Privacy & Cookie Notice

Welcome to the Privacy and Cookie Notice for OpenChrono UG (“OpenChrono”)

Effective as of: 1st January 2024

OpenChrono respects your privacy and is committed to protecting your personal data.

This notice (together with our Terms of Service, and other documents referred to) explains how we look after your personal data, how we collect and process it through your use of this website or infrastructure, or when you purchase one of our products or services or interact with us or our communities or infrastructure. We might also collect personal data about you from other sources, such as other companies or publicly available information. By visiting our website, and using our products, services and infrastructure, you are accepting and consenting to the practices described in this notice. You can find out more in the The Personal Data We Collect About You section below.

1. About us............................................................................................................ 1

2. Important Information About This Privacy Notice.................................. 2

3. The Personal data we collect about you................................................... 3

4. Marketing....................................................................................................... 12

5. Automated Decision-Making and Data Profiling .................................. 14

6. Disclosures of your personal data............................................................. 15

7. International transfers.................................................................................. 19

8. Data security.................................................................................................. 20

9. Data retention................................................................................................ 21

10. Your legal rights.............................................................................................. 21

1. About us

The OpenChrono Group of companies is made up of different legal entities, details of which can be found below. This notice is issued on behalf of the OpenChrono Group, so when we mention "COMPANY” "we", "us" or "our" in this notice, we are referring to the relevant company in OpenChrono Group responsible for processing your data. OpenChrono UG is the data controller and responsible for this website.

If you have any questions about this notice, or about exercising your legal rights, or about our privacy practices, please contact our data protection officer (DPO) using the details listed below. If you are based in the EU, you may contact us via our German entity.

OpenChrono Ltd Formal House 60 St.George’s Place Cheltenham Gloucestershire GL50 3PN United Kingdom

OpenChrono UG Kud15 Gloria Berlin Kururstendamm 15 10719 Berlin Germany

DPO	Kevin Bradford
Email address	[e-mail]
Postal address	Formal House 60 St. George’s Place Cheltenham, Gloucestershire, England, GL50 3PN

You have the right to make a complaint at any time to the relevant data regulator, as set out below. We would, however, appreciate the chance to deal with your concerns before you approach any data regulator, so please contact us in the first instance.

UK Data Protection Authority	Berlin Data Protection Authority
Information Commissioner's Office (ICO)	Berliner Beauftraget fur Datenschutz und Informationsfrieheit
Wycliffe House Water Lane, Wilmslow Cheshire, SK9 5AF ENGLAND	Alt-Moabit 59-61 10555 Berlin Eingang: Alt-Moabit 60 GERMANY
Tel:+ 44 0303 123 1113 Fax: [phone]	Tel:+ 49 30 13889-0 Fax: [phone]
https://ico.org.uk/global/contact-us/	[e-mail]

2. Important Information About This Privacy Notice

It is important that you read this notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This notice supplements other notices and is not intended to override them.

This website is not intended for children and we do not knowingly collect data relating to children.

2.1 Changes to the Privacy Notice and your duty to inform us of changes.

We keep this notice under regular review. This version was last updated on 31st December 2023. Previous versions are available by contacting us at [e-mail].

If we change the way we use your personal data, we’ll update this notice and, if appropriate, let you know through our website or by email.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

2.2 Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy information of every website you visit.

3. The Personal data we collect about you

3.1 What is personal data?

Personal data means any information which can be used to identify you. It does not include data where the identity has been removed (anonymous data).

We do not currently collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

3.2 Lawful basis

We process your personal data only when we have a ‘lawful basis’ (or valid legal justification) to do so. The lawful bases we commonly rely on are:

· Where we need to process the personal data in order to perform the contract we are about to enter into or have entered into with you. For example, we cannot provide our services to you without knowing who you are.

· Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

· Where we need to comply with a legal obligation. For example, we might be required to gather information to comply with tax laws.

· Where you have agreed we can collect your personal data, or sensitive personal data, and use it in a certain way. For example, when you are consenting to your personal data being transferred outside the UK or the EU.

