Version 3 (DSE-en-v3) · valid from 06.10.2026
Clause 1 – Controller
1.1 Nivara AG, Unterer Graben 1, 9000 St. Gallen. Data protection: [email protected]. Supervisory authority: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.
1.2 The respective issuer is the controller for the entries in the ledger of the Notes; Nivara AG maintains the ledger as its processor (C3 Art. T5). Nivara AG forwards enquiries regarding ledger data to the relevant issuer. Nivara AG has appointed heyData GmbH, Schützenstrasse 5, 10117 Berlin, Germany, as its data protection adviser (Art. 10 of the Federal Act on Data Protection (FADP)). heyData GmbH can be contacted at [email protected].
1.3 Nivara AG does not currently carry out the processing activities described in Clause 13 (usage analysis), Clause 14.1 sentence 2 and Clause 14.3 (advertising on third-party channels, segmentation), Clause 15 (artificial intelligence), as well as Clauses 2.3, 3.2 and 19 (partners, forum, community). These activities shall only be implemented once users have been informed in accordance with Clause 16 and, where necessary, have given their consent. The machine translation referred to in Clause 15.4 and the connection of the user's own AI service as set out in Clause 15.6 are already in effect.
Clause 2 – Collection of personal data
2.1 Nivara AG collects: identification data (name, address, email, telephone, profile photo), KYC/KYB data (copy of identification document, verification results, year of birth), results of preliminary checks of email addresses and telephone numbers (deliverability, disposable address, risk status, number of known data breaches, connection type), organisational data (company details, logo, membership and role), financial data (IBAN, transaction history), communication content (messages in the communication module and in the company chat), evidence relating to signatures and passkeys, technical usage data (IP address and the location derived from it, browser, logs) and pseudonymous blockchain data (wallet addresses, token parameters).
2.2 For identification purposes, the KYC service provider uses biometric data (facial image comparison, liveness detection). Such data constitute sensitive personal data (Art. 5 let. c FADP) and shall only be processed with express consent (Art. 6 para. 7 FADP). The KYC service provider acts as a processor on behalf of Nivara AG. Without consent, the identification process cannot be completed; subscription and purchase then remain blocked (Clause 8.1).
2.3 In addition, Nivara AG collects data on the assignment to an inviting partner, listings in the forum and posts in the community (Clause 19).
Clause 3 – Purposes of data processing
3.1 Nivara AG processes personal data for the following purposes: (i) performance of contracts; (ii) KYC/KYB compliance; (ii a) preliminary checks of email addresses, telephone numbers and company registration numbers for validity and misuse; (iii) due diligence obligations under the Anti-Money Laundering Act (AMLA), where applicable; (iv) platform operation and security; (v) communication; (vi) legal obligations (Swiss Financial Market Supervisory Authority (FINMA), tax authorities); (vii) audit trail; (viii) analysis and improvement of the use of the website and platform (Clause 13); (ix) advertising, marketing and other sales activities (Clause 14); (x) use of artificial intelligence systems (Clause 15). The legal bases for processing are the performance of contracts, legal obligations, legitimate interest (Art. 31 FADP) and, for purposes (viii) to (x), to the extent that processing is not covered by the aforementioned legal bases, consent.
3.2 Further purposes include the partner programme (assignment and remuneration, Clause 19.1), resale via the forum (Clause 19.3), the community and moderation (Clause 19.4) and the AI-supported recording of assets (Clause 15.9).
Clause 4 – Cookies and tracking
4.1 Nivara AG distinguishes between three categories of cookies and similar technologies: (i) technologies that are technically necessary for operation and security (session management, load balancing, fraud prevention); (ii) analytics technologies for measuring and improving usage; (iii) marketing technologies for advertising and audience measurement.
4.2 Necessary technologies are used without consent. Nivara AG does not currently use analytics or marketing technologies. If these are introduced, they shall only be used after consent has been given through a consent dialogue. The user’s selection shall be recorded and may be changed at any time. In addition, cookies can be managed in the browser.
