Privacy Policy

1. Our principles and the purpose of this Privacy Policy

The company SentX is committed to respecting the privacy of the Users and the secrecy and security of personal data, in accordance with the provisions of the applicable regulations.

Your privacy and the security of your data are our priority. It is part of our DNA and is reflected in the principles that govern our Privacy Policy.

Transparency

We are 100% transparent with you about the data we collect and/or process about you and explain why we use it and for what purposes. We will not treat your data in an unexpected, obscure or abusive way.

Control

You are the only one who can control how your data is used. We provide you with the tools so that you can decide at any time how you want us to treat your data, up to when and how you can access and update your personal information.

Security

We care about ensuring the security, secrecy and confidentiality of your data and personal information. We have carried out the proper analysis and risk assessments according to the best standards of security and privacy, in order to adopt the most demanding and robust security measures on your data to prevent its loss, alteration, misuse or unauthorized access.

These principles are set out in detail in the following sections that make up our Privacy Policy, which we encourage you to read carefully. In it we inform you about everything necessary for you to maintain control over your data as a user of the NFT MarketPlace of SentX (hereinafter, the "MarketPlace"), either in the condition of buyer user or in the condition of creator user, or when you interact with us in any way in connection with the MarketPlace (hereinafter, the "User" or the "Users").

Please note that the MarketPlace is an online brokerage platform whose use allows to view, explore, create, edit, publish, unpublish, buy and sell NFT under the operation of the Blockchain technology and network, in accordance with the General Terms and Conditions set forth in the Marketplace (hereinafter, the "General Terms and Conditions"). The Blockchain ecosystem itself implies a decentralization of all the operators involved, such as "miners", "nodes", "Wallet" providers and other Blockchain service providers, which may be actors in the chain or flow of information that travels through Blockchain, generating data, issuing it, receiving it or treating it in any other way, so that each of them can fulfill the specific function that allows the ecosystem to work properly. This poses a great challenge to the privacy of the Users participating and interacting in Blockchain since, although in general it brings numerous advantages to the privacy of the Users (being able to participate in a pseudonymous or anonymous way in an environment with high levels of security), however, due to its intrinsic technical characteristics, the decentralization of the ecosystem prevents a single actor from having full control over Users' data, which could lead to a loss of the control that Users have over their data, as it flows in a complex ecosystem automatically among a large number of actors in the chain.

In the General Conditions you can find all the details about the functioning of the MarketPlace and the use of Blockchain technology within it.

As we have said, through this Privacy Policy, what we intend is to inform you of who we are and how we will treat your data when we act as a MarketPlace brokerage service provider and as part of that Blockchain ecosystem, but we also want you to be aware of all of the above and, especially, that, as we have informed you, there are third parties that may also intervene in the Blockchain ecosystem and process your data, therefore having their own privacy policies, depending on the different roles they hold (data controllers, data processors, etc.), and although we encourage you to read them carefully, we warn that they are alien and independent from us and we cannot assume any responsibility for what is established in them, nor for the actual treatment and handling of your data by these third parties.

2. Who is the data controller?

The data controller responsible for the processing of your personal data is:

• SENTX LABS, SL (operating commercially as "SentX")
• VAT / CIF: B16403198
• Registered office: C/ Ortega y Gasset 9, 6th & 7th floor, 30009 Murcia, Spain
• Registered with the Registro Mercantil de Murcia (sheet MU-113640, inscription 1, IRUS 1000422115959)
• Privacy contact: [email protected]

For any questions, requests or complaints regarding the content of this Privacy Policy and our treatment of your data, you can contact us by writing to [email protected]. SentX has not appointed a Data Protection Officer (DPO) as it is not required to do so under Article 37 of Regulation (EU) 2016/679 (GDPR); the privacy contact above is the designated point for all data-protection enquiries.

Children

The Service is intended exclusively for users aged 18 or over. SentX does not knowingly collect personal data from children. If we become aware that we have collected personal data from a person under the age of 18, we will delete that data without undue delay.

