1. Introduction & Scope

STO Chain operates the Tokenized Real Estate DApp ("DApp") allowing users to invest, trade, and manage tokenized real estate assets through STOC tokens on the STO Chain blockchain. Due to the regulated nature of real-world asset (RWA) tokenization, this KYC/AML Policy applies to all users accessing the STOC DApp, regardless of nationality or residence.

This policy is developed in compliance with the following regulatory frameworks:

• Financial Action Task Force (FATF) Recommendations on Virtual Assets and Virtual Asset Service Providers
• US Bank Secrecy Act (BSA) and FinCEN regulations
• EU Anti-Money Laundering Directives (AMLD5 / AMLD6)
• Markets in Crypto-Assets Regulation (MiCA) (EU) 2023/1114
• South Korea Act on Reporting and Using Specified Financial Transaction Information
• Vietnam Decree No. 87/2019/ND-CP on Anti-Money Laundering
• ASEAN Regional AML/CFT Guidelines

2. Customer Due Diligence (CDD)

2.1 Standard CDD Requirements

All users must complete Standard CDD before accessing investment or trading features of the STOC DApp. Required documentation includes:

• Full legal name as per government-issued identification
• Date of birth and nationality
• Residential address (proof of address document, no older than 3 months)
• National ID card, passport, or driver's license
• Email address and phone number for two-factor authentication

2.2 Enhanced Due Diligence (EDD)

Enhanced due diligence is mandatory for users meeting any of the following criteria:

• Transactions or balances exceeding $10,000 USD (or equivalent) within 30 days
• Politically Exposed Persons (PEPs) and their family members or close associates
• Users residing in high-risk or FATF-monitored jurisdictions
• Institutional investors, legal entities, or DAOs investing on behalf of third parties
• Users flagged by automated transaction monitoring systems

2.3 Corporate / Legal Entity KYC

For legal entities, organizations, or DAOs using the STOC DApp, the following documents are required:

• Certificate of incorporation or equivalent formation document
• Articles of association / Bylaws
• List of Board members and Ultimate Beneficial Owners (UBOs holding 10% or more)
• Authorized signatory documentation and board resolution
• Proof of registered business address

3. Verification Process

• Users create an account on the STOC DApp and initiate KYC through the integrated identity verification module.
• Identification documents are submitted via the DApp's secure portal and processed by STO Chain-approved KYC/identity verification partners.
• Liveness checks and biometric verification are performed to prevent identity fraud.
• Sanctions screening is conducted against OFAC SDN lists, EU Consolidated Sanctions List, UN Sanctions List, and country-specific watchlists.
• Users receive verification status (Approved / Pending / Rejected) within 1-3 business days.
• Verified status is recorded on-chain through STO Chain's integrated KYC compliance layer.

4. Prohibited Persons & Restricted Jurisdictions

Access to the STOC DApp is strictly prohibited for:

• Residents or citizens of US-sanctioned countries including Iran, North Korea, Cuba, Syria, and Crimea
• Individuals on OFAC SDN lists, EU Consolidated Sanctions List, or INTERPOL Red Notices
• Persons convicted of financial crimes, fraud, or terrorism financing
• US Persons (as defined by SEC regulations) unless explicitly authorized under applicable exemptions
• Persons under 18 years of age (or the legal age of majority in their jurisdiction)

5. Transaction Monitoring & Suspicious Activity

5.1 Automated Monitoring

STO Chain employs real-time automated transaction monitoring systems to detect patterns indicative of money laundering, terrorism financing, or market manipulation.

5.2 Suspicious Activity Reporting (SAR)

STO Chain will file Suspicious Activity Reports (SARs) with relevant Financial Intelligence Units (FIUs) including FinCEN (USA), KOFIU (South Korea), Anti-Money Laundering Bureau (Vietnam), and local equivalents as required.

6. Record Retention

All KYC/AML records, transaction logs, and due diligence documentation will be retained for a minimum of 5 years from account closure, in compliance with FATF Recommendation 11 and applicable local laws.