4.3 For information on the analysis of usage, see Clause 13; for advertising and marketing, see Clause 14; for the use of artificial intelligence, see Clause 15.
Clause 5 – Disclosure of data and transfers abroad
5.1 Nivara AG discloses personal data to the following categories of recipients to the extent necessary for the respective purposes: IT, hosting and communication service providers, identification service providers, services for the preliminary verification of contact details and for geolocation, map services, payment service providers and providers of wallet infrastructure. From the moment of commissioning of the ledger on Polygon PoS (Clause 19.14 of the Terms of Use), RPC and indexing providers shall be added and, from their introduction in accordance with Clause 1.3, analytics and AI service providers, partners and counterparties on resale shall also be included. Further recipients include issuers, public authorities where disclosure is required by law, and any appointed auditor. Upon request, Nivara AG shall disclose which specific recipients have received data relating to the person making the enquiry (Art. 25 FADP).
5.1a For the Connect account, the payment service provider receives the necessary identity and account details, including the IBAN and the platform's internal customer identifier. The payment service provider independently verifies this information and is solely responsible for such verification. The legal basis for this processing is the performance of the contract.
5.2 From the moment of commissioning of the ledger on Polygon PoS (Clause 19.14 of the Terms of Use), token parameters, wallet addresses, balances and transactions shall be stored on the public blockchain. Due to the nature of the system, this data is accessible worldwide and cannot be deleted. Only pseudonymous data without personal data in plain text shall be stored; however, wallet addresses may constitute personal data if they can be linked to a person (Clause 12 and Clause 20 of the Terms of Use). The associated transfer of data abroad is based on the performance of the contract with the user (Art. 17 para. 1 let. b FADP). Until the moment of commissioning, no data shall be stored on a blockchain.
5.3 For recipients in the USA that are certified under the Swiss-U.S. Data Privacy Framework, Nivara AG relies on that framework (Art. 16 para. 1 FADP). For recipients in other countries without an adequate level of data protection, as well as for non-certified recipients in the USA, it uses the standard contractual clauses recognised by the FDPIC, with the Swiss adaptations (Art. 16 para. 2 let. d FADP). Such contracts cannot fully compensate for a lack of statutory protection, particularly with regard to access by public authorities in the recipient country or the country of its parent company. Counterparties involved in resale and services that the user connects to the platform themselves may be located in any country. Disclosure to counterparties is based on the performance of the contract (Art. 17 para. 1 let. b FADP); disclosure to services linked by the user is based on the user’s explicit consent, which they give upon establishing the connection (Art. 17 para. 1 let. a FADP).
5.4 Nivara AG processes personal data primarily in Switzerland. Its service providers under Clause 5.1 may process personal data in any country worldwide or access the systems from there for maintenance and support purposes, in particular in the EEA, the United Kingdom and the USA. In India, only backup copies are stored; the associated metadata is held in the EU. When delivering content, locations close to the place of access are also used, generally in the country in which the user is located.
Clause 6 – Retention period
6.1 Contractual data and business records: 10 years (Art. 958f of the Swiss Code of Obligations (CO)). Technical logs: 12 months. Audit trail: for the duration of the contractual relationship and for a further ten years thereafter (Art. 127 CO). Records relating to data protection enquiries: five years after completion. Data from identification and due diligence (KYC results) and the link between a person and a wallet address: for the term of the Notes and for a further ten years thereafter (Art. 127 and 958f CO; Clause 12.2). Identity document images and biometric data: deletion upon completion of the verification. Thereafter, deletion or anonymisation. Wallet addresses may constitute personal data (Clause 12.1).
Clause 7 – Data security
7.1 Nivara AG protects personal data in particular through encryption during transmission (TLS) and storage (AES-256), multi-factor authentication upon login, role-based access controls, penetration tests and regular backups in Switzerland and India, with metadata in the EU. The keys of the wallets of natural persons are managed by the OpenSigner key infrastructure without Nivara AG having access to them (non-custodial, sandbox iFrame); company wallets are only available once they have been activated (Clause 5.2 of the Terms of Use). Nivara AG shall report data security breaches that are likely to result in a high risk to the FDPIC as soon as possible (Art. 24 FADP).
