Last updated: 27 October 2026

This Privacy Policy and Data Processing Terms (this “Policy”) describes how Triangle collects, uses, discloses and protects Personal Data, and sets out the terms on which Triangle Processes Personal Data on behalf of its Subscribers. It applies to Triangle together with its affiliates, including Triangle Digital Limited (“TRI”) (collectively, “Triangle”, “we”, “us” or “our”).

This Policy forms part of and is incorporated into the General Terms and Conditions and any applicable Confirm Order, Developer Terms or other agreement governing the provision of Services (collectively, the “Agreement”). By using our Website or Service, you acknowledge the practices described in this Policy.

Triangle acts as a data controller when it determines the purposes and means of Processing Personal Data, for example in relation to visitors to our Website and users of our Service. Triangle acts as a data processor when it Processes Personal Data on behalf of a Subscriber in connection with the Services, in which case the data-processing provisions of this Policy and the Schedules apply and references to “TRI” mean the Triangle entity acting as Processor on behalf of that Subscriber.

We comply with applicable data protection laws, including the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR, the Bermuda Personal Information Protection Act 2016 (“PIPA”), and applicable United States state privacy laws.

For purposes of this Policy:

“Account” means a unique account created for you to access our Service or parts of it.

“Affiliate” means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or voting securities.

"Applicable Data Protection Law" means any privacy, data protection or data security law applicable to the Processing of Personal Data under the Agreement, including, where applicable:

(a) the Bermuda Personal Information Protection Act 2016 ("PIPA");
(b) Regulation (EU) 2016/679 ("GDPR");
(c) applicable national legislation implementing or supplementing GDPR;
(d) the California Consumer Privacy Act of 2018, as amended ("CCPA"); and
(e) other applicable United States state privacy laws.

"Controller" means the entity that determines the purposes and means of Processing Personal Data and includes an "organisation" to the extent that term is applicable under PIPA and a "business" where applicable under the CCPA.

“Consumer” means, for the purposes of applicable United States state privacy laws, a natural person who is a resident of the relevant state.

“Cookies” means small files placed on your device that enable certain features and functionality of the Service.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates and includes an "individual", "consumer" or equivalent term under Applicable Data Protection Law.

"Personal Data" means any information relating to an identified or identifiable natural person and includes "personal information" and equivalent terms under Applicable Data Protection Law.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise Processed, and any materially equivalent event constituting a breach of security under Applicable Data Protection Law.

"Process", "Processing" and "Processed" mean any operation or set of operations performed upon Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, transmission, disclosure, combination, restriction, erasure or destruction.

"Processor" means an entity that Processes Personal Data on behalf of a Controller and includes a "service provider", "contractor" or equivalent role where applicable under Applicable Data Protection Law.

"Restricted Transfer" means a transfer of Personal Data that requires an approved transfer mechanism or other safeguard under Applicable Data Protection Law.

“Service” means the Triangle application, platform and Website through which Triangle facilitates the issuance and selling of digital assets.

“Subscriber” means a customer that has entered into the Agreement with Triangle and on whose behalf TRI Processes Personal Data in connection with the Services.

"Subprocessor" means a third party engaged by TRI to Process Personal Data on behalf of Subscriber in connection with the Services.

"Supervisory Authority" means a public authority having regulatory or supervisory authority over protection of Personal Data, including, where applicable, the Privacy Commissioner for Bermuda or a competent data protection supervisory authority established pursuant to GDPR.

“Triangle” (also “we”, “us” or “our”) means Triangle together with its affiliates, including Triangle Digital Limited (“TRI”).

“Usage Data” means data collected automatically through use of the Service, such as IP address, device and browser type, pages visited, time and date of visit and other diagnostic data.

“Website” means Triangle’s website, accessible at www.triangle.digital, and related domains.

Terms including "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach" and "Processing" shall, where Applicable Data Protection Law uses materially equivalent terminology, be interpreted to include that equivalent terminology.