3. What data is processed, for what purpose and why do we process the data?

Data we process about you

As a User of the MarketPlace, we process different data about you and for different purposes on appropriate legal bases, either because these purposes are necessary based on the execution of the General Conditions of the MarketPlace, accepted by the User at the time of registration, and which constitute a legal relationship between the User and us, and in respect of which this Privacy Policy is an integral part, either because we pursue legitimate interests duly weighed so that they do not affect your rights and freedoms, and in accordance with these, or because certain legal obligations apply to us that require us to process data about you as a result of your use of the MarketPlace. In any other case, we will request your consent to the processing of your data for a specific purpose duly informed.

The data we process about you is as follows:

• Basic, identifying, contact and/or professional data: name and surname, User name, image and/or avatar chosen, email, telephone, and any other basic or identifying information, completed in the User profile.
• MarketPlace access credentials and identifiers assigned to the User.
• Statistical data of use and interactions of the User with the MarketPlace.
• Data relating to the device and/or connection with which the MarketPlace is accessed: IP address, geolocation, and other connection metadata, as well as information that we may have obtained through the use of cookies and similar technologies (SDKs, pixels, tags, beacons, etc.).
• Data of the transactions and operations carried out in the MarketPlace between Users, as well as billing data to User Creators.
• Metadata relating to NFTs and Smart Contracts, as well as those data that are entered by the Originator User when creating an NFT or collection, including any personal data embedded in the underlying asset of the NFT.
• Public Blockchain address(es) and Wallet that is used by the User to participate in the MarketPlace.
• Data published in Blockchain associated with such public addresses, only for some specific fraud investigation purposes.
• Data related to queries, support, complaints and/or suggestions.
• Data provided in surveys and User tests that we may conduct, in particular, information related to satisfaction with the MarketPlace.
• Data relating to NFT reports made by Users.

Part of this data may be visualized in the MarketPlace by the rest of the users, to the extent necessary to access the different functionalities of the MarketPlace, or to allow the Users to interact with each other and to close the transactions of the NFT, provided that this is strictly necessary for this purpose and in full compliance with the general principles of processing contained in the applicable regulations.

Origin and origin of your data

In general, we obtain this data either directly from you, when you complete the registration form in the MarketPlace, complete the User profile, make a query, complaint or suggestion, or contact us by any means and provide us with the data that are required or are voluntary, or we can generate or capture them automatically during registration, during the process of creating a User or during the use of the MarketPlace itself in response to the operational functioning and/or functionalities existing at any given time.

In this case, all the information you provide as a User must be truthful and accurate. For these purposes, the User guarantees the authenticity of all the data provided as a consequence of the completion of the corresponding forms. The User shall be the only responsible for the false or inaccurate statements made, and for the damages caused to SentX, or to third parties, due to the information provided.

In case of provision of false data or data that do not correspond to the account holder, SentX reserves the right to cancel the User's account and/or to adopt the measures it deems appropriate for the best defense of its interests and rights, or those of affected third parties that may be concerned as a result of the foregoing.

SentX reserves the right to verify the information provided by the User by any means that may be appropriate for the purposes of control and/or verification that may correspond, according to the state of the art at any given time and what is most appropriate for the protection of the interests and rights of the parties involved.

In other cases, we may also obtain data from third parties with whom, as a User, you have a relationship, and those third parties have reached agreements with SentX so that you can become a User, so they provide us with your basic and strictly necessary data so that you can or we can register you and access the MarketPlace (for example, creator companies that sign an agreement with SentX to be part of the MarketPlace and designate a contact person who will be a creator User in the MarketPlace).

If the User provides personal data of third parties through the functionalities that, if any, are available in the MarketPlace, the User shall be obliged to inform them of such treatment as detailed in this Privacy Policy and that their data will be provided to SentX for this purpose, responding exclusively and fully in case of any breach in this regard, being exempt SentX from any liability in this area.

