Privacy Policy.

This privacy policy explains how we process personal data in connection with Arkiv, our universal data layer for Ethereum. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

We collect and process only the data necessary to provide our Services, improve user experience, and comply with legal obligations.

Golem Factory GmbH is the controller of the processing described in Section 04, which we carry out for our own purposes, in particular in connection with our website, the issuing of API keys, the operation of the public RPC endpoints and our communications with you.

Arkiv is infrastructure on which users, developers and decentralised applications (dApps) write, store and query data. Where you or a third-party application write data to Arkiv (for example, entity content and attributes), you or the operator of that application decide which data are written and for which purpose, and act as controller of that processing. If you use a third-party application built on Arkiv, please refer to that application's privacy policy.

Where the GDPR applies, we process personal data on the following legal bases (Article 6(1) GDPR). The legal basis for each processing activity is indicated in Section 04. Under the FADP, we process personal data in accordance with the principles of Article 6 FADP and, where required, on the basis of a justification under Article 31 FADP.

• Consent: only where we ask for it, for example for newsletters or non-essential cookies and analytics. We do not rely on consent for any processing on the blockchain
• Contract performance: To provide Arkiv Services you've requested
• Legal obligations: To comply with applicable laws and regulations, for example accounting and record-keeping obligations, and to respond to lawful requests from authorities
• Legitimate interests: For service improvement and security purposes, prevent abuse and fraud, understand and improve the Services reasonably in line with your expectations.

Data written to Arkiv are, by default, publicly visible and queryable by anyone and replicated across the nodes of the network. By acknowledging this privacy notice, you understand that our advice is to not write personal data in clear text to Arkiv, whether about yourself or other people, and in particular no sensitive personal data. If your application needs to reference personal data, you acknowledge that our recommendation is to keep that data off-chain and write to Arkiv only a salted or keyed hash, a cryptographic commitment or encrypted data.

Website Usage

When you visit our website, we automatically collect technical information including IP addresses, browser types, device information, and usage patterns to ensure website functionality and security. This data is stored for a maximum of 30 days and processed based on our legitimate interest in maintaining website security and functionality.

API Keys and Public RPC Endpoints

To create an API key, you provide your email and wallet address, which we use to issue and manage your key (contract performance). Providing this data is necessary to obtain an API key; without them we cannot issue one.

For each request to our public RPC endpoints, we store the IP address, request metadata, API key (if any), and arkiv_query content. We use this to secure the endpoints and to understand how Arkiv is used, based on our legitimate interest.

Queries can contain any data you or your application include in them, such as wallet addresses or other identifiers. We store this content as part of the request record. By acknowledging this privacy notice, you are advised to refrain from including in your queries any personal data beyond what is strictly necessary for the relevant purpose, in accordance with the principle of data minimisation.

Blockchain Address Processing

Data Categories: Wallet addresses, transaction hashes, block numbers, timestamps, gas fees, and smart contract interaction data.

Legal Basis: Contract performance (to provide Arkiv Services) and legitimate interest (network security and fraud prevention).

Classification: Blockchain addresses are pseudonymous identifiers. Where they relate to a natural person who can be identified by means reasonably likely to be used (for example, by combining them with off-chain information or following a data breach), they are personal data, and we treat them as such. The same applies to transaction hashes and other on-chain metadata linked to those addresses.

On-Chain Data

• Cryptographic hashes
• Transaction metadata
• Smart contract addresses
• Block timestamps
• Wallet addresses (public keys)
• Entity content and attributes written by users or applications

Retention: Data submitted to Arkiv may be removed from Arkiv's active state when deleted or upon expiration of the applicable “Expires In” period. However, the data itself, including entity content and attributes, will also be recorded on blockchain, where it will remain publicly accessible and cannot be deleted or modified, even if removed from Arkiv's active state.

Off-Chain Data

• Account preferences
• Communication data
• Support interactions
• Analytics data
• API key data (email address, wallet address)
• RPC request records (IP address, request metadata, API key, query content)

Retention: as set out in this privacy notice

Smart Contract Processing

Smart contracts deployed on Arkiv may automatically process data according to their programmed logic, without human intervention. Smart contracts deployed by third parties are the responsibility of those third parties, and we recommend that you review their code and documentation before interacting with them. We do not use smart contracts or other automated means to take decisions about you that produce legal effects concerning you or similarly significantly affect you. Should this change, we will inform you in advance and ensure your right to obtain human intervention, to express your point of view and to contest the decision.

Communication and Support

If you contact us or subscribe to updates, we process contact information and communication content to respond to inquiries and provide requested information (contract performance or our legitimate interest in responding to you; for newsletters, your consent, which you can withdraw at any time through the unsubscribe link). This data is retained for up to 3 years after our last interaction, unless a longer period is required by law.