Capitalised terms not defined in this Policy have the meanings given to them in the Agreement.

This Policy applies only to Processing of Personal Data by TRI on behalf of Subscriber in connection with the Services.

Except where the Parties expressly agree otherwise, Subscriber acts as Controller and TRI acts as Processor in respect of Personal Data Processed by TRI on behalf of Subscriber.

Where TRI determines the purposes and means of Processing for its own legitimate purposes or to satisfy obligations imposed directly upon TRI by law or regulation, including applicable obligations relating to anti-money laundering, counter-terrorist financing, sanctions screening, fraud prevention, regulatory compliance, record keeping, security, incident investigation or the exercise or defence of legal rights, TRI shall act as an independent Controller or equivalent entity in respect of that Processing.

Such Processing shall not be subject to Subscriber's instructions under Section 5 except to the extent required by Applicable Data Protection Law.

Subscriber is responsible for ensuring that:

(a) its instructions to TRI comply with Applicable Data Protection Law;
(b) it has an appropriate lawful basis for the collection and Processing of Personal Data submitted to the Services;
(c) required notices have been provided to Data Subjects;
(d) any permissions or consents required by Applicable Data Protection Law have been obtained;
(e) Personal Data provided to TRI is appropriate, relevant and limited to what is reasonably necessary for the purposes for which it is Processed; and
(f) Subscriber does not instruct TRI to Process Personal Data in violation of Applicable Data Protection Law.

When you create an Account, use the Service or contact us, we may collect Personal Data you provide, including your name, email address, postal address, telephone number, and information necessary to facilitate the issuance and selling of digital assets, such as identity-verification and know-your-customer information and payment details.

We automatically collect Usage Data when you access the Service, including your device’s IP address, browser type and version, the pages of the Service that you visit, the time and date of your visit, the time spent on those pages, and other diagnostic data.

We use Cookies and similar tracking technologies to operate and improve the Service, including strictly necessary cookies, functionality cookies, and analytics and performance cookies. You can instruct your browser to refuse Cookies, although some features of the Service may not function properly. Further detail is set out in the “Cookies and Do Not Track” section below.

Where Triangle provides the Services to a Subscriber, Triangle Processes Personal Data on that Subscriber’s behalf as a Processor. The categories of Personal Data and Data Subjects Processed in that capacity are described in Schedule 1 (Details of Processing).

We use Personal Data for the purposes described below. Where Triangle acts as a Controller, we rely on the legal bases set out in this section. Where Triangle acts as a Processor, we Process Personal Data only on the documented instructions of the relevant Subscriber as described in the “Processing Instructions” section.

We use Personal Data to:

• provide, operate, maintain and improve the Service and your Account;
• verify identity and comply with know-your-customer, anti-money-laundering, sanctions and other legal and regulatory obligations;
• facilitate the issuance and selling of digital assets and process related payments;
• communicate with you, including service, security and transactional messages;
• provide news, offers and marketing where permitted by law;
• respond to and manage your requests and enquiries;
• monitor, secure and analyse use of the Service and prevent fraud and misuse; and
• evaluate or conduct a merger, acquisition, reorganisation or other business transfer.

Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases: performance of a contract with you or to take steps at your request before entering into a contract; compliance with a legal obligation to which we are subject; your consent, which you may withdraw at any time; our legitimate interests, provided these are not overridden by your interests, rights and freedoms; and, where necessary, protection of vital interests or performance of a task carried out in the public interest.

Where PIPA applies, Triangle uses Personal Information consistently with the Bermuda Personal Information Protection Act 2016, including by limiting use to purposes that are proportionate and necessary, providing appropriate notice, and relying on a lawful basis permitted under PIPA, such as your consent or the performance of a contract.

Where required by law, we will obtain your consent before sending marketing communications. You may opt out of marketing at any time by following the unsubscribe instructions in our messages or by contacting us using the details in the “Contact Us” section.

