XPRV PRIVACY NOTICE
Welcome to the Privacy Notice for XPRV Limited (“XPRV”)
XPRV respects your privacy and is committed to protecting your personal data.
This notice explains how we look after your personal data, how we collect and process it through your use of this website or infrastructure, or when you purchase one of our products or services. We might also collect personal data about you from other sources, such as other companies or publicly available information. By visiting our website, you are accepting and consenting to the practices described in this notice. You can find out more in the [The Personal Data We Collect About You] section below.
1. About usThis notice is issued on behalf of XPRV Limited so when we mention "XPRV", "we", "us" or "our" in this notice, we are referring to XPRV Limited responsible for processing your data. XPRV Limited is the data controller and responsible for this website.
If you have any questions about this notice, or about exercising your legal rights, or about our privacy practices, please contact our [data protection manager/data protection officer] at: contact@xprv.io, or by post or email using the details listed below.
Email: contact@xprv.io
Postal Address:
XPRV Limited UK
Formal House,
60 St Georges Place,
Cheltenham
GL50 3PN
United Kingdom
You have the right to make a complaint at any time to the relevant data regulator, as set out below. We would, however, appreciate the chance to deal with your concerns before you approach any data regulator, so please contact us in the first instance.
UK Data Protection Authority
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane, Wilmslow
Cheshire, SK9 5AF
ENGLAND
Tel:+ 44 0303 123 1113
Fax: +44 1625 524510
2. Important Information About This Privacy NoticeIt is important that you read this notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This notice supplements other notices and is not intended to override them.
This website is not intended for children and we do not knowingly collect data relating to children.
2.1 Changes to the Privacy Notice and your duty to inform us of changes.We keep this notice under regular review. This version was last updated on 31/10/2023. Previous versions are available by contacting us at contact@xprv.io
If we change the way we use your personal data, we’ll update this notice and, if appropriate, let you know through our website or by email.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
2.2 Third-party linksThis website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy information of every website you visit.
3. The data we collect about you3.1 What is personal data?Personal data means any information which can be used to identify you. It does not include data where the identity has been removed (anonymous data).
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
3.2 Lawful basisWe process your personal data only when we have a ‘lawful basis’ (or valid legal justification) to do so. The lawful bases we commonly rely on are:
• Where we need to process the personal data in order to perform the contract we are about to enter into or have entered into with you. For example, we cannot provide our services to you without knowing who you are.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation. For example, we might be required to gather information to comply with tax laws.
• Where you have agreed we can collect your personal data, or sensitive personal data, and use it in a certain way. For example, when you are consenting to your personal data being transferred outside the UK or the EU.
Note that we might process your personal data for more than one lawful basis, depending on the specific purpose for which we are using your data. Please contact us if you need additional details of an occasion where we use more than one basis.
3.3 Purposes for processing personal dataThe table below outlines the personal data we might process, the possible source of that personal data, our purpose in processing the data, and our ‘legal basis’ for the processing.
3.3.1 Personal data you provide to us directly What personal data might be provided to us
Identity Data, includes information such as:
name, date of birth, address, email address and telephone number, photo, video or audio data, or other information we might require to conduct KYC/AML and identity checks such as your passport or driving license.
We might receive this data when you interact with our infrastructure, stake one or more assets using our infrastructure, or otherwise interact with us including by phone, post, email or social media.
If we carry out KYC and AML checks and a periodic review of that information we might collect Special Categories of Personal Data about you in so far as this identifies you as a politically exposed person. In this connection we might also collect information about criminal convictions and offences.
Why we process that personal data
We might process this personal data when providing our products and services to you, and administering our relationship with you including:
• Accepting you as a customer, including setting you up as a customer on our website or infrastructure.
• Processing and delivering your orders or transactions, including managing rewards, payments, fees and charges and transferring and receiving assets.
• Registering your ownership of assets, the assets you stake and the returns you receive following such staking.
• Providing customer support services to you. We might record and monitor any communications between you and us, including phone calls, to maintain appropriate records, check your instructions, analyse, assess and improve our services, and for training and quality control purposes.
• Registering you as a customer, conducting KYC/AML checks, verifying your identity and eligibility (and those of and any joint account holders)
Lawful basis
• Performance of a contract with you
• Legal obligations
• Legitimate interest (ensuring our efficiency in providing our services to you, on how we meet our legal obligations).
What personal data might be provided to us
Digital Identity Data includes data such as:
wallet address, digital identity, public key (or other unique identifier), asset ownership history, voting history, or information we might require to enable you to interact with us, our infrastructure, our assets, our website, our voting systems, or those of our partners.
