3 Privacy policy

Version 1.0 | 16 October 2026

These policies describe the proposed Vanuatu services of AYOV CAPITAL MANAGEMENT LTD. Licensing applications are being prepared; no licence grant is represented. The responsible provider must be identified in the accepted service agreement. Publishing these policies does not change the operator of an existing service.

Responsible provider and information collected

The entity collecting information must identify itself at the relevant collection point or in the service agreement. The proposed Vanuatu applicant must not be presented as controller of legacy records merely by publishing this book. For website, account or legacy-service information, use the operator identified for that service and contact compliance@ayovcapital.com to route a privacy request.

Information may include contact details, identity and verification documents, beneficial ownership, authority, residence, bank profiles, asset provenance, wallet addresses, transaction records, correspondence, security logs and cookie choices. AYOV should collect only information reasonably necessary for the stated purpose. Avoid sending health, unrelated financial or third-party personal information unless specifically required through a lawful secure process.

Purposes grounds and recipients

Information is used to respond to enquiries, assess admission, verify authority, prevent financial crime and fraud, administer mandates and transactions, reconcile assets, handle complaints, protect systems and meet legal duties. The responsible entity must identify the applicable legal ground for each use. Contract steps, legal obligations and legitimate operational purposes must not be replaced by blanket marketing consent. Optional tracking requires an appropriate separate choice where required.

Information may be disclosed to authorised staff, contracted verification/security/hosting/custody/conversion providers, professional advisers and authorities where lawful and necessary. Access must be limited by purpose and confidentiality. AYOV's policy is not to sell client personal information. A provider list and relevant processing locations must be available for the service; no unspecified jurisdiction is represented as providing equivalent protection.

International processing and blockchain

Before cross-border processing, the responsible entity must assess applicable transfer requirements and put required contractual or other safeguards in place. A Vanuatu application does not displace privacy laws that otherwise apply. Clients may request information about relevant recipients, processing countries and safeguards, subject to lawful confidentiality restrictions.

Public blockchains expose transaction addresses, amounts and other recorded data to observers worldwide, and entries may be permanent. AYOV must not publish identity documents, bank details or raw due-diligence evidence on-chain. A wallet can still become identifiable when linked to other information. Blockchain records cannot ordinarily be erased by AYOV. Wallet software, explorers, RPC services and linked third-party sites have their own policies.

Retention rights and requests

Records are retained for their documented purpose and applicable legal periods, including AML and dispute requirements, then securely deleted or anonymised where appropriate. A valid retention duty or hold may limit deletion. Contact compliance@ayovcapital.com for access, correction, deletion, restriction, portability or objections where applicable. AYOV must verify requests proportionately, explain any lawful refusal and respond within the applicable deadline. Withdrawal of optional consent affects future consent-based processing, not earlier lawful processing. Clients retain complaint rights to the competent authority where applicable.