Your information, handled with purpose.

Controller and contact

Nobu Bank is the controller for registrations of interest in the Nobu OnChain SRBI Fund (NNBTF). For privacy questions and requests, contact the Global Treasury, Digital Asset Business team at arie.hartanto@nobubank.com. Identify your registration reference where available; do not email identity documents unless requested through an appropriate channel.

Information we collect

We collect your name, job title, work email, selected contact details, country of residence, organization and licensing information, indicative investment interest, preferences, and eligibility answers. We record submission time, consent choices and their versions, registration reference, and internal follow-up status and notes. Optional fields may be left blank.

For abuse prevention, the application hashes your IP address using a server-held secret and stores the hash rather than the raw IP address. Hosting and security providers necessarily process connection metadata to deliver their services. Please do not submit identity documents, account numbers, seed phrases, or private keys through this form.

Why we process it and our legal bases

We use your registration to assess eligibility, plan the founding tranche, prioritize follow-up, respond to your document request, and discuss the proposed product and integration needs. The registration form requests your consent for these purposes. We process security metadata to protect the service and meet applicable obligations. Separate, optional consent covers NNBTF updates; it is unticked by default and can be withdrawn independently.

Registration is voluntary. Required fields and consent enable us to process and respond to your request. Declining required consent prevents submission. An automated priority score helps organize human follow-up using ticket size, timing, founding interest, and regulated status. It does not determine investor eligibility, an allocation, or any other final decision. Ask the team for a human review.

Storage, recipients, and cross-border processing

Submitted registration records are stored in Supabase Postgres in Singapore. The website runs on Vercel, with application functions configured for Singapore. Authorized Nobu Bank staff and contracted service providers process information only as needed for the stated purposes. Website delivery, operational logs, security checks, authentication, and email delivery may involve processing in other countries; database region selection alone does not limit every service provider to Singapore.

Cloudflare Turnstile processes security signals to help distinguish automated abuse from legitimate submissions. Vercel Analytics provides cookieless website analytics. Resend, when enabled, delivers confirmation and internal notification emails; email content is limited to what is needed, with internal notifications directing staff to the private admin page.

For transfers outside Indonesia, Nobu Bank is responsible for assessing the receiving country’s level of protection and appropriate binding safeguards under applicable law, and obtaining any additional consent where required. The team can provide information about the applicable safeguards. Data is not sold or shared for third-party advertising.

Local drafts and cookies

The form saves a draft in your browser’s local storage for up to 7 days so you can return after a refresh. It may contain your personal information. Use a private device and choose “Clear this draft” to remove it. The draft is cleared after successful submission. Consent choices are not restored after a refresh. Essential cookies support admin authentication and briefly display a submitted reference. No advertising cookies are used.

Retention

Registration records are retained for up to 24 months after your last substantive interaction, unless a longer period is required by law, a documented legal hold, or a subsequent client relationship. Marketing consent is retained until withdrawal or expiry of the relevant purpose. Abuse-prevention hashes in the rate-limit table are cleared after one day; the submission’s hash follows the registration record’s retention. Deletion requests and retention reviews are handled by the team, including deletion from the email queue and applicable provider systems. Backups expire under the providers’ backup schedules.

Your rights

Under Undang-Undang Pelindungan Data Pribadi (UU PDP), Indonesia’s Personal Data Protection Law, Law No. 27 of 2022, you may, subject to applicable conditions, request information about processing; access or a copy of your data; correction; completion; cessation, deletion, or destruction; withdrawal of consent; restriction or postponement; and portability. You may object to solely automated decisions with legal or significant effects and pursue complaints or remedies available under law.

Contact the team to exercise these rights. We may verify your identity proportionately before responding. Withdrawing optional marketing consent does not affect an existing request for documents; withdrawing required processing consent may prevent further follow-up. Withdrawal does not invalidate lawful processing already performed. Requests will be handled within the applicable statutory timelines.

Security and changes

Access is restricted to authorized staff. Data access takes place through server routes, and administrative actions require authentication and an email allow-list. No internet service can eliminate every security risk. Where a personal data protection failure occurs, Nobu Bank will provide notifications required under applicable law.

Material changes to this notice will be reflected in a new version and, where required, communicated or consented to before new processing begins. Read Law No. 27 of 2022.