Privacy Notice
Last Updated: October 9, 2026
Version: 2.0
This Privacy Notice
Please carefully read this Privacy Notice as it provides you with information about your personal data being processed in connection with your access to and use of the Website and Communication Channels, including in connection with RCM Note Tokens. This Privacy Notice explains which types of personal data we hold on you, how we collect and process such data, how long we keep it, and so on.
If you provide us with personal data relating to another person, you must ensure that you have the right to provide such personal data to us and that the relevant person has received, read and understood this Privacy Notice before their personal data is provided to us.
Interpretation
Unless otherwise provided in this Privacy Notice, capitalised terms used in this Privacy Notice have the meaning determined in the XMAQUINA Terms & Conditions (the “Terms”). You should read the Terms carefully as they affect your obligations and legal rights. In this Privacy Notice, “personal data” and “personal information” are synonyms. They refer to any information that identifies or can reasonably identify you, either directly or indirectly.
Contact Details
XMAQUINA Foundation, established under the laws of the Cayman Islands, is the data controller for the data processed in connection with the Website and Communication Channels.
Humanoid Holdings Ltd., a British Virgin Islands company, is the data controller responsible for personal data processed in connection with RCM Note Tokens, including related application, issuance, holding, transfer, redemption, and administration processes.
In this Privacy Notice, references to “we”, “us” or “our” mean XMAQUINA Foundation or Humanoid Holdings Ltd., as applicable to the relevant processing activity.
You may contact us at hello@xmaquina.io with any questions or requests relating to this Privacy Notice or the processing of your personal data, including in connection with RCM Note Tokens.
Type of Data
The categories of personal data collected depend on how you interact with us, use the Website, and the requirements of the applicable laws. We collect and process the following types of personal data:
Application Data
This includes your name, email address, links to social media accounts, resume or cover letter, and other information you choose to provide us with.
Identity and Verification Data
Information required to verify your identity or, where applicable, the identity and ownership of an entity you represent. This may include your name, date and place of birth, nationality, citizenship, residential address, tax residence and taxpayer identification number, identification documents, proof of address, source of funds or source of wealth information, U.S. status, photo, facial image, video, liveness verification data, selfie or similar biometric or verification information, and other information required for KYC/KYB or legal compliance. Where you act on behalf of an entity, this may also include information relating to the entity, its beneficial owners, controllers, authorised representatives, and ownership and control structure.
Wallet Data
This means information related to your Wallet, including address, blockchain transaction history associated with the relevant Wallet address, or token holdings to the extent visible through public blockchain data. While a Wallet address alone does not identify a specific individual, when combined with other data (such as a nickname or email address), it may enable identification. As a result, such combined data could be considered personal information.
Marketing Data
This includes your email address.
Technical Data
This includes information collected by log files, including internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and the number of clicks.
Community Data
This may include your nickname, name, photos, messages, comments, and other information you share in our Communication Channels. Under the law, we may be a data controller or joint data controller with the provider of each Communication Channel. If we are joint controllers, you can exercise your data protection rights regarding the Community Data with either us or the provider of the respective Communication Channel. However, we can only help with processing operations explicitly described in this Privacy Notice. For any other data processing, the provider acts as an independent data controller.
Contact Data
This may include name, contact details, social media account handles, and other data, depending on what information you provide to us. This may also include contact details and communication records used in connection with RCM Note Token-related processes, including application, acquisition, holding, claim, transfer, redemption, or administration. Please do not provide personal data unless it is reasonably necessary or requested by us. Note that we may also collect certain other information, which may be required under the applicable laws.
Cookies Data
This includes data collected through cookies and similar tracking technologies used in connection with your access to and interaction with the Website. Such data may include IP address, browser type and version, device type, operating system, date and time of visit, pages viewed, session information, interaction events, cookie identifiers, visitor identifiers, and other usage data relating to your interaction with the Website.
We use necessary cookies and analytics cookies. Necessary cookies are used to ensure the proper operation, security, availability and protection of the Website. For example, the Website may use Cloudflare cookies, such as _cfuvid, to support traffic management, security, rate-limiting and protection against abusive or malicious traffic. Analytics cookies are used to understand how visitors use the Website and to improve its functionality and user experience. For example, the Website may use Google Analytics cookies, such as _ga and _ga_*, to distinguish users and maintain session information.
Data Use
The personal data is processed as follows:
Application Data
To enable you to apply a Project for funding or otherwise contribute to the MachineDAO. Processing is necessary for reviewing and executing the above arrangements.
