Last revised: June 10, 2026 — Version 2.0
The purpose of this document is to provide you with information on the use of your personal data in accordance with the Cayman Islands Data Protection Act (as amended) and, in respect of any EU data subjects, the EU General Data Protection Regulation (together, the “Data Protection Legislation”).
We may update this Policy from time to time. If we make any changes, we will update the “Last revised” date above. We encourage you to periodically review this Policy for the latest information on our privacy practices. Any modifications will be effective upon posting of the updated Policy. Your continued use of our services following the posting of any updated Policy indicates your acceptance of the updated Policy.
1. Your Personal Data
We may collect personal data you provide to us, including name, address, email, contact details, IP address, and correspondence records. We may also obtain personal data from publicly accessible directories and other sources.
2. How We May Use Your Personal Data
We, to the extent we are a data controller under the Data Protection Legislation, may collect, store and use your personal data for purposes including the following:
The processing is necessary for the performance of a contract, including:
- facilitating the continuation or termination of our contractual relationship; and
- transactions between us.
The processing is necessary for compliance with applicable legal or regulatory obligations, including:
- undertaking due diligence including anti-money laundering and counter-terrorist financing checks, including verifying your identity and address;
- sanctions screening and complying with applicable sanctions and embargo legislation;
- complying with requests from regulatory, governmental, tax and law enforcement authorities;
- surveillance and investigation activities;
- carrying out audit checks, and instructing our auditors;
- maintaining statutory registers; and
- preventing and detecting fraud.
The pursuit of our legitimate interests, or those of a third party to whom your personal data may be disclosed, including:
- complying with a legal, tax, accounting or regulatory obligation to which we or a third party are subject;
- assessing and processing requests you make;
- investigating any complaints, or pursuing or defending any claims, proceedings or disputes;
- providing you with, and informing you about, products and services;
- managing our risk and operations;
- complying with audit requirements;
- ensuring internal compliance with our policies and procedures;
- protecting us or related entities against fraud, breach of confidence or theft of proprietary materials;
- seeking professional advice, including legal advice;
- facilitating business asset transactions involving us or related entities;
- monitoring communications to/from us (where permitted by law); and
- protecting the security and integrity of our or related entities' IT systems.
We will only process your personal data in pursuing our legitimate interests where we have considered that the processing is necessary and, on balance, our legitimate interests are not overridden by your legitimate interests, rights or freedoms.
3. Sharing Your Personal Data
We may share your personal data with our affiliates and service providers. In certain circumstances we may be legally obliged to share your personal data and other financial information with relevant regulatory authorities such as the Cayman Islands Monetary Authority or the Tax Information Authority. They, in turn, may exchange this information with foreign authorities, including tax authorities and other applicable regulatory authorities. In exceptional circumstances, we will share your personal data with regulatory, prosecuting and other governmental agencies or departments, and parties to litigation (whether pending or threatened) in any country or territory.
Our affiliates and service providers may process your personal data on our behalf, including with our banks, accountants, auditors and lawyers which may be data controllers in their own right. Our service providers are generally processors acting on our instructions. Additionally, a service provider may use your personal data where this is necessary for compliance with a legal obligation to which it is directly subject. The service provider, in respect of this specific use of personal data, may be deemed to be acting as a data controller.
4. Sending Your Personal Data Internationally
Due to the international nature of our business, your personal data may be transferred to jurisdictions that do not offer equivalent protection of personal data as under the Data Protection Legislation. In such cases, we will process personal data or procure that it be processed in accordance with the requirements of the Data Protection Legislation. To the extent that we transfer personal data of EU, EEA, UK, or Swiss data subjects outside those jurisdictions, we shall do so in accordance with applicable data protection law, including, where required, by relying on adequacy decisions, standard contractual clauses, or other appropriate safeguards as recognized under the applicable Data Protection Legislation. Further information on the transfer mechanisms we rely on is available upon request by contacting us at the address set out in Section 8.
5. Retention and Deletion of Your Personal Data
We will keep your personal data for as long as it is required by us. For example, we may require it for our legitimate business purposes, to perform our contractual obligations, or where law or regulation obliges us to. Some personal data will be retained after your relationship with us ends. We expect to delete your personal data (at the latest) once there is no longer any legal or regulatory requirement or legitimate business purpose for retaining your personal data. To determine the appropriate retention period for personal data, we may consider applicable legal requirements, the amount, nature, and sensitivity of the personal data, the risk of harm from unauthorized use or disclosure, the purposes for which we process your personal data, and whether we can achieve those purposes through other means.
6. Automated Decision-Making
We will not take decisions producing legal effects concerning you, or otherwise significantly affecting you, based solely on automated processing of your personal data, unless we have considered the proposed processing in a particular case and concluded that it meets the applicable requirements under the Data Protection Legislation.
7. Your Rights
You have certain data protection rights, including the right to:
- be informed about the purposes for which your personal data are processed;
- access your personal data;
- receive a portable copy of your personal data, or request that we transmit it to another controller in a structured, commonly used, and machine-readable format, where technically feasible (right of data portability);
- stop direct marketing;
- restrict the processing of your personal data;
- have incomplete or inaccurate personal data corrected;
- ask us to stop processing your personal data;
- withdraw your consent to our processing of your personal data at any time, where processing is based on consent. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal;
- appeal any decision by us to decline to process your request;
- be informed of a personal data breach (unless the breach is unlikely to be prejudicial to you);
- complain to the Data Protection Ombudsman; and
- require us to delete your personal data in some limited circumstances.
8. Contact Us
We are committed to processing your personal data lawfully and to respecting your data protection rights. Please contact us at legal@doublezero.xyzif you have any questions about this notice or the personal data we hold about you marking your communication “[NAME] - Data Protection Enquiry”. If you interact with our services on behalf of or through an organization, your information may also be subject to your organization’s privacy practices, and you should direct privacy inquiries to your organization.
9. Children
Our services are intended for users who are 18 years of age or older and are not directed at children. We do not knowingly collect personal data from individuals under the age of 18. If you believe that personal data of a child has been submitted to us in error, please contact us at legal@doublezero.xyz so that we may take appropriate steps.
10. Additional Information for Certain Jurisdictions
California
If you are a California resident, you may have certain additional rights under the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”). You have the right to know the categories of personal information collected about you in the preceding 12 months, the purposes for which it is used and shared, and the categories of third parties with whom it is shared. You may also request access to or deletion of your personal information, opt out of the sale or sharing of your personal information, and request correction of inaccurate personal information. We will not discriminate against you for exercising any CCPA or CPRA rights. To exercise these rights, please contact us at legal@doublezero.xyz. You may also designate an authorized agent to submit requests on your behalf, subject to identity verification requirements. We have not sold personal information of California residents.
European Economic Area, United Kingdom, and Switzerland
If you are a data subject in the European Economic Area, the United Kingdom, or Switzerland, you have certain rights under the GDPR and equivalent applicable legislation. References to “personal data” and “personal information” in this Policy are used consistently with “personal data” as defined under the GDPR. We process your personal data on the lawful bases described in Section 2 above. You may exercise the rights described in Section 7 above by contacting us at legal@doublezero.xyz. If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority in your jurisdiction. All personal data we process may be transferred, processed, and stored in jurisdictions outside the European Economic Area, the United Kingdom, or Switzerland. To the extent such transfers occur, we will implement appropriate safeguards in accordance with applicable data protection law, including standard contractual clauses or other recognized mechanisms, as further described in Section 4.