Data protection

1. Principles

• Lawful, fair and transparent processing, explained in plain language.
• Purpose limitation: data is used only for the purposes it was collected for.
• Minimisation: only data needed for the purpose is processed.
• Accuracy: data is kept up to date and corrected when wrong.
• Storage limitation: data is kept only as long as needed or legally required.
• Integrity and confidentiality: data is protected against unauthorised access and loss.
• Accountability: we keep records that show how we comply.

2. Processing for clients

When we process data for a client or programme operator, the agreements with that client set out the instructions and safeguards that apply.

3. Classification and access

Verification documents, credentials, keys and transaction identifiers are treated as confidential. Access is limited to people who need it.

4. Retention and deletion

Retention follows the purpose of the data and the legal requirements of the entity responsible for it, in particular anti-money-laundering record-keeping. At the end of the retention period, data is deleted or irreversibly anonymised. Data under legal hold is kept until the hold ends.

5. Blockchain records

Records written to public blockchains cannot be changed or deleted. We do not put identifying personal data on public blockchains; blockchain addresses held in our systems are protected like other transaction data.

6. International transfers

Where data moves between countries, the safeguards required by the applicable law and agreements apply.

7. Incidents

Security incidents involving personal data are recorded, assessed and contained. Controllers and authorities are notified where the law requires.