Legal
Privacy and cookie policy
How T-Blocks handles personal data on tblocks.io and in our work with issuers, investors and partners, and how we use cookies.
On this page
- Who we are and how to reach us
- What this policy covers
- The personal data we collect
- Where it comes from
- Why we use it, and on what legal basis
- Who we share it with
- Transfers outside Europe
- Cookies and similar technologies
- Automated tools and decisions
- How long we keep it
- Your rights
- Newsletters and marketing
- Security
- Other websites
- Changes to this policy
- Questions and complaints
Who we are and how to reach us
T-Blocks International Sàrl is a private limited liability company registered in Luxembourg, with its registered office at 26, Rue Goethe, L-1637 Luxembourg (RCS B293452). In this policy, "T-Blocks", "we" and "us" mean T-Blocks International Sàrl.
T-Blocks builds the on-chain rail for the world's markets. Private Assets, which structures assets and strategies into documented instruments for eligible traditional and digital investors, is live. Public Assets and the Atlas and Meridian toolkit are coming soon.
T-Blocks International Sàrl is the controller of the personal data described here. For any privacy question or request, write to info@tblocks.io with the subject line "Privacy request".
What this policy covers
This policy explains how we handle personal data when you:
- visit tblocks.io;
- fill in one of our forms, such as a waitlist, an enquiry, the newsletter, the issuer intake or the investor access form;
- take part in onboarding, due diligence, a data room or an issuance process with us; or
- deal with us as a business contact, adviser, service provider or job applicant.
It is written to meet our obligations under the EU General Data Protection Regulation (GDPR) and Luxembourg data protection law. A specific process, such as an issuance or an onboarding, may come with its own notice. Where it does, that notice adds to this policy.
Our services are for professional and otherwise eligible users. They are not directed at children, and we do not knowingly collect personal data from them.
The personal data we collect
What we hold depends on how you deal with us. Most visitors share nothing beyond the technical data in the last row.
| Category | Examples | When |
|---|---|---|
| Contact details | Name, business email, phone number, job title, organisation, country | When you fill in a form or contact us |
| Professional information | Your role, your organisation's sector and profile, the asset or strategy you describe, documents you upload | Enquiries, the issuer intake and the investor access form |
| Onboarding and due diligence | Identity documents, date of birth, nationality, proof of address, tax details, beneficial ownership, sanctions and PEP screening results, source of funds, wallet addresses, bank details, eligibility information | Only when you onboard as an issuer, investor or counterparty |
| Transaction records | Subscriptions and expressions of interest, commitments, settlement details, holdings, reporting records | Only when you take part in an issuance or a related process |
| Communications | Emails, messages, meeting notes, support requests, your communication preferences | When we correspond |
| Marketing preferences | Newsletter sign-up, consent records, email opens and clicks where lawful | When you subscribe or receive our emails |
| Recruitment | CV, employment history, education, interview notes, references | When you apply to work with us |
| Technical and usage data | Pages viewed, referring site, approximate country, device type, browser, IP address, scroll depth and clicks on our pages, security logs | When you browse the website (see Cookies) |
We do not ask for special category data, such as health or political opinions. If due diligence or screening reveals sensitive information, or information about criminal allegations, we process it only where the law allows and with appropriate safeguards.
Where it comes from
- From you, when you fill in a form, write to us, subscribe, onboard or upload documents.
- From your organisation, when it involves you in an issuer, investor or partner process.
- From service providers and counterparties, such as identity verification and screening providers, payment and settlement providers, custodians, fund administrators and auditors.
- From public sources, such as company registers, sanctions lists and published professional information.
- From cookies and similar technologies on our website, as described in Cookies.
- From introductions, by partners, introducers or at events.
