Privacy policy (TEST TEMPLATE)
⚠ TEST TEMPLATE — not legally reviewed. Built from the data inventory and the ADRs (0010, 0011, 0015, 0016, 0017, 0018, 0021). Pending the legal adviser’s review before production. Not legal advice.
This document covers every data item recorded for the Seldon Trevize platform in
docs/architecture/data-inventory.md §2 plus the cohort added in PR #60 (P11
issuer theme add-on, ADR-0020 §3; P9 provisioning jobs, ADR-0018). Each item lists the
controller (or processor / sub-processor chain), the legal basis under GDPR, the retention
period (a proposal where the deciders’ timing is still open), and the path to
exercise data- subject rights.
1. Controller / processor split (ADR-0011)
| Surface | Controller | Seldon Trevize’s role |
|---|---|---|
| The platform itself (directory, console, staff Access, audit log, Cloudflare provisioner, social-login broker session) | Seldon Trevize GmbH | controller |
| Each issuer’s backoffice (issuers, emissions, distributions, register, partners, payments) | The issuer | processor on the issuer’s behalf |
Each hosted investor page (invest-<issuer>.seldon-trevize.com)
|
The issuer | processor; sub-processor for the embedded wallet, social login, funding screen |
| Investors’ wallet addresses and on-chain transactions | none (public on-chain data) | n/a — see § 2 |
| Affiliate library (master data + consent records) | Seldon Trevize GmbH (ADR-0021 | controller of the library; the issuer is the controller of its own invite-only entries |
The platform’s processors and sub-processors are listed in the sub-processor register below (§ 6).
2. Wallet addresses and on-chain data
A wallet address is a pseudonym, not by itself personal data. Once the holder’s identity has been linked to the address (by the holder themselves — through social login, passkey binding, fiat on-ramp usage, or voluntary verification), the address becomes a data item we process under the GDPR.
On-chain state (transaction history, token balances, claimed distributions) is a public record and falls under the EU GDPR Article 17 (right to erasure) carve-out for public ledger data: the data subject cannot demand erasure of a public on-chain record. The remedy is to move the assets to a new wallet (we do not control the holder’s keys). When the holder closes their issuer-side profile, the off-chain records are deleted per the issuer’s retention schedule; the on-chain history stays.
3. SIWE sessions — app.session (ADR-0016)
A SIWE (EIP-4361) session begins when the holder signs a nonce-bound message with their wallet and ends when the holder disconnects or 24 hours pass. The server stores the wallet address, the issued role set, the expiry time, and a session record. The session cookie is first-party only — no third- party trackers and no analytics scripts in the session namespace.
| Item | Legal basis | Retention |
|---|---|---|
| Session record (wallet, role set, expiry, last seen) | contract performance (art. 6(1)(b)) | 24 hours after disconnect or expiry |
4. Passkey wallet and social login (ADR-0015)
The hosted investor page supports a passkey smart account (Safe core or ERC-4337) and an OAuth broker for social sign-in. The OAuth broker is Better Auth, MIT; alternatives on file are Keycloak and Ory (heavier deployments). Identity providers we ship with the broker are Google, Apple, X, GitHub, e-mail link. Telegram is intentionally excluded (third-party script).
The provider (Google, Apple, etc.) is a separate controller of its own data; ST receives only the OAuth subject identifier and the e-mail address needed to bind the passkey. We do not store access tokens or refresh tokens of any provider — by design (ADR-0015 §2).
| Item | Legal basis | Retention |
|---|---|---|
provider (Google / Apple / …) |
consent (art. 6(1)(a)) at sign-in | lifetime of the wallet + audit window |
subject id (the provider’s stable id) |
consent (art. 6(1)(a)) | lifetime of the wallet + audit window |
e-mail (returns by the provider, stored for binding the passkey to the
wallet)
|
consent (art. 6(1)(a)) | lifetime of the wallet + audit window |
Adding GitHub as a sign-in identity provider is under discussion; not yet shipped.
