Privacy Policy

This Privacy Policy applies to:

• the Finger Bridge website;
• partner and business enquiry forms;
• developer and integration enquiries;
• newsletters and business communications;
• demonstration, sandbox, API, or portal services that link to this Privacy Policy;
• other interactions between you and Sargia relating to Finger Bridge.

This Privacy Policy does not govern the personal information processed independently by financial institutions, issuers, brokers, banks, custodians, exchanges, settlement providers, or other third parties connected through Finger Bridge.

Where Sargia processes personal information solely on behalf of a business customer, that customer may act as the data controller and Sargia may act as a data processor or service provider. In those circumstances, the customer’s privacy notice may also apply.

We may collect the following categories of information.

2.1 Information you provide directly

When you contact us or submit a form, we may collect:

• your name;
• business email address;
• telephone number;
• company name;
• job title or department;
• country or region;
• information about your organisation;
• your integration or partnership requirements;
• the contents of messages, enquiries, and correspondence;
• documents or information you voluntarily provide.

2.2 Account and developer information

Where account, sandbox, developer portal, or API functionality is available, we may collect:

• account identifiers;
• login credentials in encrypted or hashed form;
• account permissions and roles;
• API keys and associated metadata;
• integration settings;
• account activity records;
• authentication, security, and access logs.

You must not submit passwords, private keys, seed phrases, or other sensitive authentication credentials through general enquiry forms.

2.3 Technical and usage information

When you access our website or services, we may automatically collect:

• IP address;
• browser type and version;
• operating system;
• device type;
• language and time-zone settings;
• referring and exit pages;
• pages viewed and features used;
• date and time of access;
• session identifiers;
• diagnostic, performance, and error information;
• security and audit logs.

2.4 Cookies and similar technologies

We may use cookies, local storage, pixels, and similar technologies to:

• operate and secure the website;
• remember language and interface preferences;
• maintain sessions;
• understand website performance;
• measure usage and improve our services;
• detect fraud, abuse, or unauthorised access.

Where required by applicable law, we will obtain consent before using non-essential cookies. Merely describing non-essential cookies in a privacy policy may not by itself constitute valid consent in jurisdictions that require an affirmative choice.

We may use personal information to:

• respond to enquiries and requests;
• evaluate partnership and integration opportunities;
• arrange meetings, demonstrations, and technical discussions;
• provide and administer website, sandbox, developer, API, and portal access;
• authenticate users and manage permissions;
• provide technical support;
• operate, maintain, secure, and improve Finger Bridge;
• monitor system performance and service availability;
• prevent fraud, misuse, cyberattacks, and unauthorised access;
• maintain business, security, compliance, and audit records;
• send service-related communications;
• send marketing or business communications where permitted;
• comply with legal, regulatory, tax, accounting, and contractual requirements;
• establish, exercise, or defend legal claims;
• conduct internal analysis, product planning, and service development.

We will not use personal information in a manner materially incompatible with the purposes described above unless permitted or required by law.

Where applicable data-protection law requires a legal basis, we may process personal information based on:

• Consent, where you have given us permission;
• Contractual necessity, where processing is required to take steps at your request or perform an agreement;
• Legal obligation, where processing is required by applicable law;
• Legitimate interests, including operating and securing our services, responding to business enquiries, preventing abuse, and developing our business, provided those interests are not overridden by your rights;
• Establishment, exercise, or defence of legal claims;
• other lawful grounds available under applicable law.

Under EU data-protection rules, processing may rely on grounds including consent, contractual necessity, legal obligations, public-interest tasks, vital interests, and legitimate interests where the relevant conditions are satisfied.

We may disclose personal information to the following recipients where reasonably necessary.

5.1 Service providers

We may use third-party providers for:

• cloud hosting and data storage;
• website operation;
• cybersecurity;
• analytics;
• customer relationship management;
• email and communications;
• technical support;
• identity and access management;
• professional advisory services.

These providers may process information only for the services they provide to us and subject to appropriate contractual and security obligations.

5.2 Business and integration partners

Where you request an introduction, integration, partnership, or related service, we may share relevant business contact and enquiry information with:

• issuers;
• brokers;
• banks;
• custodians;
• exchanges;
• settlement providers;
• technology and data providers;
• other financial-market participants.

We will not share your information with a potential partner for unrelated marketing without an appropriate legal basis.

5.3 Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers, consultants, and other professional advisers where necessary.