Under applicable data protection laws, you have the following rights on the data that we hold. Please note that all the technical measures for reasonably ensuring these rights are in place; however, blockchain technology limitations may affect our ability to fulfill certain requests for on-chain data. Please note that data recorded on the blockchain is outside our control and cannot be removed; where your request concerns such data, we will explain what we can and cannot do:

Right to Access

You can request confirmation as to whether we process personal data concerning you and obtain a copy of those data together with the information required by law. For on-chain data that we can associate with you, this includes publicly visible transaction information.

Right to Rectification

We will correct or complete inaccurate personal data held in systems under our control, where required by applicable law.

Where inaccurate data has been submitted to Arkiv, a subsequent update may correct the information in Arkiv's active state. However, the original data will remain permanently recorded and publicly accessible on the underlying blockchain, even after a correction has been made.

Right to Erasure

Where you have submitted data to Arkiv, you may be able to delete it or shorten its “Expires In” period through the Arkiv SDK or API, removing it from Arkiv's active state.

However, where data has been recorded on the underlying blockchain, it remains permanently recorded and publicly accessible, including any personal data contained in it. Such data cannot be deleted from the blockchain, even if removed from Arkiv's active state.

Right to Restrict Processing

In the circumstances provided by applicable law, you may request that we restrict the processing of your personal data, for example while we verify its accuracy or assess an objection.

Where applicable, we will restrict the processing of personal data under our control, except where continued processing is permitted by law.

Where personal data has been recorded on the underlying blockchain, its distributed and immutable nature may limit our ability to restrict its continued availability or processing by independent network participants.

You acknowledge that restriction does not require us to remove data from our technical logs.

Right to Data Portability

Available for off-chain data in structured formats. Blockchain data is inherently portable through public blockchain explorers.

Right to Object

You can object to processing based on legitimate interests. Note that essential blockchain operations cannot be objected to as they're necessary for service provision.

Right to Withdraw Consent

You can withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out before the withdrawal. We do not rely on consent for any processing on the blockchain.

Rights Relating to Automated Decisions

You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

How to Exercise Your Rights

Contact us at privacy@golem.network with:

• Your specific request and preferred outcome
• Wallet address(es) or account identifiers (if applicable)
• Where we have reasonable doubts about your identity, proof of identity (to prevent unauthorized requests)
• Timeframe for response (we respond within 30 days). Where necessary, taking into account the complexity and number of requests, this period may be extended by up to two further months; in that case, we will inform you of the extension and the reasons for it. Exercising your rights is free of charge.

Right to Lodge a Complaint: You have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local data protection authority or, if you are in the EU/EEA, with the supervisory authority of the relevant Member State in accordance with GDPR.

Off-Chain Data Retention

• Website data: 30 days
• RPC IP addresses: 30 days
• RPC request records: 12 months
• API key data: While the key is active
• Support communications: 3 years
• Account preferences: Until account deletion
• Analytics data: 26 months (GDPR compliant)

On-Chain Data Retention

Data submitted to Arkiv may be deleted or expired from Arkiv's active state according to the applicable data lifecycle mechanisms, including the “Expires In” functionality.

However, where data is recorded on the underlying blockchain, the data itself, including entity content and attributes, remains permanently stored and publicly accessible, even after it has been deleted or has expired from Arkiv's active state. This applies to both user-submitted content and associated blockchain records, such as transaction metadata and wallet addresses.

Golem Factory GmbH cannot delete or modify information already recorded on the underlying blockchain.

We strongly recommend that users and developers avoid submitting personal data to Arkiv, particularly sensitive personal data, due to these permanent retention characteristics.

Blockchain Network Considerations

Blockchain networks are inherently global and decentralized. Data on Arkiv may be processed by network nodes worldwide, including outside the EEA. This is necessary for blockchain functionality and network security.

Safeguards for Data Transfers

• Standard Contractual Clauses (SCCs): For transfers in countries without an adequate level of data protection to third-party service providers. Such SCCs are recognised and adapted for Switzerland by the FDPIC.
• Adequacy Decisions: Transfers to countries recognised as providing an adequate level of data protection by the Swiss Federal Council or by the European Commission (e.g., EEA countries, the United Kingdom, and the United States for companies certified under the Swiss-U.S. or EU-U.S. Data Privacy Framework)
• Consent: your explicit consent for specific transfers, where no other safeguard is available and after you have been informed of the possible risks
• Derogations: where the transfer is necessary for the performance of a contract with you

Third-Party Service Providers

We share data with carefully selected service providers for:

• Infrastructure hosting and maintenance
• Analytics and performance monitoring
• Customer support and communication
• Security and fraud prevention

All providers are contractually required to provide adequate data protection.

We may update this privacy policy from time to time. Material changes will be communicated through our website or other appropriate means. The effective date of the current policy is displayed at the top of this document.