We might receive this data when you use our infrastructure or website to conduct staking activities, open an account with us, correspond with us by any media, or take part in online discussions. We might also receive this data when you conduct on-chain activities using the same Digital Identity Data where this data is publicly available or from a third party.
Why we process that personal data
We might process this personal data so that you can :
• use our infrastructure or website to conduct staking activities,
• interact with us
• interact with our technological systems
• vote on-chain
• receive rewards, tokens, coins or other assets resulting from your staking activities.
Lawful basis
• Performance of a contract with you
• Legal obligations
• Legitimate interest (ensuring we deliver the products or services orders, ensure the voting is correctly recorded)
What personal data might be provided to us
Financial Data includes information such as bank account, payment card details, wallet address, tax information, the number of assets earned, uploaded, used and exchanged.
We might receive this information when you conduct staking activities using our infrastructure, or pay for other products or services using our infrastructure.
Why we process that personal data
We might process this data so that you can:
• receive any rewards or assets to which you become entitled through your use of our infrastructure, products or services
• use our infrastructure for staking purposes
Lawful basis
• Performance of a contract with you
• Legal obligations
What personal data might be provided to us
When you inform us of your marketing preferences or how you would like to receive information from us, or subscribe to our services, publications or social media, we call this Marketing Data.
Note: you can ask us to stop sending you marketing information by adjusting your marketing choices (the How do you use my personal data for marketing? section below explains how to do this).
Why we process that personal data
We process your personal data:
• to make suggestions and recommendations about our infrastructure, goods and services
• to help with social interactions through our services and community, or to add extra functions in order to provide a better experience.
• deliver relevant website content and advertisements, inform you of our offers and promotions about charities and products, personalise your marketing messages about our products and services so they’re more relevant and interesting to you (where allowed by law). This may include analysing how you use our infrastructure, products, services and your transactions
• notify you about changes to our terms and conditions, our products or services, or this notice
• update you about your account and holdings
• verify your identity if you contact our customer support or social media teams
• allow you to take part in interactive features of our services
• ask you to leave a review, take a survey, or provide feedback.
• if you agree, provide you with information about our partners’ promotions or offers which we think you might be interested in
• if you agree, allow our partners and other organisations to provide you with information about their products or services
• measure or understand the effectiveness of our marketing and advertising, and provide relevant advertising to you
• ask your opinion about our infrastructure, products or services
Lawful basis
• Legitimate interests (to send direct marketing, ensure our direct marketing is relevant to your interests, develop our products and services, and to be efficient about how we meet our legal and contractual duties)
• Consent (where we’re legally required to get your consent to send you direct marketing about our products or services, or partners’ promotions or offers, or for you to receive marketing from other organisations)
What personal data might be provided to us
Where you have enabled location or GPS services, we will be able to see your location. We call this Location Data.
Why we process that personal data
Where you have enabled location-based services, we can:
• provide you with location-relevant advertising, products and services, (for example, information about nearby merchants)
• protect against fraud
Lawful basis
• Keeping to contracts and agreements between you and us
• Legitimate interests (to develop and market our products and keep to regulations that apply to us)
• Consent (to track you when you have location services switched on)
3.3.2 Personal Data we receive when your devices interact with our websites, infrastructure.What personal data might be provided to us
Technical Data includes information about your device, how it connects to other devices and networks, and how you connect with the device.
This might the internet protocol (IP) address used to connect your device to the internet, your login information, the browser type and version, the time zone setting, the operating system, the type of device you use, a unique device identifier (for example, your device's IMEI number, the MAC address of the device's wireless network interface, or the mobile phone number used by the device), mobile network information, your mobile operating system and the type of mobile browser you use.
We might collect this data when your devices interact with our website or infrastructure, by using cookies, pixels, tracking technologies, analytics systems, server logs and other similar technologies.
Our cookies will regularly collect this information in order to stay up to date (but only if you have given us permission). Please see our Cookie Notice for further details.
We might also receive Technical Data about you if you visit other websites employing our cookies.
Why we process that personal data
We process this data to administer, manage and protect our business, website and infrastructure, including:
• troubleshooting,
• data analysis,
• testing,
• research,
• statistical and survey purposes,
• system maintenance,
• support,
• reporting
• hosting of data
• making sure that content is presented in the most effective way for you and your device
• helping keep our website and infrastructure safe and secure
Lawful basis
• Legitimate interests (provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
• Legal obligation
• Consent (where required by law)
• Keeping to contracts and agreements between you and us
What personal data might be provided to us
Location Data is information about your location.
