Privacy Policy
1. Scope
This Policy explains how Issura Pte. Ltd. collects, uses, discloses and protects personal data in connection with the Issura platform. It is written to the standard of the Personal Data Protection Act 2012 of Singapore ("PDPA"). Where you are located elsewhere, additional local rights may apply.
2. Data Protection Officer
The PDPA requires us to appoint a Data Protection Officer and to make their contact details available. Our DPO can be reached at privacy@issura.capital.
3. What we collect
| Category | Examples |
|---|---|
| Registration data | Name, email address, password (stored hashed), role, company name for issuers. |
| Identity data | Date of birth, nationality, country of residence, identity document type and number, and images of an identity document. |
| Facial image | A self-captured photograph compared against your identity document to confirm you are the document holder. |
| Address data | Proof of address documentation. |
| Financial and eligibility data | Declared accredited investor basis and any supporting evidence; source of wealth and source of funds information where requested. |
| Screening results | Outcomes of sanctions, politically exposed person and adverse media checks, and blockchain analytics results for your wallet address. |
| Wallet and transaction data | Blockchain address, subscriptions, holdings, transfers and distributions. |
| Consent records | Which version of our Terms and this Policy you accepted, and when. |
| Technical data | IP address, device and browser information, and interaction logs. |
Sensitivity. Identity documents and facial images are sensitive. We collect them because AML and CFT obligations require us to verify identity, and we limit access to staff who need it.
4. Why we collect it
To create and administer your account, and to authenticate you.
To verify identity and eligibility, and to meet AML, CFT and sanctions obligations.
To enable subscription to offerings and to maintain ownership records.
To communicate about your account, your holdings and distributions.
To detect and prevent fraud, abuse and unauthorised access.
To comply with legal obligations and respond to lawful requests from authorities.
To improve the Platform, using aggregated or de-identified data wherever possible.
We do not sell personal data. We do not use it for third-party advertising.
5. Basis for processing
We rely principally on your consent, given at registration and at the points where you submit verification information, and on the exceptions in the PDPA that permit processing necessary to comply with legal obligations and to prevent financial crime. Where we rely on a legal obligation, withdrawing consent will not remove that obligation.
6. Who we share it with
| Recipient | Purpose |
|---|---|
| Identity, sanctions and PEP screening providers | Verification and ongoing screening. |
| Blockchain analytics providers | Assessment of wallet risk before whitelisting and thereafter. |
| Cloud, database and email infrastructure providers | Hosting and delivery of the service. |
| Issuers | Where you subscribe to an offering, the issuer receives the information it needs to maintain its register of holders and to meet its own obligations. |
| Regulators, law enforcement and courts | Where required by law, or where we file a report we are obliged to make. |
| Professional advisers and auditors | Under duties of confidentiality. |
We require service providers to protect personal data to a standard comparable to that required under the PDPA.
7. Transfers outside Singapore
Our infrastructure providers may process data outside Singapore. Where personal data is transferred out of Singapore, we take steps to ensure the recipient is bound to a standard of protection comparable to the PDPA, whether by contract, by binding corporate rules, or because the recipient is subject to comparable law.
8. Blockchain data — please read
Some information is written to a public blockchain and cannot be altered or erased by us or by anyone else.
Your wallet address, and the fact that it has been whitelisted to hold a particular instrument, are recorded on-chain and are publicly visible.
Subscriptions, transfers and distributions involving your address are permanently and publicly recorded.
A blockchain address is pseudonymous, not anonymous. Anyone who can associate an address with your identity can view its full history, and that association may be made from information outside our control.
This has a consequence you should understand: a request to delete personal data cannot extend to information already written to a public blockchain. Where we hold an off-chain link between your identity and your address, we can remove that link within our own systems, subject to our retention obligations. We cannot remove the on-chain record itself.
We do not write your name, identity document, address or other directly identifying information to any blockchain.
9. How long we keep it
Records collected for anti-money-laundering purposes, including verification records, supporting documents, transaction records and the reasoning behind decisions, are retained for at least five years from the end of the business relationship or the completion of the transaction, whichever is later. This is a legal requirement and applies even if you close your account or withdraw consent.
Other data is retained only as long as necessary for the purpose for which it was collected, and is then deleted or anonymised.
10. Security
We apply access controls, encryption in transit, hashing of credentials, and optional two-factor authentication. Access to identity documents is restricted. No system is completely secure, and we cannot guarantee absolute security. We will notify affected individuals and the Personal Data Protection Commission of a notifiable data breach as required by law.
11. Your rights
Access. You may request the personal data we hold about you and information about how it has been used or disclosed in the past year.
Correction. You may ask us to correct inaccurate or incomplete data.
Withdrawal of consent. You may withdraw consent on reasonable notice. We will explain the likely consequences, which will usually include being unable to continue offering you the service. Withdrawal does not affect processing we are legally required to perform, nor our retention obligations.
Requests should be sent to privacy@issura.capital. We will respond within the time required by law and will tell you if we cannot comply and why. A reasonable fee may apply to an access request, and we will inform you before proceeding.
12. Cookies
We use cookies and similar technologies that are necessary for the Platform to function, including to keep you signed in and to protect against abuse. Where we use non-essential analytics we will say so and provide a means to decline.
13. Children
The Platform is not directed at persons under 18 and we do not knowingly collect their personal data. If we learn we have done so, we will delete it, subject to any legal retention obligation.
14. Changes
We may update this Policy. The version identifier and date at the top will change, and the version you accepted is recorded against your account. Where a change is material we will notify registered users and, where required, seek renewed consent.
15. Complaints
If you are dissatisfied with how we have handled your personal data, contact our DPO at privacy@issura.capital. You may also lodge a complaint with the Personal Data Protection Commission of Singapore.