy notices. Where confidentiality features are used, access to protected information is controlled in accordance with the relevant technical configuration and permissions.

3. Why we use your data

• To respond to inquiries you submit through contact forms and email.
• To provide the Services, including access to documentation, developer tooling, and admin dashboards where relevant.
• To send you commercial information about T-REX products, standards, and events where such communications are otherwise permitted under applicable law.
• To measure and improve our Services, including product analytics, security monitoring, and abuse prevention.
• To comply with our legal, regulatory, tax, and accounting obligations.

4. Lawful bases

Depending on the processing activity and applicable law, we rely on one or more lawful grounds or conditions for using personal information, including:

• Consent, where required for the relevant processing, including for non-essential cookies and for marketing communications where required.
• Contract necessity, where processing is necessary to provide you with a Service you have requested or to take steps at your request before entering into a contract.
• Under PIPA, other conditions permitted by section 6 may apply, including use authorised or required by law and other uses permitted by PIPA, as appropriate to the relevant processing.
• Where the GDPR or UK GDPR applies, the relevant legal bases may include legitimate interests and compliance with a legal obligation, as appropriate.

Where we rely on legitimate interests, you may object to the processing in the circumstances provided by applicable law (see Section 8).

5. Sharing and disclosure

We do not sell personal information. We disclose personal information only where necessary for the purposes described in this policy, including to third parties that support our Services. Service providers that process personal information on our behalf are subject to appropriate contractual obligations relating to confidentiality, security and data protection.

Categories of recipients include cloud hosting and storage providers, customer relationship and email delivery platforms, analytics providers, event and webinar platforms, professional advisers, and regulators or law enforcement where required.

Third-party applications and services made available or discoverable through the T-REX AppStore may process personal information independently from DAOS Ltd. Where a third party determines the purposes and means of its processing, that third party is responsible for the relevant processing under its own privacy notice. Listing, technical integration or interoperability with the T-REX Network does not, by itself, make DAOS Ltd. the controller of personal information processed independently by that third party.

6. International transfers

DAOS Ltd. may transfer personal information to service providers located outside Bermuda or the jurisdiction in which you are located. Before transferring personal information from Bermuda to an overseas third party, DAOS Ltd. will assess the level of protection afforded by the recipient and will use contractual or other safeguards where required under PIPA to ensure a comparable level of protection.

Where the GDPR or UK GDPR applies to a restricted transfer, DAOS Ltd. will use an applicable transfer mechanism, such as an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum, as appropriate.

Information about the principal jurisdictions and categories of overseas recipients used by DAOS Ltd. will be provided in this policy or other applicable privacy information as required by law.

7. Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or for as long as a legal or regulatory requirement obliges us to keep it.

• Inquiry records are retained for up to 36 months from the last interaction.
• Marketing subscription records are retained until you unsubscribe; following an opt-out or objection, DAOS Ltd. may retain limited suppression information where necessary to ensure that your marketing preference continues to be respected.
• Financial and contract records are retained for the periods required by applicable tax and commercial law.

8. Your rights

Subject to local law, you may:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete data, erase or destroy personal information, or to restrict or block its use, where those rights are available under applicable law and subject to any lawful retention requirement.
• Ask us to restrict or object to or require us to cease certain processing, including use for advertising, marketing or public-relations purposes where applicable.
• Request portability of data you provided to us.
• Withdraw consent for any processing that is based on consent.
• Lodge a complaint with your national data protection authority.

To exercise any of these rights, please contact us using the details in Section 11. We will respond within the period required by applicable law. Under Bermuda PIPA, a completed written request is generally answered within 45 days, subject to permitted extensions; where the GDPR or UK GDPR applies, the usual response period is one month, subject to statutory extensions.

9. Cookies and similar technologies

Our websites use a small number of cookies for essential functionality, security, and privacy-friendly analytics. Non-essential cookies, including analytics and marketing cookies, are only set once you consent through our cookie banner.

You can change or withdraw your preferences at any time through the available cookie settings or consent-management tool, where provided, or by clearing your cookies and revisiting the site.

10. Security

We maintain technical and organisational measures appropriate to the nature of the data and the risk of processing. These include encryption in transit, encrypted storage for sensitive fields, access control, audit logging, and periodic reviews. No system is perfectly secure, but we treat data protection as a first-class part of how we design and operate the Services.

11. Contact us

Questions about this policy or about your personal data can be sent to privacy@t-rex.network.

Written correspondence can be sent to:
Privacy Officer,
Digital Asset Operational Services ISAC Ltd.,
c/o Apex Corporate Services Ltd.,
Vallis Building,
4th Floor,
58 Par-la-Ville Road,
Hamilton HM 11, Bermuda.

When contacting us, please describe your request clearly so we can respond promptly.

This policy may be updated from time to time. Material changes will be communicated on this page and, where appropriate, by direct notice to registered users.