We might be able to track your location if location services are enabled on your device.
Why we process that personal data
We process this data to
• determine the location of potential users of our website and infrastructure to prevent access from locations where we are not licensed to sell our products or services.
Lawful basis
• Legitimate interests (to prevent ineligible parties from purchasing our products or services)
• Legal obligation
What personal data might be provided to us
Usage Data is information on how you have used our website, infrastructure, products and services, including:
information about your visit, such as the links you’ve clicked on, through and from our website (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling and clicks), and methods used to browse away from the page or site.
Why we process that personal data
We process this data to
• to create a better website and user experience
• make suggestions and recommendations about our goods and services
• to help with social interactions through our services, or to add extra functions in order to provide a better experience.
• deliver relevant website content and advertisements, personalise your marketing messages about our products and services so they’re more relevant and interesting to you (where allowed by law). This may include analysing how you use our products, services and your transactions
Lawful basis
• Legitimate interests (to develop our products and services, and to be efficient about how we meet our legal and contractual duties)
• Consent (where we’re legally required to get your consent to send you direct marketing about our products or services, or partners’ promotions or offers, or for you to receive marketing from other organisations)
What personal data might be provided to us
Transaction Data is information such as payments or transfers made or received, assets held, wallets interacted with, transaction dates and times, meta data and indexed data, the time taken to make the transfer/payment, currencies, exchange rates, messages sent and received, Technical Data about your device.
For example, when you use our infrastructure to stake an asset, our systems might record the asset, the number of assets, who is staking them, the length of time staked, and rewards earned and received during the staking term and the relevant wallets, blockchains and protocols.
We might also collect details of the person or entity you are transacting with (including some of their Identity Data, Technical Data, Financial Data and Contact Data).
Why we process that personal data
We process this data in order to
• perform our contract with you and/or the recipient of one of the assets being staked.
• fulfil the transaction
• comply with our regulatory obligations when administering our business
Lawful basis
• Performance of a contract with you
• Legitimate interest of a third party (party receiving one of our assets and their ability to participate with our services and systems to vote)
• Our legitimate interests (ensuring the effective and efficient working of our assets, and systems such as our voting
3.3.3 Personal Data we receive from third partiesWhat personal data might be provided to us
KYC/AML providers
When conducting KYC/AML and identify verification checks, we might receive data from third parties such as credit reference agencies, financial or credit institutions, official registers and databases, as well as joint account holders, fraud prevention agencies and partners.
This data might include your credit record, information to help us check your identity, information about your spouse and family (if applicable in the context of your account details or your interaction with us) and information relating to your transactions.
In carrying out KYC and AML checks and a periodic review of that information we might collect Special Categories of Personal Data about you in so far as this identifies you as a politically exposed person. In this connection we might also collect information about criminal convictions and offences.
Why we process that personal data
We might or our partners might process your personal data to
• protect against fraud
• comply with financial crime laws
• confirm your eligibility to use our services.
• help us better understand your financial circumstances and manage fraud risks related to your account.
Lawful basis
• Legal obligation
• Legitimate interest (to prevent fraud, develop and improve how we deal with financial crime and meet our legal responsibilities)
• Consent (where required by law)
What personal data might be provided to us
Blockchain platforms and products
Given the transparent and accessible nature of blockchain and other distributed ledger technologies, and the interaction of and between different wallets, chains, protocols and platforms, we might receive information about you from other custodians, wallets or technological providers with whom our systems interact, including from Sui.io, the Vega Protocol or the Celestia network.
Why we process that personal data
We might process this data in order to
• perform our contract with you and/or the recipient of one of our assets or other products or services
• fulfil the staking transaction.
• comply with our regulatory obligations when administering our business.
Lawful basis
• Performance of a contract with you
• Legitimate interest of a third party (party receiving one of our assets and their ability to participate with our services and systems to vote)
• Our legitimate interests (ensuring the effective and efficient working of our assets, and systems such as voting.)
What personal data might be provided to us
Providers of financial or payment services
We might receive information about you during the course of the transactions you engage in by using our website, infrastructure, products or services, from counterparties such as regulated and unregulated financial or credit institutions including merchants, ATMs, custodians, wallets, exchanges, peer to peer ecosystems
Why we process that personal data
We process this data in order to
• perform our contract with you and/or the recipient of the assets staked
• fulfil the staking transaction.