Note that we might process your personal data for more than one lawful basis, depending on the specific purpose for which we are using your data. Please contact us if you need additional details of an occasion where we use more than one basis.

3.3 Purposes for processing personal data

The table below outlines the personal data we might process, the possible source of that personal data, our purpose in processing the data, and our ‘legal basis’ for the processing.

3.3.1 Personal data you provide to us directly

What personal data might be provided to us	Why we process that personal data	Lawful basis
Identity Data, includes information such as: name, date of birth, address, email address and telephone number, photo, video or audio data, or other information we might require to conduct KYC/AML and identity checks such as your passport or driving license. We might receive this data when you purchase one of our products or services, interact with our infrastructure, or otherwise interact with us including by phone, post, email or social media. If we carry out KYC and AML checks and a periodic review of that information we might collect Special Categories of Personal Data about you in so far as this identifies you as a politically exposed person. In this connection we might also collect information about criminal convictions and offences.	We might process this personal data when providing our products and services to you, and administering our relationship with you including: · Registering you as a customer, conducting KYC/AML checks, verifying your identity and eligibility (and those of and any joint account holders. Accepting you as a customer, including setting you up as a customer on our website or infrastructure. · Processing and delivering your orders or transactions, including managing rewards, payments, fees and charges and transferring and receiving assets. · Providing customer support services to you. We might record and monitor any communications between you and us, including phone calls, to maintain appropriate records, check your instructions, analyse, assess and improve our services, and for training and quality control purposes.	· Performance of a contract with you · Legal obligations · Legitimate interest (ensuring our efficiency in providing our services to you, on how we meet our legal obligations).
Digital Identity Data includes data such as: wallet address, digital identity, public key (or other unique identifier), asset ownership history, voting history, or information we might require to enable you to interact with us, our assets infrastructure, our website, or our Infrastructure, or those of our partners. We might receive this data when you purchase or use our assets or infrastructure or other products or services, open an account with us, correspond with us by any media, or take part in online discussions. We might also receive this data when you conduct on-chain activities using the same Digital Identity Data where this data is publicly available.	We might process this personal data so that you can : · Purchase our assets or use our infrastructure or website · interact with us · interact with our technological systems · receive ownership of one of our assets from us or a third party.	· Performance of a contract with you · Legal obligations Legitimate interest (ensuring we deliver the products or services orders, ensure the voting is correctly recorded)
Financial Data includes information such as bank account, payment card details, wallet address, tax information, the number of assets earned, uploaded, used and exchanged. We might receive this information when you purchase an asset, use our infrastructure, or pay for other products or services, or register your details in order to receive assets	We process this data so that you can: · Purchase and receive any assets to which you become entitled through your use of our infrastructure, products or services or your engagement with us.	· Performance of a contract with you · Legal obligations
When you inform us of your marketing preferences or how you would like to receive information from us, or subscribe to our services, publications or social media, we call this Marketing Data. Note: you can ask us to stop sending you marketing information by adjusting your marketing choices (the How do you use my personal data for marketing? section below explains how to do this).	We process your personal data: · to make suggestions and recommendations about our infrastructure, goods and services · to help with social interactions through our services and community, or to add extra functions in order to provide a better experience. · deliver relevant website content and advertisements, inform you of our offers and promotions about charities and products, personalise your marketing messages about our products and services so they’re more relevant and interesting to you (where allowed by law). This may include analysing how you use our infrastructure, products, services and your transactions · notify you about changes to our terms and conditions, our products or services, or this notice · update you about your account and holdings. · verify your identity if you contact our customer support or social media teams · allow you to take part in interactive features of our services and products · ask you to leave a review, take a survey, or provide feedback. · if you agree, provide you with information about our partners’ promotions or offers which we think you might be interested in · if you agree, allow our partners and other organisations to provide you with information about their products or services · measure or understand the effectiveness of our marketing and advertising, and provide relevant advertising to you · ask your opinion about our infrastructure, products or services	· Legitimate interests (to send direct marketing, ensure our direct marketing is relevant to your interests, develop our products and services, and to be efficient about how we meet our legal and contractual duties) · Consent (where we’re legally required to get your consent to send you direct marketing about our products or services, or partners’ promotions or offers, or for you to receive marketing from other organisations)
Where you have enabled location or GPS services, we will be able to see your location. We call this Location Data.	Where you have enabled location-based services, we can: · provide you with location-relevant advertising, products and services, (for example, information about nearby merchants) · protect against fraud	· Keeping to contracts and agreements between you and us · Legitimate interests (to develop and market our products and keep to regulations that apply to us) · Consent (to track you when you have location services switched on)