On the other hand, SentX may obtain information associated with the public address of the User's Wallet that is published in Blockchain, for the purposes of prevention and/or investigation of fraudulent or illicit activities in the MarketPlace.

Likewise, due to the operation of Blockchain itself, we may obtain data or metadata related to the NFT, Smart Contracts or your Wallet, by other parties or entities involved in such ecosystem, in order to ensure that transactions can be carried out correctly as requested by Users.

Purposes we pursue and reasons we have for processing your data

The purposes for which we treat your data as a User are the following:

• Provision of the service and all available functionalities, operation, administration, support and maintenance of the MarketPlace: based on the execution of the General Conditions of the MarketPlace, we will process your data for the purpose of providing the service to you as a User of the MarketPlace, allowing you to enjoy all the functionalities available at all times, operate and maintain it so that the MarketPlace works correctly and securely, or, where appropriate, withdraw or block your access to the service, which includes allowing us to check the requirements demanded of the User, your compliance with the General Conditions of the MarketPlace, proceed or facilitate the registration of the User and, where appropriate, the updating of your data, your access and use of the MarketPlace at any time, among other similar purposes in execution and compliance with all the points incorporated in the General Conditions of the MarketPlace, all while maintaining the condition of User and not requesting cancellation.
• Conducting surveys, User tests and other research activities: based on our legitimate interest to maintain and improve the quality of the service and the User experience, we may contact you to collect information regarding your satisfaction or opinion in relation to the MarketPlace, the service provided and its functionalities, as long as you have not objected to such legitimate interest.
• Maintenance of the activity and security of the MarketPlace, avoidance of information security breaches and possible breaches: based on our legitimate interest, as owner and responsible for the MarketPlace, in ensuring the availability and security of the MarketPlace for all Users, and in accordance with the General Conditions of the MarketPlace, the legal notices and other relevant notices of use, as well as with the provisions of our Cookies Policy and the cybersecurity regulations applicable to SentX (Royal Decree Law 12/2018, Royal Decree-Law 7/2022 on 5G security, etc.), we will process your data in order to maintain active and manage the security of the MarketPlace, protect it against security incidents and malicious attacks that it may suffer and, in general, enable free and continuous access to the MarketPlace in a secure manner by all Users.
• Internal management and response to claims, demands, complaints and litigation related to the MarketPlace: based on our legitimate interest associated with the right to effective judicial protection that protects us, we may process your data to manage, respond and intervene as an interested party or similar in administrative or judicial proceedings, when they, in any way, are related to you or refer to you in the corresponding condition. This purpose also applies to the processing of data through the functionality "report NFT" that, if applicable, is used by the User, so that SentX can investigate the claims or reports sent through this channel for the best defense of the rights and interests concerned, as well as, if necessary, take the actions it deems appropriate in light of the provisions of the General Conditions of the MarketPlace for this purpose and in the applicable regulations.
• Management of billing, accounting and taxation of the MarketPlace: based on compliance with the legal obligations imposed on us in terms of billing and accounting, we are obliged to process your data for the proper management of billing, accounting and taxation, which includes collecting or declaring your data in the invoices, in the accounting books that we keep or in the statements that for tax purposes may be required by the applicable regulations in this area.
• Retention of data on transactions, identification of Users and other procedures derived from the regulations on prevention of money laundering and financing of terrorism: we have a legitimate interest in acting with due diligence and proactivity in compliance with the aforementioned regulations, so we will treat your data for the purpose of being able to identify you properly and keep them together with the history of the transactions made, always with the aim of, if necessary, to make this information available to the competent authorities that may require it.
• Prevention and investigation of fraud and/or illicit activities: based on the legitimate interest we have to prevent and investigate fraud within the MarketPlace, SentX may process personal data of the Users in order to set up automatic alerts that indicate a potential fraud and/or illicit activity for the purpose of being further investigated by SentX. During such investigation process, and if strictly necessary, SentX may also combine such data with other data published in Blockchain, allowing us to perform a better investigation and evaluation of the specific case, in order to make decisions regarding the establishment and implementation of those control measures and mitigation of the risks detected at any given time.
• Compliance with applicable regulations and response to requests and official requests made by the authorities: in general, as any actor providing information society services and responsible for data processing, various legal obligations apply to us, including obligations in terms of consumer affairs, data protection and security, services and digital markets, as well as in terms of mandatory collaboration with the competent authorities, including law enforcement agencies. Based on the foregoing, we may need to process your data in order to comply with such obligations, for example, to respond to data protection rights exercises that we receive, or to respond to legitimate requests or requests notified to us that require, for example, that we provide some information about you.
• Attention and response to contracting requests, doubts, queries, suggestions and any other type of contact received: based on our legitimate interest in managing and providing an effective response to the request or other type of contact made by a User of the MarketPlace, as well as to the extent necessary for the execution of pre-contractual measures at the request of the User aimed at the acceptance of the General Conditions of the MarketPlace or the signing with SentX of an agreement to participate in the MarketPlace, we may process the data of the person who contacts us to provide an effective response based on the contact made, to respond to the suggestion to correct or improve the MarketPlace service in the sense raised or, where appropriate, to inform about the commercial conditions of the MarketPlace and to enter into a contractual relationship for that purpose.
• Statistical analysis of the MarketPlace: based on our legitimate interest to measure the quality of service of the MarketPlace, as well as to know how it is used by the Users, we may perform appropriate statistical analysis with MarketPlace usage data in order to: (1) measure the quality of service and, in case of degradation, take the necessary measures to prevent and/or remedy such degradation; and (2) make better business decisions regarding the future evolution of the MarketPlace, as well as improvements or evolutionary corrections that, if necessary, must be made to offer an adequate experience.
• Sharing of publicly available network data in our analytics tools: Based on our legitimate interest to enhance the functionality and user experience of the MarketPlace, we may process and share publicly available network data in our analytics tools. This includes data related to wallets and NFTs held, the worth of these NFTs, and network and market activity, in order to provide insights and improve our services.