• comply with our regulatory obligations when administering our business.
Lawful basis
• Performance of a contract with you
• Legitimate interest of a third party (party receiving one of our assets and their ability to participate with our services and systems to vote)
• Our legitimate interests (ensuring the effective and efficient working of our assets, and systems such as voting.)
3.3.4 Personal Data we receive from social media and publicly available sourcesWhat personal data might be provided to us
We might collect information about your identity, tax information, and other publicly available information from sources such as:
registrars of companies such as Companies House in the UK; tax authorities such as HMRC in the UK; public registers such as the electoral roll.
Why we process that personal data
We process your personal data to :
• protect against fraud,
• comply with financial crime laws
• confirm your eligibility to use our services
• better understand your financial circumstances and manage fraud risks related to your account.
• conduct enhanced due diligence, security and KYC purposes
Lawful basis
• Legal obligation
• Legitimate interest (to prevent fraud, develop and improve how we deal with financial crime and meet our legal responsibilities)
• Consent (where required by law)
What personal data might be provided to us
Social Media Data includes your social media ‘handle’ or username, your avatar, your interaction with other users and with us.
Social media includes Telegram, Instagram, WhatsApp, Signal, Slack, Twitter or ‘X’, Facebook, Discord, Slack, Reddit, LinkedIn and others.
Why we process that personal data
We process this data to
• interact with you for marketing purposes
• conduct due diligence.
• create a profile about you
Lawful basis
• Legitimate interests (to send direct marketing, ensure our direct marketing is relevant to your interests, develop our products and services, and to be efficient about how we meet our legal and contractual duties)
• Consent (where we’re legally required to get your consent to send you direct marketing about our products or services, or partners’ promotions or offers, or for you to receive marketing from other organisations)
We might also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we might aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this notice.
3.4 If you fail to provide personal dataWhere we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we might not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we might have to cancel a product or service you have with us but we will notify you if this is the case at the time.
3.5 Change of purposeWe will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we might process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
4. MarketingWe strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.
4.1 Promotional offers from usYou might receive marketing communications (by post, push notification, email and text message ) from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing. Where national laws require us to get your consent to send marketing messages, we’ll do so in advance. You can object to profiling for direct marketing purposes.
4.2 Third-party marketingWe will get your express opt-in consent before we share your personal data with any third party for marketing purposes. You can find out more in the [Do you share my personal data with anyone else?] section below.
4.3 Opting outYou can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions.
4.4 CookiesWe use cookies to analyse how you use our website. For more information about the cookies we use, please see our [Cookie Notice]. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies.
Cookie name
Squarespace Analytics and Performance Cookies
Type
[Targeting]
[Functional]
Strictly necessary
Purpose
• Enables our website administrator to conduct processing and enable the functionality of our website;
• Estimates our audience size and demonstrates how our website it used.
• Stores information about your browsing preferences, and so allow us to customise our site and to provide you with offers that are targeted to your individual interests.
• Recognises you when you return to our site.
• Allows you to use our site in a way that makes your browsing experience more convenient, for example, by allowing you to store items in an electronic shopping basket between visits. If you register with us or complete our online forms, we will use cookies to remember your details during your current visit, and any future visits provided the cookie was not deleted in the interim.
Longevity
• Infinite
• 21 years after you leave our website
• Browsing session only
5. Automated Decision-Making and Data Profiling We might make automated decisions about you. This means that we might use technology that can evaluate your personal circumstances and other factors to predict risks or outcomes. This is sometimes known as profiling. We do this for the efficient running of our services and to ensure decisions are fair, consistent, and based on the right information.
For example, we might make automated decisions about you that relate to:
• Opening accounts: conducting KYC, anti-money laundering and sanctions checks, or identity and address checks.
• Detecting fraud: monitoring your account to detect fraud and financial crime
Our legal basis is one or more of the following: keeping to contracts and agreements between you and us, legal obligations, legitimate interests (to develop and improve how we deal with financial crime and meet our legal responsibilities).
Our infrastructure, and the blockchain protocols our infrastructure interact with, might use smart contracts. ‘Smart contracts’ are software code which automate processes and enable the efficient transfer of data, assets and money. Within our infrastructure, they enable and effect interactions with validators.
Our legal basis is one or more of the following: keeping to contracts and agreements between you and us, legal obligations and legitimate interests (ensuring efficient transfer of data, money and assets, and efficiently meeting our legal responsibilities).
Where we make an automated decision about you, you have the right to ask that it is manually reviewed by a person. You can find out more about this in the [What are my rights?] section below.