3.3.2 Personal Data we receive when your devices interact with our websites, platforms or products. infrastructure.

What personal data might be provided to us	Why we process that personal data	Lawful basis
Technical Data includes information about your device, how it connects to other devices and networks, and how you connect with the device. This might include the internet protocol (IP) address used to connect your device to the internet, your login information, the browser type and version, the time zone setting, the operating system and platform, the type of device you use, a unique device identifier (for example, your device's IMEI number, the MAC address of the device's wireless network interface, or the mobile phone number used by the device), mobile network information, your mobile operating system and the type of mobile browser you use. We might collect this data when your devices interact with our website or platform or infrastructure, by using cookies, pixels, tracking technologies, analytics systems, server logs and other similar technologies. Our cookies will regularly collect this information in order to stay up to date (but only if you have given us permission). We might also receive Technical Data about you if you visit other websites employing our cookies.	We process this data to administer, manage and protect our business, website and platform or infrastructure, including: · troubleshooting, · data analysis, · testing, · research, · statistical and survey purposes, · system maintenance, · support, · reporting · hosting of data · making sure that content is presented in the most effective way for you and your device · helping keep our website and the platform or infrastructure safe and secure	· Legitimate interests (provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) · Legal obligation · Consent (where required by law) · Keeping to contracts and agreements between you and us
Location Data is information about your location. Our systems might identify or be able to track your location if location services are enabled on your device or product.	We process this data to · determine the location of potential users of our website and platform or infrastructure to prevent access from locations where we are not licensed to sell our products or services.	· Legitimate interests (to prevent ineligible parties from purchasing our products or services) · Legal obligation
Usage Data is information on how you have used our website, platform or infrastructure, products and services, including: information about your visit, such as the links you’ve clicked on, through and from our website or platform (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling and clicks), and methods used to browse away from the page or site or platform.	We process this data to · to create a better website and user experience · make suggestions and recommendations about our goods and services · to help with social interactions through our services, or to add extra functions in order to provide a better experience. · deliver relevant website content and advertisements, personalise your marketing messages about our products and services so they’re more relevant and interesting to you (where allowed by law). This may include analysing how you use our products, services and your transactions	· Legitimate interests (to develop our products and services, and to be efficient about how we meet our legal and contractual duties) · Consent (where we’re legally required to get your consent to send you direct marketing about our products or services, or partners’ promotions or offers, or for you to receive marketing from other organisations)
Transaction Data is information such as payments or transfers made or received, assets held, wallets interacted with, transaction dates and times, meta data and indexed data, the time taken to make the transfer/payment, currencies, exchange rates, messages sent and received, Technical Data about your device. For example, when using our asset or infrastructure our systems might record the asset, the number of assets, who is transferred onwards, we receive information about the new holder staking them, the length of time staked, and rewards earned and received during the staking term and the relevant wallets, blockchains and protocols. We might also collect details of the person or entity you are transacting with (including some of their wallet address and other data associated with the device or wallet they hold. Identity Data, Technical Data, Financial Data and Contact Data).	We process this data in order to · perform our contract with you and/or the recipient of one of our assets or other products or services. · fulfil the transaction · comply with our regulatory obligations when administering our business.	· Performance of a contract with you · Legitimate interest of a third party (party receiving one of our assets; and their ability to participate with our services and infrastructure · Our legitimate interests (ensuring the effective and efficient working of our assets, and systems.

