Privacy Policy

Privacy Policy

Effective date: March 20, 2026 | Last updated: March 20, 2026

Tokenised ETFs (“we,” “us,” “the Platform”), published and operated by The Vanderbilt Portfolio AG, Zurich, Switzerland, is dedicated to protecting your privacy and handling your personal data responsibly. This Privacy Policy provides a thorough explanation of the data we collect when you visit tokenisedetfs.com, the purposes for which we process that data, the legal grounds supporting our processing activities, the measures we employ to secure your information, and the rights you hold as a data subject under applicable privacy legislation.

Scope of This Policy

This Privacy Policy applies to all data processing that takes place through tokenisedetfs.com. This includes your interactions with our treasury ETF analysis, yield product coverage, entity profiles, product comparisons, risk metrics analysis, market access guides, dashboard, glossary, and any communications initiated through our contact channels.

This policy does not extend to third-party websites or services linked from the Platform, including data providers such as RWA.xyz, DeFi Llama, blockchain explorers, fund issuer portals, or regulatory authority websites.

Data Controller

The entity responsible for processing your personal data is:

The Vanderbilt Portfolio AG Zurich, Switzerland Email: info@tokenisedetfs.com

Our Data Protection Officer can be reached at the same address and oversees compliance with the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), and all applicable data protection frameworks.

What Information We Collect

Automatically Collected Technical Data

When you access tokenisedetfs.com, our servers and integrated analytics services automatically collect the following technical information:

• Device data — Your browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and language preferences.
• Network data — Your IP address (anonymized prior to analytics storage), approximate geographic location derived from your IP address (country and city level), and referring URL.
• Behavioral data — Pages you visit, the sequence in which you navigate between sections (e.g., from the dashboard to a specific treasury ETF profile), time spent on each page, scroll depth, click events, and session duration. This data reveals, in aggregate, whether visitors spend more time analyzing BUIDL’s $2.83B AUM or comparing yield products — insights that guide our editorial priorities.
• Performance metrics — Page load times, server response codes, and error rates collected to maintain Platform uptime and responsiveness.

Data Collected via Cookies and Tracking Technologies

We deploy cookies and related technologies as detailed in our Cookie Policy. In brief, these include essential cookies for site functionality, Google Analytics 4 cookies for traffic measurement, and Google AdSense cookies for advertising delivery. Each cookie category, its purpose, retention period, and opt-out mechanism is fully documented in the Cookie Policy.

Data You Voluntarily Provide

We collect personal data that you choose to share with us through the following interactions:

• Email contact — When you write to info@tokenisedetfs.com, we collect your email address, your name if you provide it, and the content of your message. Common inquiries include methodology questions, data correction requests, and institutional data licensing discussions.
• Newsletter subscription — If you subscribe to receive updates, we collect your email address and any stated content preferences (e.g., interest in treasury products vs. yield strategies).
• Data licensing inquiries — Institutional users (asset managers, research firms, compliance teams) who inquire about licensing our analytical data provide their name, organization, role, email, and a description of their intended use case.

Data We Do Not Collect

Tokenised ETFs is a research and analysis platform — we do not operate as a fund, broker, exchange, or custodian. We do not process investment transactions, hold client assets, or provide portfolio management services. As such, we do not collect: cryptocurrency wallet addresses or private keys, brokerage or bank account information, social security numbers or tax identification numbers, investment portfolio holdings or transaction histories, biometric data, or any category of data classified as sensitive personal data under GDPR Article 9.

Legal Bases for Processing

We process personal data under the following legal bases as defined by the GDPR and Swiss FADP:

• Legitimate interest (Article 6(1)(f) GDPR) — Automatically collected technical and behavioral data is processed under our legitimate interest in maintaining Platform security, analyzing audience engagement, improving content quality, and ensuring technical reliability. We have assessed that these interests do not override your fundamental rights and freedoms, particularly given our use of IP anonymization and data aggregation.
• Consent (Article 6(1)(a) GDPR) — Non-essential cookies (analytics and advertising) are set only after you provide affirmative consent through our Consent Mode v2-compliant banner. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contractual performance (Article 6(1)(b) GDPR) — Data submitted via contact forms and newsletter sign-ups is processed to fulfill your request or to take pre-contractual steps at your initiative.
• Legal obligation (Article 6(1)(c) GDPR) — Certain data may be retained to comply with Swiss financial record-keeping obligations or in response to lawful requests from authorities.

How We Use Your Data

1. Platform operation — Delivering content reliably across devices and browsers, ensuring that data-intensive pages like our dashboard and comparison matrices render correctly.
2. Editorial optimization — Analyzing aggregate traffic patterns to determine which content areas warrant expanded coverage — for instance, whether reader interest is growing faster in tokenized treasury products or credit protocol yield tokens.
3. Communication — Responding to inquiries sent to info@tokenisedetfs.com and delivering newsletter content to subscribed users.
4. Advertising — Displaying advertisements through Google AdSense to sustain free public access to our independent research. As noted in our methodology, we do not accept paid placements from fund issuers; advertising revenue comes exclusively from Google AdSense.
5. Security — Monitoring for abnormal traffic patterns, preventing bot abuse, and protecting against unauthorized data extraction.
6. Legal and regulatory compliance — Maintaining records as required under Swiss law.

Google Analytics and Google AdSense Disclosure

Google Analytics 4 (GA4): We use GA4 to collect aggregated website usage statistics. GA4 processes data including page views, session duration, user demographics (age range and interest categories, in aggregate), traffic sources, and device categories. We have configured GA4 with the following privacy measures: IP anonymization is active, data retention is set to 14 months, data sharing is limited to analytics functions, and remarketing features are disabled. GA4 data is processed on Google servers, potentially located in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework.