4. How long is the data retained?

In general, we will retain your data for the time necessary to fulfill each purpose described in each processing activity and to determine any liability that may arise from such purpose and/or processing.

Once the indicated retention periods are exceeded, we will proceed to block your personal data during the period of limitation of legal actions and, after that period, we will proceed to its definitive deletion according to the applicable regulations, and/or to its anonymization in a secure way by SentX.

In the event that we proceed to the deletion of your data as provided in this Privacy Policy, please note that such process will take place on the databases and storage systems controlled by SentX. However, due to the very nature of the Blockchain network explained, certain data related to the transactions carried out in such network and that, in no case will be able to identify you directly, will remain permanently registered in its nodes and, on which, SentX does not have the capacity to proceed to its deletion.

5. Who is the recipient of the data and are there any international data transfers?

Third parties that may access, receive and process your data

To provide the Service and perform the processing purposes described above, SentX engages authorized third-party processors acting on behalf of and under the documented instructions of SentX, contractually bound by GDPR Article 28 data-processing agreements. The principal categories of processors and the entities currently engaged are:

• Cloud hosting and data storage: Google Cloud Platform (Google Ireland Ltd. / Google LLC) — Cloud SQL, Cloud Run / GKE, Cloud Memorystore (Redis), Cloud Tasks, Cloud Logging.
• Object and asset storage: Microsoft Azure (Microsoft Ireland Operations Ltd. / Microsoft Corporation) — Blob Storage; Filebase Inc. — IPFS pinning.
• Authentication: Magic Labs, Inc. (Magic.link) — email-based wallet authentication.
• Transactional email: Twilio SendGrid, Inc. — delivery of account, notification and security emails.
• Error monitoring: Functional Software, Inc. d/b/a Sentry — error tracking, performance monitoring, and session replay.
• Product analytics: Google Tag Manager / Google Analytics (Google Ireland Ltd. / Google LLC); Microsoft Clarity (Microsoft Corporation) — heatmaps, behavioural metrics, session replay.
• Customer support: Help Scout PBC — support widget and ticketing.
• Fraud, geolocation and abuse prevention: Focsec OÜ — IP-based geolocation, VPN/proxy/Tor/datacenter detection, ASN lookup; Blockpass IDN Limited — KYC where required.
• Public profile resolution: HashPack (Wallet HQ Pty Ltd) — public Hedera profile lookup (no personal data sent beyond the public account ID).