3.3.3 Personal Data we receive from third parties

What personal data might be provided to us	Why we process that personal data	Lawful basis
KYC/AML providers We do not conduct KYC/AML internally, we outsource this activity, when our partner is conducting KYC/AML and identify verification checks, they might receive data from third parties such as credit reference agencies, financial or credit institutions, official registers and databases, as well as joint account holders, fraud prevention agencies and partners. This data might include your credit record, information to help check your identity, information about your spouse and family (if applicable in the context of your account details or your interaction with us) and information relating to your transactions. In carrying out KYC and AML checks and a periodic review of that information they might collect Special Categories of Personal Data about you in so far as this identifies you as a politically exposed person. In this connection we might also collect information about criminal convictions and offences.	We might or our partners might process your personal data to · protect against fraud · comply with financial crime laws · confirm your eligibility to use our services. · help us better understand your financial circumstances and manage fraud risks related to your account.	· Legal obligation · Legitimate interest (to prevent fraud, develop and improve how we deal with financial crime and meet our legal responsibilities) · Consent (where required by law)
Blockchain platforms and products Given the transparent and accessible nature of blockchain and other distributed ledger technologies, and the interaction of and between different wallets, chains, protocols and platforms, we might receive information about you from other custodians, wallets or technological providers with whom our systems interact, including the Ethereum and Solana Protocols For example, when one of our assets is transferred onwards, we receive information about the new holder including their wallet address and other data associated with the device or wallet they hold.	We might process this data in order to · perform our contract with you and/or the recipient of one of our assets or other products or services · comply with our regulatory obligations when administering our business. ·	· Performance of a contract with you · Legitimate interest of a third party (party receiving one of our assets and their ability to participate with our systems) · Our legitimate interests (ensuring the effective and efficient working of our assets, and systems)
Providers of financial or payment services We might receive information about you during the course of the transactions you engage in by using our website, infrastructure, products or services, from counterparties such as regulated and unregulated financial or credit institutions including merchants, ATMs, custodians, wallets, exchanges, peer to peer ecosystems	We might process this data to: · perform our contract with you and/or the recipient of the assets staked · fulfil the staking transaction. · comply with our regulatory obligations when administering our business.	· Performance of a contract with you · Legitimate interest of a third party (party receiving one of our assets and their ability to participate with our services and systems to vote) · Our legitimate interests (ensuring the effective and efficient working of our assets, and systems)

3.3.4 Personal Data we receive from social media and publicly available sources

What personal data might be provided to us	Why we process that personal data	Lawful basis
We might collect information about your identity, tax information, and other publicly available information from sources such as: registrars of companies such as Companies House in the UK, or the Unternehmensregister in Germany; tax authorities such as HMRC in the UK, or the Bundeszentralamt fur Steuern in Germany; or; public registers such as the electoral roll.	Our partners might process your personal data to : · protect against fraud, · comply with financial crime laws · confirm your eligibility to use our services · better understand your financial circumstances and manage fraud risks related to your account. · conduct enhanced due diligence, security and KYC purposes	· Legal obligation · Legitimate interest (to prevent fraud, develop and improve how we deal with financial crime and meet our legal responsibilities) · Consent (where required by law)
Social Media Data includes your social media ‘handle’ or username, your avatar, your interaction with other users and with us. Social media includes Telegram, Instagram, WhatsApp, Signal, Slack, Twitter or ‘X’, Facebook, Discord, Slack, Reddit, LinkedIn and others.	Our partners might process this data to · interact with you for marketing purposes · conduct due diligence. · create a profile about you	· Legitimate interests (to send direct marketing, ensure our direct marketing is relevant to your interests, develop our products and services, and to be efficient about how we meet our legal and contractual duties) · Consent (where we’re legally required to get your consent to send you direct marketing about our products or services, or partners’ promotions or offers, or for you to receive marketing from other organisations)

We might also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we might aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this notice.

