Privacy Policy

Last updated: [DD Month YYYY]

Template for review. Have a lawyer check this text against your actual data processing before release.

1. Who we are

[Legal entity name], registration no. [number], registered at [address] ("we", "us"), is the controller of the personal data described in this policy. You can contact us at [privacy@company.eu].

Data Protection Officer (if appointed): [name, email].

2. What data we collect

Contact data: name, email address, phone number.
Case data: the type of incident, your description of what happened, transaction hashes, wallet addresses and correspondence you choose to share.
Contract and billing data: details needed to prepare a contract and invoice.
Technical data: IP address, browser type and pages visited, collected through server logs [and analytics tools, if used].

Please do not send us passwords, seed phrases or private keys. We will never ask for them.

3. Why we use your data and on what legal basis

To answer your request and assess your case — steps prior to entering a contract (Art. 6(1)(b) GDPR).
To carry out the investigation and deliver the report — performance of a contract (Art. 6(1)(b) GDPR).
To keep accounting records — legal obligation (Art. 6(1)(c) GDPR).
To protect the security of our website and prevent abuse — legitimate interest (Art. 6(1)(f) GDPR).
To send news or marketing, only if you opt in — consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

4. Who we share data with

We do not sell personal data. We share it only where necessary with:

service providers that host our website, email and CRM [list providers], under data processing agreements;
law enforcement, lawyers or exchanges — only with your instruction or where required by law;
our accountants and auditors.

5. Transfers outside the EEA

If a provider processes data outside the European Economic Area, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses. [Specify if applicable]

6. How long we keep data

Requests that do not lead to a contract: [12 months].
Case files and reports: [N years] after the case is closed.
Accounting records: as long as required by [country] law.

7. Your rights

You have the right to access, correct, delete or restrict the processing of your data, to object to processing, to data portability, and to withdraw consent. To exercise these rights, write to [privacy@company.eu]. We respond within one month.

You can also lodge a complaint with your local data protection authority, or with [name of supervisory authority in your country].

8. Cookies

Our website uses only cookies that are strictly necessary for it to work. [If you add analytics or marketing cookies, describe them here and add a consent banner.]

9. Security

We protect data with encryption in transit, access controls and limited staff access. No system is completely secure, but we notify affected people and the authority of a data breach where the law requires it.

10. Changes to this policy

We may update this policy. The date at the top shows the latest version. Significant changes will be announced on the website.