Effective Date: September 2026 | Last Updated: September 2026
Finrock respects your privacy and is committed to protecting personal information.
This Privacy Policy explains how Finrock Tech Limited and, where applicable, its relevant subsidiaries, affiliates and associated entities (collectively, “Finrock”, “we”, “us” or “our”) collect, use, disclose, store, transfer and otherwise process personal information when you visit our websites, communicate with us, submit an enquiry, participate in our ecosystem, or access or use products, platforms and services operated by or on behalf of Finrock.
Depending on the product or service you use, your location and the Finrock entity with which you interact, personal information may be processed by different entities within the Finrock group and may be subject to additional product-specific privacy notices, terms or requirements under applicable law.
For this website and general enquiries, Finrock Tech Limited is the entity responsible for the processing of personal information unless otherwise stated. Where another Finrock group entity is responsible for a particular product, service or activity, the applicable documentation or privacy notice may identify that entity.
This Privacy Policy is intended to provide transparent information about our data practices. Where consent is required under applicable law for a particular processing activity, we will seek that consent separately.
The information we collect depends on how you interact with Finrock and the products or services involved.
2.1Identity and Contact Information
2.2Enquiry and Participation Information
When you contact Finrock, submit a website form or express an interest in participating, partnering or collaborating with us, we may collect information such as:
2.3Identity Verification and Compliance Information
Where required for a particular product, service or activity, we or authorised service providers may collect information necessary for identity verification, eligibility, Know Your Customer (KYC), Know Your Business (KYB), anti-money laundering and counter-terrorist financing (AML/CFT), sanctions screening, fraud prevention, source-of-funds or source-of-wealth verification, and other legal or regulatory requirements.
This may include identification documents, verification information, corporate records, beneficial ownership information, compliance screening results and information obtained from permitted compliance databases, public sources or authorised third parties.
2.4Financial and Transaction Information
Where relevant to a Finrock product or service, we may process information relating to payments, transactions, wallet addresses, blockchain transactions, account activity, subscriptions or participation, deposits, withdrawals, transfers, settlement and reconciliation.
Finrock may use specialist third-party providers for payments, banking, custody, identity verification or other financial services. Where appropriate, sensitive payment credentials may be processed directly by those providers rather than stored by Finrock.
2.5Asset and Tokenization Information
Where our products or services involve real-world assets, digital assets or tokenization, we may process information concerning relevant assets, ownership, issuers or originators, asset documentation, transaction information and other information necessary for due diligence, administration, tokenization, distribution, compliance or lifecycle management.
2.6Technical and Usage Information
2.7Analytics and Intelligence Data
Where you interact with Finrock analytics, intelligence or automated functionality, we may collect information about how those services are accessed and used. Where such information constitutes personal information, it will be processed in accordance with this Privacy Policy and applicable law.
We may process personal information for purposes including:
Finrock processes personal information in accordance with applicable data protection and privacy laws in the jurisdictions in which the relevant Finrock entity operates or provides products and services.
Where applicable law requires a lawful basis for processing, we may rely on one or more grounds including your consent; performance of a contract or steps requested before entering into a contract; compliance with legal or regulatory obligations; legitimate interests pursued by Finrock or a third party where those interests are not overridden by applicable rights; protection against fraud, security threats or unlawful activity; or another lawful basis available under applicable law.
Where we rely on consent, you may withdraw that consent subject to applicable law. Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.
Additional jurisdiction-specific notices, disclosures or rights may apply where required by applicable law.
Finrock does not sell personal information. We may disclose personal information where reasonably necessary to:
Finrock operates internationally. Personal information may therefore be transferred to, stored in or processed in jurisdictions other than the jurisdiction in which it was originally collected.
Where required by applicable law, Finrock will use appropriate safeguards for international transfers of personal information, which may include recognised adequacy mechanisms, contractual protections or other lawful transfer arrangements.
Our websites and digital services may use cookies and similar technologies to enable essential functionality, maintain security, understand website usage and performance, remember preferences, and provide analytics or communications functionality.