3.4 If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we might not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we might have to cancel a product or service you have with us but we will notify you if this is the case at the time.

3.5 Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we might process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

4. Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

4.1 Promotional offers from us

You receive marketing communications (by post, push notification, email and text message ) from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing. Where national laws require us to get your consent to send marketing messages, we’ll do so in advance. You can object to profiling for direct marketing purposes.

4.2 Third-party marketing

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes. You can find out more in the Disclosures of Your Personal Data section below.

4.3 Opting out

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions.

4.4 Cookies

We use cookies to analyse how you use our website. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies.

Cookie name	Domain	Type	Purpose	Cookie Duration[AC2]
crisp-client/*	openchrono.io	Functional	We use this to restore the chat session and messages of a chatbox user when browsing between website pages and/or coming back on the website a few days after.
Next_Locale	openchrono.io	Essential (website wont work properly without it)	We need this to keep track of the user visited locale, currently the only option is `en-gb`. If the user is on `/en-gb/whatever-page` and they navigate to `/another-page`, we need to prefix it with the last visited locale.

5. Automated Decision-Making and Data Profiling

We might make automated decisions about you. This means that we might use technology that can evaluate your personal circumstances and other factors to predict risks or outcomes. This is sometimes known as profiling. We do this for the efficient running of our services and to ensure decisions are fair, consistent, and based on the right information.

For example, we or our partners might make automated decisions about you that relate to:

· Opening accounts: conducting KYC, anti-money laundering and sanctions checks, or identity and address checks.

· Detecting fraud: monitoring your account to detect fraud and financial crime

Our legal basis is one or more of the following: keeping to contracts and agreements between you and us, legal obligations, legitimate interests (to develop and improve how we deal with financial crime and meet our legal responsibilities).

Our infrastructure, and the blockchain protocols our infrastructure interact with, might use smart contracts. ‘Smart contracts’ are software code which automate processes and enable the efficient transfer of data, assets and money. Within our infrastructure, they enable and effect interactions with validators.

We use Smart contracts to mint new assets, destroy or freeze ‘redeemed’ physical assets and ensure seamless asset ownership transfer.

The automated processing they do is: Escrow functions, release payments, transfer asset ownership, Mint new assets, remove redeemed assets from circulation.

Our legal basis is one or more of the following: keeping to contracts and agreements between you and us, legal obligations and legitimate interests (ensuring efficient transfer of data, money and assets, and efficiently meeting our legal responsibilities).

Where we make an automated decision about you, you have the right to ask that it is manually reviewed by a person. You can find out more about this in the What are my rights? section below.

6. Disclosures of your personal data

We might share your personal data with the parties set out below, for the purposes set out in the table Purposes for processing personal data above.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