5. Funding providers (stx-fund referral flow, ADR-0015)
The funding screen is a referral only: Seldon Trevize names the licensed provider, hands over the investor’s wallet address and chain, and shows status until USDC arrives. We do not process the fiat side of the transaction. Each funding provider (Banxa, Kraken business account, locally licensed Kosovo exchange office per L94) is a separate controller of the investor’s payment data; Seldon Trevize receives only the referral-session id and the resulting USDC confirmation. The provider is the contracting party of the investor; the issuer is the merchant of record only for the referral (L90).
6. Hosting, access and platform infrastructure
| Service | Role | Jurisdiction and (sub-)processor status |
|---|---|---|
| Cloudflare (DNS, Access, TLS, proxy) | processor of every ST surface | EU/UK/US data centres; SCCs in place; sub-processor list: see Cloudflare’s published sub-processor page (URL TBD pending confirmation) |
| Cloudflare hosting for issuer sites | TBD |
the platform’s hosting decision per
docs/infrastructure/hosting-decisions.md is TBD
|
| Worker / indexer servers (the platform’s own servers) | processor for the issuer’s read data | jurisdiction and provider TBD; DPA TBD |
| Transactional mailer (consent confirmation, password reset, alerts) | TBD | provider is the canonical choice — Postmark or Amazon SES — TBD; EU/UK/US routing |
| GitHub backup of repositories | controller | US storage; SCCs; the platform repository lives at Seldon-Trevize/stx-docs |
For each sub-processor we have, or will have, a Data Processing Agreement covering: data subject category, processor purpose, engagement limits, breach notification within 24 hours, sub-processor disclosure, audit rights, deletion on termination.
7. Voluntary verification and profit-share receipts (ADR-0010)
Voluntary holder verification is opt-in. The KYC provider (name Postmark or SES — TBD; the platform’s preferred provider list is under ADR-0010 review) holds the documents and exposes a reference id and a status to ST. We do not store the KYC documents ourselves. Articles signed by the holder (EIP-191/712 and ERC-1271 for smart accounts) are stored on the chain; the associated receipt is computed from chain + profile + tax data.
| Item | Legal basis | Retention |
|---|---|---|
verification reference id (provider, holder, status) |
consent (art. 6(1)(a)) | lifetime of the wallet + tax-relevant audit window |
| Receipts (chain + profile + tax data) | legal obligation (art. 6(1)(c) — tax retention) | audit window per applicable tax statute |
8. Notices and alerts
| Item | Legal basis | Retention |
|---|---|---|
| Recipient e-mail or Telegram for platform alerts (pause, migration, sweep, classification, refund) | consent (art. 6(1)(a)) | active subscription; stopped-on-unsubscribe |
| Recipient e-mail for the first-level support SLA (B11 / Q47) | contract (art. 6(1)(b)) | active subscription; stopped-on-unsubscribe |
9. Affiliate programme (ADR-0021)
The platform-wide library (ADR-0021 holds master records for affiliates who
consented to be visible beyond their inviting issuer (visibility levels, consent timestamp,
consent method). Records introduced by an issuer for the issuer’s own staff are private to
the issuer. Per-tranche terms (code, payout, fee, discount, all within the 10 % pool) live
on-chain through setPartner. The contract pays the partner fee directly to the
partner’s payout address; Seldon Trevize’s take from the contract is the Agio, never a
partner-management fee.