TRI shall Process Personal Data only:

(a) for the purposes of providing, maintaining, securing and supporting the Services;
(b) in accordance with the Agreement, applicable Confirm Order and this Policy;
(c) in accordance with documented instructions provided by Subscriber; or
(d) as otherwise required by applicable law.

If applicable law requires TRI to Process Personal Data other than in accordance with Subscriber's documented instructions, TRI shall inform Subscriber of that legal requirement before Processing unless applicable law prohibits such notification.

If TRI reasonably believes that a Subscriber instruction infringes Applicable Data Protection Law, TRI may notify Subscriber and suspend performance of the affected instruction until the Parties resolve the matter.

TRI shall not be required to obtain independent legal advice concerning the lawfulness of Subscriber's instructions.

TRI shall ensure that persons authorised to Process Personal Data:

(a) are subject to appropriate contractual, statutory or professional confidentiality obligations;
(b) are authorised to access Personal Data only to the extent reasonably necessary for the performance of their duties; and
(c) receive appropriate privacy and information security awareness or training relevant to their roles.

TRI shall implement and maintain appropriate administrative, technical, organisational and physical safeguards designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

In determining appropriate security measures, TRI may take into account:

(a) the state of the art;
(b) costs of implementation;
(c) the nature, scope, context and purposes of Processing;
(d) the nature and sensitivity of Personal Data;
(e) the likelihood and severity of risks to Data Subjects;
(f) the nature, scale and complexity of the Services; and
(g) applicable legal and regulatory requirements.

TRI's security programme shall include controls appropriate to the relevant risks, which may include:

(a) identity and access management;
(b) multi-factor authentication;
(c) privileged access controls;
(d) encryption and cryptographic protection;
(e) network, endpoint, application and cloud security;
(f) vulnerability and patch management;
(g) secure software development;
(h) logging, monitoring and security alerting;
(i) malware protection;
(j) security incident response;
(k) business continuity and disaster recovery;
(l) personnel security and awareness;
(m) third-party security management;
(n) data retention and secure disposal; and
(o) controls protecting API credentials, digital wallets, cryptographic keys and other security-sensitive material where applicable.

Additional technical and organisational measures may be described in Schedule 2 to this Policy.

TRI may update its technical and organisational measures from time to time provided that such updates do not materially reduce the overall level of protection applicable to Personal Data during the term of the Agreement.

Subscriber grants TRI general authorisation to engage Subprocessors for Processing reasonably necessary to provide, secure, host, operate, maintain or support the Services.

Before permitting a Subprocessor to Process Personal Data on behalf of Subscriber, TRI shall enter into a written agreement with that Subprocessor imposing data protection and confidentiality obligations appropriate to the Processing and, where required by GDPR, obligations providing substantially equivalent protection to the obligations imposed on TRI by this Policy.

TRI remains responsible for the performance of its obligations under this Policy notwithstanding its appointment of a Subprocessor, subject to the limitations and exclusions of liability set out in the Agreement to the extent permitted by Applicable Data Protection Law.

Where required by Applicable Data Protection Law, TRI shall make available information concerning its then-current material Subprocessors and shall provide reasonable advance notice of intended additions or replacements.

Subscriber may object to a new Subprocessor on reasonable and documented data protection grounds by notifying TRI within ten (10) business days following notice of the proposed appointment.

The Parties shall work in good faith to address the objection.

Where the Parties cannot reasonably resolve the objection and TRI cannot provide the applicable Services without the proposed Subprocessor, Subscriber may terminate the affected portion of the Services upon written notice, without terminating Services not affected by the relevant Processing.

An objection shall not entitle Subscriber to require TRI to materially redesign the Services or prevent TRI from using a Subprocessor across its customer base.

We may disclose and share Personal Data in the circumstances described below, in each case subject to Applicable Data Protection Law.

We share Personal Data with third-party service providers and Subprocessors that perform functions on our behalf, such as web analytics (for example, Google Analytics), email and marketing (for example, HubSpot), payment processing (for example, Stripe), and fraud prevention and security (for example, Invisible reCAPTCHA). These providers may Process Personal Data only for the purposes we specify and subject to appropriate confidentiality and data-protection obligations.