Clause 8 – Obligation to provide data
8.1 Identity and KYC/KYB data are mandatory for the performance of the contract, due diligence obligations (AMLA, where applicable) and the requirements of the issuers. Without this data, neither market access nor the conclusion of a contract is possible. The provision of marketing data is voluntary.
Clause 9 – Profiling and automated decision-making
9.1 The AML/KYC check is automated; from the moment of commissioning of the ledger on-chain, T-REX whitelist compliance checks are carried out in addition. Suspensions are always carried out by a natural person. In the event of an automated rejection, the affected person may request a review by a natural person via the communication module (Art. 21 FADP). For the use of artificial intelligence systems, see Clause 15.
Clause 10 – Rights of the data subject
10.1 Under the FADP, data subjects have in particular the following rights: the right of access (Art. 25 FADP), the right to data portability and disclosure (Art. 28 FADP), the right to rectification (Art. 32 para. 1 FADP), the right to prohibit the processing of certain data (Art. 32 para. 2 let. a FADP), the right to restrict the disclosure of personal data to third parties (Art. 32 para. 2 let. b FADP), and the right to erasure or destruction of personal data (Art. 32 para. 2 let. c FADP). Any consent given may be withdrawn at any time. These rights may be exercised by emailing [email protected] or via the communication module; Nivara AG shall respond within 30 days. Data subjects have the right to lodge a complaint with the FDPIC.
Clause 11 – Amendments
11.1 Repealed; Clause 16 applies to amendments.
Clause 12 – Blockchain data storage and data erasure
12.1 From the moment of commissioning of the ledger on Polygon PoS (Clause 19.14 of the Terms of Use), only token parameters, wallet addresses, balances and transactions are stored on the public blockchain. Until then, no data is stored on a blockchain. Wallet addresses may constitute personal data if they can be linked to a specific person. No proprietary blockchain is operated; RPC and indexing providers act as processors. ONCHAINID claims contain only the topic, issuer and signature and, where applicable, a salted or keyed hash, but no encrypted personal data. Verification hashes of complete contractual documents do not allow any conclusion to be drawn about a person without access to the underlying document.
12.2 Identity data is stored off-chain and can be deleted and rectified. Deletion is carried out by removing the data and the link off-chain. The link between a person and a wallet address is retained in a restricted, inaccessible state for the term of the Notes and for ten years thereafter; it is then deleted. The provider of the wallet infrastructure also knows the link between account and wallet (Clause 5.1).
Clause 13 – Analysis of website and platform usage
13.1 Nivara AG collects and analyses usage data on the website and within the platform. This includes in particular pages accessed and views, clicks and interactions, time spent on the site, search queries and use of filters, points at which users abandon processes (onboarding, asset registration, subscription), device type, browser, operating system, truncated IP address and referring page.
13.2 Usage analysis is carried out for operational and security purposes, error detection, measuring and improving usability, evaluating the use of individual functions, measuring reach, capacity planning and generating aggregated statistics.
13.3 The necessary collection, namely session management, fraud detection and logging pursuant to Clause 7 and Clause 18 of the Terms of Use, is carried out for the performance of the contract and on the basis of legitimate interest. Any further behavioural analysis shall only be carried out with consent; it is not required for the use of the platform and may be withdrawn at any time without any adverse consequences.
13.4 On the website, a consent dialogue controls the categories set out in Clause 4. Within the platform, the settings can be accessed through the user profile. The granting, change and withdrawal of consent are logged with a timestamp.
13.5 For users residing in the European Economic Area, non-essential cookies and similar technologies shall only be used after prior consent.
13.6 Where possible, analyses are carried out in aggregated and pseudonymised form. Where analyses are attributed to a logged-in user, Clause 14 and Clause 9 also apply.
