Privacy notice and GDPR statement
What we collect, why, on which legal basis, who else sees it, how long we keep it, and how you use your rights. Written under the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR / RGPD).
Draft prepared with the website: it describes how the site actually works. Have it reviewed before relying on it, in particular the two points marked “to confirm”.
1. Who is responsible
Swiss NFT Association, an association (Verein) under Art. 60 ff. of the Swiss Civil Code, Zürich, Switzerland — info@swissnftassociation.ch. We are the controller of the data described here. We have not appointed a data protection officer; write to the address above for anything about your data.
EU representative (GDPR Art. 27): to confirm — required if the association regularly offers its membership to people in the EU.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account: name, email, password (kept only as a one-way scrypt hash), when you confirmed your email and last signed in | Your account and signing in | Contract (1)(b) |
| Two-step verification: your method, the authenticator secret, hashes of your recovery codes | Protecting your account | Contract (1)(b); security, legitimate interest (1)(f) |
| Google sign-in, if you use it: your Google account identifier, name and verified email | Signing you in with Google | Contract (1)(b), at your request |
| Wallet: the address of the Engage wallet created for your account | Holding your membership NFT | Contract (1)(b) |
| Profile: organisation, role, location, about, links — all optional | Your profile; shown to other signed-in members only if you switch it on | Contract (1)(b); visibility: consent (1)(a), withdrawable at any time |
| Membership: plan, payment status and dates; for companies the company name and website | Running your membership, issuing your NFT | Contract (1)(b); accounting, legal obligation (1)(c) |
| Referral: the name or email of the member who brought you, if you give it | The referral discount | Contract (1)(b) |
| Contributor intake: name, email, profile, expertise, contribution size, resources, attribution choice | Planning the research programme | Consent (1)(a) |
| Newsletter: your email | Sending the newsletter | Consent (1)(a) |
| Server logs: IP address, time and page of requests | Delivering the site, preventing abuse (rate limits) | Legitimate interest (1)(f) |
| Consent record: when you accepted this notice, and which version | Being able to show your consent | Legal obligation (1)(c) |
We do not use analytics, tracking pixels, advertising, profiling or automated decisions that affect you.
3. Who else processes data
- Engage (engagewallet.ch, OnchainLabs, Switzerland) creates and operates your wallet. It receives your email, which approves the wallet: Engage sends the codes that confirm your email, reset your password, provide two-step verification by email and approve any signature. It mints your membership NFT. It never receives your password.
- Stripe processes membership payments. Your card details go to Stripe directly, never to us; Stripe tells us whether a payment succeeded.
- Google, only if you choose “Continue with Google”, confirms your identity to us.
- Google Fonts serves the typefaces of this website: your browser connects to Google's servers when it loads a page.
- Our hosting provider runs the site and its database on our behalf (location: to confirm).
We do not sell or rent personal data.
4. Transfers abroad
We are based in Switzerland, which the European Commission recognises as offering an adequate level of protection. Stripe and Google may process data in the United States; they rely on the EU–U.S. and Swiss–U.S. Data Privacy Frameworks and on standard contractual clauses.
5. The public blockchain
Your membership NFT is recorded on Polygon, a public blockchain. Your wallet address and the NFT are visible to anyone and, by the nature of a blockchain, cannot be changed or deleted afterwards — not even by us. They are not linked to your name on chain. If you delete your account, we delete the wallet on Engage and everything that links the address to you on our side.
6. How long we keep it
- Account, profile, two-step verification and wallet link: while you have an account; deleted when you delete it.
- Payment records (plan, amounts, dates): ten years, as Swiss accounting law requires — without your name once your account is deleted.
- Newsletter: until you unsubscribe or delete your account. Contributor intake: while you contribute, or until you ask us to delete it.
- Server logs: kept by our hosting provider for a short period for security, then deleted.
7. Your rights
You have the right to access your data (GDPR Art. 15), to have it corrected (16) or deleted (17), to restrict its processing (18), to receive it in a portable format (20), to object to processing based on legitimate interest (21), and to withdraw a consent at any time, without affecting what happened before (7(3)). Under the FADP you have equivalent rights.
- Download your data and delete your account yourself in Profile and settings → Privacy and data.
- Correct your details and switch your profile's visibility in Profile and settings → Profile.
- For anything else, write to info@swissnftassociation.ch. We answer within 30 days.
You may complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the authority of the country where you live or work.
8. Cookies
We set only cookies the site needs, so no consent banner is required:
- sna_session — keeps you signed in (30 days, or until you sign out).
- sna_signed_in — switches the menu to “My account” (30 days, or until you sign out).
- sna_oauth — protects a Google sign-in while it is in progress (10 minutes).
9. Security
All traffic to the site uses HTTPS. Passwords are stored only as scrypt hashes; two-step verification is available to every member; sessions are signed; sign-in attempts are limited. Wallet keys are never held by us: Engage splits each key between two independent parties (MPC), and every signature needs a code sent to your email.
10. Changes
This is version 2026-10-23. When we change this notice we update its version; your account records which version you accepted, and your settings page tells you if it has changed since.