Legal · SWSS Chain Foundation

    Privacy Policy

    How SWSS Fintech Limited collects, processes, transfers and safeguards personal data across the SWSS Ecosystem, in alignment with the General Data Protection Regulation (Regulation (EU) 2016/679) and analogous global data protection regimes.

    v1.0Effective 19 May 2026Binding Instrument

    Governed under the laws referenced in Section 12 (placeholder pending counsel review).

    Contact Legal Desk Request PDF Copy
    Section 01

    Preamble & Scope

    This Privacy Policy (the "Policy") sets forth the manner in which the SWSS Fintech Limited (the "Company", "we", "us", or "our"), acting in its capacity as data controller, collects, records, organises, structures, stores, adapts, retrieves, discloses, transfers, restricts and erases Personal Data in connection with the operation of the SWSS Chain Layer 1 protocol and its dependent products (collectively, the "SWSS Ecosystem").

    The Policy applies, without limitation, to the following surfaces: SWSS Chain Mainnet and Testnet, SWSS App, SWSS DEX, SWSS Pay, SWSS RwaX, SWSS Identity X, SWSS NodeX, SWSS Bridge, SWSS Draw, SWSS REALM, SWSS AI OwlX, SWSS DevHub, SWSS Docs, the SWSS Chain block explorer, and any associated marketing or institutional websites operated under the swss.io and swsschain.io namespaces.

    Use of any such surface constitutes the data subject's informed acknowledgement of the processing activities described herein. Where consent is required as a lawful basis, it is obtained by affirmative action and may be withdrawn at any time in accordance with Section 10.

    Section 02

    Definitions

    The following capitalised terms shall bear the meanings ascribed below throughout this Policy.

    Personal Data
    Any information relating to an identified or identifiable natural person (the data subject), as defined in GDPR Art. 4(1).
    Processing
    Any operation or set of operations performed on Personal Data, whether or not by automated means (GDPR Art. 4(2)).
    Controller / Processor
    Entities that determine the purposes and means of, or that process Personal Data on behalf of, the Controller (GDPR Art. 4(7)–(8)).
    Data Subject
    The identified or identifiable natural person to whom the Personal Data relates.
    On Chain Data
    Cryptographic artefacts and state transitions recorded on SWSS Chain Mainnet or Testnet, including transaction hashes, addresses, signatures and event logs.
    Off Chain Data
    Personal Data processed in conventional data systems operated by the Company or its Sub-Processors.
    KYC Tier
    The verification level (Tier 1, Tier 2 or Tier 3) assigned to a data subject by SWSS Identity X following Customer Due Diligence procedures.
    Pseudonymous Identifier
    An identifier (such as a wallet address) that, in isolation, does not identify a natural person but may do so when combined with additional information.
    IVL
    Identity Verification Layer, the institutional infrastructure underpinning SWSS Identity X, implementing selective disclosure and zero knowledge attestations.
    Sub-Processor
    Any third party engaged by the Company to process Personal Data on its behalf, under a binding written agreement compliant with GDPR Art. 28.
    Section 03

    Lawful Bases For Processing

    The Company processes Personal Data only where, and to the extent that, at least one of the lawful bases enumerated in GDPR Art. 6(1) is satisfied. The applicable basis for any specific processing activity is determined contextually and may be more particularly described in supplemental notices delivered at the point of collection.

    3.1Consent, Art. 6(1)(a)
    Where the Company relies on consent (for example, in connection with optional analytics cookies, marketing communications or non essential profiling), such consent is solicited by a clear affirmative act and may be withdrawn at any time without detriment to the lawfulness of processing carried out prior to withdrawal.
    3.2Performance Of A Contract, Art. 6(1)(b)
    Processing necessary for the performance of the Terms of Service or for taking steps at the request of the data subject prior to entering into a contract, including account provisioning, deed issuance via SWSS RwaX, and settlement on SWSS Pay.
    3.3Legal Obligation, Art. 6(1)(c)
    Processing required for compliance with statutory and regulatory obligations to which the Company or its affiliates are subject, including obligations arising under the Financial Action Task Force ("FATF") 40 Recommendations, the EU Sixth Anti Money Laundering Directive ("6AMLD"), the U.S. Bank Secrecy Act, and comparable instruments.
    3.4Legitimate Interests, Art. 6(1)(f)
    Processing necessary for the legitimate interests pursued by the Company or by a third party, including the prevention of fraud, abuse and market manipulation; the maintenance of validator set integrity within SWSS NodeX; and the security of the SWSS Chain protocol, save where overridden by the interests or fundamental rights and freedoms of the data subject.
    3.5Vital Interests & Public Interest, Art. 6(1)(d)–(e)
    Processing necessary to protect the vital interests of the data subject or another natural person, or for the performance of a task carried out in the public interest, including cooperation with competent authorities upon lawful request.
    Section 04