Why we use it, and on what legal basis
We process personal data only where the law gives us a basis to do so.
| Purpose | Legal basis |
|---|---|
| Answering your enquiry, arranging meetings and assessing whether we can work together | Steps you ask for before a contract; our legitimate interest in running and growing our business |
| Running the website and its forms, keeping them secure and measuring how they are used | Our legitimate interest in a secure, working website; your consent for non-essential cookies |
| Onboarding issuers, investors, distributors and counterparties, and checking eligibility | Steps before a contract; performance of a contract; our legitimate interests |
| Identity, sanctions, anti-money-laundering, fraud and other compliance checks | Legal obligations; our legitimate interest in preventing fraud and managing risk |
| Subscriptions, settlement, registry, reporting and servicing | Performance of a contract; legal obligations; our legitimate interests |
| Service and operational messages, such as onboarding, security and policy notices | Performance of a contract; legal obligations; our legitimate interests |
| Newsletters, updates and event invitations | Your consent where the law requires it; otherwise our legitimate interest in business-to-business communication. You can opt out at any time. |
| Improving our website, forms and services | Our legitimate interests; your consent for analytics cookies where required |
| Recruitment | Steps before a contract; our legitimate interests; legal obligations where they apply |
Transfers outside Europe
Some of our providers process data outside the European Economic Area. When personal data leaves the EEA, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses or another safeguard the GDPR allows, with extra contractual, technical and organisational measures where needed. Write to us if you would like details of the safeguard for a particular transfer.
Automated tools and decisions
We use rules, scoring and workflow tools to organise submissions, support onboarding and help our team assess assets. Atlas and Meridian, our assessment and structuring tools, are coming soon; when they open, any process that uses them will explain how. Unless a process-specific notice says otherwise, we do not make decisions with legal or similarly significant effects on you by automated means alone. A person on our team is always involved.
How long we keep it
We keep personal data only as long as we need it for the purposes above, including to meet legal, regulatory, tax, accounting, audit and limitation requirements.
| Data | How long |
|---|---|
| Website analytics and security logs | A limited period, for security, troubleshooting and statistics |
| Enquiries and business contacts | While the relationship is active, then for a reasonable follow-up period |
| Onboarding, due diligence, transaction and reporting records | For the relationship, then as long as law, regulation, audit standards, limitation periods or contracts require |
| Marketing preferences | Until you unsubscribe, withdraw consent or object, or we no longer need them |
| Recruitment records | For the recruitment process, then for a limited period where the law allows |
When we no longer need personal data, we delete it, anonymise it, or archive it securely where the law requires us to keep it.
Your rights
Under data protection law, you can ask us to:
- give you access to your personal data;
- correct data that is inaccurate or incomplete;
- delete your data;
- restrict how we use it;
- stop using it where we rely on our legitimate interests;
- give you your data in a portable format, where this applies; and
- review a decision made solely by automated means, where this applies.
Where we rely on your consent, you can withdraw it at any time, for cookies through your cookie choices. Withdrawing consent does not affect what we did before.
To use any of these rights, write to info@tblocks.io. We may need to confirm your identity first. Some rights have legal limits, for example where a request would affect other people's rights, legal privilege, confidentiality or records we must keep.
Newsletters and marketing
Our newsletter and updates are sent through HubSpot. Every email has an unsubscribe link, and you can also write to info@tblocks.io. Unsubscribing does not stop service, legal, transaction or security messages we still need to send you.
We keep a record of what you agreed to on our forms, the wording you saw and when. If you unsubscribe or ask us to delete your data, we keep only a one-way hash of your email address, so that we do not add you back or email you again.
Security
We protect personal data with technical and organisational measures that include access controls and permissions, strong authentication, encryption in transit and, where available, at rest, audit logs, controlled document access, checks on our providers, incident response and backups. No system is completely secure. If you hold access to one of our environments, please keep your credentials confidential and tell us straight away if you suspect misuse.
Other websites
Our website and emails link to websites and services we do not run. Their own privacy notices apply, and we encourage you to read them before you share personal data.
Changes to this policy
We update this policy when the law, our services, our providers or the way we handle data change. The date at the top shows the latest version. Where the law requires it, we will also tell you directly or ask for your consent.
Questions and complaints
If you have a question or a concern about how we handle your data, please write to info@tblocks.io first, and we will try to resolve it.
You also have the right to complain to a data protection authority. In Luxembourg, this is the Commission nationale pour la protection des données (CNPD), cnpd.public.lu.