Each processor is engaged only to the extent strictly necessary for the provision of the contracted services and for the period of time strictly necessary for that purpose. The current list may evolve; the up-to-date list is published in our Cookie Policy and can be requested at any time at [email protected].

Automated decision-making and fraud-prevention profiling

SentX operates automated rules to flag suspected fraud, money-laundering, abuse, and breach of these terms (for example, anomalous trading patterns, sanctioned wallet addresses, or VPN/Tor connections from prohibited locations). These rules may produce automated decisions such as concealing a Collection or NFT, restricting account features, or temporarily suspending Service access. Such decisions are not based exclusively on automated processing within the meaning of Article 22 GDPR: in every case where a decision materially affects you, a human reviewer at SentX validates the decision before it is enforced. You retain the right under Article 22(3) GDPR to obtain human intervention, express your point of view, and contest any such decision by writing to [email protected].

On the other hand, we inform you that, to the extent that your use of the MarketPlace will enable your participation in Blockchain and the intermediation with other MarketPlace Users with whom you close NFT transactions, your data may be shared both with the other actors that, necessarily, intervene in the Blockchain chain and that have a relevant role in the transactions carried out to create the NFTs, and transfer them (mainly, the different nodes that intervene in the Blockchain network, and that validate and make copies of the record in which each transaction is recorded in such chain or the different operators of the Wallet), as well as with the Users with whom you interact and close transactions directly, with our intermediation, as we explain in detail in the General Conditions of the MarketPlace.

For clarity: (1) through the following link you will be able to access information from the nodes of the Blockchain network of Hedera Hashgraph (although SentX is not responsible for the veracity or updating of such content as it is a third party unrelated to SentX); and (2) the Wallet operator used in the MarketPlace and with which information could be shared, as used by the User, is indicated in the General Terms and Conditions.

It is necessary to clarify that your personal data incorporated in the transactions that have to take place in the Blockchain network to offer the functionalities of the MarketPlace, will be communicated to the nodes of the Blockchain network for the sole purpose of providing such functionalities. However, once such transactions have been registered in the network, they will remain there immutably and will be publicly accessible by third parties, without SentX being responsible for the processing that, if any, is subsequently carried out by the node itself or such third parties.

In addition, in the event that there is an obligation or legal requirement that so provides, we may communicate your data to the competent public administrations in accordance with such obligation or legal requirement and, where appropriate, also to other bodies such as State Security Forces and Corps and judicial bodies.

International transfers of your data

Some of the processors listed above are located in, or replicate data to, the United States or other third countries outside the European Economic Area. In particular: Sentry (US-hosted ingest endpoint), Microsoft Clarity (US), HelpScout (US), Filebase (US), Magic.link (US), SendGrid / Twilio (US). Google Cloud Platform and Microsoft Azure may replicate operational data across global regions, but SentX configures primary storage in the EU/EEA where available.

For transfers to the United States, SentX relies on the EU-U.S. Data Privacy Framework adequacy decision adopted by the European Commission on 10 July 2023 (where the recipient is self-certified) and, additionally or alternatively, on the European Commission's Standard Contractual Clauses (SCCs) of 4 June 2021 supplemented by Transfer Impact Assessments and appropriate technical measures (encryption in transit and at rest, pseudonymization, access restrictions). For transfers to other third countries, SentX relies on the relevant adequacy decision, SCCs, or another lawful Article 46 GDPR transfer mechanism.

