> For the complete documentation index, see [llms.txt](https://perena.gitbook.io/perena/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://perena.gitbook.io/perena/legal/privacy-notice.md). # Privacy Notice Last Updated: April 29, 2026 This Privacy Notice explains how Perena Foundation, a Panamanian private-interest foundation under Law 25 of 12 June 1995, Foundation ID 25058713 (“the Foundation”, “we”, “us”, “our”), processes personal data in connection with the website at perena.org and related user interface (the “Services”). BY USING THE SERVICES YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY NOTICE. IF YOU DO NOT AGREE, DO NOT USE THE SERVICES. This Privacy Notice should be read together with the Terms of Use, the Risks Disclosure, the Regulatory Notice, and the Click-through acknowledgements. 1\. Who we are The Foundation is the data controller in respect of the personal data described below. The Foundation publishes the Services without charge, in furtherance of its purposes as a Panamanian private-interest foundation. The non-custodial on-chain smart contracts accessible through the Services (the “Perena Protocol”) are not operated or controlled by the Foundation, and the Foundation is not a data controller in respect of any on-chain data. Blockchain data is public, immutable, and outside the Foundation’s control. Norbert Private Limited (issuer of USD\*) and Journal 1 Corp. (discretionary investment manager of Norbert’s portfolio) are separate legal entities. This Privacy Notice does not cover their processing of personal data. If you are dealing directly with Norbert or with Journal 1, please consult their own privacy notices. 2\. Personal data we process 2.1 Wallet and transaction data Wallet addresses that connect to the Services, transaction hashes, approvals, and related on-chain data. These are pseudonymous but may become identifying if linked to other information. 2.2 Device and usage data IP address, approximate location derived from IP address, device type, operating system, browser, language, referring URL, pages viewed, timestamps, and similar technical data. 2.3 Communication data Any name, email, social-media handle, attachment, or other information you provide when contacting us, applying for a role, or completing a form. 2.4 Compliance data Information collected or received for sanctions screening, AML compliance, jurisdiction screening, and fraud prevention, including screening results from third-party compliance providers and click-through certification records. We do not intentionally collect special-category personal data. You should not provide us with such data unless expressly requested. 3\. Purposes and legal bases 3.1 Providing the Services Allowing you to connect a wallet, view Protocol state, submit transactions, and record your click-through certifications. Legal basis: performance of our contract with you (the Terms of Use) and our legitimate interests in publishing the Services in furtherance of the Foundation’s purposes. 3.2 Security, fraud prevention, and compliance Sanctions screening, jurisdiction screening, detection of prohibited activity, and protection of the Services from abuse. Legal basis: legitimate interests and compliance with Applicable Law. 3.3 Analytics and improvement Measuring usage, diagnosing errors, and improving the Services. Legal basis: legitimate interests. 3.4 Communications Responding to enquiries, support requests, role applications, and notices. Legal basis: legitimate interests. 3.5 Legal and regulatory obligations Responding to lawful requests from authorities, enforcing our rights, and defending legal claims. Legal basis: legal obligation and legitimate interests. 4\. Cookies and similar technologies We may use strictly necessary cookies and similar technologies to operate the Services. Where we use non-essential analytics technologies, we will seek your consent where required by Applicable Law. You may control cookies through your browser. 5\. Recipients We may disclose personal data to: * service providers (hosting, analytics, security, compliance, and support), acting under written data-processing agreements; * professional advisers (lawyers, accountants, auditors), bound by confidentiality; * group entities (Journal 1 Corp. and Norbert Private Limited) where reasonably necessary for compliance, accounting, or legal purposes, subject to written agreements; * compliance and enforcement recipients where disclosure is required by law, legal process, or a lawful regulatory request, or where necessary to protect rights, users’ safety, or the integrity of the Services; * in a corporate transaction (reorganisation, merger, sale, transfer). We do not sell personal data. 6\. International transfers We operate globally. Personal data may be transferred to, and processed in, jurisdictions other than your own. Where Applicable Law requires safeguards for such transfers, we implement them (for example, European Commission standard contractual clauses or equivalent mechanisms). 7\. Retention We retain personal data only as long as necessary for the purposes for which it was collected, or as required by Applicable Law. Click-through certifications and compliance-screening records are retained for as long as required for audit and regulatory-defence purposes, typically a minimum of seven years. Note that on-chain data cannot be deleted or modified by us. 8\. Your rights Subject to Applicable Law, you may have the right to (a) access; (b) rectification; (c) erasure (noting that on-chain data cannot be erased); (d) restriction or objection; (e) data portability; (f) withdrawal of consent; (g) complaint to a data-protection authority. To exercise any right, contact . We may need to verify your identity. 9\. Security We implement appropriate technical and organisational measures to protect personal data. No system is perfectly secure, and you use the Services at your own risk. 10\. Children The Services are not directed to persons under 18. We do not knowingly process children’s personal data. 11\. Changes We may update this Privacy Notice. Changes take effect when posted, as indicated by the “Last Updated” date. 12\. Contact legal \[x] perena.org