1. Purpose of this Privacy Policy
This Privacy Policy explains how Matrex collects, uses, discloses, stores, protects, and retains personal information.
Matrex is a token management and investor administration software platform. The platform may be used for tokenised real-world asset projects, investor onboarding, identity verification, anti-fraud controls, transfer restrictions, document repositories, transaction workflows, and compliance records.
This Privacy Policy applies to visitors, users, issuer personnel, administrators, investors, prospective investors, token holders, service providers, and other people who interact with Matrex.
2. Personal information we collect
Matrex may collect the following categories of personal information:
- identity information, including name, date of birth, nationality, identity document details, photographs, signatures, and verification results;
- contact information, including email address, phone number, physical address, and communication preferences;
- account information, including username, password credentials, authentication settings, roles, permissions, and login history;
- investor eligibility information, including wholesale investor status, accredited investor status, qualified purchaser status, sophisticated investor status, professional investor status, certifications, acknowledgements, and supporting documents;
- AML/CFT and sanctions information, including beneficial ownership information, source of funds information, source of wealth information, politically exposed person checks, sanctions screening results, watchlist results, and risk scores;
- transaction information, including subscription records, transfer requests, approval records, token holdings, wallet addresses, blockchain transaction identifiers, timestamps, settlement information, payment references, and project participation records;
- technical and device information, including IP address, device identifiers, operating system, browser type, time zone, approximate location, log data, session data, security events, cookies, analytics data, and fraud indicators;
- communications information, including emails, support requests, notices, messages, call notes, document comments, and audit trails;
- uploaded documents and project records, including subscription documents, signed agreements, evidence of eligibility, tax forms, corporate documents, trust documents, registers, board approvals, powers of attorney, and due diligence materials;
- compliance and security information, including audit logs, access logs, permission changes, failed login attempts, device risk information, geolocation signals, and investigation records; and
- any other information you provide to us or that is required for platform operation, compliance, fraud prevention, cybersecurity, legal claims, or issuer administration.
3. How we collect personal information
We may collect personal information:
- directly from you;
- from issuers, project sponsors, administrators, advisers, fund managers, lawyers, accountants, trustees, supervisors, or other authorised parties;
- from identity verification, AML/CFT, sanctions, blockchain analytics, payment, fraud prevention, e-signature, secure file transfer, hosting, and compliance providers;
- from blockchain networks and public ledgers;
- from your device, browser, wallet, or network connection;
- from public registers, company registers, court records, sanctions lists, government databases, and other lawful sources; and
- from communications with us.
4. Why we collect and use personal information
Matrex may collect and use personal information for the following purposes:
- providing, operating, securing, and improving the Matrex platform;
- creating and managing accounts;
- verifying identity;
- assessing investor eligibility;
- supporting issuer onboarding and investor administration;
- administering token subscriptions, transfers, registers, restrictions, notices, approvals, redemptions, reporting, and records;
- detecting, preventing, investigating, and responding to fraud, cyber threats, unauthorised access, misuse, sanctions risk, money laundering, terrorist financing, market abuse, and unlawful conduct;
- collecting IP address, operating system, device, browser, location, and usage data for legitimate anti-fraud, cybersecurity, compliance, audit, and platform-integrity purposes;
- complying with securities, financial markets, AML/CFT, sanctions, tax, privacy, accounting, audit, court, regulator, and law enforcement obligations;
- supporting secure file transfer, document management, e-signature, and communication workflows;
- maintaining evidence, audit trails, and compliance records;
- enforcing platform terms and project rules;
- responding to support requests and disputes;
- sending administrative, legal, compliance, security, and service communications;
- improving user experience, analytics, performance, and reliability; and
- protecting the rights, property, safety, and legitimate interests of Matrex, users, issuers, investors, service providers, and third parties.
5. Legal bases and lawful purposes
Depending on the jurisdiction, Matrex may process personal information because:
- processing is necessary to provide the platform or perform a contract;
- processing is necessary for compliance with legal obligations;
- processing is necessary for legitimate business, cybersecurity, anti-fraud, compliance, audit, and platform-integrity purposes;
- processing is necessary to establish, exercise, or defend legal claims;
- processing is necessary to protect users, issuers, investors, or third parties;
- processing is authorised by the relevant user, issuer, administrator, or project sponsor; or
- consent has been obtained where required.
6. Sensitive information
Matrex may collect sensitive information only where reasonably necessary for lawful purposes, including identity verification, AML/CFT, sanctions screening, fraud prevention, security, investor eligibility, legal compliance, or where you provide it as part of project documentation.
Sensitive information may include government identification, biometric verification outputs, nationality, tax information, source of funds information, politically exposed person status, criminal or sanctions screening indicators, precise location in limited security contexts, and financial information.
Matrex does not use sensitive information to infer characteristics unrelated to the relevant compliance, security, platform, or legal purpose.
7. Cookies and similar technologies
Matrex may use cookies, pixels, local storage, software development kits, analytics tools, and similar technologies.
These technologies may be used for login, authentication, fraud prevention, cybersecurity, session management, preferences, analytics, performance, and platform improvement.
You may be able to manage cookies through your browser settings, but disabling cookies may affect platform functionality.