What personal data might be transferred	Why we transfer that personal data	Lawful basis	Location
Internal: We share your personal data within the OpenChrono group of companies where they act as processors and joint controllers, to the extent systems, resources and operations are shared.	This is to provide you with the best service, send you information about our products and services we think you’ll be interested in hearing about, or to comply with our regulatory requirements.	Our legal bases are contract, legal obligation and legitimate interest.	The OpenChrono group has offices in Germany and the UK.
Government bodies, such as regulators, law enforcement authorities, competition authorities, and tax authorities, acting as processor or joint controller	To check your identity, protect against fraud, keep to laws (including tax laws, anti-money laundering laws, data protection or cyber security laws or any other laws), and confirm that you’re eligible to use our products and services.	Our legal basis is legal obligation.	These bodies include HMRC (the UK Tax Authority), the FCA (the UK financial authority), the ICO (the UK data regulator), BaFIN (the German financial authority).).
Financial crime prevention service providers, acting as processor and joint controllers.	These include identity verification service providers, fraud prevention and financial crime agencies, or other entities required by law or in connection with an investigation.	Our legal bases are contract and legal obligation.	In the UK, these include Equifax and Experian, in Germany these include Schufa.
People, wallets or entities to whom you make transfers. Where you transfer assets or where you make a payment to another party or transfer from your account.	we’ll provide the recipient with your details alongside your transfer (for example, your name/wallet address, digital identity, or public key). This is because we’re required by law to include certain information with transfers.	Our legal bases are contract and legal obligation.	These entities can be located globally, as well as in the United Kingdom.
Professional advisors: acting as processor or joint controller including lawyers, bankers, auditors and insurers.	who provide consultancy, banking, legal, insurance, payroll management and accounting services	Our legal bases are contract and legal obligation.	The entities are located in the UK and Germany
Social media. We might share members’ links to their assets, or interact with there public avatar or identifiers	. We might also use social media for marketing purposes, and therefore we might share your personal data to check if you also hold an account with them; to send your our adverts, where we think that one of our new products or services might interest you; to send our adverts to people who have a similar profile to you.	Our legal basis is legitimate interests (to ensure our advertising is as effective as possible).	The social media entities are global. The recipients can be located in the UK, the USA, and the EEA.
Where you ask us to share your personal data with a third party.	For example, you might authorise third parties to act on your behalf (such as a lawyer, accountant or family member or guardian under a power of attorney).	Our legal basis would be contract, legal obligation or legitimate interest.	The entity would be located wherever you had sourced them.
Purchasers of our portfolio or assets: third parties to whom we might sell, transfer or merge parts of our business or our assets.	Alternatively, we might seek to acquire other businesses or merge with them.	Our legal basis would be contract and legitimate interest.	The location of the counterparty.
Suppliers: service providers, including
IT service providers, acting as processors	· email · cloud computing · web hosting, · system administration · network services · software developers · network and blockchain platforms including Ethereum · node validator services · source code management, · infrastructure management and collaboration.	Our legal bases are: · legitimate interest (in conducting business communications, maintaining our web presence, website functionality and infrastructure, conducting our on-chain business, and software development and collaboration.)	These providers are based in the USA, Switzerland and globally. Some of the service providers, such as node validators and other participants on the protocols our infrastructure engages with, might be located globally due to the distributed nature of blockchain and distributed ledger technologies.
Software application providers, acting as processors,	who provide software that we use to deliver our products and services and conduct our business, such as document management systems, workspace, operations and project/task management, contract management and electronic document signing, information storage, accounting systems, managing our marketing database, internal document storage systems, smart contract developers.	Our legal bases are: legitimate interest (operational efficiency, business necessity, executing business contracts and agreements).	These entities are located in the USA, UK and EU.
Mailing service providers, acting as processors,	who ship our products to you.	Our legal bases are: legitimate interest (operational efficiency and business necessity).	These are based globally as best suits the location of the recipient
Financial services providers and partners, acting as processor or joint controllers,	who offer billing, audit services, payment networks, wallet providers, payment processors, banking and financial services partners.	Our legal bases are: legitimate interest (business financial operations, essential for server operations and infrastructure).	These are located in the UK and EU.
Analytics providers, and “cookies”, acting as processors,	who offer services such as surveys and statistical analysis. track and analyse our website users to understand how visitors interact with our site.		These entities are located in the EU, UK and USA.
Customer-service providers, acting as processors,	who offer marketing and customer assistance services.	Our legal bases are: legitimate interest (analysing website activity to improve our products and services, and website/infrastructure efficiency.)	These entities are based in the EU and the UK.
Communications services providers, acting as processors.	who offer video and meeting facilities, community, communications and correspondence services (such as sending emails, push notifications and text messages, creating a community for customers interaction.	Our legal bases are: legitimate interest (in conducting business communications, public relations and branding, business and community communication, group messages and channels, external communication and coordination, community engagement and project coordination.)	These providers are based in the USA, Switzerland and globally.

