Last update: 16th March 2023
- Your information on the blockchain
- What information we collect
- How and why we use/share your information
- International Data Transfers
- Your rights
- Contact details
2. Your information on the blockchainBlockchain technology, also known as distributed ledger technology (or simply ‘DLT’), is at the core of CANDIDE Wallet. Blockchains are decentralized and made up of digitally recorded data in a chain of packages called ‘blocks’. The manner in which these blocks are linked is chronological, meaning that the data is very difficult to alter once recorded. Since the ledger may be distributed all over the world (across several ‘nodes’ which usually replicate the ledger) this means there is no single person making decisions or otherwise administering the system (such as an operator of a cloud computing system), and that there is no centralized place where it is located either. Accordingly, by design, a blockchains records cannot be changed or deleted and is said to be ‘immutable’. This may affect your ability to exercise your rights such as your right to erasure (‘right to be forgotten’), or your rights to object or restrict processing, of your personal data. Data on the blockchain cannot be erased and cannot be changed. Although smart contracts may be used to revoke certain access rights, and some content may be made invisible to others, it is not deleted. In certain circumstances, in order to comply with our contractual obligations to you (such as delivery of tokens) it will be necessary to write certain personal data, such as your wallet address, onto the blockchain; this is done through a smart contract and requires you to execute such transactions using your wallet’s private key. In most cases ultimate decisions to (i) transact on the blockchain using your wallet address, as well as (ii) share the public key relating to your wallet address with anyone (including us) rests with you. IF YOU WANT TO ENSURE YOUR PRIVACY RIGHTS ARE NOT AFFECTED IN ANY WAY, YOU SHOULD NOT TRANSACT ON BLOCKCHAINS AS CERTAIN RIGHTS MAY NOT BE FULLY AVAILABLE OR EXERCISABLE BY YOU OR US DUE TO THE TECHNOLOGICAL INFRASTRUCTURE OF THE BLOCKCHAIN. IN PARTICULAR THE BLOCKCHAIN IS AVAILABLE TO THE PUBLIC AND ANY PERSONAL DATA SHARED ON THE BLOCKCHAIN WILL BECOME PUBLICLY AVAILABLE
2. What information we collect
2.2 When visiting our websiteWhen you use the Platform to register an account, fill in forms provided on the Platform, subscribe to our services or report a problem with the website, we may collect, store and use certain personal information that you disclose to us. The information we collect from you may include (but is not limited to): your IP address, email address, and feedback.
2.3 When using CANDIDE Wallet AppWhen using the CANDIDE Wallet App, we never collect and process any of your personal data. The data is stored in different instances and publicly accesible on the blockchain. On the Blockchain the following data will be stored:
- your smart contract address of the CANDIDE Wallet;
- transaction made with the CANDIDE Wallet contracts; and
- ETH and token balance.
We may also collect information about how you use the Platform through Google Play’s Android Advertising ID technology and Apple iOS’s Advertising Identifier. This is used only by us and our trusted third party service providers (see “Service Providers” below) for advertising and user analytics. The advertising identifier will only be connected to personally identifiable information where you have provided us with your explicit consent.
3. How and why we use/share your informationLawful basis for processing your information We will only use your personal data when the law allows us to. Most commonly we will use your personal data in the following circumstances:
- Where you have asked us to do so, or consented to us doing so
- Where we need to do so in order to perform a contract we have entered into with you
- Where it is necessary for our legitimate interests (or those of a third party) and your fundamental rights do not override those interests;
- Where we need to comply with a legal or regulatory obligation
MarketingYou will receive marketing messages from us if you have given us your consent to do so or if you have provided feedback on our Platform and have not opted out of receiving marketing messages (and it is within our legal rights, when balanced against your rights and freedoms as an individual, to serve you with marketing). To unsubscribe from marketing emails at any time, please click on the unsubscribe link at the bottom of any marketing email and update your account preferences. You may also contact us to inform us if you do not wish to receive any marketing materials from us.