8. Disclosure of personal information
Matrex may disclose personal information to:
- issuers, project sponsors, administrators, fund managers, advisers, trustees, supervisors, lawyers, accountants, auditors, or other authorised project participants;
- identity verification providers;
- AML/CFT, sanctions, politically exposed person, and watchlist screening providers;
- blockchain analytics and wallet verification providers;
- payment, banking, settlement, escrow, and transaction service providers;
- cloud hosting, cybersecurity, analytics, logging, monitoring, error reporting, session replay, and support providers (including, for example, Sentry — used by Matrex for error and performance monitoring and, where the visitor has granted analytics cookie consent, masked session replay; Matrex configures Sentry to default-mask all text and input values and to strip identifying user fields before transmission);
- secure file transfer and document management providers;
- e-signature and workflow providers;
- professional advisers;
- regulators, law enforcement agencies, courts, tribunals, tax authorities, government agencies, or dispute-resolution bodies;
- prospective purchasers, investors, financiers, insurers, or advisers in connection with a business sale, merger, restructuring, financing, or due diligence process; and
- other parties where authorised, required by law, or reasonably necessary for platform, compliance, security, fraud prevention, legal, or operational purposes.
9. International transfers
Matrex may store, process, or disclose personal information in New Zealand, Australia, the United States, the European Union, the United Kingdom, Singapore, or other jurisdictions where Matrex, its users, issuers, service providers, or infrastructure providers operate.
Where required, Matrex will use appropriate safeguards for international transfers, which may include contractual protections, vendor due diligence, access controls, encryption, and other security measures.
10. Retention of personal information
Matrex retains personal information for as long as reasonably required for the purposes described in this Privacy Policy.
Compliance, identity, AML/CFT, sanctions, investor eligibility, audit, transaction, anti-fraud, cybersecurity, legal, tax, accounting, and dispute records may be retained for extended periods where required or appropriate.
Because token administration, securities compliance, AML/CFT compliance, investor registers, transfer restrictions, legal claims, and blockchain-related records may require long-term evidence, some records may be retained after an account is closed.
Matrex may retain de-identified, aggregated, security, audit, or statistical information where it no longer identifies an individual.
11. Security
Matrex uses technical, organisational, and administrative safeguards designed to protect personal information.
Safeguards may include access controls, encryption, secure file transfer, authentication controls, audit logs, vendor controls, monitoring, backup procedures, and security review processes.
No system is completely secure. Users are responsible for protecting their own credentials, devices, wallets, private keys, and communications.
12. Your privacy rights
Depending on your location and applicable law, you may have rights to:
- request access to personal information held about you;
- request correction of personal information;
- request deletion of personal information;
- request restriction of processing;
- object to processing;
- request portability;
- withdraw consent where processing is based on consent;
- opt out of certain analytics, marketing, sale, sharing, or targeted advertising activities; and
- complain to a privacy regulator.
Matrex may need to verify your identity before responding to a request.
Matrex may refuse, limit, or defer a request where permitted by law, including where retention is required or appropriate for AML/CFT, sanctions, securities compliance, investor records, legal claims, fraud prevention, cybersecurity, tax, accounting, audit, or regulatory purposes.
13. California privacy notice
This section applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to Matrex.
Matrex may collect the following categories of personal information:
- identifiers;
- customer records information;
- protected classification information where required for compliance or identity purposes;
- commercial information;
- internet or electronic network activity information;
- geolocation information;
- professional or employment-related information;
- inferences for fraud, compliance, risk, and security purposes; and
- sensitive personal information.
Matrex collects these categories for the purposes described in this Privacy Policy, including platform operation, identity verification, investor administration, compliance, AML/CFT, sanctions screening, fraud prevention, cybersecurity, audit, legal obligations, and service improvement.
Matrex may disclose these categories to the service providers and other parties described in this Privacy Policy.
Matrex does not sell personal information for money.
Matrex does not knowingly sell or share personal information of consumers under 16 years of age.
Matrex may use analytics or advertising technologies that could be considered "sharing" under California law. Where required, Matrex will provide a "Do Not Sell or Share My Personal Information" mechanism or honour legally recognised opt-out signals.
California residents may have the right to know, access, correct, delete, opt out of sale or sharing, limit use of sensitive personal information, and not be discriminated against for exercising privacy rights.
To exercise California privacy rights, contact privacy@matrex.io or use our privacy request webform.
14. New Zealand privacy notice
Matrex handles personal information in accordance with the New Zealand Privacy Act 2020 where that Act applies.
Matrex collects personal information for lawful purposes connected with its platform functions, compliance obligations, anti-fraud controls, cybersecurity, investor administration, and business operations.
Where practical, Matrex collects personal information directly from the individual, but may also collect it from issuers, administrators, service providers, public sources, blockchain networks, regulators, or other authorised sources.
Individuals may request access to and correction of personal information held by Matrex.
Privacy requests may be sent to privacy@matrex.io.
Individuals may complain to the New Zealand Privacy Commissioner if they are not satisfied with Matrex's handling of their personal information.
15. Children
Matrex is not intended for children.
Users must not provide personal information about children unless authorised and necessary for a lawful project, legal, trust, inheritance, beneficial ownership, or compliance purpose.
16. Automated processing and risk controls
Matrex may use automated or semi-automated tools to assist with identity verification, fraud detection, sanctions screening, risk scoring, device risk, blockchain analytics, access control, and transaction monitoring.
These tools may produce alerts, scores, recommendations, or restrictions.
Matrex may review automated outputs manually where appropriate.
17. Blockchain data
Blockchain transactions may be public, permanent, and difficult or impossible to delete.
Wallet addresses, transaction hashes, token balances, and smart contract interactions may be visible on public blockchains.
Matrex cannot delete or modify information recorded on public blockchains.
18. Changes to this Privacy Policy
Matrex may update this Privacy Policy from time to time.
Updated versions will be published on matrex.io.
The updated policy will apply from the date published or from any later effective date stated in the policy.
19. Contact
Privacy questions and requests should be sent to the Matrex Privacy Officer:
This document is published by Matrex. It may be updated from time to time — the effective date at the top of this page reflects the current version.