5.4 Legal and regulatory authorities

We may disclose information where we reasonably believe it is necessary to:

• comply with law, regulation, court orders, or lawful government requests;
• cooperate with regulators or law-enforcement authorities;
• protect the security, rights, property, or safety of Sargia, our users, or others;
• investigate fraud, security incidents, or unlawful conduct.

5.5 Corporate transactions

Information may be disclosed or transferred in connection with a proposed or completed merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to applicable law.

Finger Bridge provides technology and connectivity infrastructure.

Unless expressly stated in a separate agreement, Sargia does not through this website:

• open securities or bank accounts for end users;
• receive or hold customer funds;
• provide investment advice;
• execute securities transactions for retail users;
• act as a broker, custodian, bank, exchange, or asset issuer.

Personal and transactional information collected independently by a connected financial institution is governed by that institution’s own privacy policy and legal obligations.

Certain Finger Bridge services may record hashes, timestamps, identifiers, signatures, or other verification information on a blockchain or distributed ledger.

Information recorded on a public blockchain may be:

• publicly accessible;
• replicated across multiple nodes;
• difficult or impossible to alter or delete;
• retained independently of Sargia.

We seek to avoid placing directly identifying personal information on public blockchains. Where verification technology is used, we may instead record cryptographic hashes or non-directly identifying references.

You should not submit personal information, confidential information, private keys, passwords, or sensitive documents to a public blockchain field unless expressly instructed and legally authorised to do so.

Sargia is established in Japan. Your information may be processed in Japan and in other countries where our service providers or business partners operate.

Those countries may have data-protection laws different from those in your country.

Where required, we will use appropriate safeguards for international transfers, which may include:

• contractual data-protection clauses;
• adequacy decisions;
• data-processing agreements;
• technical and organisational safeguards;
• other legally recognised transfer mechanisms.

The European Commission has adopted standard contractual clauses that may be used for certain transfers of personal information outside the European Economic Area.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to satisfy legal, regulatory, accounting, security, and contractual requirements.

Retention periods may vary according to the type of information and the purpose for which it is processed.

For example:

• general business enquiries may be retained while the enquiry remains active and for a reasonable period afterward;
• partnership and contractual records may be retained for the duration of the relationship and applicable limitation periods;
• security and access logs may be retained for a period reasonably necessary to investigate incidents and protect our systems;
• information required by law may be retained for the legally prescribed period.

We may retain aggregated or anonymised information that no longer identifies an individual.

We use reasonable administrative, organisational, physical, and technical safeguards designed to protect personal information against:

• unauthorised access;
• loss;
• misuse;
• alteration;
• destruction;
• unauthorised disclosure.

Such measures may include encryption, access controls, authentication, logging, network protection, backups, employee access restrictions, and security monitoring.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on your location and applicable law, you may have the right to:

• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of processing;
• object to certain processing;
• withdraw consent;
• request data portability;
• request information about third-party disclosures or international transfers;
• lodge a complaint with a competent data-protection authority.

These rights may be subject to legal conditions, limitations, exemptions, identity verification, and record-retention obligations.

To exercise your rights, contact us using the details below.

We may send you information concerning Finger Bridge, events, services, integrations, or business opportunities where permitted by law.

You may unsubscribe from marketing communications at any time by:

• using the unsubscribe link in the communication; or
• contacting us directly.

We may continue to send non-marketing communications relating to active accounts, security, contracts, enquiries, or service operation.

Our website may contain links to third-party websites, applications, blockchains, financial institutions, or services.

We do not control the privacy practices of those third parties. Their collection and use of information are governed by their own privacy notices and terms.

The inclusion of a link or reference does not necessarily imply endorsement, affiliation, or responsibility for that third party.

Finger Bridge is intended for businesses, financial institutions, developers, and professional users.

Our services are not directed to children, and we do not knowingly collect personal information from children through the website.

If you believe that a child has provided personal information to us, please contact us so that we can take appropriate action.

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to our data-processing practices;
• legal or regulatory developments;
• security or operational requirements.

We will publish the updated version on this page and revise the “Last updated” date.

Where required by law, we will provide additional notice or obtain consent for material changes.

For questions, requests, or concerns regarding this Privacy Policy or our handling of personal information, contact:

Sargia Inc. Operator of Finger Bridge Osaka, Japan

Email: bridge@sargia.jp

Website: fingerbridge.com

You may also contact the Personal Information Protection Commission of Japan regarding matters within its jurisdiction. The PPC is Japan’s authority responsible for the Act on the Protection of Personal Information.