T-Blocks International Sarl
Effective Date: 10 April 2026
Last Updated: 10 April 2026

1. Introduction

T-Blocks International Sarl, a Luxembourg private limited liability company with its registered office at 26, Rue Goethe, L-1637 Luxembourg (“T-Blocks”, “we”, “us”, or “our”), provides capital-markets infrastructure and related digital services for issuers, distributors, professional investors, and other business users.

This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal data when you:

• visit tblocks.io or any related T-Blocks web pages;
• contact us or submit an inquiry;
• complete an issuer, investor, distributor, partner, or other onboarding form;
• access any T-Blocks data room, investor interface, subscription workflow, or reporting environment; or
• otherwise interact with us in a professional or commercial context.

This Privacy Policy is intended to satisfy our transparency obligations under applicable data protection law, including the EU General Data Protection Regulation (“GDPR”) and applicable Luxembourg data protection rules.

This Privacy Policy does not replace any additional privacy notice, offering document, onboarding notice, or contractual disclosure that may apply to a specific T-Blocks service, issuance, sub-fund, counterparty, service provider, or regulated intermediary. Where another notice applies to a specific process, that notice will supplement this Privacy Policy.

2. Who is responsible for your personal data

For the purposes described in this Privacy Policy, the data controller is:

T-Blocks International Sarl
26, Rue Goethe
L-1637 Luxembourg
Email: info@tblocks.io

If you have questions about this Privacy Policy or want to exercise your data protection rights, you can contact us at info@tblocks.io with the subject line: Privacy Request.

3. Who this Privacy Policy applies to

This Privacy Policy applies to personal data relating to, for example:

• visitors to our website;
• prospective and existing issuers, sponsors, asset managers, and their representatives;
• prospective and existing investors, distributors, broker or placement contacts, and their representatives;
• service-provider and professional-adviser contacts;
• event contacts, newsletter subscribers, and business development leads; and
• applicants for roles or contractor engagements with T-Blocks.

Our services are generally designed for professional, business, or otherwise eligible users, not children. We do not knowingly market our services to children or intentionally collect personal data from children through our website or onboarding workflows.

4. Categories of personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data.

A. Identification and contact data

This may include:

• full name;
• business email address;
• telephone number;
• job title;
• employer or affiliated entity;
• postal address;
• country and jurisdiction; and
• other professional contact details.

B. Professional and organisational data

This may include:

• company name;
• company role or function;
• business sector;
• investment, distribution, or issuer profile;
• regulatory or licensing information;
• ownership or corporate structure information; and
• due-diligence and institutional readiness information you submit to us.

C. Onboarding, KYC, KYB, and due-diligence data

Where relevant to onboarding, eligibility, risk management, legal compliance, or transaction execution, this may include:

• date of birth;
• nationality or place of residence;
• government-issued identification details;
• copies of identification documents;
• selfie, liveness, or identity-verification data;
• proof of address;
• tax identification data;
• beneficial ownership information;
• sanctions, PEP, adverse media, and related due-diligence screening results;
• source-of-funds or source-of-wealth information;
• wallet addresses;
• bank account or payment details; and
• subscription, suitability, or eligibility-related information.

For enterprise-level KYC and KYB processes, we may work with third-party providers. Where such providers are used on our forms or in connection with data submission on their systems, their identity will be disclosed at the relevant point of collection or submission. We take reasonable steps to ensure that such providers apply appropriate and compliant data-handling standards.

D. Transactional, subscription, and investment-related data

Where relevant to a T-Blocks process, this may include:

• onboarding status;
• deal-room activity;
• subscription or expression-of-interest data;
• commitment or transaction history;
• settlement details;
• holdings or registry-related data; and
• reporting and servicing records.

E. Communications and relationship data

This may include:

• emails, messages, meeting notes, call summaries, and support requests;
• documents or information you upload to us;
• survey or feedback responses;
• event attendance and networking notes; and
• records of your communication preferences.

F. Technical, usage, and device data

When you use our website or digital services, we may collect:

• IP address;
• browser type and version;
• operating system;
• device identifiers;
• approximate geolocation derived from IP;
• referral source;
• pages viewed;
• timestamps;
• clickstream and usage data;
• authentication and access logs;
• document-access logs; and
• security logs.

G. Marketing and preference data

This may include:

• newsletter sign-up data;
• communication preferences;
• consent records; and
• email engagement data, such as opens and clicks, where lawfully used.

H. Recruitment data

If you apply for a role with us, we may collect:

• CV or résumé;
• employment history;
• education;
• interview notes;
• references;
• right-to-work information; and
• other information relevant to recruitment.

