1Who is the controller
- Controller
- ValkunCoin (dados da entidade a publicar)
- Registration
- a publicar
- Address
- Portugal
- contato@valkuncoin.com
- Data Protection Officer
- Encarregado de Proteção de Dados — privacidade@valkuncoin.com
For data subjects in Brazil, the DPO above also acts as the contact channel with the ANPD (LGPD art. 41).
2What data we process
| Category | Examples | Source |
|---|---|---|
| Account | Email, password (stored only as a hash by the auth provider), language, country of residence, age confirmation | You |
| Wallets | Linked public Solana addresses and the proof-of-ownership signature | You |
| Rewards | Pseudonymous remittance ID, corridor, VLKC amount, status and on-chain transaction hash | Licensed partner / blockchain |
| Consents | Cookie and marketing choices, policy version, date and pseudonymised IP | You / system |
| Updates list | Name, email, mobile number with country code (optional), language, marketing preference | You |
| Privacy requests | Email, request type, message | You |
| Technical & security | Pseudonymised IP (salted hash), user agent, authentication and sensitive-action logs | System |
We do not process civil identity data (ID documents, selfies), bank details or special categories of data. Identity verification (KYC) is carried out by the licensed partner, an independent controller of that data.
3Purposes and legal bases
| Purpose | GDPR | LGPD |
|---|---|---|
| Account, authentication and 2FA | Contract (6(1)(b)) | Contract (art. 7, V) |
| Link wallets and pay cashback | Contract (6(1)(b)) | Contract (art. 7, V) |
| Keep records of cashback paid | Legal obligation — accounting/tax (6(1)(c)) | Legal obligation (art. 7, II) |
| Block sanctioned jurisdictions, prevent fraud | Legal obligation & legitimate interest (6(1)(c),(f)) | Legal obligation & legitimate interest (art. 7, II, IX) |
| Security, access logs, abuse prevention | Legitimate interest (6(1)(f)) | Legitimate interest (art. 7, IX) |
| Waitlist | Consent (6(1)(a)) | Consent (art. 7, I) |
| News emails | Consent (6(1)(a)) | Consent (art. 7, I) |
| Analytics and marketing cookies | Consent (6(1)(a), ePrivacy) | Consent (art. 7, I) |
| Handle data-subject requests, demonstrate compliance | Legal obligation (6(1)(c)) | Legal obligation & exercise of rights (art. 7, II, VI) |
We do not carry out automated decision-making or profiling with legal or similarly significant effects.
5International transfers
Some providers are based outside the EEA or Brazil. We rely on adequacy decisions (including the EU-US Data Privacy Framework where applicable), European Commission standard contractual clauses and, for Brazilian data subjects, ANPD standard clauses (LGPD art. 33). We choose EU hosting regions whenever available.
6Retention
| Data | Period |
|---|---|
| Account, wallets, preferences | While the account exists; deleted when you delete it |
| Records of cashback paid | 10 years (accounting/tax), anonymised after account deletion |
| Unconfirmed waitlist | 30 days |
| Confirmed waitlist | Until consent is withdrawn or 24 months without launch |
| Proof of consent | Consent duration + 3 years |
| Security and audit logs | 12 months |
| Wallet signature challenges | 10 minutes (auto-deleted) |
| Privacy requests | 3 years after reply |
7On-chain data
Wallet addresses and Solana transactions are public, permanent and replicated by thousands of independent nodes. We cannot alter or delete them. When you delete your account we remove the link between your email and your wallets in our systems, but on-chain transactions remain visible.
8Your rights
- Access and confirmation of processing
- Rectification
- Erasure
- Portability (JSON)
- Objection to processing based on legitimate interest
- Restriction of processing
- Withdraw consent at any time
- Information about who we share data with
- Lodge a complaint with the CNPD (Portugal — www.cnpd.pt) or the ANPD (Brazil — www.gov.br/anpd)
Most rights can be exercised directly in your account's Privacy Centre (export, delete, consents). For the rest, use the privacy-rights form or write to privacidade@valkuncoin.com. We reply within 1 month (GDPR), extendable as allowed by law, and within 15 days for the full statement under LGPD art. 19. We may ask you to verify your identity.
9Security
- Encrypted transport (HTTPS/TLS, HSTS) and encryption at rest by the database provider.
- Row Level Security: each user can only access their own rows.
- Passwords never stored in plain text; two-factor authentication available.
- Salted-hash IP pseudonymisation; data minimisation by default.
- Rate limiting, security headers and Content Security Policy.
- Incident response plan: notification to the CNPD within 72 hours and to the ANPD within 3 business days where applicable, and to data subjects where there is high risk.
10Minors
The service is for people aged 18 or over only. If we learn we collected a minor's data, we delete it.
11Changes
We may update this policy. Material changes are announced by email or on the site with reasonable notice.