    Categories Of Personal Data Collected

    The Company processes the following non exhaustive categories of Personal Data, the precise composition of which depends upon the products accessed, the KYC Tier achieved and the lawful bases engaged.

    • Identity attributes: full legal name, date of birth, nationality, residential address, government issued identifiers and biometric templates derived from documentary verification.
    • KYC Tier 1 / 2 / 3 attributes processed via SWSS Identity X, ranging from baseline email verification (Tier 1) to enhanced due diligence dossiers for institutional counterparties and politically exposed persons (Tier 3).
    • Wallet & on chain telemetry: wallet addresses, public keys, signed payloads, transaction hashes, smart contract interaction logs and validator attestations.
    • Device, browser & network metadata: IP address, user agent string, device fingerprint, locale, screen geometry and approximate geolocation derived therefrom.
    • Behavioural & analytics data: page view sequences, feature interactions, session duration and aggregated funnel telemetry.
    • Communications: support tickets, correspondence with the legal desk, governance forum posts and survey responses.
    Section 05

    On Chain Data & Immutability

    Owing to the cryptographic and distributed nature of SWSS Chain, certain categories of On Chain Data are irreversibly committed to the canonical ledger and replicated across the global validator set governed by SCP four pillar consensus (SAPE · DSA · PCA · BFTFA).

    Material Notice, Irreversible On Chain Storage
    Information that is broadcast to, or derived from, SWSS Chain Mainnet or Testnet, including but not limited to wallet addresses, transaction payloads, deed identifiers and validator attestations, is, by protocol design, permanent, public and beyond the Company's unilateral control. The right to erasure described in Section 10 cannot be exercised in respect of such On Chain Data. Data subjects should not transmit sensitive Personal Data through transaction memos, calldata or other on chain channels.

    The Company mitigates re identification risk through pseudonymisation, the use of zero knowledge attestations within the IVL, and the strict segregation of directly identifying attributes within Off Chain controlled environments operated under access controls described in Section 11.

    Section 06

    Purposes Of Processing

    • Service delivery: provisioning, authentication, and operation of accounts, wallets, deeds, swaps, bridges and validator nodes.
    • Regulatory compliance: Customer Due Diligence, sanctions and politically exposed person screening, transaction monitoring and Suspicious Activity Report ("SAR") filing.
    • Security & abuse prevention: fraud detection, anti Sybil controls, rate limiting, abuse forensics and incident response.
    • Validator set integrity: reputation scoring, uptime measurement and slashing administration within SWSS NodeX.
    • Product analytics: measurement and improvement of usability, performance and conversion outcomes.
    • Service communications: transactional notices, security alerts and material protocol announcements.
    Section 07

    Disclosure & Sub-Processors

    Personal Data may be disclosed to the following categories of recipients, in each case under contractual safeguards meeting the requirements of GDPR Art. 28 and equivalent statutes.

    • Cloud infrastructure providers furnishing compute, storage and content delivery services.
    • KYC and Customer Due Diligence vendors integrated into the IVL.
    • Sanctions, watch list and politically exposed person screening providers (OFAC, EU, UN, HMT).
    • Analytics, observability and customer engagement platforms operating under data processing agreements.
    • Professional advisers, auditors, banking partners and insurers, bound by legal or contractual confidentiality.
    • Competent authorities, courts and law enforcement bodies, where disclosure is required by enforceable legal process.

    An up to date register of Sub-Processors is furnished upon written request to the Legal Desk contact form below.

    Section 08

    International Transfers

    The Company may transfer Personal Data outside the European Economic Area, the United Kingdom or the data subject's jurisdiction of residence. Where such transfers occur, the Company relies on one or more of the following lawful mechanisms: (i) an adequacy decision issued by the competent authority; (ii) the European Commission Standard Contractual Clauses (Implementing Decision (EU) 2021/914) or the UK International Data Transfer Addendum; or (iii) any successor mechanism approved by the relevant supervisory authority.

