LEGAL
Privacy Policy
Tread Foundation Last updated: September 16, 2026
1. Who we are and what this covers
Tread Foundation, a foundation company incorporated in the Cayman Islands, of Cayman Fiduciary Limited, Third Floor, Landmark Square, 64 Earth Close, PO Box 707 Camana Bay, Grand Cayman KY1-9006, Cayman Islands ("the Foundation", "we", "us") is the controller of personal data processed through treadfoundation.com (the "Site").
This Policy explains what personal data we collect when you visit the Site or contact us, why we process it, and the rights you have. It applies to the Site only. It does not apply to tread.fi, which is operated by Tread Labs Corporation, a separate company not owned or controlled by the issuer of TREAD, and which has its own privacy policy.
2. The short version
The Site is a publishing site. There is nothing to sign up for and nothing to buy.
— No accounts. There is no registration, login or user profile.
— No wallet connection. We never ask for, receive or store a wallet address, private key, seed phrase or signature.
— No transactions. There is no payment, claim, staking or locking function on the Site.
— No advertising, no ad networks, no cross-site tracking, no data sales. We do not sell or share personal data for advertising or cross-context behavioural advertising, and we never have.
— No tracking cookies. See section 5.
Practically, if you read the Site and never write to us, the only personal data we handle is your IP address and standard technical request data, held briefly for security and aggregate statistics.
3. Personal data we collect
3.1 Information you give us. If you email us — for example at legal@treadfoundation.com — we receive your email address, your name if you give it, and the contents of your message and any attachments.
3.2 Information collected automatically. When you visit the Site, our hosting provider and analytics automatically process:
— your IP address, and a coarse location (typically country) inferred from it;
— your device and browser type, operating system and language;
— the pages you view, the time and date, the page that referred you, and outbound links you follow;
— technical request and error data recorded in server logs.
3.3 Aggregate statistics. We view page-level analytics in aggregate. We do not build profiles of individual visitors and do not attempt to identify you from analytics data.
3.4 Sensitive data. We do not seek, and ask that you do not send us, special-category or sensitive personal data.
4. Why we process it, and our legal bases
Each purpose below is paired with the legal basis we rely on under the UK and EU GDPR.
Serving the Site and its documents to you
Legitimate interests — operating a website.
Security, abuse prevention, and maintaining the integrity of the Site
Legitimate interests — protecting our systems and our readers.
Aggregate statistics on how the Site is used
Legitimate interests — understanding and improving our publication.
Responding to your correspondence
Legitimate interests — dealing with enquiries, or taking steps at your request.
Publishing token disclosures and meeting regulatory obligations
Compliance with a legal obligation; legitimate interests.
Establishing, exercising or defending legal claims
Legitimate interests; compliance with a legal obligation.
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded they are not, given how limited the processing is.
5. Cookies and similar technologies
The Site does not use advertising cookies, cross-site tracking pixels, social media tracking pixels, session-replay tools, or fingerprinting.
The Site uses only technologies that are strictly necessary to deliver and secure the pages you request, together with cookieless analytics — which counts page views without setting a tracking cookie and without following you across other websites.
Because we do not set non-essential cookies, no cookie consent banner is presented. If that ever changes, we will update this Policy and seek consent before setting any non-essential cookie.
You can configure your browser to refuse cookies or alert you when one is set; parts of the Site may then not function as intended.
6. Who we share it with
We do not sell personal data. We share it only with:
— Our hosting and site platform provider (Framer B.V.), which hosts the Site and processes server logs and analytics on our behalf as a processor;
— Our email provider, for correspondence you send to us;
— Our professional advisers — lawyers, auditors, accountants — where necessary and bound by confidentiality;
— Regulators, law enforcement, courts and other authorities, where we are required to disclose by law or where disclosure is necessary to establish, exercise or defend legal claims;
— A successor entity, in connection with any reorganisation of the Foundation, subject to this Policy continuing to apply.
We do not share personal data with Tread Labs Corporation for its own purposes.
7. International transfers
The Foundation is established in the Cayman Islands and our service providers operate in a number of countries, including in the European Economic Area and the United States. Where we transfer personal data out of the UK or EEA, we rely on an adequacy decision where one applies, or otherwise on the Standard Contractual Clauses approved by the European Commission (and the UK Addendum or the UK International Data Transfer Agreement, as applicable), together with any additional safeguards the transfer requires. You may request a copy of the relevant safeguard by writing to us.
8. How long we keep it
— Server logs and technical data — normally no more than 12 months, unless retained longer for a specific security investigation.
— Aggregate analytics — retained on an aggregated basis that does not identify you.
— Correspondence — for as long as needed to deal with the matter and then for a further period reflecting applicable limitation periods, normally up to 6 years.
We keep personal data for longer where a legal, regulatory or record-keeping obligation requires it, or where it is needed for legal claims.
9. Security
We take reasonable and appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. The Site is served over HTTPS. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your rights
10.1 If you are in the UK or EEA, you have the right to: request access to your personal data; request its correction or erasure; request restriction of processing; object to processing based on legitimate interests; request portability of data you provided to us; and, where processing is based on consent, withdraw that consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority.
10.2 If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to request deletion; to request correction; and not to receive discriminatory treatment for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is no "Do Not Sell or Share" mechanism to offer. We do not use or disclose sensitive personal information for purposes requiring a right to limit.
10.3 If you are in the Cayman Islands, you have the rights available to data subjects under the Data Protection Act (2021 Revision), including rights of access, rectification, erasure, restriction and objection, and the right to complain to the Cayman Islands Ombudsman.
10.4 How to exercise a right. Write to legal@treadfoundation.com. We will respond within the period required by applicable law, normally one month. We may need to ask for information to verify who you are before acting. Exercising these rights is free, unless a request is manifestly unfounded or excessive.
11. Children
The Site is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Third-party links
The Site links to third-party websites, including tread.fi, the MiCAR white paper register, block explorers and social media platforms. We are not responsible for the privacy practices or content of those sites. Review their privacy policies before providing personal data to them.
13. Changes to this Policy
We may update this Policy from time to time. The current version is always posted here with its "last updated" date. Where a change is material, we will take reasonable steps to draw it to your attention.
14. Contact us
Questions, requests or complaints about this Policy or about how we handle personal data:
Tread Foundation Cayman Fiduciary Limited, Third Floor, Landmark Square, 64 Earth Close, PO Box 707 Camana Bay, Grand Cayman KY1-9006, Cayman Islands legal@treadfoundation.com
© 2026 Tread Foundation