Affiliate sign-up via an issuer site. Where an affiliate signs up directly through an issuer’s site, the issuer records the affiliate’s name, e-mail and any free-text note. The lawfulness is pre-contract (art. 6(1)(b) GDPR). The record is deleted when the issuer’s affiliate relationship ends.
| Item | Legal basis | Retention |
|---|---|---|
| Master record (visibility, consent time, method, marketing assets) | consent (art. 6(1)(a)) for library entries; contract (art. 6(1)(b)) for staff-entered entries | lifetime of the affiliate + audit window |
| Affiliate sign-up via the issuer site (name / e-mail / note) | contract (art. 6(1)(b) — pre-contractual measure) | while the affiliate relationship with the issuer exists |
| Per-tranche terms (on-chain) | n/a — public on-chain | n/a |
10. Cloudflare provisioner P9 (ADR-0018, post-launch)
The Cloudflare provisioner runs signed console jobs that set up DNS records, the staff
Access group for the issuer origin, the Access app, and a wildcard TLS certificate. Jobs
carry the staff member’s wallet address (controller) and may carry a staff e-mail address in
target/parameters. The staff e-mail is processed on the basis of
the employment / service contract (art. 6(1)(b)) — see PR #60, the data-inventory P9 row.
11. Custodian (ADR-0015 §2; L86, L95, FD)
The Tangany custodian option is an issuer-side choice. Storing IS additive — the platform only ever accesses custodian APIs on the issuer’s instructions. Tangany GmbH’s CASP authorisation is the basis; Tangany’s KWG custody permission (2021) applies. The custody contract and the platform integration fee are TBD; this section closes once L95 is settled (FD).
12. Recovery helper (ADR-0015 §5)
Seldon Trevize operates the recovery helper (guardian) for passkey smart accounts. A recovery request requires the user’s identity check (provider re-authentication) plus a 24-hour hold; during that hold we may flag the request for human approval if the indicators warrant it. After the hold, the on-chain waiting period begins — 7 days by default, at least 48 hours — during which the issuer’s admin wallet can cancel the recovery if the request looks suspicious. The user receives notices at each step.
Recovery helper records (pending recoveries / delays / approvals; ADR-0015) are pseudonymised — wallet addresses and timestamps only. ST holds no holder-side keys and cannot sign for the holder unilaterally; the holder owns both passkeys.
13. Theme preference cookie stx-theme (P13b)
A first-party cookie set on .seldon-trevize.com is the only preference cookie
we set:
| Item | Legal basis | Retention |
|---|---|---|
stx-theme (one of light / dark) |
strictly functional cookie; ePrivacy Art. 5(3) exemption (no consent gate) |
Max-Age=31536000 (365 days); Path=/; Secure;
SameSite=Lax; no HttpOnly required (read by client JS to
apply the theme before paint)
|
No tracking cookies, no analytics, no third-party cookies.
14. WalletConnect (ADR-0015 Amendment 1; SP-4)
WalletConnect 2 (sign-client 2.26.x) is a session-only integration. The
WalletConnect relay
reads via the chain’s configured public RPC, not through the connected wallet and not
through /stx-api/rpc
(ADR-0015 Amendment 1). WalletConnect gates the connect-src allowlist.
Production is off by default until the legal review clears; the integration
is used on staging only (board b21 / SP-4). WalletConnect 2.26 itself is
proprietary-licensed (Reown); packages/elements does not vendor the Reown
AppKit wrapper.
15. Logs, audit and retention
| Log | Pseudonymisation | Retention |
|---|---|---|
| Per-issuer audit log (actor wallet, role, mandate, action, payload hash, timestamp) | wallet address only | proposed 90 days hot / 365 days cold (audit window) |
| EIP-712 step-up audit (request method + canonical request target) | wallet address + payload hash | proposed 90 days |
| Sign-in / sign-out events | wallet address + role set | proposed 30 days |
| Relay-objection events | wallet address + relay id | proposed 90 days hot / 365 days cold |
| Anti-fraud / abuse flags | wallet address + flag taxonomy | proposed 365 days |
16. Third-country transfers
Where data leaves the European Economic Area, the platform relies on:
- Adequacy decisions by the European Commission, where they apply (United Kingdom, Switzerland, others).
