Logo

RWANFTFI Corporation — Privacy Policy

Version: 1.0
Effective date: 29 September 2026
Applies to: https://app.rwanftfi.com and related RWANFTFI services

1. Who we are

This Privacy Policy explains how RWANFTFI Corporation ("RWANFTFI", "we", "us" or "our") collects, uses, shares and protects personal data when you use our website, NFT platform, digital wallet features and related services (the "Services").

RWANFTFI Corporation is a corporation incorporated in the Republic of Panama and registered with the Public Registry of Panama, Mercantile Section, under Folio No. 155774978.

Registered address: Advanced Tower Building, First Floor, Ricardo Arias Street, Panama City, Republic of Panama
Privacy contact: [email protected]

RWANFTFI is the data controller for the personal data described in this Policy, except where a third-party provider acts as an independent controller, as explained in Section 6.

This Policy should be read together with the RWANFTFI Corporation NFT Terms available at https://app.rwanftfi.com/terms.

2. Personal data we collect

We collect only the personal data reasonably necessary to provide the Services, protect the platform and comply with legal obligations.

Wallet and blockchain data. This includes public wallet addresses connected to the Services, transaction hashes, NFT ownership records, purchase, sale and transfer history, and related on-chain data. We do not request or store your private keys or seed phrases.

Account and contact data. This may include your email address, username, communication preferences and information you provide when contacting us.

Transaction and platform data. This includes NFT listings, orders, bids, purchase prices, royalties, platform balances, withdrawals, fees and related records.

Compliance data. Where required by our AML/CTF Policy, applicable law or risk indicators, we may request identity information, proof of address, source-of-funds or source-of-wealth information, and supporting documents. We also process sanctions screening results and wallet risk assessments.

Technical and security data. This includes IP address, browser type, device information, access timestamps, log files, security events and approximate location derived from IP address.

Communications. This includes messages, support requests, complaints and records of our responses.

We do not intentionally collect sensitive personal data. Where identity verification involves biometric or similar data, it is carried out by the relevant verification provider under its own privacy terms, unless we expressly inform you otherwise.

3. How we collect personal data

We collect personal data directly from you when you connect a wallet, create or use an account, list or buy NFTs, contact us or respond to compliance requests.

We collect data automatically through the operation of the Services, including logs, cookies and similar technologies.

We may also receive data from public blockchains, blockchain analytics and wallet-screening providers, sanctions-screening sources, fiat-to-crypto on-ramp partners, and public or official sources.

4. Why we use personal data

We use personal data for the following purposes:

  1. To provide, operate and maintain the Services, including NFT listings, purchases, transfers and platform wallet functions.
  2. To process transactions, record ownership and calculate fees or royalties.
  3. To communicate with you about transactions, the Services, security matters, support requests and changes to our terms.
  4. To prevent fraud, market manipulation, wash trading, unauthorised access and other misuse of the Services.
  5. To carry out sanctions screening, wallet-risk screening, customer due diligence and transaction monitoring under our AML/CTF Policy.
  6. To comply with legal obligations and respond to lawful requests from courts, regulators and competent authorities.
  7. To establish, exercise or defend legal claims.
  8. To improve the security, performance and functionality of the Services.

We do not sell personal data.

5. Legal bases for processing

We process personal data on one or more of the following legal bases:

  • Contract: processing necessary to provide the Services under our Terms.
  • Legal obligation: processing necessary to comply with applicable law, including AML/CTF, sanctions and record-keeping requirements.
  • Legitimate interests: processing necessary for security, fraud prevention, risk management and service improvement, where these interests are not overridden by your rights.
  • Consent: where required, for example for certain non-essential cookies or optional communications. You may withdraw consent at any time.

For data subjects in Panama, we process personal data in accordance with Law No. 81 of 26 March 2019 on the Protection of Personal Data and Executive Decree No. 285 of 28 May 2021.

For users in the European Economic Area, the United Kingdom or other jurisdictions with similar laws, we apply the legal bases and rights required by the applicable data protection law.

6. Fiat-to-crypto on-ramp services

Fiat-to-crypto purchases available through the Services may be provided by an independent third-party provider, including Guardarian. RWANFTFI does not receive, hold or process your fiat payment card or bank account details for those purchases.

When you use an on-ramp service, the provider may collect identity, payment and verification data from you directly and perform its own KYC, AML and fraud checks. The provider processes that data as an independent controller under its own terms and privacy policy.

We may receive limited information from the provider, such as order identifier, transaction status, cryptocurrency amount, destination wallet address and information necessary for support, reconciliation, fraud prevention or compliance.