6. Disclosures of your personal dataWe might share your personal data with the parties set out below, for the purposes set out in the table [Purposes for processing personal data] above.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Government bodies, such as regulators, law enforcement authorities, competition authorities, and tax authorities, acting as processor or joint controller, to check your identity, protect against fraud, keep to laws (including tax laws, anti-money laundering laws, data protection or cyber security laws or any other laws), and confirm that you’re eligible to use our products and services. Our legal basis is legal obligation. These bodies include HMRC (the UK Tax Authority), the FCA (the UK financial authority), the ICO (the UK data regulator).
Financial crime prevention service providers, acting as processor and joint controllers. These include identity verification service providers, fraud prevention and financial crime agencies, or other entities required by law or in connection with an investigation. Our legal bases are contract and legal obligation. The entities are located in the UK and Germany.
People, wallets or entities you transfer money or assets to: Where you make a payment or transfer from your account, we’ll provide the recipient with your details alongside your transfer (for example, [your name, wallet address, unique identifier]). This is because we’re required by law to include certain information with transfers. Our legal bases are contract and legal obligation. These entities can be located globally, as well as in the United Kingdom.
People, wallets or entities who send you money or assets. When you receive a payment or transfer into to your account, we’ll provide the payer or sender with your details (for example, your name, IBAN, wallet address, unique identifier). Our legal bases are contract and legal obligation. These entities can be located globally, depending on the location of your counterparty and technology providers they use (for example custodians, wallets or digital identity providers), as well in the United Kingdom.
Credit reference agencies: when conducting KYC/AML checks or when you apply for credit from us, these agencies might act as processors or joint controllers. Our legal bases are contract and legal obligation. If you are in the United Kingdom, these include Equifax and Experian.
Professional advisors: acting as processor or joint controller including lawyers, bankers, auditors and insurers based in the United Kingdom, Germany and the USA who provide consultancy, banking, legal, insurance, payroll management and accounting services. Our legal bases are contract and legal obligation. The entities are located in the UK and Germany.
Social media. We might use social media for marketing purposes, and therefore we might share your personal data (limited to only your name, email address) to check if you also hold an account with them; to send your our adverts, where we think that one of our new products or services might interest you; to send our adverts to people who have a similar profile to you. Our legal basis is legitimate interests (to ensure our advertising is as effective as possible). The recipients can be located in the UK, the USA, and the EEA.
Where you ask us to share your personal data with a third party. For example, you might authorise third parties to act on your behalf (such as a lawyer, accountant or family member or guardian under a power of attorney). Our legal basis would be contract, legal obligation or legitimate interest. The entity would be located wherever you had sourced them.
Purchasers of our portfolio or assets: third parties to whom we might sell, transfer or merge parts of our business or our assets. Alternatively, we might seek to acquire other businesses or merge with them. Our legal basis would be contract and legitimate interest.
Suppliers: service providers, including:
• IT service providers, acting as processors, who provide email, Cloud Computing and Web Hosting, network services, software developers, network and node validator services, source code management, infrastructure management and collaboration. These providers are based in the USA, Switzerland and globally. Some of the service providers, such as node validators and other participants on the protocols our infrastructure engages with, might be located globally due to the distributed nature of blockchain and distributed ledger technologies. Our legal bases are: legitimate interest (in conducting business communications, maintaining our web presence, website functionality and infrastructure, conducting our on-chain business, and software development and collaboration.)
• Software application providers, acting as processors, who provide software that we use to deliver our products and services and conduct or business, such as document management systems, operations and task management, contract management and electronic document signing, information storage, accounting systems, managing our marketing. These are located in the USA. Our legal bases are: legitimate interest (operational efficiency, business necessity, executing business contracts and agreements).
• Mailing service providers, acting as processors, who ship our products to you. These are based globally as best suits the location of the recipient. Our legal bases are: legitimate interest (operational efficiency and business necessity).
• Financial services providers and partners, acting as processor or joint controllers, who offer server operations and billing, audit services, payment networks, custodians, staking services, wallet providers, payment processors, banking and financial services partners and payments networks such as Visa, Mastercard, Revolut. These are located in the UK and EU. Our legal bases are: legitimate interest (business financial operations, essential for server operations and infrastructure).
• Analytics providers, and “cookies”, acting as processors, who track and analyse our website users to understand how visitors interact with our site. These entities are located in the EU and the UK. Our legal bases are: legitimate interest (analysing website activity to improve our products and services, and website/infrastructure efficiency.)