    Where required, supplementary technical and organisational measures, including transport encryption, key compartmentalisation and access logging, are deployed to ensure an essentially equivalent level of protection.

    Section 09

    Retention

    Personal Data are retained for no longer than is necessary for the purposes for which they were collected, save where a longer retention period is mandated by applicable law. The indicative retention matrix below reflects the Company's current schedule; particular periods may be extended where required by regulatory obligation, legal proceedings or the legitimate interest assessment of the Company.

    CategoryRetention PeriodLegal Basis
    Account profile dataLife of relationship + 6 yearsContract, legitimate interest
    KYC / CDD records5–7 years post-termination6AMLD, FATF, BSA
    Transaction-monitoring logs5 years from creationLegal obligation
    Support correspondence24 monthsLegitimate interest
    Marketing consents & preferencesUntil withdrawnConsent
    On-chain artefactsPermanent (protocol design)Contract, public interest
    Section 10

    Data Subject Rights

    Subject to the qualifications set forth in applicable law and in Section 05 (On-Chain Immutability), data subjects are entitled to exercise the rights enumerated below by addressing a written request to the Legal Desk contact form below.

    10.1Access, Rectification & Portability
    The right to obtain confirmation as to whether Personal Data concerning the data subject is being processed and, where so, to obtain a copy thereof; the right to rectification of inaccurate data; and the right to receive Personal Data provided to the Company in a structured, commonly used and machine readable format.
    10.2Erasure ('Right To Be Forgotten')
    The right to obtain erasure of Personal Data in the circumstances prescribed by GDPR Art. 17, save that On Chain Data committed to the canonical SWSS Chain ledger is, by design, irreversibly recorded and cannot be erased.
    10.3Restriction, Objection & Automated Decisions
    The right to restrict processing, the right to object to processing carried out on the basis of legitimate interest, and the right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects, including in respect of validator reputation scoring within SWSS NodeX.
    10.4Complaint To A Supervisory Authority
    Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with a Supervisory Authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement.
    Section 11

    Security Measures

    The Company implements appropriate technical and organisational measures, calibrated to the state of the art and the risks inherent in the processing, including:

    • Encryption at rest using AES-256-GCM and encryption in transit using TLS 1.3.
    • Custody of cryptographic key material within FIPS 140-2 Level 3 hardware security modules.
    • Alignment with the SOC 2 Type II Trust Services Criteria and ISO/IEC 27001:2022 controls framework.
    • Role based access control, least privilege provisioning and immutable audit logging.
    • Validator integrity safeguarded by SCP v3.2.1 four pillar consensus and slashing for proven misbehaviour.
    • Independent penetration testing, threat modelling and continuous vulnerability management.
    Section 12

    Breach Notification

    The Company maintains a documented incident response programme designed to detect, contain, eradicate and remediate Personal Data breaches in accordance with GDPR Arts. 33 and 34.

    Notification SLA
    Where a Personal Data breach is likely to result in a risk to the rights and freedoms of natural persons, the Company shall notify the competent Supervisory Authority without undue delay and, where feasible, not later than seventy two (72) hours after having become aware of it. Where the breach is likely to result in a high risk, affected data subjects shall be notified directly without undue delay.
    Section 13

    Children's Data

    The SWSS Ecosystem is not directed to, and is not intended for use by, persons under the age of eighteen (18) years. The Company does not knowingly collect Personal Data from minors. Where the Company becomes aware that Personal Data of a minor has been collected, such data shall be deleted from active systems without undue delay, subject to any overriding legal retention obligation.

    Section 14

    Updates & Contact

    The Company reserves the right to amend this Policy from time to time to reflect changes in applicable law, regulatory guidance or operational practice. The version identifier and effective date are stated in the header of this document. Material amendments shall be notified to data subjects through the SWSS App, the institutional website or by email to the address on record, as appropriate.

    All enquiries, requests and complaints concerning this Policy or the exercise of data-subject rights should be directed to the Company's legal desk at the Legal Desk contact form below. A Data Protection Officer has been appointed and may be reached at the same address marked for the attention of the "DPO".