Service ProvidersOur service providers provide us with a variety of administrative, statistical, and technical services. We will only provide service providers with the minimum amount of personal data they need to fulfill the services we request, and we stipulate that they protect this information and do not use it for any other purpose. We take these relationships seriously and oblige all of our data processors to sign contracts with us that clearly set out their commitment to respecting individual rights, and their commitments to assisting us to help you exercise your rights as a data subject.
4. SecurityCandide takes the protection of your information very seriously. We have put in place appropriate physical, electronic and managerial security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed, including use of secure servers, passwords and industry standard encryption for data. Where we have given you a password that enables you to access certain parts of our Platform, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
5. International Data TransfersPlease note that some of our service providers may be based outside of the European Economic Area (the “EEA”). These service providers may work for us or for one of our suppliers and may be engaged in, among other things, the fulfilment of your request for information, products and services, the processing of your payment details and the provision of support services. Where we transfer your data to a service provider that is outside of the EEA we seek to ensure that appropriate safeguards are in place to make sure that your personal data is held securely and that your rights as a data subject are upheld. Transfers of personal data are either made:
- to a country recognized by the European Commission as providing an adequate level of protection; or
- to a country which does not offer adequate protection but whose transfer has been governed by the standard contractual clauses of the European Commission, by implementing other appropriate cross-border transfer solutions to provide adequate protection.
7. Your RightsAs a data subject you have a number of rights in relation to your personal data. Below, we have described the various rights that you have as well as how you can exercise them. Right of Access You may, at any time, request access to the personal data that we hold which relates to you (you may have heard of this right being described as a “subject access request”). Please note that this right entitles you to receive a copy of the personal data that we hold about you in order to enable you to check that it is correct and to ensure that we are processing that personal data lawfully. It is not a right that allows you to request personal data about other people, or a right to request specific documents from us that do not relate to your personal data. You can exercise this right at any time by writing to us using the contact details set out here and telling us that you are making a subject access request. You do not have to fill in a specific form to make this kind of request.
Your Right to Rectification and ErasureYou may, at any time, request that we correct personal data that we hold about you which you believe is incorrect or inaccurate. Please note that we may ask you to verify any new data that you provide to us and may take our own steps to check that the new data you have supplied us with is right. You may also ask us to erase personal data that we control if you do not believe that we need to continue retaining it (you may have heard of this right described as the “right to be forgotten”).
Although we will do everything to respect your request and personal data it may not always be possible to erase all of your personal data as there may be legal requirements to keep certain personal data or technical limitations to the data we can delete; for example, we are not able to satisfy requests to erase records and information recorded on the blockchain, including, but not limited to, your chosen user name, your transaction history and your account balance.
There may also be legitimate interests in keeping certain data including, amongst others, if the data is required for the Platform to function. If this is the case we will continue to process this data. If erasure is not technically possible or we believe that we have a good legal reason to continue processing personal data that you ask us to erase we will tell you this and our reasoning at the time we respond to your request. You can exercise this right at any time by writing to us using the contact details set out here and telling us that you are making a request to have your personal data rectified or erased and on what basis you are making that request. If you want us to replace inaccurate data with new data, you should tell us what that new data is. You do not have to fill in a specific form to make this kind of request.
Your Right to Restrict ProcessingWhere we process your personal data on the basis of a legitimate interest you are entitled to ask us to stop processing it in that way if you feel that our continuing to do so impacts on your fundamental rights and freedoms or if you feel that those legitimate interests are not valid. You may also ask us to stop processing your personal data
- if you dispute the accuracy of that personal data and want us verify that data’s accuracy;
- where it has been established that our use of the data is unlawful but you do not want us to erase it;
- where we no longer need to process your personal data (and would otherwise dispose of it) but you wish for us to continue storing it in order to enable you to establish, exercise or defend legal claims.
You can exercise this right at any time by writing to us using the contact details set out here and telling us that you are making a request to have us stop processing the relevant aspect of your personal data and describing which of the above conditions you believe is relevant to that request. You do not have to fill in a specific form to make this kind of request.