We may share Personal Data among Triangle and its affiliates, including Triangle Digital Limited, for the purposes described in this Policy.

If Triangle is involved in a merger, acquisition, financing, reorganisation or sale of assets, Personal Data may be transferred as part of that transaction, subject to this Policy.

We may disclose Personal Data where required to do so by law or in response to valid requests by public authorities, to enforce our agreements and policies, to protect the rights, property or safety of Triangle, our users or others, or to detect, prevent or address fraud, security or technical issues.

Triangle does not sell Personal Data for monetary consideration. Certain disclosures to service providers for advertising, marketing or analytics may be considered a “sale” or “sharing” under some United States state privacy laws; where applicable, you may exercise the right to opt out as described in the “Your Privacy Rights” section.

Where TRI receives a request directly from a Data Subject concerning Personal Data TRI Processes solely on behalf of Subscriber, TRI shall, where reasonably practicable and legally permitted:

(a) direct the Data Subject to Subscriber; or
(b) notify Subscriber of the request.

TRI shall not independently respond substantively to such a request except upon Subscriber's documented instructions or where required by applicable law.

Taking into account the nature of the Processing, TRI shall provide reasonable assistance to Subscriber through appropriate technical and organisational measures to enable Subscriber to respond to requests by Data Subjects exercising rights under Applicable Data Protection Law.

Such rights may include, where applicable, rights of:

(a) access;
(b) correction or rectification;
(c) deletion or erasure;
(d) restriction;
(e) objection;
(f) data portability;
(g) withdrawal of consent; and
(h) rights relating to certain automated decision-making activities.

Depending on where you are located and the law that applies, you may have the rights described below in relation to your Personal Data. Where available, you may access and update certain Personal Data directly within your Account settings. To exercise any of these rights, contact us using the details in the “Contact Us” section. We will respond within the time required by Applicable Data Protection Law. Where Triangle Processes Personal Data as a Processor on behalf of a Subscriber, we will refer your request to that Subscriber and assist them as described in the “Data Subject Requests” section.

If you are in the EU or UK, you have the right to:

• access the Personal Data we hold about you and receive a copy of it;
• request rectification of inaccurate or incomplete Personal Data;
• request erasure of your Personal Data in certain circumstances;
• request restriction of, or object to, our Processing in certain circumstances;
• data portability, where Processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time where Processing is based on consent; and
• lodge a complaint with a competent Supervisory Authority.

If the Bermuda Personal Information Protection Act 2016 applies, you have the right to be informed about the use of your Personal Information, to request access to and correction of your Personal Information, to request that we stop or not begin using your Personal Information in certain circumstances, to rights in relation to automated decision-making, and to make a complaint to the Privacy Commissioner for Bermuda.

If you are a resident of a United States state with an applicable privacy law (including California under the CCPA/CPRA), you may have the right to:

• know and access the categories and specific pieces of personal information we collect, use, disclose and share;
• delete personal information we have collected from you, subject to exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information and of targeted advertising;
• limit the use and disclosure of sensitive personal information; and
• not receive discriminatory treatment for exercising your rights.

To exercise your rights, submit a request using the details in the “Contact Us” section. We may need to verify your identity before responding and may decline requests where permitted by law. You may use an authorised agent to submit a request on your behalf. We do not charge a fee unless your request is manifestly unfounded or excessive.

You may opt out of any sale or sharing of personal information by contacting us or using any opt-out mechanism we make available on the Website. California residents may also request information about disclosures of personal information to third parties for their direct marketing purposes under California’s “Shine the Light” law.

TRI shall notify Subscriber without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed by TRI on behalf of Subscriber.

Where reasonably practicable, TRI shall provide initial notification within twenty-four (24) hours after TRI confirms that such Personal Data Breach has occurred.

