Privacy Policy — Rome Protocol / Bloom

Effective on publication.

Coin Vesting, Inc., a Delaware C-corporation doing business as Rome Protocol ("we", "us"), operates the Rome Protocol website and Bloom, a permissioned platform for issuing and investing in tokenized real-world assets on the Rome network. This policy governs both the Bloom application and our marketing website, and explains what personal data we collect, why, who processes it, how long we keep it, and the rights you have. It applies to applicants, investors, issuer representatives, and site visitors.

Who may use Bloom. Bloom is offered only to non-U.S. persons; U.S. residents are not onboarded.

1. The data involved — and who holds it

Identity verification is carried out by Sumsub, our identity-verification provider, acting as our processor (see §2). The sensitive identity documents and biometrics you submit are collected and stored by Sumsub, not by us — we retain only the result of the check and an opaque reference to it (the full verdict reaches us transiently at verification time and is not stored — see §2).

Collected and stored by Sumsub (on our behalf, to verify you):

• Identifiers & profile data — name, date of birth, nationality, contact details.
• Government-issued document data — passport, ID card, or equivalent, and the data extracted from them.
• Visual and biometric data — a facial image and a liveness check.
• Financial & source-of-funds information and screening & compliance data (sanctions/PEP/adverse-media), where applicable.

Stored by us (the minimum we need to operate the platform and meet our obligations):

• The verification result — whether your identity is verified, the verdict date and validity period, and (if applicable) a rejection category. Not the underlying documents or biometrics.
• An opaque reference to your verification case (a correlation id — not your name or ID number).
• Blockchain data — your wallet address(es), on-chain transactions, and allowlist membership (see §8).
• Self-declared application data — the jurisdiction and investor type you select, and the declarations you agree to.
• Issuer business information (for issuer representatives) — the legal name, jurisdiction, and registration number an issuer submits to onboard, and the approving reviewer's wallet. For a sole trader, the legal name may itself be personal data.
• Technical, device, and network data — IP address, device/browser data, and server access logs.

What we do NOT store

We do not store your identity documents, facial image, or biometric data — those are held by Sumsub under its own retention and security controls. What we do retain is the set listed under "Stored by us" above — the verification result, the opaque case reference, your blockchain data, your self-declared application data, (for issuer representatives) the issuer business information, and technical and network data — never the underlying documents or biometrics.

Cookies

Our app and website use cookies and similar technologies to operate and secure the service and to remember your session. Any non-essential cookies (such as analytics) will be described in a separate cookie notice.

2. Identity verification is performed by Sumsub

We use Sumsub (Sum and Substance Ltd and its affiliates) to perform identity verification (KYC), liveness, and AML/CFT screening. For this primary verification, Sumsub acts as our processor — it collects, processes, and stores your identity data on our behalf and under our instructions; we retain only the verification result and an opaque reference (the full verdict payload reaches our server transiently at verification time and is not stored). Sumsub independently acts as a controller for network-level fraud detection, fraud-model training, and certain of its own compliance functions, and may retain data for those purposes under its own notice. Sumsub's handling and retention of the underlying documents and biometrics are governed by its own privacy notice.

3. Why we process your data (purposes)

Identity verification and liveness; AML/CFT compliance and ongoing monitoring; sanctions/OFAC screening; underage prevention; fraud detection; determining your eligibility to hold a given tokenized asset (allowlist admission); and operating and securing the platform and website.

4. Legal basis

We process your personal data on these bases:

• Legal obligation — to meet anti-money-laundering and counter-terrorist-financing requirements and related financial-services law.
• Performance of a contract with you — to provide the platform.
• Explicit consent — for biometric data (facial image and liveness); you may decline, but we then cannot verify you and cannot grant access to gated assets.
• Legitimate interests — fraud detection and prevention, and processing technical and device data to secure and operate the platform.

4a. Automated decision-making

Your identity-verification verdict is applied automatically to determine whether you may be admitted to hold a gated asset. Because this can significantly affect you, you may request human review, express your view, and contest the outcome — contact us at rome@romeprotocol.com.

5. How long we keep it

What we hold (the verification result, the opaque case reference, your wallet address, your self-declared application data, and — for issuer representatives — the issuer business information) we retain for the duration of our relationship with you and for at least five years after it ends, in line with the retention period applicable to anti-money-laundering records. Technical and network data, including access logs, are kept for a shorter period consistent with security and operations. The underlying identity documents and biometrics are held by Sumsub, not by us, under Sumsub's retention schedule; they are deleted or returned in accordance with our instructions at the end of our contract with Sumsub. On-chain data cannot be deleted (see §8).

6. Who we share it with

Beyond Sumsub (§2), we may disclose your data to: our hosting and infrastructure providers (acting as our processors, to run the platform); regulators, law enforcement, and other authorities where we are legally compelled or where necessary to meet a compliance obligation; our professional advisers (legal, audit); and a successor entity in a corporate transaction. We do not sell your personal data.

6a. International transfers

Your data may be processed in countries other than your own, including countries where we and Sumsub operate (such as the United Kingdom, United States, Germany, Singapore, Brazil, and the United Arab Emirates). Where the law requires it, such transfers are protected by appropriate safeguards.

7. Your rights

Subject to applicable law, you may request to access, correct, delete, port, restrict, or object to the processing of your personal data, and you may withdraw consent where we rely on it. You may also complain to a data-protection regulator. To exercise any of these, contact us at rome@romeprotocol.com — you do not need to contact Sumsub directly; we coordinate the request. We may be required by law to retain certain records (for example, anti-money-laundering records) notwithstanding a deletion request. Note the on-chain limits in §8.

8. Blockchain data is public and permanent

Bloom operates on a public blockchain. Your wallet address, transactions, and allowlist membership are recorded on-chain, where they are public and immutable. We cannot delete, alter, or restrict on-chain data — a deletion or rectification right can only be honored for the off-chain records we control, not for data already written to the chain. Consider this before transacting.

9. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data. No system is perfectly secure.

9a. Not directed at minors

Bloom is not directed at, and we do not knowingly collect data from, anyone under 18. Identity verification is designed to prevent underage access; if you believe a minor has provided us data, contact us and we will delete what we control.

10. Changes & contact

We may update this policy; material changes will be posted here with a new effective date. Questions or requests: rome@romeprotocol.com · Coin Vesting, Inc. (DBA Rome Protocol).