Where required by applicable law, non-essential cookies will be used only after appropriate consent has been obtained. Users may be able to manage cookie preferences through available cookie controls or browser settings. Additional information may be provided in a separate Cookie Policy.
Where permitted by applicable law, we may send information concerning Finrock, our ecosystem, products, services, events or developments that may be relevant to you. Where consent is required, we will obtain it before sending such communications.
You may unsubscribe from marketing communications at any time by using the unsubscribe mechanism included in the communication or by contacting us at [email protected].
Finrock maintains technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, misuse, loss or destruction. These measures may include access controls, authentication, encryption, monitoring, secure infrastructure, internal security controls and appropriate requirements for service providers.
Products and services involving digital assets, blockchain networks, smart contracts, wallets, exchanges, custodians or other third-party infrastructure may involve technical and cybersecurity risks that are not entirely within Finrock's control. No electronic transmission, blockchain network, digital platform or information-storage system can be guaranteed to be completely secure.
Where required by applicable law, Finrock will assess and respond to personal-data security incidents and make notifications to affected individuals or competent authorities where legally required.
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, compliance, accounting, security and operational requirements.
Retention periods may vary according to the nature of the information, the product or service involved, contractual requirements, KYC/AML and other regulatory obligations, actual or potential disputes, and applicable record-retention or limitation periods.
When personal information is no longer required, we may securely delete, destroy or anonymise it, subject to applicable law.
Depending on your jurisdiction, your relationship with Finrock and applicable law, you may have certain rights in relation to your personal information, including rights to:
These rights are not absolute and may be subject to legal or regulatory exceptions, including requirements for Finrock to retain certain records. We may need to verify your identity before responding to a request.
Certain Finrock products or services may interact with public or permissioned blockchain networks. Information recorded on a public blockchain may be publicly accessible and, because of the nature of distributed-ledger technology, may be permanent or may not be capable of being altered or deleted by Finrock.
As a result, certain rights that may ordinarily apply to data held in centralised systems, including correction or deletion, may be technically limited in relation to information recorded directly on a blockchain.
Where Finrock processes personal information associated with blockchain activity outside the underlying blockchain record, we will process that information in accordance with this Privacy Policy and applicable law.
Finrock may process, preserve or disclose personal information where reasonably necessary to comply with applicable legal, regulatory, tax, sanctions, AML/CFT, fraud-prevention, reporting, record-keeping or other compliance obligations.
Where permitted or required by applicable law, information may be provided to competent regulators, governmental bodies, courts, law-enforcement authorities, financial institutions, compliance providers or other authorised recipients.
Nothing in this Privacy Policy limits any processing or disclosure that is required by applicable law or a binding legal or regulatory obligation.Finrock websites, products or services may contain links to, integrate with or enable access to third-party websites, platforms, wallets, custodians, exchanges, payment providers or other services.
Independent third parties may process personal information under their own privacy policies and terms. Finrock is not responsible for the privacy practices of independent third parties, and users should review the applicable privacy information before using their services.
Finrock's products and services are not directed to children or persons who are not legally eligible to use the applicable product or service. We do not knowingly seek to collect personal information from children in circumstances where such processing would be prohibited by applicable law.
If we become aware that personal information has been collected contrary to applicable requirements, we will take appropriate steps to address it.
We may update this Privacy Policy from time to time to reflect changes in our products, technology, operations, legal requirements or data-processing practices.
When we make changes, we will publish the updated Privacy Policy and revise the 'Last Updated' date. Where required by applicable law, we will provide additional notice of material changes.
If you have questions about this Privacy Policy, wish to exercise an applicable data protection right, or have concerns about how Finrock handles personal information, please contact:
Finrock Tech Limited
Email: [email protected]
Website: www.finrock.co
Where applicable, you may also have the right to contact or lodge a complaint with the relevant data protection or supervisory authority in your jurisdiction.