Google AdSense: This Platform displays advertisements served by Google AdSense. As disclosed in our conflict-of-interest statement, advertising revenue from Google AdSense is our sole revenue source — we receive no compensation from fund issuers such as BlackRock, Franklin Templeton, Ondo Finance, or Maple Finance. Google AdSense uses cookies, including the DoubleClick IDE cookie, to deliver and optimize advertisements. Details on specific AdSense cookies and their retention periods are provided in our Cookie Policy. You may opt out of personalized advertising at https://adssettings.google.com.

Google Consent Mode v2

This Platform implements Google Consent Mode v2 to comply with EEA and UK data protection requirements. Consent Mode v2 transmits your consent choices to Google services via consent signals: ad_storage, analytics_storage, ad_user_data, ad_personalization, and functionality_storage. All signals default to “denied” until you grant affirmative consent. When consent is withheld, Google services operate in privacy-preserving modes — AdSense serves contextual ads without cookies, and GA4 sends anonymized measurement pings without setting persistent identifiers.

Data Sharing

We do not sell your personal data. Data is shared with the following categories of processors under binding data processing agreements:

• Google LLC — As the provider of Google Analytics and Google AdSense, Google receives analytics and advertising data as described above.
• Hosting infrastructure provider — Our hosting provider processes server access logs (containing anonymized IP addresses and request metadata) to ensure Platform availability and performance.
• Email delivery service — Our email service provider processes subscriber email addresses to deliver newsletter communications.

We may disclose personal data when required by law, in response to valid legal process from a court or regulatory authority, or to protect the rights, safety, or property of The Vanderbilt Portfolio AG or its users.

International Data Transfers

The Vanderbilt Portfolio AG is headquartered in Zurich, Switzerland. Switzerland benefits from an adequacy decision by the European Commission under GDPR Article 45, meaning data transfers between the EEA and Switzerland are permitted without additional safeguards. For transfers to service providers outside Switzerland and the EEA — including Google LLC in the United States — appropriate safeguards are in place, including the EU-U.S. Data Privacy Framework certification, Standard Contractual Clauses (SCCs), or binding corporate rules maintained by the data importer.

Data Retention

We retain personal data for the minimum period necessary to serve the purposes outlined in this policy:

• Server access logs — 90 days, then automatically purged.
• Google Analytics data — 14 months, per our GA4 retention configuration.
• Contact form and email correspondence — 2 years from the last communication, then deleted unless legal or contractual obligations require longer retention.
• Newsletter subscriber data — Retained while the subscription is active. Upon unsubscription, your email is removed from active lists within 30 days.
• Advertising cookie data — Retention periods vary by cookie and are governed by Google’s policies (see our Cookie Policy for specific durations).

Data Security Measures

We employ technical and organizational measures proportionate to the sensitivity of the data we process:

• Encryption in transit — All connections to tokenisedetfs.com use TLS/SSL encryption, ensuring data transmitted between your browser and our servers cannot be intercepted.
• Access controls — Internal access to personal data is restricted to authorized personnel on a need-to-know basis.
• Security monitoring — Automated monitoring detects and alerts on anomalous access patterns, brute-force attempts, and other security threats.
• Vendor security — Third-party processors (Google, hosting providers, email services) maintain their own security certifications and undergo periodic audits.

No system is fully immune to breach. In the event of a personal data breach affecting your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and will notify affected individuals without undue delay where required by GDPR Article 34.

Your Rights Under GDPR and Swiss FADP

Individuals in the European Economic Area, the United Kingdom, and Switzerland are entitled to the following rights:

• Access (Article 15 GDPR) — Request a copy of the personal data we process about you.
• Rectification (Article 16 GDPR) — Request correction of inaccurate or incomplete data.
• Erasure (Article 17 GDPR) — Request deletion of your personal data, subject to overriding legal obligations.
• Restriction (Article 18 GDPR) — Request that processing be limited under specified circumstances.
• Portability (Article 20 GDPR) — Receive your personal data in a structured, machine-readable format and transmit it to another controller.
• Objection (Article 21 GDPR) — Object to processing based on legitimate interests, including objection to profiling for advertising.
• Consent withdrawal — Withdraw cookie or other consent at any time without retroactive effect.
• Complaint — File a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch or with your local supervisory authority.

To exercise any right, email info@tokenisedetfs.com. We will respond within 30 days or the statutory deadline, whichever is shorter.

Your Rights Under CCPA/CPRA

California residents enjoy the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know — Request disclosure of categories and specific pieces of personal information collected.
• Right to delete — Request deletion of collected personal information, subject to statutory exceptions.
• Right to opt out of sale/sharing — Google advertising cookies may constitute “sharing” of personal information under CCPA. Opt out by declining advertising cookies via our consent banner or enabling Global Privacy Control (GPC) in your browser.
• Right to non-discrimination — We will not deny services, charge different prices, or provide a different service level based on your exercise of CCPA rights.

To submit a CCPA request, contact info@tokenisedetfs.com.

Children’s Privacy

This Platform is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child under 16 has provided personal data to us, contact info@tokenisedetfs.com and we will promptly delete the information.

Changes to This Privacy Policy

We reserve the right to update this Privacy Policy as our data practices evolve or as legal requirements change. Material updates will be communicated by posting a notice on the Platform and updating the “Last updated” date. We encourage you to review this policy periodically.

Contact Us

For privacy-related questions, data protection requests, or concerns about our data handling practices:

The Vanderbilt Portfolio AG Zurich, Switzerland Email: info@tokenisedetfs.com

See also our Cookie Policy and Terms of Service for related governance documents.