TRI shall provide information reasonably available to it which may include:

(a) a description of the nature of the Personal Data Breach;
(b) the categories of Personal Data affected;
(c) the categories and, where reasonably ascertainable, approximate number of affected Data Subjects;
(d) the approximate number of affected Personal Data records where reasonably ascertainable;
(e) known or reasonably anticipated consequences;
(f) containment and remediation measures taken or proposed;
(g) recommended measures for Subscriber where applicable; and
(h) an appropriate contact point for further information.

TRI may provide information in phases where complete information is not available at the time of initial notification.

Unless required by applicable law, TRI shall not make a notification to a Supervisory Authority or affected Data Subjects on Subscriber's behalf without Subscriber's authorisation.

Nothing in this Section restricts TRI from reporting an incident where TRI is independently required to do so by law or by a competent governmental or regulatory authority.

Notification or investigation of a Personal Data Breach does not constitute an admission by TRI of fault, negligence, liability or breach of the Agreement.

Taking into account the nature of the Processing and information available to TRI, TRI shall provide reasonable assistance to Subscriber with:

(a) data protection impact assessments required under Applicable Data Protection Law; and
(b) any required prior consultation with a competent Supervisory Authority concerning Processing performed by TRI on behalf of Subscriber.

Subscriber remains principally responsible for determining whether a data protection impact assessment or prior consultation is required for Subscriber's Processing activities.

Where TRI or a Subprocessor makes a Restricted Transfer, the Parties shall implement an appropriate transfer mechanism where required by Applicable Data Protection Law.

Where Personal Data subject to GDPR is transferred to a recipient in a country outside the European Economic Area that is not covered by an applicable adequacy decision or other lawful basis for the transfer, the Parties shall use an appropriate mechanism permitted under Chapter V of GDPR.

Where required for a Restricted Transfer from Subscriber to TRI, the Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914 ("EU SCCs") shall be incorporated into this Policy by reference and shall apply to the relevant transfer.

Unless the nature of the Processing requires otherwise:

(a) Module Two shall apply where Subscriber is a Controller and TRI is a Processor;
(b) Module Three shall apply where Subscriber is a Processor and TRI is a Processor;
(c) the optional docking clause shall apply;
(d) general written authorisation shall apply to Subprocessors;
(e) the governing law for the EU SCCs shall be the law of an EU Member State that permits third-party beneficiary rights under the EU SCCs; and
(f) the competent supervisory authority shall be determined in accordance with the EU SCCs.

The information contained in Schedules 1 and 2 of this Policy shall populate the relevant annexes to the EU SCCs to the extent appropriate.

Nothing in this Policy varies or modifies the EU SCCs in a manner prohibited by the EU SCCs.

TRI shall provide information reasonably available to TRI and reasonably necessary for Subscriber to conduct a transfer impact assessment relating to a Restricted Transfer involving TRI.

TRI may protect confidential, security-sensitive or third-party information through reasonable confidentiality controls when providing such information.

Where PIPA applies to a transfer of Personal Information to an overseas third party, the Party responsible for the transfer shall comply with applicable PIPA requirements concerning assessment and protection of Personal Information transferred overseas.

Where TRI transfers Personal Information subject to PIPA to an overseas Subprocessor and a comparable level of protection cannot otherwise reasonably be established, TRI shall implement contractual, corporate or other safeguards appropriate to the requirements of PIPA.

Upon termination or expiry of the Services involving Processing of Personal Data, TRI shall, at Subscriber's choice and subject to the technical capabilities of the Services, return or delete Personal Data Processed solely on behalf of Subscriber, except to the extent retention is required by applicable law or regulatory obligation.

TRI may retain Personal Data:

(a) where required by law or regulation;
(b) to comply with applicable AML, sanctions, financial-services, accounting, audit or regulatory record-retention requirements;
(c) where reasonably required for the establishment, exercise or defence of legal claims; or
(d) within backup or disaster-recovery systems until deletion occurs through TRI's ordinary backup retention cycle.

