GDPR Notice

This GDPR Data Processing Notice is issued by WaldChain in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR). It describes how we collect and process your personal data, the legal bases we rely on, and the rights you are entitled to exercise.

1. Data Controller Identity & Contact

The data controller within the meaning of Art. 4(7) GDPR is:

2. Purposes & Legal Bases of Processing

We process personal data for the following purposes and on the following legal bases under Article 6 GDPR:

3. Categories of Personal Data Processed

• Identification & contact data: Name, email address, phone number, company name.
• Communication data: Content of messages sent via contact form or email.
• Technical / usage data: IP address, browser type, device type, pages visited, session duration, referral source — collected by Google Analytics only with your prior consent.
• Cookie data: Cookie consent preference (strictly necessary, not subject to consent).

4. Recipients & International Data Transfers

Your personal data may be shared with the following categories of recipients:

• Google LLC (Google Analytics): Analytics data transferred to the USA. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR adequacy decision). Applies only where you have given consent.
• Resend Inc.: Email delivery service used to route contact form submissions. Data is processed solely for the purpose of email transmission.
• Vercel Inc.: Website hosting infrastructure. Server-side logs may be retained for security and performance purposes.
• Competent authorities: Public authorities, courts, or regulatory bodies where required by applicable law (Art. 6(1)(c)).

Where personal data is transferred to a third country without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Art. 46(2)(c) GDPR as an appropriate safeguard.

5. Retention Periods

Personal data is retained only for as long as necessary for the stated purpose or as required by law. In accordance with the storage limitation principle (Art. 5(1)(e) GDPR):

• Contact & communications data: 3 years from the date of last contact.
• Analytics data: up to 14 months as configured in Google Analytics 4 (only collected with consent).
• Cookie consent records: retained persistently to avoid repeatedly asking for consent.
• Server/access logs: 90 days for security purposes.

6. Your Data Subject Rights (Articles 15–22 GDPR)

You have the following rights with respect to your personal data:

• Right of Access (Art. 15): You have the right to obtain confirmation of whether we process data concerning you, and to receive a copy of that data.
• Right to Rectification (Art. 16): You have the right to have inaccurate personal data corrected and incomplete data completed.
• Right to Erasure (Art. 17): You have the right to request the deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restriction of Processing (Art. 18): You have the right to request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability (Art. 20): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right Not to Be Subject to Automated Decision-Making (Art. 22): We do not carry out solely automated decision-making, including profiling, that produces legal or similarly significant effects.

7. How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to us by email. To allow us to process your request efficiently, please include:

• Your full name
• Email address associated with your enquiry
• The specific right(s) you wish to exercise
• Any additional information to help us identify your data (e.g. approximate date of contact)

8. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).

We encourage you to contact us first so we can resolve your concerns directly before escalating to a supervisory authority.