5. How we collect personal data

We collect personal data:

• directly from you, when you contact us, fill in a form, subscribe, onboard, upload documents, or use our services;
• from your organisation or representatives, where they involve you in an issuer, investor, distributor, or service-provider process;
• from service providers and counterparties, including KYC/KYB vendors, payment providers, wallet or settlement providers, regulated intermediaries, fund administration and audit providers, and technology vendors;
• from public or reliable third-party sources, such as company registries, sanctions lists, beneficial ownership registers, or publicly available professional information;
• through cookies and similar technologies, where applicable; and
• through referrals and business development channels, such as partners, introducers, or event interactions.

6. Why we process personal data and our legal bases

We process personal data only where we have a lawful basis to do so.

A. To respond to inquiries and manage business relationships

We use personal data to communicate with you, respond to requests, schedule meetings, and assess whether there is a fit for a T-Blocks relationship or service.

Legal basis:

• pre-contractual steps; and
• our legitimate interests in running and growing our business.

B. To operate our website and digital environments

We use personal data to provide website functionality, manage forms, authenticate users, administer data rooms, monitor usage, and maintain platform security and performance.

Legal basis:

• performance of a contract or pre-contractual steps, where applicable;
• our legitimate interests in operating secure and effective digital services; and
• consent, where required for non-essential cookies or similar technologies.

C. To onboard issuers, investors, distributors, and counterparties

We use personal data to assess eligibility, structure workflows, manage onboarding, coordinate due diligence, control access, and administer participation in T-Blocks processes.

Legal basis:

• pre-contractual steps;
• performance of a contract; and
• our legitimate interests in evaluating and operating commercial relationships.

D. To carry out KYC, KYB, sanctions, fraud-prevention, and compliance checks

We use personal data to verify identity, assess eligibility, screen counterparties, prevent misuse, investigate suspicious activity, and support compliance with applicable legal, regulatory, audit, and risk-management requirements.

Legal basis:

• compliance with legal obligations, where applicable; and
• our legitimate interests in fraud prevention, risk management, and protecting our business, users, service providers, and counterparties.

E. To execute subscriptions, transactions, settlements, and reporting

We use personal data to coordinate subscriptions, payments, settlement flows, registry and reconciliation processes, reporting, and related operational support.

Legal basis:

• performance of a contract;
• compliance with legal obligations; and
• our legitimate interests in administering transactions and related servicing.

F. To send service, transactional, and operational communications

We use personal data to send notices about onboarding, access, subscriptions, transactions, policy changes, security matters, reporting, or other service-related communications.

Legal basis:

• performance of a contract;
• compliance with legal obligations; and
• our legitimate interests in administering our services and relationships.

G. To send marketing and thought-leadership communications

We may use personal data to send newsletters, updates, event invitations, and information about T-Blocks services, content, and developments.

Legal basis:

• your consent, where required by law; or
• our legitimate interests in limited B2B marketing and relationship management, where permitted by law.

You can opt out at any time.

H. To improve our products, services, and internal processes

We may analyse usage, engagement, process performance, and business interactions to improve our website, forms, workflows, security, and services.

Legal basis:

• our legitimate interests in improving our products, services, and operations; and
• consent where required for specific analytics technologies.

I. To recruit and manage candidates

We use personal data to assess applications, communicate with candidates, and manage recruitment processes.

Legal basis:

• pre-contractual steps;
• our legitimate interests in recruitment; and
• compliance with legal obligations, where applicable.

7. Sensitive data and criminal-offence related data

We do not intentionally ask for special-category personal data unless this is necessary for a lawful purpose.

Where due-diligence, sanctions, adverse media, or compliance checks reveal sensitive data or information relating to criminal allegations or offences, we will process such data only where permitted by applicable law and subject to appropriate safeguards.

8. Recipients of personal data

We may share personal data with the following categories of recipients where relevant and lawful:

• members of the T-Blocks team and authorised personnel;
• hosting, cloud, CRM, communications, analytics, payment, security, and IT vendors;
• identity-verification, KYC/KYB, AML, sanctions-screening, and fraud-prevention providers;
• legal advisers, auditors, accountants, and compliance advisers;
• fund administrators, registry or reconciliation providers, and reporting providers;
• banks, custodians, payment institutions, wallet or settlement providers, and stablecoin or tokenisation infrastructure partners;
• brokers, placement agents, distributors, venues, introducers, or counterparties involved in a relevant process;
• the relevant issuer, sponsor, investor, sub-fund, vehicle, or other transaction participant, where needed for due diligence, onboarding, execution, reporting, or compliance;
• competent courts, regulators, supervisory authorities, tax authorities, law-enforcement authorities, or other public authorities; and
• acquirers, investors, financiers, or advisers in connection with a corporate transaction, restructuring, financing, or sale of business.