7. Sharing personal data

We share personal data only where necessary and with appropriate safeguards:

  • with service providers that support our infrastructure, including cloud hosting, security, email delivery, support and IT services;
  • with blockchain analytics, wallet-screening and compliance-screening providers;
  • with on-ramp, payment and other integrated service providers when you choose to use their services;
  • with professional advisers, auditors and legal representatives;
  • with courts, regulators, law enforcement and competent authorities where required by law;
  • with a successor entity in connection with a merger, acquisition, restructuring or sale of assets, subject to appropriate confidentiality protections.

Service providers acting on our behalf may process personal data only under our instructions and must protect it appropriately.

8. Public blockchain data

Blockchain transactions are generally public, permanent and cannot be changed or deleted by RWANFTFI. Wallet addresses, transaction hashes, timestamps and NFT transfers recorded on a public blockchain may remain publicly accessible even after you stop using the Services or ask us to delete your data.

Your rights described in Section 12 apply to personal data we control off-chain, but may not be technically enforceable against data recorded on a public blockchain.

9. International data transfers

We and our service providers may process personal data outside the country where you live, including outside Panama.

Where we transfer personal data internationally, we rely on a lawful transfer mechanism under applicable law. This may include your consent, transfers necessary for the performance of a contract with you, transfers to jurisdictions offering an adequate level of protection, contractual safeguards, or another mechanism permitted by law.

10. Data retention

We keep personal data only as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

  • Compliance, customer due diligence and transaction records are generally retained for at least five (5) years after the end of the business relationship or the relevant transaction, or longer where required by law or an ongoing investigation.
  • Account and contact data are retained while you use the Services and for a reasonable period afterwards to resolve disputes and meet legal obligations.
  • Technical and security logs are retained for the period necessary to protect the Services and investigate incidents.

When data is no longer required, we delete it, anonymise it or restrict further processing.

11. Security

We implement technical and organisational measures appropriate to the risks of our processing. These include access controls, restricted administrative access, encryption in transit where supported, network protections, monitoring and logging of security events, and limiting access to personal data to authorised persons who need it for their duties.

No system is completely secure. You are responsible for protecting your wallet, private keys, seed phrases, devices and login credentials. RWANFTFI will never ask you to disclose your private key or seed phrase.

If a personal data breach presents a risk to data subjects, we will notify the competent authority and affected individuals as required by applicable law. For breaches subject to Panamanian law, we will make the required notification within 72 hours.

12. Your rights

Subject to applicable law, you may have the right to:

  • Access personal data we hold about you;
  • Rectify inaccurate or incomplete data;
  • Cancel or delete data that is no longer needed or is processed unlawfully;
  • Object to certain processing, including processing based on legitimate interests;
  • Portability, meaning to receive certain data in a structured, commonly used format;
  • Withdraw consent where processing is based on consent;
  • Restrict processing or not be subject to certain automated decisions, where these rights apply under your local law.

These rights may be limited where we must keep data to comply with AML/CTF, sanctions, tax, accounting or other legal obligations, or to establish, exercise or defend legal claims.

To exercise your rights, email [email protected] with the subject "Privacy Request". We may need to verify your identity before responding. For requests under Panamanian law, we will respond within ten (10) business days or any other period required by applicable law.

If you are dissatisfied with our response, you may complain to the competent data protection authority. In Panama, this is the National Authority for Transparency and Access to Information (ANTAI). Users in other jurisdictions may contact their local supervisory authority.

13. Cookies and similar technologies

We use cookies, local storage and similar technologies that are necessary to operate the Services, maintain sessions, remember wallet connection preferences and protect the platform.

Where we use analytics or other non-essential technologies, we request consent where required by applicable law. You can control cookies through your browser settings, but disabling necessary cookies may affect the operation of the Services.

14. Age restriction

The Services are intended only for persons aged 18 or older who have legal capacity to enter into binding agreements. We do not knowingly collect personal data from minors. If we learn that we have collected such data, we will delete it unless we must retain it by law.

15. Third-party websites and services

The Services may contain links to or integrations with third-party websites, wallets, blockchains, marketplaces and service providers. Their privacy practices are governed by their own policies. We are not responsible for third-party services that we do not control.

16. Changes to this Policy

We may update this Policy from time to time. The updated version will be published on our website with a new effective date. Where required by law, we will notify you of material changes or request your consent.

17. Contact

RWANFTFI Corporation
Advanced Tower Building, First Floor, Ricardo Arias Street, Panama City, Republic of Panama
Email: [email protected]