Privacy Policy

Privacy Policy

Effective Date: March 19, 2026

The Vanderbilt Portfolio AG (“we,” “us,” “our”) operates capitaltokenization.com (“the Site”). This Privacy Policy describes in detail how we collect, use, store, share, and protect information when you visit our Site. Capital Tokenization provides institutional intelligence on capital markets tokenization, and we are committed to handling visitor data responsibly and transparently. By accessing the Site, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy applies to all visitors of the Site, whether you are reading our fixed-income analysis, browsing entity profiles, reviewing dashboard metrics, or subscribing to our research communications. It does not apply to third-party websites linked from our content, which maintain their own privacy policies.

1. Information We Collect

We collect information in two primary categories: information collected automatically through your use of the Site, and information you voluntarily provide.

1.1 Automatically Collected Information

When you visit any page on Capital Tokenization — including our comparisons, equities coverage, institutional infrastructure analysis, or private markets intelligence — our servers and third-party services automatically collect certain technical data:

• Server Logs: Your IP address, browser type and version, operating system, referring URL, pages visited, time spent on each page, and timestamps of access. These logs are generated by our hosting infrastructure and are essential for maintaining site security and performance.
• Google Analytics 4 (GA4): We use Google Analytics 4 to understand how visitors interact with the Site. GA4 collects data including page views, session duration, bounce rate, geographic location (country and city level), device type, screen resolution, and user flow through the Site. GA4 uses first-party cookies and does not collect personally identifiable information by default. Google’s privacy policy governs how Google processes this data: https://policies.google.com/privacy.
• Google AdSense: We display advertisements through Google AdSense, which may use cookies and web beacons to serve ads based on your prior visits to our Site or other websites. Google’s advertising partners may collect data about your browsing activity across websites that participate in the Google advertising network. You can opt out of personalized advertising by visiting Google’s Ad Settings.
• Performance Metrics: We collect Core Web Vitals data (Largest Contentful Paint, First Input Delay, Cumulative Layout Shift) to monitor and optimize the user experience across the Site.

1.2 Voluntarily Provided Information

We collect information you actively provide in the following contexts:

• Contact Inquiries: When you email us at info@capitaltokenization.com with questions about our methodology, data corrections, partnership inquiries, or general feedback, we collect your email address, name (if provided), and the content of your message.
• Newsletter Subscriptions: If you subscribe to Capital Tokenization research updates, we collect your email address and any preferences you indicate regarding coverage areas (e.g., fixed-income tokenization, equity tokenization, private markets).
• Report Downloads: If you request research materials through our report download page, we collect the information you submit on that form, typically your name, email address, and professional affiliation.

1.3 Information We Do Not Collect

Capital Tokenization does not collect financial account information, investment portfolio data, social security numbers or government identifiers, payment card information, or health data. We do not sell, rent, or trade personal data to third parties.

2. How We Use Information

We use collected information for the following specific purposes:

• Site Operations and Improvement: Maintaining server uptime, fixing technical issues, optimizing page load speeds, and ensuring the Site functions correctly across devices and browsers.
• Content Analytics: Understanding which coverage areas — such as bond tokenization issuance tracking, repo tokenization analysis, or settlement infrastructure coverage — generate the most reader engagement, so we can allocate research resources effectively.
• Advertising: Serving relevant advertisements through Google AdSense to support the free availability of our institutional-grade research.
• Communications: Responding to inquiries sent to info@capitaltokenization.com and delivering newsletter content to subscribers who have opted in.
• Security: Detecting and preventing unauthorized access, abuse, or fraudulent activity on the Site.
• Legal Compliance: Fulfilling obligations under applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP), and the California Consumer Privacy Act (CCPA).

3. Legal Basis for Processing (GDPR)

For visitors in the European Economic Area (EEA) and Switzerland, we process personal data under the following legal bases:

• Legitimate Interest (Article 6(1)(f) GDPR): Server logging, security monitoring, and analytics processing to maintain and improve the Site.
• Consent (Article 6(1)(a) GDPR): Non-essential cookies for advertising and analytics, newsletter subscriptions, and personalized content delivery. You may withdraw consent at any time.
• Contractual Necessity (Article 6(1)(b) GDPR): Processing required to respond to your inquiries or deliver subscribed research content.
• Legal Obligation (Article 6(1)(c) GDPR): Processing required to comply with applicable laws and regulations.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on the Site. Cookies are small text files stored on your device that help us recognize returning visitors and understand usage patterns.

