AFRX Security Token

Privacy Policy

Issued by: Afrail Inc.
Effective Date: May 26, 2025
Last Updated: May 26, 2025

Privacy Policy for AFRX Security Token Platform (AFRX.io)

This Privacy Policy describes how Afrail Inc. ("Company," "we," "our," or "us"), a Delaware corporation and the issuer of the AFRX Security Token (ERC-3643, built on the ERC-1400 base standard), collects, uses, stores, shares, and protects your personal information through its website located at afrx.io and affiliated services provided by our partners, including Tokeny S.A. ("Tokeny") and Sumsub ("Sumsub").

This document outlines the terms, risks, and legal conditions governing the AFRX Security Token issued by Afrail Inc.

By accessing or using afrx.io, or engaging with any services related to the purchase, issuance, or management of the AFRX Security Token, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Information We Collect

a. Information You Provide to Us (Afrail Inc.)

• Full legal name
• Email address
• Phone number
• Mailing address
• Country of residence
• Wallet address (for receipt of tokens)
• Signed agreements (e.g., Purchase Agreement)
• Communication records (emails, messages, support requests)

b. Information Collected by Tokeny

Tokeny is our tokenization infrastructure provider. When you create an account on the Tokeny-powered portal, they may collect:

• Identification data (name, email, phone)
• Wallet address
• Transaction history on the platform
• IP address and browser/device metadata
• Investor eligibility data (via T-REX compliance rules)

c. Information Collected by Sumsub

Sumsub is our compliance partner for KYC/AML and investor verification. Information collected may include:

• Government-issued ID
• Proof of address
• Selfie or biometric data for ID verification
• Sanctions screening results
• Date of birth and nationality
• IP address and geolocation

2. How We Use Your Information

We use the collected information to:

• Verify investor identity and eligibility (KYC/AML compliance)
• Facilitate the purchase and issuance of AFRX Security Tokens
• Comply with applicable securities laws and regulations (including Reg D and Reg S)
• Operate, maintain, and improve our website and Tokeny portal
• Communicate with investors about updates, token activity, legal compliance, and support
• Generate anonymized analytics to improve investor experience

3. Legal Basis for Processing

Our legal basis for collecting and using your personal information includes:

• Performance of a contract (e.g., Purchase Agreement)
• Compliance with legal obligations (e.g., securities laws, anti-money laundering regulations)
• Legitimate interest in maintaining investor security and platform integrity
• Consent (where required by law, such as marketing communications)

4. Information Sharing and Disclosure

We may share your personal information with the following categories of recipients:

• Tokeny S.A. for issuance and lifecycle management of your AFRX Security Tokens
• Sumsub for identity verification and AML/KYC compliance
• Legal and compliance service providers involved in managing the security token issuance
• Regulatory authorities when legally obligated to do so (e.g., SEC, FINRA)
• Third-party custodians, wallets, or exchanges for secondary market activities, if applicable (e.g., INX, tZERO)

We do not sell your personal data to any third parties.

5. Data Storage and Security

We implement robust technical and organizational security measures to protect your personal information, including:

• Encrypted transmission via SSL/TLS
• Data encryption at rest
• Role-based access control
• Secure cloud infrastructure partners
• Regular penetration testing and security assessments
• Tokeny and Sumsub maintain their own independent security and privacy policies. Please refer to:
  • Tokeny Privacy Policy: https://tokeny.com/privacy-policy/
  • Sumsub Privacy Policy: https://sumsub.com/privacy-notice/

6. Data Retention

We retain your personal information only as long as necessary to fulfill legal, regulatory, and operational requirements, including:

• Regulatory audit and reporting (e.g., 5–7 years)
• AML/KYC recordkeeping
• Legal defense and dispute resolution

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access and obtain a copy of your data
• Correct or update inaccurate information
• Withdraw consent (where applicable)
• Request deletion of your data
• Object to processing under legitimate interests
• Lodge a complaint with a supervisory authority

To exercise your rights, contact us at: privacy@afrx.io.

8. Cross-Border Transfers

As a global investment platform, your data may be stored or processed in jurisdictions outside your home country, including the United States, the EU, and cloud infrastructure regions. We ensure adequate safeguards are in place as required by applicable data protection laws.

9. Third-Party Services and Links

Our website and services may contain links to third-party services, including Tokeny, Sumsub, INX, or tZERO. We are not responsible for their privacy practices or content. Please review their privacy notices directly.

10. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal, technical, or business developments. Updates will be posted on this page with an updated effective date.

11. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact:

Attn.: Data Protection Officer
Afrail Inc.
101 Marietta Street NW
Atlanta, GA 30303
USA

Email: privacy@afrx.io
Website: afrx.io
GitHub Repository: github.com/afrail-inc/afrx-security-token