13.7 Raw data from the usage analysis is deleted or anonymised after 14 months; aggregated statistics that do not contain any personal references may be retained for longer. Otherwise, Clause 6 applies.
13.8 Where Nivara AG uses third-party analytics services, these providers act as processors and are contractually bound to process data only for specified purposes. They are among the recipients referred to in Clause 5.1; the countries and guarantees are set out in Clauses 5.3 and 5.4.
Clause 14 – Advertising, marketing and sales activities
14.1 Nivara AG processes personal data for its own advertising, targeted marketing and other sales activities. This includes information on assets, functions and events, contacting users through the platform, by email and by telephone, as well as targeted advertising on third-party channels.
14.2 For this purpose, Nivara AG uses master data, communication data, usage data as set out in Clause 13, information on roles and category interests, transaction behaviour on the platform and voluntary information. Sensitive personal data is not used for advertising purposes.
14.3 Nivara AG creates target audience segments and personalises content and offers. This constitutes profiling within the meaning of Art. 5 let. f FADP. Where an analysis constitutes high-risk profiling within the meaning of Art. 5 let. g FADP, Nivara AG shall carry out a data protection impact assessment in advance in accordance with Art. 22 FADP.
14.4 The legal basis is the legitimate interest in promoting its own services to existing users (Art. 31 FADP); in all other cases, consent is required. Mass advertising by electronic means shall only take place under the conditions set out in Art. 3 para. 1 let. o of the Federal Act against Unfair Competition (UCA), with the sender’s details correctly stated and an opt-out option included in every message. For users in the EEA, electronic direct marketing outside an existing customer relationship shall only take place after prior consent.
14.5 Users may object to the processing of their data for advertising and marketing purposes at any time and without giving any reason, via the settings in their user profile, the unsubscribe link in every message or the communication module. The objection shall be implemented without undue delay and shall have no effect on the use of the platform or on existing contracts.
14.6 Personal data shall only be transferred to third-party advertising platforms with consent. Without consent, only aggregated analyses that cannot be linked to specific persons are used.
14.7 Nivara AG does not sell personal data and does not make it available to third parties for their own purposes.
14.8 This Privacy Policy is for information purposes only; it does not constitute consent nor does it replace any required consent. Where consent is required, it shall be obtained separately, on a granular basis, voluntarily and in a manner that allows it to be withdrawn at any time.
Clause 15 – Use of artificial intelligence
15.1 Nivara AG uses artificial intelligence systems to operate, secure and further develop the platform.
15.2 AI systems are used in particular in the following areas: (i) assisting with the review and evaluation of documents during onboarding and asset recording; (ii) detection of anomalies in AML/KYC checks and fraud prevention; (iii) text suggestions, summaries and translations for asset descriptions and communications; (iv) analysis of usage data as described in Clause 13; and (v) assistance with support.
15.3 Suspensions are always carried out by a natural person. In the event of an automated rejection, the affected person may request a review by a natural person via the communication module (Art. 21 FADP). Clause 9 and Clause 21 of the Terms of Use apply in addition.
15.4 Where users interact directly with an AI system, this shall be clearly indicated. Content generated or substantially modified by an AI system shall be labelled; for users in the EU, the transparency obligations under Art. 50 of Regulation (EU) 2024/1689 (AI Act) apply in accordance with the EU timetable. The French and Italian versions of the platform texts are machine-translated; the German version shall prevail.
15.5 Users' personal data is not used to train general-purpose AI models of third parties. To improve Nivara AG’s own models, it shall be used only in aggregated or pseudonymised form; the use of identifying data requires explicit consent.
15.6 Where third-party AI services are used, these providers act as processors and are contractually bound to process data solely for the specified purpose and to refrain from using the data for their own purposes. Transfers abroad are governed by Clause 5. If the user connects an AI service to the platform (MCP) themselves, the responses from the platform tools (profile, portfolio, contracts, assets) are transmitted to that service at the user's request. That service does not act as a processor on behalf of Nivara AG.
