Institutional Compliance · Legal Documentation

Global Privacy Policy & Data Governance

Document Ref: NV-DPG-2026-V4 · Effective Date: January 1, 2026 · Nodezvia Platform

1. Regulatory Scope & Data Controller Overview

This Global Privacy Policy and Data Governance Charter ("Privacy Policy") governs the collection, processing, storage, dissemination, and protection of personal, financial, and telemetry data collected by Nodezvia ("Nodezvia", "Platform", "Company", "we", "us", or "our") across all web applications, programmatic API endpoints, distributed ledger nodes, and client custody interfaces.

Nodezvia acts as an independent Data Controller and regulated Virtual Asset Service Provider (VASP) compliance participant. We operate under stringent international data privacy standards, including Regulation (EU) 2016/679 (General Data Protection Regulation / GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Swiss Federal Act on Data Protection (FADP), and Financial Action Task Force (FATF) Recommendation 16 (Travel Rule).

2. Categories of Information Collected & Processed

In order to deliver institutional digital asset clearing, Multi-Party Computation (MPC) vault infrastructure, and fiat correspondent banking integration, Nodezvia collects and processes the following exhaustive categories of data:

Individual Identification Data (KYC): Legal full name, residential address, nationality, tax identification number (SSN/TIN), date of birth, government-issued biometric passports or national identity cards, live facial liveness verification telemetry, and proof of address documentation.
Corporate & Entity Verification Data (KYB): Certificates of incorporation, articles of association, registers of directors, Ultimate Beneficial Ownership (UBO) structures exceeding 10% equity thresholds, audited financial statements, and regulatory licensing credentials.
Financial Ledger & Transactional Telemetry: Source of funds declarations, public blockchain wallet addresses (UTXO/Account-based), smart contract interactions, on-chain hash identifiers, transaction timestamps, gas parameters, fiat correspondent IBAN/SWIFT/FedNow routing identifiers, and execution order books.
Hardware, Network & Cryptographic Telemetry: IP addresses, autonomous system numbers (ASN), Hardware Security Module (HSM) session handshakes, browser fingerprinting data, WebAuthn public keys, device integrity attestations, and MPC threshold key shard rotation logs.

3. Lawful Basis for Processing Operations

We process personal and financial data strictly pursuant to recognized lawful bases under international jurisprudence:

Statutory Regulatory Compliance (Art. 6(1)(c) GDPR): Fulfilling anti-money laundering (AML), counter-terrorist financing (CTF), automated sanctions screening against OFAC, EU, UN, and UK HM Treasury databases, and FATF Travel Rule transmission requirements.
Performance of Contractual Obligations (Art. 6(1)(b) GDPR): Executing digital asset orders, settling cross-border payment rails, managing segregated custody ledgers, and maintaining continuous API accessibility.
Legitimate Institutional Interests (Art. 6(1)(f) GDPR): Detecting zero-day protocol exploits, network anomaly detection, DDoS defense, key shard disaster recovery, and internal risk modeling.

4. Multi-Party Computation (MPC) & Zero-Knowledge Architecture

Nodezvia utilizes state-of-the-art Multi-Party Computation (MPC) key sharding protocols. At no point in the custodial lifecycle does Nodezvia construct, store, or serialize a monolithic private key in memory or persistent storage. Cryptographic key shards are distributed across geographically sovereign, air-gapped Hardware Security Modules (HSMs) with FIPS 140-3 Level 4 validation.

Where telemetry is collected regarding threshold transaction signing, Nodezvia applies Zero-Knowledge Proof (ZKP) mechanisms to verify participant legitimacy without disclosing underlying cryptographic identity materials.

5. Data Dissemination & Cross-Border Transmission

Nodezvia maintains a strict zero-monetization policy: under no circumstances do we sell, rent, lease, or monetize user data to commercial advertising brokers or third-party marketers. Data sharing occurs solely under binding Data Processing Agreements (DPAs) with:

Regulated Correspondent Financial Institutions: Tier-1 commercial banks, clearing houses, and SEPA/FedNow settlement providers necessary to execute fiat transactions.
On-Chain Forensics & Compliance Providers: Automated blockchain analytics partners for real-time transaction risk scoring and illicit wallet detection (e.g., sanctioned mixers or ransomware addresses).
Judicial, Regulatory & Law Enforcement Authorities: Competent jurisdictional authorities only upon presentation of verified subpoenas, court warrants, or binding mutual legal assistance treaties (MLAT).

6. Mandatory Statutory Retention Periods

Pursuant to international AML/KYC directives (including the European Union 5th and 6th Anti-Money Laundering Directives and Bank Secrecy Act regulations), Nodezvia is legally mandated to maintain customer identification records, transactional ledgers, and communication archives for a minimum statutory period of seven (7) years following account termination.

Due to the immutable, decentralized nature of public blockchain networks, transactions confirmed on public ledgers cannot be modified, deleted, or purged by Nodezvia or any third party.

7. Data Subject Rights & Regulatory Limitations

Subject to local statutory law, you retain verified rights regarding your personal information, including the Right of Access (Art. 15 GDPR), Right to Rectification (Art. 16 GDPR), Right to Restriction of Processing (Art. 18 GDPR), and Right to Data Portability (Art. 20 GDPR).

Please note that the "Right to Erasure" (Right to be Forgotten) is expressly constrained by statutory obligations requiring mandatory financial audit and anti-money laundering record retention.

8. Information Security Protocols

All data in transit is encrypted using Transport Layer Security (TLS 1.3) with perfect forward secrecy. Data at rest is encrypted using AES-256-GCM authenticated encryption. Our infrastructure undergoes continuous vulnerability monitoring, SOC 2 Type II audits, and third-party penetration tests.

9. Data Protection Officer (DPO) & Regulatory Inquiries

To exercise formal Data Subject Access Requests (DSAR), submit regulatory compliance inquiries, or communicate with our designated Data Protection Officer, please address official correspondence to:

Office of the Data Protection Officer
Nodezvia Compliance & Data Privacy Desk
Official Email: admn@nodezvia.com
Response Window: 30 Calendar Days (per GDPR/CCPA standard requirements)