7. Policy Review

This KYC/AML Policy is reviewed annually or upon significant changes to applicable regulations. STO Chain reserves the right to amend this Policy at any time and will notify users via email or in-app notification.

1. Acceptance of Terms

By accessing, registering, or using the STOC Tokenized Real Estate DApp ("DApp", "Platform", or "Service") operated by STO Chain ("Company", "We"), you ("User") agree to be legally bound by these Terms of Service ("Terms"). If you do not agree with these Terms, you must cease using the Platform immediately.

2. Service Description

The STOC DApp provides the following services:

• Tokenization of real estate assets into compliant STOC digital securities on the STO Chain blockchain
• Fractional ownership of tokenized real estate through STOC tokens
• Secondary market trading of real estate tokens between verified users
• Yield distribution and rental income payments in STOC tokens or stablecoins
• Portfolio management dashboard and real-time asset tracking
• Smart contract-based governance voting for property management decisions

3. Eligibility Requirements

To use the STOC DApp, you must:

• Be 18 years of age or older (or the legal age of majority in your jurisdiction)
• Successfully complete KYC/AML verification as required by this Platform
• Not be a resident or citizen of any restricted jurisdiction per the KYC/AML Policy
• Have the legal capacity to enter into binding contracts in your jurisdiction
• Comply with all applicable local laws and regulations related to digital asset and real estate investment

4. User Accounts

4.1 Account Registration

Users must register an account and connect a compatible Web3 wallet (STO Chain-compatible wallet) to access DApp features. You are solely responsible for securing your wallet credentials and private keys. STO Chain will never ask for your private keys or recovery phrases.

4.2 Account Responsibility

You agree to: (i) provide accurate and up-to-date information during registration; (ii) notify STO Chain immediately of any unauthorized access to your account; (iii) not share account access with third parties; and (iv) maintain a valid KYC verification status.

5. Investment Risks & Disclaimers

INVESTING IN TOKENIZED REAL ESTATE CARRIES SIGNIFICANT RISK. YOU MAY LOSE SOME OR ALL OF YOUR INVESTMENT CAPITAL. BY USING THE STOC DAPP, YOU ACKNOWLEDGE AND ACCEPT THE FOLLOWING RISKS:

• Market risk: Real estate asset values and STOC token prices may fluctuate significantly
• Liquidity risk: There is no guarantee of a liquid secondary market for tokenized assets
• Regulatory risk: Changes in laws and regulations may adversely affect your investments
• Smart contract risk: Bugs or vulnerabilities in smart contracts may result in loss of funds
• Blockchain risk: Network congestion, forks, or protocol failures may affect transactions

NOTHING ON THIS PLATFORM CONSTITUTES FINANCIAL, INVESTMENT, LEGAL, OR TAX ADVICE. CONSULT QUALIFIED PROFESSIONALS BEFORE MAKING INVESTMENT DECISIONS.

6. Prohibited Conduct

Users are strictly prohibited from:

• Using the Platform for money laundering, terrorism financing, or any illegal purpose
• Attempting to bypass KYC/AML controls or using fraudulent identification
• Engaging in market manipulation, wash trading, or front-running
• Accessing the Platform using automated bots, scrapers, or unauthorized scripts
• Attempting to hack, reverse-engineer, or compromise the DApp's smart contracts
• Intentionally misrepresenting property information or investment terms

7. Service Fees

STO Chain charges the following fees, subject to change with 30 days notice:

• Transaction fees: Network gas fees paid in STOC tokens for all on-chain transactions
• Platform fees: Percentage-based fees on investment transactions displayed at time of trade
• Withdrawal fees: Applied to fiat currency withdrawals from real estate yield distributions
• Secondary market fees: Trading fees on token-to-token transfers on the secondary market

8. Intellectual Property

All content, software, trademarks, logos, and technology on the STOC DApp are the exclusive property of STO Chain or its licensors. You may not copy, reproduce, distribute, or create derivative works without prior written consent from STO Chain.

9. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, STO Chain AND ITS DIRECTORS, EMPLOYEES, AND AGENTS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, OR GOODWILL, ARISING FROM YOUR USE OF OR INABILITY TO USE THE PLATFORM.

10. Governing Law & Dispute Resolution

These Terms are governed by and construed in accordance with applicable law. Disputes shall first be resolved through good-faith negotiation, followed by binding arbitration under internationally recognized arbitration rules. Users in specific jurisdictions retain rights under local consumer protection laws.

11. Amendments

STO Chain may update these Terms at any time. Continued use of the Platform after notification of changes constitutes acceptance of the updated Terms.

1. Introduction

STO Chain ("We") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect information when you use the STOC Tokenized Real Estate DApp. This policy complies with the following regulatory frameworks:

• EU General Data Protection Regulation (GDPR) 2016/679
• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• South Korea Personal Information Protection Act (PIPA)
• Vietnam Decree No. 13/2023/ND-CP on Personal Data Protection
• ASEAN Framework on Personal Data Protection

2. Data We Collect

2.1 Identity & KYC Data

• Full name, date of birth, nationality, and government-issued ID number
• Facial biometric data collected during liveness verification (processed by third-party KYC provider)
• Proof of address documents and residential information
• Source of wealth declarations and financial background information

2.2 Account & Transaction Data

• Blockchain wallet addresses and transaction history on STO Chain
• Investment portfolios, balances, and yield payment records
• Login timestamps, IP addresses, and device fingerprints
• KYC verification status and compliance flags

2.3 Communication Data

• Email addresses, phone numbers, and communication preferences
• Support ticket history and customer service interactions
• Feedback, survey responses, and user-generated content

3. Legal Basis for Data Processing

• Contract performance: Processing necessary to provide DApp services under our Terms of Service
• Legal obligation: AML/KYC compliance under applicable financial regulations
• Legitimate interest: Fraud prevention, security monitoring, and platform improvement
• Consent: Optional marketing communications and analytics (with right to withdraw at any time)

4. How We Use Your Data

• Identity verification and ongoing KYC/AML compliance screening
• Processing investment transactions and real estate yield distributions
• Fraud detection, risk assessment, and security monitoring
• Regulatory reporting to financial authorities as required by law
• Platform analytics to improve user experience and DApp functionality
• Sending service notifications, transaction confirmations, and policy updates

5. Data Sharing & Disclosure

5.1 Third-Party Service Providers

• KYC/identity verification providers (e.g., Sumsub, Onfido, or equivalent)
• Sanctions screening and AML compliance service providers
• Cloud infrastructure providers for secure data storage
• Legal and compliance advisors under confidentiality obligations

5.2 Regulatory Disclosure

We may disclose your personal data to financial intelligence units (FIUs), law enforcement agencies, tax authorities, or regulators when required by applicable law, court orders, or to prevent financial crime.

5.3 No Data Sales

STO Chain does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes under any circumstances.

6. Your Data Rights

• Right of access: Request a copy of personal data we hold about you
• Right of rectification: Request correction of inaccurate or incomplete information
• Right of erasure: Request deletion of your data (subject to regulatory retention obligations)
• Right of restriction: Request limited processing of your data in certain circumstances
• Right of data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests

To exercise your rights, contact: support@stochain.io. We will respond within 30 days (GDPR), 45 days (CCPA), or within the timeframe prescribed by applicable local law.

7. Data Retention

• KYC/AML records: 5 years from account closure (FATF compliance)
• Transaction records: 7 years (financial regulatory requirements)
• Account data: Duration of account activity plus 2 years after closure
• Marketing data: Until consent is withdrawn

8. Security Measures

STO Chain implements industry-standard security measures including AES-256 encryption at rest, TLS 1.3 for data in transit, multi-factor authentication, regular penetration testing, and least-privilege access controls.

9. Contact Information

General: support@stochain.io

Compliance: support@stochain.io

Legal: support@stochain.io

Website: https://stochain.io