Any Personal Data retained pursuant to this Section shall remain subject to the applicable confidentiality and security provisions of this Policy for so long as it remains Personal Data.

TRI shall make available information reasonably necessary to demonstrate compliance with its obligations as a Processor under applicable Data Protection Law.

TRI may satisfy such requests by providing, as appropriate:

(a) security and privacy documentation;
(b) relevant policies or policy summaries;
(c) completed security questionnaires;
(d) independent certification or assurance reports, where available;
(e) vulnerability or penetration-testing summaries; or
(f) other reasonably equivalent assurance materials.

Where information provided under Section 16.1 is not reasonably sufficient to demonstrate compliance and Applicable Data Protection Law requires an audit right, Subscriber may conduct an audit or appoint an independent auditor to do so, subject to:

(a) reasonable prior written notice;
(b) reasonable frequency and scope;
(c) appropriate confidentiality obligations;
(d) the audit not unreasonably disrupting TRI's operations;
(e) the audit not exposing information relating to other TRI customers;
(f) reasonable security restrictions imposed by TRI; and
(g) Subscriber bearing its own audit costs unless Applicable Data Protection Law requires otherwise.

TRI may satisfy an audit request through independent third-party assurance where that assurance reasonably addresses the subject matter concerned.

Nothing in this Policy limits the lawful powers of a competent Supervisory Authority or the Bermuda Monetary Authority.

Where PIPA applies, TRI shall Process Personal Information in accordance with the obligations applicable to TRI under PIPA.

TRI shall maintain reasonable safeguards against loss, unauthorised access, destruction, use, modification, disclosure or other misuse of Personal Information, having regard to the likelihood and severity of harm, sensitivity of the Personal Information and context in which it is held.

Where TRI engages an overseas third party in connection with Personal Information subject to PIPA, TRI shall implement measures appropriate to TRI's obligations under PIPA concerning third-party use and overseas transfers.

Nothing in this Policy transfers to TRI responsibility for PIPA obligations that apply to Subscriber independently as an organisation using Personal Information.

This Section applies only to the extent that a United States state privacy law applies to Personal Data Processed by TRI on behalf of Subscriber.

Where TRI acts as a service provider, contractor or processor under applicable United States privacy law, TRI shall:

(a) Process Personal Data for the limited and specified purposes described in the Agreement and Subscriber's documented instructions;
(b) not sell Personal Data or share it for cross-context behavioural advertising where prohibited by applicable law;
(c) not retain, use or disclose Personal Data outside the direct business relationship between TRI and Subscriber except as permitted by applicable law;
(d) not combine Personal Data received from Subscriber with Personal Data received from or collected on behalf of another person or collected from TRI's own interaction with a consumer except where such combination is permitted by applicable law;
(e) provide the same level of privacy protection required of TRI by applicable law with respect to such Processing;
(f) notify Subscriber if TRI determines that it can no longer meet an applicable legal obligation relating to such Personal Data; and
(g) provide reasonable assistance enabling Subscriber to comply with applicable consumer privacy requests.

Where required by applicable law, Subscriber may take reasonable and appropriate steps to help ensure TRI uses Personal Data consistently with Subscriber's applicable obligations and may require TRI to stop and remediate any unauthorised use.

Nothing in this Section causes the CCPA or another United States privacy law to apply to a Party, Processing activity or Data Subject where that law would not otherwise apply.

The Service is not directed to, and we do not knowingly collect Personal Data from, children under the age of 16. For consistency across the jurisdictions in which we operate, we apply the age of 16 as our minimum threshold, regardless of any lower age permitted under a particular law. If you are under 16, please do not use the Service or provide us with any Personal Data.

If we become aware that we have collected Personal Data from a child under 16 without appropriate consent from a parent or guardian, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us using the details in the “Contact Us” section. Where we rely on consent as the legal basis for Processing and the applicable law requires parental consent, we will seek the consent of a parent or guardian before collecting or using the child’s Personal Data.

