Effective Date: 19th August 2026
Corda Foundation Privacy Policy
This Privacy Notice (“Privacy Notice”) explains how Corda Foundation SEZC (“Corda,” “we,” “us,” or “our”) collects, uses, and discloses personal information about you. This Notice applies when you use our website at www.corda.xyz, interact with the Corda Protocol and our other services (together, the “Services”), contact our team, or otherwise engage with us. This Notice applies to all users of the Services, including Investors.
We may update this Notice from time to time. If we do, we will update the ‘Last Updated’ date above and, where a change is material, post a notice on our website. We encourage you to review this Notice periodically.
CONTENTS
- Collection of Information
- Use of Information
- Sharing of Information
- Cookies and Analytics
- Transfer of Information
- Your Choices
- Your Privacy Rights
- Additional Disclosures for Individuals in the EEA, UK, and Switzerland
- Children’s Personal Information
- Contact Us
COLLECTION OF INFORMATION
Information You Provide to Us
We collect information you provide directly to us. This includes information you give us when you connect a digital wallet through the Services; complete our identity verification (KYC/AML) process, including your name, date of birth, nationality, government-issued identification, a photograph for biometric comparison, and details of your source of funds; complete investor onboarding or subscription documentation, including your investor classification, bank details, tax identification information, and jurisdiction and eligibility confirmations; communicate with us by email, chat, or messaging features; participate in surveys, events, or interactive features such as forums or comment functions; apply for a job with us; or otherwise engage with us in connection with business development or partnership opportunities.
Note that your interactions with third-party wallet providers are governed by their own privacy policies, and any information you share through public or interactive features of the Services may be visible to others.
Information We Collect Automatically
When you use the Services, we automatically collect certain information, including:
- Device and Usage Information: IP address, browser and device type, operating system, cookie identifiers, and information about the pages you visit, links you click, and how you use the Services.
- Transaction and On-Chain Activity: records of transactions initiated through the Corda Protocol, including wallet addresses, token transfers, vault interactions, and on-chain state transitions. Some of this information is recorded on the Solana blockchain and is publicly accessible.
- Cookies and Similar Technologies: we, and third parties on our behalf, use cookies, pixel tags, and similar technologies to collect information about your use of the Services. See Your Choices below for more detail.
Information We Collect from Other Sources
We also receive information about you from third parties, including: our KYC/AML verification providers, who supply identity verification outcomes and risk scores; External Partners operating within the Corda Protocol ecosystem, such as fund managers, transfer agents, and distributors; the Solana blockchain, in connection with vault and investment activity; our on-chain monitoring and security providers; and any third-party platform through which you choose to access the Services.
USE OF INFORMATION
We use the information we collect to:
- Provide and operate the Services, including investment vaults, token subscription and redemption, and wallet connectivity;
- Conduct KYC/AML verification, eligibility checks, sanctions screening, and other regulatory compliance activities;
- Communicate with you about your account, transactions, and the Services, and respond to your requests;
- Develop, test, and improve the Corda Protocol and related technologies, including analytics and, where used, AI tools;
- Manage our relationships with External Partners, process job applications, and administer events;
- Detect, investigate, and prevent fraud, security incidents, and other malicious or unlawful activity, and protect the rights and property of Corda and others;
- Comply with our legal, regulatory, and contractual obligations; and
- Carry out any other purpose disclosed to you at the time your information was collected, or with your consent.
We may also use personal information for marketing purposes, such as to send you communications about the Services that may be of interest to you (see Your Choices below).