Identity and Verification Data
To verify your identity and, where applicable, the identity, ownership, control structure, and authority of persons acting on behalf of entities; conduct KYC/KYB, sanctions, eligibility, and other compliance checks; prevent fraud, unauthorised access, unlawful activity, and misuse of the Website; assess and administer your participation in RCM Note Token-related processes, including acquisition, holding, claim, transfer, and redemption; and comply with legal requirements. Processing is necessary to perform a contract with you, to comply with legal obligations, or for our legitimate interests in achieving these purposes.
Wallet Data
To enable your participation in the MachineDAO governance vote, RCM Note Token-related processes, including acquisition, holding, claim, transfer, redemption, and related activities. The lawful basis for such data processing is the performance of a contract with you.
Marketing Data
To provide you with marketing and newsletter emails concerning the latest developments, news, and insights related to the MachineDAO and Website. We will send such emails based on your consent or our legitimate interests in sending you communications that we consider relevant to you.
Technical Data
To enhance the user experience by improving the Website functionality, usability, user flow, and interface. The lawful basis for such data processing is our legitimate interest to improve the Website operation.
Community Data
To enable community communication and interaction, handle community requests made via Communication Channels, as well as facilitate discussions on MachineDAO proposals, surveys, marketing campaigns, and other activities. The lawful basis for such data processing is our legitimate interest in achieving these purposes. Since processing details may vary across the Communication Channels, please refer to privacy policies of the respective providers for more information, including X (Twitter), Discord, and LinkedIn.
Contact Data
To respond to your inquiries, communicate with you, and send confirmations, notices, disclosures, and other non-marketing communications. Processing is necessary to respond to your request, to perform a contract with you, and to comply with legal obligations.
Cookies Data
We use necessary cookies to support the proper operation, security, availability, traffic management, rate-limiting, and protection of the Website, including through services such as Cloudflare. We may also use analytics cookies to understand how visitors use the Website and to improve its functionality, usability, and user experience, including through third-party tools such as Google Analytics. Analytics cookies are set only where you have given your consent through the cookie banner presented on the Website, and you may withdraw that consent at any time through the same banner or through your browser settings. Necessary cookies are set on the basis of our legitimate interest in the secure and reliable operation of the Website.
Processing Period
As a general rule, your personal data is kept as long as it is necessary for the purposes it was collected. It may be retained longer if required to meet our legal obligations, in relation to legal proceedings, or to protect our rights and legitimate interests or those of third parties. The storage periods are as follows:
Application Data
If your application is approved, as long as our relationship with you continues and for six (6) years after its termination or expiration, regardless of reason. If your application is rejected, the Application Data will be retained for one (1) year thereafter. We set this retention period due to the statutes of limitations established in the applicable law.
Identity and Verification Data
Identity and Verification Data is retained for six (6) years after the end of the relevant relationship with you or completion of the relevant transaction, unless a longer period is required by applicable law. This retention period reflects the statutes of limitations established in the applicable law.
Wallet Data
We do not set a retention period for Wallet Data that is not personal data, and we are not able to identify any particular individual with such Wallet Data. If Wallet Data becomes identifiable, it will be retained while the Wallet is connected to the Website and for six (6) years thereafter. We set this retention period due to the statutes of limitations established in the applicable law. Note that due to the nature of a blockchain, the Wallet Data may be stored permanently on the applicable blockchain, not by us, and may be accessed and viewed by any person at any time. Please consider the features of the blockchain data processing outlined in this Privacy Notice below.
Marketing Data
As long as you remain a subscriber. You can unsubscribe from marketing emails at any time by (i) contacting us, or (ii) clicking the unsubscribe button at the bottom of each marketing email. Then your email address will be removed from our marketing database. Please note that administrative or service-related communications (like email verifications or maintenance notifications) are not considered marketing and may not include an unsubscribe option.
Technical Data
Until the browsing session from your respective device expires. Generally, anonymised data is stored permanently to analyse the Website use.
Community Data
As long as necessary for the purposes outlined in this Privacy Notice, unless otherwise specified (e.g., in a consent form or privacy statement). We do not set a retention period for statistical or analytical information obtained via the Communication Channels, as this data does not identify any individual. Please note that we may not be able to delete personal data you share with us via the Communication Channels. Therefore, such data is processed until either you or the operator of the respective Communication Channel deletes it.
Contact Data
For six (6) years from the last date when you contacted us regarding the same matter. We set this retention period due to the statutes of limitations established in the applicable law.
