4 Data protection and records policy

Version 1.0 | 16 October 2026

These policies describe the proposed Vanuatu services of AYOV CAPITAL MANAGEMENT LTD. Licensing applications are being prepared; no licence grant is represented. The responsible provider must be identified in the accepted service agreement. Publishing these policies does not change the operator of an existing service.

AYOV requires clear ownership and classification of public, internal and restricted data. Identity, bank, AML, security and key-related records are restricted. Personnel must receive only the access needed for their role. Shared passwords, public evidence folders and secrets embedded in documents or source code are prohibited. Security measures must be appropriate to risk, with tested access control, secure transmission, backups and recovery.

Records must allow an authorised reviewer to reconstruct onboarding, instructions, approvals, asset admissions, minting, trades, transfers, redemption, payments and administrative changes. Corrections must preserve the original event and an explanation. An evidence hash is a reference to a record, not a replacement for retaining the underlying document and authority.

The retention register must identify record type, legal basis, start event, minimum period, holds and deletion method. AML transaction records and relationship records have different retention start events; they must not be deleted from a blanket website-retention rule. Operational logs and unsuccessful enquiries should not be kept indefinitely without a purpose. Backup deletion must follow a controlled cycle, and recovered data remains subject to applicable deletion restrictions.

Suspected loss, unauthorised disclosure or alteration must be reported internally immediately. The incident lead must contain harm, preserve evidence and assess notification obligations. AYOV must not claim a security certification, audit result or recovery performance without evidence. Material incidents must be communicated to affected parties and authorities where required, with accurate facts and protective steps.