Privacy Policy

1. Who we are

This policy is issued by OnchainSuite Ltd (“OnchainSuite”, “we”, “us”), a company registered in England and Wales (company number 17370357), with its registered office at 31 Nash Square, Birmingham, United Kingdom, B42 2EX. We have applied to register with the UK Information Commissioner’s Office (ICO) as a fee payer (application number C2013999); this page will show our registration reference once the ICO confirms it.

For questions about this policy or your personal data, contact privacy@onchainsuite.com, or our data protection contact at dpo@onchainsuite.com.

2. When we are a controller vs a processor

OnchainSuite plays two different roles, and which one applies determines whose privacy policy governs:

• As a controller, for personal data we decide the purposes of: website visitors, prospects who request early access, and the administrators of customer accounts. This policy covers that data.
• As a processor, for personal data we process on behalf of our customers (the protocols and teams who use the platform), including the on-chain and engagement data of their end users. There, the customer is the controller, their own privacy notice applies to their end users, and our Data Processing Agreement governs how we handle that data on their instructions.

3. Personal data we collect

Website & marketing

• Contact details you submit (name, work email, protocol/company, role, and anything in free-text fields).
• Usage and device data (pages viewed, referrer, approximate location from IP, browser) via cookies and analytics, see our Cookie Policy.

Account & billing (for customers)

• Account administrator details, authentication data, and billing/contact information.

On-chain & wallet data

The platform reads public blockchain data (wallet addresses and their on-chain activity). On its own a wallet address is pseudonymous, but it can become personal data under UK GDPR when it is, or can be, linked to an identifiable person. An email address or other contact identifier is linked to a wallet only where the wallet holder opts in. We do not custody assets and never initiate or sign transactions; on-chain access is read-only.

4. Our lawful bases (UK GDPR Article 6)

• Consent, for non-essential cookies/analytics and optional marketing communications. You may withdraw consent at any time.
• Contract, to provide the service to customers and administer accounts.
• Legitimate interests, to operate, secure, and improve the site and product, and to respond to enquiries, balanced against your rights.
• Legal obligation, to comply with law (e.g. tax, accounting, and responding to lawful requests).

5. How we use personal data

• To respond to early-access requests, schedule calls, and communicate about the product.
• To provide, maintain, secure, and improve the website and platform.
• To process payments and manage the customer relationship.
• To meet legal, regulatory, and security obligations and to detect and prevent abuse.

6. Sharing and sub-processors

We share personal data with vendors who help us run the service (hosting, email delivery, analytics, scheduling, payments). These act as our processors under contract and only on our instructions. A current list is on our Sub-processors page. We may also disclose data where required by law, to protect our rights, or as part of a corporate transaction. We do not sell personal data.

7. International transfers

Some vendors are located outside the UK (for example, in the United States). Where personal data is transferred outside the UK, we put in place an approved safeguard, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, and/or reliance on the EU-US Data Privacy Framework (UK Extension) where the recipient is certified. Details are on our International Data Transfers page.

8. Retention

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. Prospect and enquiry data is retained for up to 24 months from last contact; customer account and billing records are kept for the life of the contract and for 6 years afterwards to meet legal and tax obligations. Data we process on behalf of customers is retained per the DPA.

9. Your rights

Under UK GDPR you have the right to:

• access a copy of your personal data;
• rectify inaccurate data and complete incomplete data;
• erase data (“right to be forgotten”) in certain circumstances;
• restrict or object to certain processing, including direct marketing;
• data portability; and
• withdraw consent at any time, without affecting prior lawful processing.

To exercise any right, contact privacy@onchainsuite.com. You also have the right to complain to the ICO at ico.org.uk (or your local supervisory authority), though we’d appreciate the chance to resolve it first. If your data is processed by a customer of ours (us acting as processor), please direct requests to that customer.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and least-privilege, read-only and non-custodial on-chain access, logging, and vendor due diligence. Our detailed measures are described in the annex to the DPA. No system is perfectly secure, but we work to protect your data and to notify the relevant parties promptly if a reportable breach occurs.

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are set only with your consent.

12. Children

The service is for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18.

13. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a revised “last updated” date and, where appropriate, notified to you directly.

14. Contact

OnchainSuite Ltd, 31 Nash Square, Birmingham, United Kingdom, B42 2EX. Privacy enquiries: privacy@onchainsuite.com. Data protection contact: dpo@onchainsuite.com.