Some recipients act on our behalf as processors. Others act as independent controllers because they must process data for their own legal, regulatory, professional, or operational purposes.

We do not sell personal data.

9. International transfers

Because we use service providers and operate cross-border workflows, personal data may be accessed or transferred outside the European Economic Area.

Where we transfer personal data internationally, we will use an appropriate transfer mechanism under applicable law, such as:

• an adequacy decision;
• Standard Contractual Clauses approved by the European Commission; or
• another lawful safeguard or derogation available under the GDPR.

Where relevant, we may also implement supplementary contractual, technical, and organisational safeguards.

You may contact us to request more information about the safeguards we rely on for international transfers.

10. Cookies and similar technologies

We use cookies and similar technologies on our website and digital environments. We use Termly to help manage cookie consent and GDPR-related consent preferences on our website.

A. Strictly necessary cookies

These are used to provide core functionality, such as security, session management, authentication, or saving your cookie choices. These do not require consent where they are strictly necessary.

B. Analytics cookies

These help us understand website usage and performance. Where required by law, we will only use non-essential analytics cookies with your consent.

C. Marketing or preference cookies

Where used, these help us personalise communications, content, or outreach. We will only use them where required consent has been obtained.

You can manage your preferences through our cookie banner or browser settings. Disabling some cookies may affect functionality.

11. Automated processing and profiling

T-Blocks may use rule-based tools, analytics, and internal scoring or workflow-support tools to help assess submissions, organise information, support onboarding, improve services, or assist internal decision-making.

Unless explicitly stated in a process-specific notice, we do not make decisions based solely on automated processing where those decisions produce legal effects or similarly significant effects on you without meaningful human involvement.

12. Data retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, including as needed to comply with legal, regulatory, tax, accounting, audit, dispute, limitation, security, and recordkeeping requirements.

Retention periods vary depending on the type of data and the context. In general:

• website and technical logs are retained for a limited period necessary for security, troubleshooting, and analytics;
• inquiry and business development records are kept for as long as necessary to manage the relationship and a reasonable follow-up period thereafter;
• onboarding, due-diligence, KYC/KYB, transaction, and reporting records may be retained for the duration of the relationship and for additional periods required by law, regulatory expectations, audit standards, limitation periods, or contractual obligations;
• marketing records are kept until you withdraw consent, unsubscribe, object, or until we determine the data is no longer needed for that purpose; and
• recruitment records are retained for the duration of the recruitment process and, where lawful, for a limited period afterwards.

When personal data is no longer needed, we will delete it, anonymise it, or securely archive it where continued retention is required by law.

13. Your rights

Subject to applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability, where applicable;
• withdraw consent at any time where processing is based on consent;
• not be subject to certain solely automated decisions, where applicable; and
• lodge a complaint with a competent supervisory authority.

If you want to exercise your rights, contact us at info@tblocks.io.

We may need to verify your identity before acting on a request. We may also refuse or limit a request where the law allows us to do so, including where the request would adversely affect the rights of others, legal privilege, trade secrets, confidentiality obligations, or mandatory recordkeeping requirements.

14. Marketing choices

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the message or by contacting us at info@tblocks.io.

Opting out of marketing does not affect service, legal, transactional, security, or other non-marketing communications that we still need to send.

15. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures may include, where appropriate:

• access controls and permissions;
• role-based access management;
• authentication safeguards;
• encryption in transit and, where applicable, at rest;
• audit logging;
• document-access controls;
• vendor due diligence;
• incident response procedures; and
• backup and resilience measures.

No system is completely secure. You are responsible for maintaining the confidentiality of your credentials and notifying us promptly if you suspect unauthorised access or misuse.

16. Third-party websites and services

Our website or communications may contain links to third-party websites, platforms, or tools. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy notices of those third parties before sharing personal data with them.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, our services, our vendors, or our processing practices.

When we update this Privacy Policy, we will revise the “Last Updated” date above. Where required by law, we will also provide additional notice or seek consent.

18. Complaints

If you have concerns about how we process your personal data, we encourage you to contact us first at info@tblocks.io so we can try to resolve the issue.

You also have the right to lodge a complaint with the Luxembourg supervisory authority:

Commission nationale pour la protection des données (CNPD)
Website: cnpd.public.lu