• Essential Cookies: Required for basic site functionality, including session management and security. These cannot be disabled.
• Analytics Cookies (Google Analytics 4): Help us measure traffic and understand visitor behavior. Set with a default expiration of 2 years for GA4 client ID cookies.
• Advertising Cookies (Google AdSense): Used to serve personalized advertisements and measure ad performance. These are set by Google and its advertising partners.

For full details on the cookies we use, their purposes, and how to manage them, see our Cookie Policy.

You can control cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Note that disabling cookies may affect site functionality.

5. Third-Party Services and Data Sharing

We share data with the following categories of third parties:

• Google LLC: Through Google Analytics 4 and Google AdSense, as described above. Data may be transferred to Google servers in the United States. Google participates in the EU-U.S. Data Privacy Framework.
• Hosting Provider: Our web hosting provider processes server logs and site data as a data processor under our instructions.
• Content Delivery Network (CDN): Our CDN provider caches and delivers site content globally, processing IP addresses and request data in the process.

We do not sell personal data. We do not share personal data with covered entities including JPMorgan, Goldman Sachs, BlackRock, Broadridge, or any other institution whose tokenization activities we analyze.

6. International Data Transfers

Capital Tokenization is operated by The Vanderbilt Portfolio AG, based in Zurich, Switzerland. If you access the Site from outside Switzerland, your data may be transferred to and processed in Switzerland and other countries where our service providers operate, including the United States. We ensure appropriate safeguards for international transfers through Standard Contractual Clauses (SCCs) approved by the European Commission and Swiss Federal Data Protection and Information Commissioner (FDPIC).

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Server Logs: Retained for 90 days, then automatically purged.
• Google Analytics Data: Retained per GA4 default settings (14 months for user-level data).
• Contact Inquiry Data: Retained for 2 years from the date of last communication, then deleted.
• Newsletter Subscriber Data: Retained until you unsubscribe, after which your email is removed within 30 days.
• Report Download Data: Retained for 2 years from the date of download.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access (GDPR Article 15, FADP Article 25): Request a copy of the personal data we hold about you.
• Right to Rectification (GDPR Article 16): Request correction of inaccurate personal data.
• Right to Erasure (GDPR Article 17): Request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction (GDPR Article 18): Request that we limit how we process your data.
• Right to Data Portability (GDPR Article 20): Request your data in a structured, machine-readable format.
• Right to Object (GDPR Article 21): Object to processing based on legitimate interest, including profiling for advertising purposes.
• Right to Withdraw Consent: Withdraw previously given consent at any time without affecting the lawfulness of processing before withdrawal.
• CCPA Rights: California residents may request disclosure of data collected, request deletion, and opt out of the sale of personal information (we do not sell personal information).

To exercise any of these rights, contact us at info@capitaltokenization.com with “Data Rights Request” in the subject line. We will respond within 30 days for GDPR requests and 45 days for CCPA requests.

You also have the right to lodge a complaint with a supervisory authority. For Swiss residents, this is the Federal Data Protection and Information Commissioner (FDPIC). For EEA residents, contact your local data protection authority.

9. Data Security

We implement technical and organizational measures to protect personal data, including encrypted data transmission (TLS/SSL), access controls limiting data access to authorized personnel, regular security assessments, and secure hosting infrastructure with DDoS protection. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Children’s Privacy

Capital Tokenization is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately at info@capitaltokenization.com and we will delete the data.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically. Your continued use of the Site after changes constitutes acceptance of the updated policy.

12. Contact

For all data protection inquiries, rights requests, or questions about this Privacy Policy:

Email: info@capitaltokenization.com Entity: The Vanderbilt Portfolio AG, Zurich, Switzerland

For questions about our research practices and data sourcing, see our methodology page. For information about the terms governing use of our analysis and intelligence products, see our Terms of Service.