A copy of the safeguards applied to a specific international transfer can be requested at [email protected].

In any case, we are at your disposal in the mail of exercise of rights informed in section 6 of this Policy, and through which you can obtain more information about the guarantees and measures applied and provided in the applicable regulations.

6. What rights do you have as a data subject?

Your rights

As a User, the data protection regulations grant you some rights over your data that, as applicable, you may exercise against SentX. Below, we detail what they are and how you can exercise them.

Right to withdraw the consent given

It is your right to withdraw the consent given for the processing of your data for the purposes that are legitimized on that basis, at any time and in an easy way.

Right of access

It is your right to ask us for details of the data we hold about you and how we process it, and to obtain a copy of it.

Right of rectification

It is your right to obtain the rectification of your inaccurate or erroneous data, as well as to complete incomplete data.

Right to suppression

It is your right to request deletion or suppression of your data and information in certain circumstances. However, please note that there are certain occasions when we are legally entitled to continue to retain and process your data, for example, to comply with a legal obligation to retain data.

Right of limitation

This is your right to restrict or limit the processing of your information in certain circumstances. For example, if you apply for deletion of data, but, instead of deleting it, you would prefer that we block it and process it only for record-keeping purposes because you will need it later to file a complaint. Again, please note that there may be times when we are legally entitled to refuse your request for restriction.

Right of opposition

It is your right to object to the processing of your data for a specific purpose, in certain circumstances provided for by law and related to your personal situation.

Right to portability

It is your right to ask us to receive your personal data in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another data controller, provided that we process your data by automated means.

Right not to be subject to automated individual decisions

It is your right to ask us not to subject you, in certain circumstances, to a decision based solely on automated processing of your data, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Means of exercising them and response deadlines

In general, you may exercise these rights at any time and free of charge by contacting SentX at [email protected]. Likewise, in general, mechanisms for the automated cancellation of communications and other options for the withdrawal of consent and opposition will be made available to the User.

For this purpose, it is important to take into account that, when you exercise a right, in some cases you must clearly specify which one you are exercising and provide a copy of a document proving your identity. It is also necessary to indicate that some of the data processing is carried out by SentX in a way that does not require the direct identification of the Users, without SentX being obliged to obtain and/or process additional information to verify said User for the purpose of allowing him/her to exercise his/her data protection rights.

In the event that a User exercises a data protection right and, due to the reasons indicated, SentX is not in a position to identify him/her in order to attend to the request, it will inform him/her to that effect if possible. Such request shall be suspended until the User provides additional information that allows identifying him/her.

Any exercise of rights will be answered within a maximum period of one month, and this period may be extended by two months if we need it in a reasoned manner, taking into account the complexity of the request and the number of requests.

Right to lodge a complaint with a supervisory authority

If you consider that the processing of your personal data by SentX infringes data-protection law, you have the right under Article 77 of the GDPR to lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The competent authority for SentX in Spain is the Spanish Data Protection Agency (AEPD):

            Agencia Española de Protección de Datos (AEPD)

            C/ Jorge Juan, 6, 28001 Madrid, Spain www.aepd.es

We encourage you to contact us first at [email protected] so we can try to address your concern directly. This is without prejudice to your right to lodge a complaint with a supervisory authority at any time.

7. Anonymization

SentX may anonymize the personal data that are lawfully collected and processed for the purposes of the processing indicated in this Privacy Policy, applying both technical and organizational measures required by law to prevent both direct and indirect re-identification risks.

8. Further Processing of Data and Changes to the Privacy Policy

SentX reserves the right to update this Privacy Policy at any time. Such update will be made public by SentX, in any case, with the legally required notice prior to its entry into force.

In addition, it will be communicated directly to the User in the event that it affects his rights or freedoms or when, for example, the inclusion of a new processing activity would require the User's consent or modifies the scope of the legitimate interest that enables the processing.

9. Microsoft Clarity Integration

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement (https://privacy.microsoft.com/en-us/privacystatement)