Privacy Policy

1. Who we are

This website, nchain.com (the “Site”), is operated by nChain AG, a private limited company registered in Switzerland under company number CHE-423.067.388. nChain AG is part of the nChain group of companies. nChain AG is the controller of the personal data described in this policy (“we”, “us”, “our”).

• Registered address: [TO CONFIRM: registered office address of nChain AG]
• Contact for privacy questions and requests: [email protected]
• Data Protection Officer: [TO CONFIRM: whether a DPO is appointed, and their contact details]
• Representative in the EU / UK (GDPR Art. 27 / UK GDPR Art. 27): [TO CONFIRM: name and address of the EU and UK representatives, if appointed]

We process personal data in line with the Swiss Federal Act on Data Protection (FADP). Where it applies, we also follow the EU General Data Protection Regulation (GDPR) and the UK GDPR together with the UK Data Protection Act 2018.

2. What we collect, why, and on what legal basis

2.1 Contact form

• Data: the name, e-mail address and message you enter. We also record that you ticked the consent box and the date and time of submission.
• Purpose: to read and respond to your enquiry.
• Legal basis: our legitimate interest in answering enquiries sent to us (GDPR Art. 6(1)(f)). The form also asks you to confirm that you have read this policy and agree to be contacted (Art. 6(1)(a)). You can withdraw that agreement at any time by e-mailing [email protected]. Withdrawal does not affect anything we did before you withdrew.
• How it is handled: when you submit the form, the website server checks it and immediately sends it as a single e-mail to [email protected]. The e-mail is sent through our e-mail delivery provider Mailgun (Mailgun Technologies, Inc., a Sinch company), using its EU region. Your e-mail address is set as the reply-to address so that we can answer you.
• The website server does not store submissions. No database is used and nothing is written to disk. The server logs only technical status codes, never your name, e-mail address or message.
• Retention: the e-mail is kept in our mailbox for as long as needed to deal with your enquiry and any follow-up, and is then deleted in line with our internal retention policy ([TO CONFIRM: mailbox retention period]). Mailgun keeps delivery logs and message metadata for a limited period under its own retention settings ([TO CONFIRM: Mailgun log/message retention configured for mg.nchain.com]).
• Giving us this information is voluntary, but we cannot reply without a valid e-mail address.

2.2 Spam protection (captcha)

The contact form is protected by ALTCHA, an open-source proof-of-work check that runs on our own server and in your browser. When you use the form, your browser solves a small computational puzzle, and our server checks the result. ALTCHA sets no cookies and does not fingerprint or track you. No third party is involved, and no data leaves our server for this purpose. A hidden “honeypot” field and per-IP rate limits are used for the same purpose. The legal basis is our legitimate interest in keeping the form free of spam and abuse (Art. 6(1)(f)).

2.3 Hosting, security and server logs

• Hosting: the Site is hosted on a server operated by DigitalOcean, LLC in its London (United Kingdom) data centre.
• Content delivery and security: all traffic to the Site passes through Cloudflare, Inc. Cloudflare acts as a content delivery network and protects the Site against attacks. To do this it processes your IP address, request details and security-related signals. Cloudflare may set a strictly necessary security cookie (see our Cookie Notice).
• Server logs: our web server records your IP address (as passed on by Cloudflare), the date and time, the page or file requested (without query strings or form content), the response status, the response size and your browser’s user-agent string. Logs are rotated daily and deleted after 14 days.
• Purpose and legal basis: to deliver the Site, keep it secure and investigate misuse. This is our legitimate interest (Art. 6(1)(f)).

2.4 Analytics and marketing cookies (only with your consent)

If you click Accept in our cookie banner, we load Google Tag Manager. Through it we use the following services:

• Google Analytics 4 (property G-SYDYH4996G): visitor statistics.
• Google Ads (AW-10932831505): measuring and remarketing our advertising.
• LinkedIn Insight Tag: campaign measurement and audience insights on LinkedIn.
• Microsoft Clarity: usage analytics, including heatmaps and session recordings of how pages are used.

These services process online identifiers, your IP address, device and browser information, and the pages you visit and how you interact with them. The legal basis is your consent (Art. 6(1)(a) GDPR, and PECR / Art. 5(3) ePrivacy Directive for the cookies themselves).

None of these tags are loaded unless you accept. You can withdraw your consent at any time using “Cookie settings” at the bottom of every page. Details of each provider, the cookies they use and how long they last are in our Cookie Notice.

2.5 E-mail correspondence

If you e-mail us directly, we use your message and contact details to reply. The legal basis is our legitimate interest, or taking steps at your request before entering into a contract (Art. 6(1)(b)). We keep this correspondence in line with the mailbox retention period above.

3. Who we share data with

We do not sell your personal data. We share it only with the following service providers, who act as processors on our behalf (or, for the advertising platforms, sometimes as independent or joint controllers), and only as far as needed:

We may also share data with other nChain group companies where they help us respond to your enquiry. We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.

4. International transfers

nChain AG is based in Switzerland. Several of our providers are based in, or may access data from, the United States and other countries. Where personal data is transferred outside Switzerland, the UK or the EEA, we rely on one of the following safeguards:

• an adequacy decision, such as the EU–US Data Privacy Framework, the UK Extension to it and the Swiss–US Data Privacy Framework, where the recipient is certified;
• the European Commission’s Standard Contractual Clauses (SCCs), including the Swiss amendments; or
• the UK International Data Transfer Agreement or the UK Addendum to the SCCs.

Transfers between Switzerland, the UK and the EEA rely on mutual adequacy decisions. You can ask us for more information on these safeguards at [email protected].

5. How long we keep data

• Contact-form submissions: not stored on the web server. In our mailbox, see section 2.1 ([TO CONFIRM period]).
• Web server logs: 14 days.
• Your cookie choice (nc_consent): 6 months.
• Analytics and marketing cookies: see the Cookie Notice. Google Analytics data is kept for the retention period configured in our GA4 property ([TO CONFIRM: GA4 data retention setting]).

6. Your rights

Depending on where you live, you have some or all of the following rights:

• Access: to get a copy of the personal data we hold about you.
• Rectification: to have inaccurate data corrected.
• Erasure: to have your data deleted in certain circumstances.
• Restriction: to ask us to limit how we use your data.
• Portability: to receive data you gave us in a machine-readable format, where processing is based on consent or a contract and is automated.
• Objection: to object at any time to processing based on our legitimate interests, and in all cases to direct marketing.
• Withdraw consent: at any time, without affecting processing done before you withdrew. For cookies, use “Cookie settings” at the bottom of any page.

To exercise any of these rights, e-mail [email protected]. We will reply within one month, and may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.

7. Complaints

We would appreciate the chance to resolve your concern first. You also have the right to complain to a data protection supervisory authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.
• United Kingdom: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113, ico.org.uk/make-a-complaint.
• EU/EEA: the data protection authority in the member state where you live or work, or where the alleged infringement took place. A list is available from the European Data Protection Board.

8. Security

The Site is served only over HTTPS. Form data is sent to us over encrypted connections. The server is hardened, access to it is restricted, and it keeps no copy of form submissions. No method of transmission over the internet is completely secure, but we take appropriate technical and organisational measures to protect your data.

9. Children

The Site is not directed at children, and we do not knowingly collect personal data from anyone under 16.

10. Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it was last updated shown at the top.