7. International transfers

Our business model incorporates blockchain, including Ethereum and Solana, and some of the business processes and personal data will be shared “on-chain”, including member discussions. In addition, many of our business processes are international, such as the assets, you have purchased and the counterparties you have interacted with, will be stored indefinitely on-chain, and is unlikely to be capable of being removed or changed or protected. On-chain data is potentially visible globally, which means that a transfer of that data has been made internationally.

Some of our service providers are based outside the UK or the EU, and that would involve a transfer of personal data outside the UK and the EU.

We might also send your personal data outside the UK or the EU to abide by global legal and regulatory requirements, to provide ongoing support services, to credit reference agencies, fraud prevention agencies, law enforcement authorities or to enable us to provide you with products or services you have requested.

Where we can, whenever we transfer your personal data outside the UK or the EU, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following mechanisms is used:

· the transfer is to a country or entity that has been deemed to provide an adequate level of protection for personal data. Details about these countries or entities, as approved by the ICO from time to time, can be found at: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/

· appropriate safeguards are used, such as binding corporate rules, standard data protection clauses, an approved code of conduct, certification under an approved scheme, contractual clauses authorised by the ICO, administrative arrangements between public authorities of bodies, an applicable exemption, or we have your specific consent.

Please note that data on-chain is unlikely to be capable of being protected by these mechanisms.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data outside the UK or the EU.

8. Data security

We have implemented appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These measures include:

· Limiting access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

· Utilising multi-factor authentication.

· Implementing procedures to deal with any suspected personal data breach. We will notify you and any applicable regulator of a breach where we are legally required to do so.

· Electronic data and databases are stored on secure computer systems with control over access to information using both physical and electronic means.

· Our staff receives data protection and information security training.

· We have detailed security and data protection policies which staff are required to follow when they handle your personal data.

While we take all reasonable steps to ensure that your personal data will be kept secure from unauthorised access, we cannot guarantee it will be secure during transmission by you to our website or other services.

We use HTTPS (HTTP Secure), where the communication protocol is encrypted through Transport Layer Security for secure communication over networks, for all our web and payment-processing services.

If you use a password for our website, you will need to keep this password confidential. Please do not share it with anyone.

When you use our public services, which includes participating in voting and engaging with our social network accounts and our community forum, do not share any personal data that you don't want to be seen, collected or used by other customers or the general public, as this personal data will become publicly available. It might also be stored ‘on-chain’, and will not be capable of being removed, hidden or changed.

9. Data retention

How long will you use my personal data for?

Any personal data which is “on-chain”, such as your digital identifier or wallet address and the counterparty you interacted with, will be stored indefinitely, and incapable on-chain, and is unlikely to be capable of being removed or changed.

Where personal data is not “on-chain”, we will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We might retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law, we have to keep basic information about our customers for a certain period after they cease being customers for tax purposes and AML purposes.

In some circumstances you can ask us to delete your data. See the section below Your Legal Rights below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we might use this information indefinitely without further notice to you.

10. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data.

· Right to information about how your personal data is used. You have the right to be told how we use your personal data. This notice is one way in which we provide this information to you.

· Right to access your personal data.

· Right to request correction of the personal data that we hold about you. We are unable to correct any data “on-chain”.

· Right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below). We are unable to erase any data “on-chain”.

· Right to object to processing of your personal data. You can object to your personal data being processed where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.

· Right to request restriction of processing of your personal data, in certain circumstances.

· Right to request the transfer of your personal data to yourself or to a third party.

· Right to withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. Note that where you have consented to your personal data being processed or stored on-chain, we cannot remove or correct the personal data.

· Right to request a review by a person of an automated decision we made about you, where that automated decision significantly affects you.

10.1 Exercising your rights

If you wish to exercise any of the rights set out above, please contact us at [e-mail]

Your ability to exercise these rights will depend on a number of factors. Sometimes, we won’t be able to agree to your request (for example, if we have a legitimate reason for not doing so or the right does not apply to the particular information we hold about you).

10.2 No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we might charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

10.3 What we might need from you

We might need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We might also contact you to ask you for further information in relation to your request to speed up our response.

10.4 Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

---