TOHKN, operated by MIO3, Sociedad Anónima de Capital Variable, registered in the Definitive Registry of Digital Asset Service Providers of El Salvador (registration No. PSAD-0016), is committed to protecting the privacy and personal data of its Users, in compliance with the laws in force in the Republic of El Salvador and by adopting international data-protection principles and standards.}
Introduction
This Privacy Policy (hereinafter, the “Policy”) governs the collection, use, storage, disclosure, processing, transfer, and protection of the personal data of Users who access and use the mobile or desktop investment application (the “Application”) known as “TOHKN.”
TOHKN is a registered trademark owned by MIO3. The Application constitutes the only digital ecosystem linked to the MIO3 Platform through which the User may conduct Digital Asset investment activities, Exchange transactions, custody activities, and, where applicable, receive returns.
This Policy forms an integral part of the TOHKN Terms and Conditions, and the User’s express acceptance thereof is an essential requirement for registering, accessing, and using the Application’s products and services.
MIO3 may amend this Policy at any time. Any amendment shall be published in the Application and notified to the User by email or by notice within the Application. Continued use of the services following such amendments constitutes express acceptance of the revised Policy.
1. Information We Collect
TOHKN may collect the following categories of personal data:
Identification and contact information: full name or legal entity name, identity document, nationality, address, date of birth, email address, telephone number, and other similar information.
Financial and transactional data: transaction history within the Application, source and destination of funds, Digital Assets, and addresses of custodial digital wallets.
Technical and browsing data: IP address, browser type, access device, operating system, network configuration, approximate location, and activities performed within the Application, including data obtained through cookies or similar technologies.
Data obtained from public sources or authorized third parties: public records, international sanctions lists, and identity-verification providers.
Automatically collected data: usage preferences, interactions with notifications or electronic communications, and geolocation data where the User has provided express consent.
2. Purposes of Processing
Personal data collected by TOHKN shall be processed lawfully and transparently for the specific and legitimate purposes described below:
Regulatory compliance: identity verification, KYC procedures, anti-money laundering (AML), and counter-terrorist financing (CFT).
Account registration and management: creation, maintenance, and administration of the TOHKN Account and TOHKN Wallet.
Execution of transactions: purchase, sale, transfer, custody, and redemption of Digital Assets, as well as receipt of returns, where applicable.
Security and fraud prevention: detection of unlawful activities, unauthorized access, or suspicious transactions.
Legal and contractual compliance: fulfillment of legal, tax, regulatory, and contractual obligations arising from the services.
Improvement of the User experience: statistical analysis, interface personalization, and delivery of operational and informational communications.
Commercial and promotional purposes: delivery of commercial and advertising notifications, provided that the User has expressly authorized them.
Supervision and auditing: retention of records and compliance with requests from administrative, judicial, or regulatory authorities.
3. Disclosure and Transfer of Personal Data
Competent authorities: in compliance with legal, regulatory, or judicial obligations.
Service providers: third parties acting as data processors, including cloud-storage providers, payment processors, and identity-verification providers, among others.
Entities affiliated with or related to MIO3: provided that a legitimate purpose exists and an adequate level of data protection is guaranteed.
Corporate transactions: restructuring, merger, acquisition, or asset-transfer processes, subject to confidentiality agreements.
In all cases, MIO3 shall require third-party recipients of data to comply with confidentiality obligations and equivalent data-protection standards.
4. Retention of Personal Data
Personal data collected by MIO3 shall be retained only for the period strictly necessary to fulfill the purposes for which it was collected. Thereafter, the data shall be deleted or anonymized unless a legal or regulatory provision requires its retention for an additional period.
Notwithstanding the foregoing, certain personal data may be retained for a longer period due to applicable regulations, including regulations concerning the prevention of money and asset laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction.
Likewise, certain data may be retained for the period expressly established by competent administrative, judicial, or regulatory authorities in compliance with legal requests or supervision, inspection, or audit procedures.
5. User Rights
In accordance with applicable personal-data protection laws, you may exercise the following rights concerning your personal data at any time and free of charge:
Right of access: obtain confirmation as to whether MIO3 processes your personal data and, where applicable, access the corresponding information in a clear and intelligible form.
Right to rectification: request the correction or updating of inaccurate, incomplete, or outdated personal data.
Right to cancellation or deletion: request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you have withdrawn your consent, when you object to the processing of your data, when the processing is unlawful, or when the data must be deleted in compliance with a legal obligation, except where otherwise provided by law.
Right to be forgotten: require the deletion of your personal data from electronic environments and TOHKN databases.
Right to object: request that the processing of your personal data cease.
Right to restriction of processing: request that the processing of your data be restricted in specific circumstances, such as when you challenge its accuracy, the processing is unlawful, TOHKN no longer requires your data, or while your legitimate objection is being resolved.
Right to data portability: receive your data in a commonly used, machine-readable format and transmit it to another data controller where technically feasible.
Right not to be subject to automated decision-making: request not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or otherwise significantly affect you, except in cases expressly permitted by law.
To exercise any of these rights, you may submit a request to [email protected] or through the corresponding form available in the official TOHKN Application.
TOHKN shall respond to your request within the maximum period established under the Personal Data Protection Law of the Republic of El Salvador.
6.Security Measures
TOHKN adopts appropriate technical and administrative measures to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction. Such measures include:
Encryption of information during transmission and storage.
Multi-factor authentication (MFA) for account access.
Access controls based on the principles of necessity and proportionality.
Periodic audits and continuous system monitoring.
Internal privacy policies, personnel training, and confidentiality agreements.
You are also responsible for maintaining the confidentiality of your access credentials and immediately notifying MIO3 of any unauthorized use of your account.
7. International Data Transfers
Where it is necessary to transfer data to jurisdictions outside El Salvador, MIO3 shall verify that the recipient country provides an adequate level of protection in accordance with local and international regulations. In the absence of an adequate level of protection, contractual clauses or other valid legal mechanisms shall be adopted to ensure the secure processing of data in accordance with applicable regulations.
TOHKN shall maintain an updated record of international transfers carried out in accordance with the principles of accountability and traceability.
8. Changes to the Privacy Policy
MIO3 may amend this Policy at any time. Material amendments shall be notified to you through the Application or by email and shall take effect upon publication. Continued use of the services after such notice constitutes acceptance of the amendments.
9. Jurisdiction and Governing Law
This Policy shall be governed by and construed in accordance with the laws of the Republic of El Salvador. Any dispute relating to its interpretation or enforcement shall be submitted to the jurisdiction of the competent courts of that country.
10. Contact
To exercise their rights or submit inquiries regarding this Policy, the User may contact MIO3 at [email protected].