SHARING OF INFORMATION
We share personal information in the following circumstances:
- With service providers who perform functions on our behalf, such as hosting, KYC/AML verification, on-chain monitoring, analytics, and IT support;
- Through the Solana blockchain: where your activity interacts with the blockchain, certain transaction information (such as wallet addresses, amounts, and timestamps) is recorded on-chain and is publicly accessible; this information cannot be deleted or altered once recorded;
- With External Partners (such as fund managers, transfer agents, custodians, and distributors) as necessary to provide the Services, and with our corporate affiliates, including R3 Limited and other members of the R3 group — in each case subject to appropriate data protection terms; once information is shared with an External Partner or affiliate, it will also be subject to that party’s own privacy policy;
- Where we believe disclosure is required or appropriate to comply with law, legal process, or governmental requests, to protect the rights, property, or safety of Corda or others, or to investigate suspected unlawful activity;
- With our professional advisers, where necessary to obtain advice or protect our business interests; and
- In connection with a merger, financing, reorganisation, or other corporate transaction.
COOKIES AND ANALYTICS
We and our service providers use cookies, pixel tags, and similar technologies to recognise your device, understand how the Services are used, and improve their performance. We may also allow analytics providers to collect information about your use of the Services in this way. You can control cookies through your browser or device settings; see Your Choices below.
TRANSFER OF INFORMATION
We and our service providers operate in multiple jurisdictions, and personal information may be transferred to, stored, and processed in countries that do not offer the same level of data protection as your home jurisdiction, including outside the EEA and UK. Where we transfer personal information from the EEA or UK to a country without an adequate level of protection, we use appropriate safeguards, such as the EU Standard Contractual Clauses or the UK International Data Transfer Agreement. Contact us as set out below for further information.
YOUR CHOICES
Cookies. You can usually set your browser to reject cookies or alert you when they are used; note that this may affect how the Services function. Cookie-based controls do not work on mobile applications, and you may need to adjust settings separately on each device and browser you use. Our Cookie policy can be seen here: https://corda.xyz/cookies
Do Not Track. We do not currently respond to browser “Do Not Track” signals.
Communications. You may opt out of marketing communications using the unsubscribe link in any email. You cannot opt out of communications that are necessary to the Services, such as transaction confirmations or updates to this Notice.
YOUR PRIVACY RIGHTS
Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information; to receive a portable copy of it; or to withdraw any consent you have given for its processing (withdrawal will not affect processing already carried out). Some rights may be limited in the context of regulated financial services — for example, we are required to retain KYC/AML records for the periods required by applicable anti-money laundering legislation, notwithstanding a deletion request. To exercise any of these rights, contact us as set out below.
ADDITIONAL DISCLOSURES FOR INDIVIDUALS IN THE EEA, UK, AND SWITZERLAND
If you are located in the EEA, UK, or Switzerland, this section applies to you in addition to the above.
Legal Basis for Processing
We process personal information on the following legal bases: performance of a contract with you; our legitimate interests in operating and securing the Services; compliance with our legal obligations, including AML/KYC requirements; and, where applicable, your consent — for example, for marketing, or for processing special category data such as biometric information for identity verification. You may withdraw consent at any time.
Data Retention
We retain personal information for as long as necessary to provide the Services and fulfil the purposes described in this Notice, including to meet legal and regulatory requirements. KYC/AML records are generally retained for a minimum of five years from the end of the relevant relationship, or such longer period as applicable law requires. Transaction data recorded on the Solana blockchain persists indefinitely and cannot be deleted or altered, given the nature of blockchain technology — this should be considered before initiating any transaction.
Questions or Complaints
You have the right to lodge a complaint with your local supervisory authority. Contact details can be found at:
CHILDREN’S PERSONAL INFORMATION
The Services are not directed to children under 18 years of age (or such other age as required by applicable local law), and we do not knowingly collect personal information from children. The Services are available only to professional and eligible investors and institutional participants, and are not suitable for minors. If you believe a child has provided us with personal information through the Services, please contact us as set out below.
CONTACT US
Corda Foundation is the controller of the personal information described in this Notice. If you have questions about this Notice, or wish to exercise your rights, please contact us at:
Corda Foundation
Attn: Privacy Team
Email: privacy@corda.xyz
Address: c/o Highvern Cayman Limited, at PO Box 448, Elgin Court, Elgin Avenue, George Town, Grand Cayman, Ky1-1106, Cayman Islands