• Communications services providers, acting as processors, who offer video and meeting facilities, community, communications and correspondence services (such as sending emails, push notifications and text messages, creating a community for customers interaction. These providers are based in the USA, Switzerland and globally. Our legal bases are: legitimate interest (in conducting business communications, public relations and branding, business and community communication, group messages and channels, external communication and coordination, community engagement and project coordination.)
7. I nternational transfersAny personal data which is “on-chain”, such as the assets, currencies or tokens you have staked and the counterparty you staked with, will be stored indefinitely on-chain, and is unlikely to be capable of being removed or changed or protected. On-chain data is potentially visible globally, which means that a transfer of that data has made internationally.
Some of our service providers are based outside the UK, and that would involve a transfer of personal data outside the UK. We might also send your personal data outside the UK or the EU to abide by global legal and regulatory requirements, to provide ongoing support services, to credit reference agencies, fraud prevention agencies, law enforcement authorities or to enable us to provide you with products or services you have requested.
Where we can, whenever we transfer your personal data outside the UK or the EU, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following mechanisms is used:
• the transfer is to a country or entity that has been deemed to provide an adequate level of protection for personal data. Details about these countries or entities, as approved by the ICO from time to time, can be found at: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/
• appropriate safeguards are used, such as binding corporate rules, standard data protection clauses, an approved code of conduct, certification under an approved scheme, contractual clauses authorised by the ICO, administrative arrangements between public authorities of bodies, an applicable exemption, or we have your specific consent.
Please note that data on-chain is unlikely to be capable of being protected by one of these mechanisms.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data outside the UK or the EU.
8. Data securityWe have implemented appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These measures include:
• Limiting access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
• Implementing procedures to deal with any suspected personal data breach. We will notify you and any applicable regulator of a breach where we are legally required to do so.
• Electronic data and databases are stored on secure computer systems with control over access to information using both physical and electronic means.
• Our staff receives data protection and information security training.
• We have detailed security and data protection policies which staff are required to follow when they handle your personal data.
While we take all reasonable steps to ensure that your personal data will be kept secure from unauthorised access, we cannot guarantee it will be secure during transmission by you to our website or other services.
We use HTTPS (HTTP Secure), where the communication protocol is encrypted through Transport Layer Security for secure communication over networks, for all our web and payment-processing services.
If you use a password for our website, you will need to keep this password confidential. Please do not share it with anyone.
When you use our public services, which includes participating in voting and engaging with our social network accounts and our community forum, do not share any personal data that you don't want to be seen, collected or used by other customers or the general public, as this personal data will become publicly available. It might also be stored ‘on-chain’, and will not be capable of being removed, hidden or changed.
9. Data retentionHow long will you use my personal data for?
Any personal data which is “on-chain”, such as the assets, currencies or tokens you have staked and the counterparty you staked with, will be stored indefinitely on-chain, and is unlikely to be capable of being removed or changed.
Where personal data is not “on-chain”, we will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We might retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
By law, we have to keep basic information about our customers for a certain period after they cease being customers for tax purposes and AML purposes.
In some circumstances you can ask us to delete your data. See the section below [Your Legal Rights] below for further information.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we might use this information indefinitely without further notice to you.
10. Your legal rightsUnder certain circumstances, you have rights under data protection laws in relation to your personal data.
• Right to information about how your personal data is used. You have the right to be told how we use your personal data. This notice is one way in which we provide this information to you.
• Right to access your personal data.
• Right to request correction of the personal data that we hold about you. We are unable to correct any data “on-chain”.
• Right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below). We are unable to erase any data “on-chain”.
• Right to object to processing of your personal data. You can object to your personal data being processed where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Right to request restriction of processing of your personal data, in certain circumstances.
• Right to request the transfer of your personal data to yourself or to a third party.
• Right to withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. Note that where you have consented to your personal data being processed or stored on-chain, we cannot remove or correct the personal data.
• Right to request a review by a person of an automated decision we made about you, where that automated decision significantly affects you.
10.1 Exercising your rightsIf you wish to exercise any of the rights set out above, please contact us at contact@xprv.io
Your ability to exercise these rights will depend on a number of factors. Sometimes, we won’t be able to agree to your request (for example, if we have a legitimate reason for not doing so or the right does not apply to the particular information we hold about you).
10.2 No fee usually requiredYou will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we might charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
10.3 What we might need from youWe might need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
We might also contact you to ask you for further information in relation to your request to speed up our response.
10.4 Time limit to respondWe try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.