We use Cookies and similar technologies to operate, secure and improve the Service and to understand how it is used. These include strictly necessary cookies, functionality cookies, and analytics and performance cookies (for example, Google Analytics). You can set your browser to refuse Cookies or to indicate when a Cookie is being sent; however, some parts of the Service may not function properly without Cookies.

Some browsers offer a “Do Not Track” (DNT) setting. There is no uniform industry standard for responding to DNT signals. Unless we state otherwise, our Service does not currently respond differently to DNT signals, consistent with the California Online Privacy Protection Act (CalOPPA). Where required by law, we honour recognised opt-out preference signals for the sale or sharing of personal information.

TRI shall reasonably cooperate with Subscriber regarding an enquiry or investigation by a competent Supervisory Authority relating directly to Personal Data Processed by TRI on behalf of Subscriber.

TRI may communicate directly with a Supervisory Authority where required by law or regulation.

Nothing in this Policy requires TRI to waive legal privilege, disclose another customer's confidential information, compromise security controls or disclose information prohibited from disclosure by law or regulation.

The limitations and exclusions of liability contained in the Agreement apply to this Policy to the fullest extent permitted by Applicable Data Protection Law.

Nothing in the Agreement or this Policy limits or excludes liability to the extent such liability cannot lawfully be limited or excluded.

In the event of conflict regarding Processing of Personal Data, the following order of precedence applies:

(a) applicable mandatory requirements of Applicable Data Protection Law;
(b) the EU SCCs, to the extent applicable;
(c) this Policy;
(d) the Agreement; and
(e) an applicable Confirm Order,

except where a Confirm Order expressly states that a provision is intended to amend this Policy and such amendment is permissible under Applicable Data Protection Law.

This Policy becomes effective when the Agreement becomes effective or when TRI first Processes Personal Data on behalf of Subscriber, whichever occurs first.

This Policy continues for so long as TRI Processes or retains Personal Data subject to this Policy.

We may update this Policy from time to time. We will post the updated version and revise the “Last updated” date at the top of this Policy. Where required by Applicable Data Protection Law, we will provide additional notice or seek your consent. Your continued use of the Service after an update takes effect constitutes acknowledgement of the revised Policy.

If you have any questions about this Policy or our Processing of Personal Data, or if you wish to exercise your rights, you can contact us:

• By email: hello@triangle.digital or compliance@triangle.digital

The data controller responsible for Personal Data Processed in connection with the Website and Service is Triangle, including its relevant affiliate (such as Triangle Digital Limited). Where Triangle Processes Personal Data on behalf of a Subscriber, the Subscriber is the Controller and you should direct your request to that Subscriber; Triangle will assist as described in this Policy.

If you are in the EU or UK, or where PIPA applies, you may contact us at the address above regarding your Personal Data. Where we are required to appoint a Data Protection Officer, EU/UK representative, or a privacy officer under PIPA, their contact details will be provided on request.

Processing of Personal Data as reasonably necessary to provide, operate, secure, maintain and support the Services described in the Agreement and applicable Confirm Order.

For the term of the Agreement and any additional period during which Personal Data is retained in accordance with the Agreement, this Policy or applicable legal or regulatory requirements.

Processing may include:

• account creation and administration;
• user authentication and access management;
• operation of the TRI-P;
• provision of registry and digital-asset functionality;
• processing and recording Subscriber instructions;
• API operation and integration;
• identity and compliance verification;
• customer and technical support;
• fraud and security monitoring;
• cybersecurity and incident management;
• hosted data storage;
• regulatory and compliance functions where performed on behalf of Subscriber; and
• other Processing reasonably necessary to provide the Services requested by Subscriber.

Depending on Subscriber's use of the Services, Data Subjects may include:

• Subscriber personnel;
• Authorized Users;
• Subscriber customers and prospective customers;
• directors and officers;
• beneficial owners;
• shareholders or other ownership participants;
• authorised representatives;
• counterparties;
• registry participants;
• compliance contacts;
• contractors and service providers; and
• other individuals whose Personal Data Subscriber submits to the Services.