15.7 Nivara AG does not use AI systems for emotion recognition, for biometric categorisation based on personal characteristics, or for assessing the creditworthiness of natural persons. Any extension of the scope of application shall be communicated in accordance with Clause 16.
15.8 Employees and authorised persons who use AI systems possess the necessary AI literacy within the meaning of Art. 4 of the AI Act.
15.9 Information and documents from the asset upload (Addendum A, valuation and audit documents) are used to train and improve the AI-supported data capture process. Personal data is removed or pseudonymised for this purpose wherever permitted by the intended purpose. The legal basis is the consent of the Asset Owner or the issuer (C3 Art. T5), which may be withdrawn for future training. Training is carried out by providers that store data in Switzerland or the EEA.
Clause 16 – Right to amend
16.1 Amendments shall be communicated to business customers at least 30 days and to consumers at least 60 days before they take effect, via the platform and by email. Users shall confirm the revised version the next time they log in (Clause 2.3 of the Terms of Use).
16.2 The latest version of the Privacy Policy is published on the platform and bears a version number and an effective date. Nivara AG shall provide previous versions upon request.
16.3 In the event of significant changes to the data processing (e.g. new recipients, new categories of data), Nivara AG shall notify users personally in addition to the regular announcement on the platform.
Clause 17 – Change of operator and transfer of data
17.1 In the event of a change of operator pursuant to Clause 41 of the Terms of Use, NIVARA AG FL, Schaan, shall become the controller; the data required for the continuation of operations shall be transferred to it. Nivara AG shall remain the processor for technical operations and the ledger. From that point onwards, the Privacy Policy for Switzerland and the EEA shall apply.
17.2 The transfer shall be communicated at least 60 days in advance. Consumers shall expressly consent to the transfer (Clause 41.3 of the Terms of Use); without such consent, the relationship with Nivara AG shall remain in place. The notification may be given prior to authorisation, subject to authorisation being granted; the transfer shall take effect no earlier than upon authorisation.
Clause 18 – Data protection impact assessment and record of processing activities
18.1 Nivara AG carries out data protection impact assessments for biometric identification, processing on the blockchain and profiling (Art. 22 FADP).
18.2 Nivara AG maintains a record of processing activities (Art. 12 FADP).
Clause 19 – Partners, resale and community
19.1 Anyone who accesses the platform via a partner’s personal link or QR code is assigned to that partner; this is indicated during registration. The partner is informed whether the person has registered and whether they have made their first investment. For ongoing remuneration, the partner receives only summarised information about the Trade Fees paid (S1, S6). If a Business Agent Partner or an expert invites someone on behalf of a Business Partner (role R6), that person is assigned to both; both are informed only whether the person has registered and whether they have made their first investment.
19.2 Data that a partner maintains in the partner CRM about their own contacts is processed by Nivara AG as the partner’s processor; the partner remains the controller.
19.3 Resale listings in the forum are visible only to verified users. Contact details shall only be passed on to a counterparty after the user has consented to the release of their contact information. For the transaction to be completed, the counterparty and the issuer receive the information required for the contract and the transfer of ownership in the ledger.
19.4 Posts and comments in the Community Garden are visible to other users. Reporting and moderation are governed by Clause 44 of the Terms of Use.
19.5 If a Business Partner assigns the role R6 to a Business Agent Partner or an expert (agent) via the platform (Clause 10.2 of the Terms of Use), Nivara AG records the grant, the scope, the users exercising the role, and the end of the mandate, and shows the Business Partner the names of users exercising the role. Nivara AG processes contact details that the agent enters for an invitation solely for the purpose of sending and assigning the invitation (Clause 19.1); the agent is responsible for collecting these details and passing them on to the platform (C4.3-D Art. 4.6; for experts, C4.1-D Art. 17.7). For these invitations, the Business Partner can see the asset, time and status, but not the invited person; the agent cannot see any data relating to the Business Partner's investors.