- Standard Contractual Clauses (EU Commission Decision 2021/914) plus a transfer impact assessment for any other recipient country. Currently the recipients outside the EEA are: the United States (Cloudflare, GitHub backup, mailer candidate) and the United Kingdom (Cloudflare data centres, KYC provider candidate).
A list of sub-processors (name, purpose, jurisdiction, data centre
locations, DPA) is published at [sub-processor-register URL TBD] and updated
within thirty days of any change.
17. Data-subject rights (art. 15–22 GDPR)
The data subject can exercise:
- Access — see what we hold (§ 15).
- Rectification — correct what we hold (§ 16).
- Erasure — where it does not collide with the public-ledger carve-out (§ 17); the remedy is usually move the assets, not erase the row.
- Restriction of processing while a dispute is settled (§ 18).
- Portability of the structured records we hold (§ 20).
- Objection to processing on legitimate-interest grounds (§ 21); we don’t run on legitimate interest; we run on consent and contract. Where we run on legitimate interest (none today), the data subject has the right to object.
How to exercise: write to privacy@seldon-trevize.com (or to
[Datenschutzbeauftragter TBD]). We answer within one month; if the request is
complex, we may extend by up to two months under Article 12(3) GDPR and notify the data
subject.
18. Supervisory authority
The lead supervisory authority for Seldon Trevize GmbH under art. 56 GDPR
is the data protection authority of the state where the controller’s seat sits. Heidelberg
is in Baden-Württemberg; the
Landesbeauftragte für den Datenschutz und die Informationsfreiheit
Baden-Württemberg
([genauer Dienstsitz TBD]) supervises Seldon Trevize GmbH.
TBD pending confirmation. Each issuer, as controller of its own backoffice,
is supervised by its own lead authority.
19. Cookies used
| Cookie | First-party | Purpose | Lifespan | Lawfulness |
|---|---|---|---|---|
app.session (a session-cookie pseudonym) |
yes | SIWE session continuity | session | contract (art. 6(1)(b)) |
stx-theme |
yes | remembers theme choice | 365 days | strictly functional (ePrivacy Art. 5(3)) |
We do not set: - advertising cookies, - analytics cookies, - third-party tracking cookies, - cross-site cookies.
WalletConnect’s session-id is a session cookie; it expires when the wallet disconnects or 24 hours pass.
20. Out of scope
- The issuing-side privacy policy (the issuer is the controller for the issuer’s own backoffice and its own hosted investor page). The issuer publishes its own privacy policy per the rules of its own supervisory authority.
- The umbrella-emission payment leg (the issuer pays the umbrella its profit share by SEPA in EUR; that payment is the issuer’s banking contract, not the platform’s).
- The proxy partner payout (the partner fee is paid on-chain by the contract to the partner’s payout address; we don’t process that side).
21. Test template notice
This is a TEST TEMPLATE. It is not legal advice. Placeholders in
[square brackets] must be replaced by the legal adviser before production.
Wording marked proposal reflects a platform default that the legal adviser should
review against the final service agreement (B9/Q48).
Sources
-
docs/architecture/data-inventory.md§2 (per-item controller and retention columns) docs/architecture/adr/0010-voluntary-verification-data-minimisation.mddocs/architecture/adr/0011-issuer-and-platform-ownership.md-
docs/architecture/adr/0015-wallet-layer-embedded-wallet-and-funding.md(with Amendment 1; SP-4) docs/architecture/adr/0016-session-transport-and-tenancy.mddocs/architecture/adr/0017-element-styling-api.mddocs/architecture/adr/0018-cloudflare-provisioner.mddocs/architecture/adr/0021-affiliate-management.mddocs/legal/legal-checklist.mdSections K + Ldocs/business-model.md§3.1–§3.3- Article 5–22 GDPR; § 26 BDSG; § 25 / § 25a TDDDG; § 36 VSBG; Articles 5(3) ePrivacy Directive (cookies)
Translated from the German edition privacy.de.md. Only the
German edition is the legally binding version; the English edition is
provided as a courtesy.