Depending on use of the Services, Personal Data may include:

• name;
• business and personal contact details;
• account and user identifiers;
• employment and organisational information;
• IP address and device information;
• authentication and security information;
• usage and audit information;
• transactional and registry information;
• beneficial ownership information;
• identity verification information;
• government-issued identification details;
• compliance information;
• sanctions and politically exposed person screening results;
• adverse-media or risk-screening information;
• payment or billing information where applicable;
• API and system activity associated with identifiable users; and
• other Personal Data submitted by Subscriber through the Services.

Depending upon the Services and Subscriber's configuration, Processing may include information treated as sensitive, special-category or higher-risk Personal Data under Applicable Data Protection Law.

Subscriber shall not submit special-category or other sensitive Personal Data unless such Processing is reasonably necessary for Subscriber's use of the Services and Subscriber has established an appropriate lawful basis and otherwise complied with Applicable Data Protection Law.

Processing may occur continuously or intermittently throughout Subscriber's use of the Services.

Personal Data shall be retained for the term necessary to provide the Services and thereafter in accordance with TRI's applicable retention requirements, the Agreement, legal and regulatory obligations and Section 15 of this Policy.

TRI shall maintain technical and organisational measures appropriate to the risk associated with the Processing. Such measures shall include, where appropriate to the relevant Services:

• documented information security policies;
• defined security responsibilities;
• risk assessment and treatment processes;
• privacy and security awareness; and
• periodic review of security measures.

• unique user identities where appropriate;
• role-based or need-based access;
• privileged-access restrictions;
• access provisioning and deprovisioning;
• periodic access review; and
• multi-factor authentication for security-sensitive or privileged access where appropriate.

• encryption of Personal Data in transit using appropriate cryptographic protocols;
• risk-appropriate protection of Personal Data at rest;
• protection of passwords and authentication secrets;
• controls applicable to API credentials; and
• cryptographic key management where TRI controls cryptographic keys.

• appropriately configured infrastructure;
• network security controls;
• logical segregation;
• endpoint and server protection;
• cloud security controls;
• change-management processes; and
• backup and recovery mechanisms.

• vulnerability identification;
• risk-based remediation;
• security patch management;
• periodic vulnerability assessment; and
• penetration testing appropriate to the risk profile of material externally accessible Services.

• secure development practices;
• change control;
• code review or equivalent quality controls where appropriate;
• dependency management;
• security testing;
• secrets management; and
• segregation of development and production environments where appropriate.

• logging of security-relevant activity;
• authentication-event monitoring;
• privileged-activity logging where appropriate;
• monitoring for anomalous or malicious activity;
• protection of material security logs; and
• retention appropriate to operational, evidential and regulatory requirements.

• documented incident response procedures;
• incident identification and escalation;
• containment and investigation;
• evidence preservation where appropriate;
• remediation and recovery;
• notification processes; and
• post-incident review for material incidents.

• documented business continuity and disaster recovery arrangements;
• backup processes appropriate to the Services;
• restoration procedures; and
• periodic exercising or testing of relevant arrangements.

• risk-based supplier due diligence;
• contractual confidentiality and security requirements;
• appropriate oversight of material Subprocessors; and
• management of material supplier security risks.

• data retention controls;
• access restrictions;
• backup lifecycle controls;
• deletion or anonymisation processes; and
• secure disposal appropriate to the sensitivity of relevant Personal Data.

TRI shall maintain and make available to Subscriber, upon reasonable request or through another mechanism designated by TRI, a current list of material Subprocessors used to Process Personal Data on behalf of Subscribers.

For each material Subprocessor, TRI shall make available, where required by Applicable Data Protection Law:

• the Subprocessor's legal name;
• the nature of the services provided;
• the nature of Processing;
• the principal Processing location where applicable; and
• information concerning the applicable international transfer mechanism where required.

The Subprocessor list may be updated from time to time in accordance with Section 8 of this Policy.