Cookies Data
The retention period for Cookies Data varies depending on the cookie or technology used. Some cookies are session cookies and expire when your browsing session ends or shortly thereafter. Other cookies may remain on your device for a longer period, including up to two (2) years where used for analytics purposes, unless you delete them earlier or withdraw your consent where applicable.
Data Sharing
General
We do not sell or rent out your data. We may share it in line with this Privacy Notice, applicable laws, the Terms, or with your consent. Appropriate measures will be taken to protect your data during such transfers.
Recipients
Given the purposes outlined above, your personal information is shared with the following categories of recipients: (i) Affiliates; (ii) marketing, support, and technical teams; (iii) email delivery service providers; (iv) analytical solution providers; (v) hosting service providers; (vi) government authorities, upon their request or if necessary to comply with our legal obligations; (vii) another entity if we sell or otherwise transfer the Website or its parts; and (viii) other third-party solutions, which may be from time to time integrated in relation to the Website, such as Typeform, when you fill in a form to reach us via the application functionality that may be available on the Website; and Clerk, which receives and processes only emails for account management purposes; (ix) KYC/KYB Checks service providers; (x) the tokenizer, registrars, transfer agents, legal advisors, and other professional advisors involved in the administration of RCM Note Tokens; (xi) communication, document-management, e-signature service providers; and (xii) tax authorities, in connection with reporting or withholding obligations.
Features of Blockchain Data Processing
Wallet Data may interact with public and decentralised blockchains, as well as related infrastructure and software, including smart-contracts, that work autonomously. “Decentralised” means no one controls or operates the blockchain. “Public” means anyone can access blockchain data, and this access cannot be restricted. By design, blockchain records are permanent and cannot be changed or deleted. Transactions are also irreversible, which may limit your ability to exercise certain data protection rights. Since information that was entered in a blockchain becomes publicly available, we cannot control or manage access to it. The decision to use blockchain or carry out any transactions is entirely up to you.
Automated Decision-Making
Automated decision-making is the process of making a decision by automated means without any human influence on the outcomes. We do not make any automated decisions based on your personal data. However, we and our service providers may use automated or partly automated tools to support KYC/KYB Checks processes, including screening, flagging or routing for review. Where required by applicable law, you may request human review of a decision made solely by automated processing that produces legal effects concerning you.
Data Subject Rights
Verification
In case you wish to exercise your data subject rights, we may request certain information from you to verify your identity and confirm that you are entitled to exercise such rights.
Blockchain Data Processing
Please note that when interacting with blockchain networks, you may not be able to fully exercise certain rights under applicable data protection laws regarding your Wallet Data. For example, we may be unable to delete, correct, or restrict your Wallet Data. For more details, refer to the Features of Blockchain Data Processing section of this Privacy Notice.
Data Subject Rights
According to the applicable legislation, you may have the following rights:
-
Right to Access
You can request to see if we process your personal data. If we do, you can ask for details about the processing and a copy of the data to verify its accuracy and legality.
-
Right to Correction
You can request to correct or complete any incomplete or inaccurate data. We may need to verify the accuracy of the new information you provide.
-
Right to Deletion
You can request the deletion of your personal data if we no longer need it, you have successfully objected to processing, we processed it unlawfully, or we must erase it to comply with the law. We may not always be able to fulfil your request due to legal or technical reasons, which will be explained in our response.
-
Right to Withdraw Consent
You can withdraw your consent at any time if we are processing your data based on your consent.
-
Right to Human Review
You can request a human review of decisions made solely based on automated processing, including profiling, if such decisions impact your rights.
-
Right to File a Complaint
You can file a complaint with a supervisory authority if we violate your rights or legal obligations. The competent authority may depend on your location.
Data Security
We apply technical and organisational measures appropriate to the risk to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, including access controls, encryption of data in transit and, where appropriate, at rest, segregation of identity-verification data, and contractual security obligations on our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Third-Party Links
The Website may include links and social media plugins to third-party websites and applications. Clicking on them may allow third parties to collect or share your data. We do not control or endorse these third parties and are not responsible for their privacy practices. You should review the privacy policies of any external websites or apps you visit.
Personal Data of Children
The Website is not intended for children under 18 years (or older if local laws set a higher age). We do not knowingly collect or use personal data from children. If we learn that a child has provided us with personal information, it will be promptly deleted. Parents or guardians who believe their child’s data has been collected should contact us.
Modifications and Updates of this Privacy Notice
This Privacy Notice is under regular review, and may be updated at any time. If any changes to this document are made, we will change the “Last Updated” date and version number at the top of this Privacy Notice. Please review this Privacy Notice to check for the updates.