VeChain Foundation (hereinafter “VeChain”) renders this information regarding the processing of personal data provided voluntarily by you during events or competitions in the context of which VeChain is involved, in accordance with the European Regulation on the protection of personal data no. 679/2016 (“GDPR”) and any other applicable privacy law related to personal data collected by VeChain, collectively referred also to “Privacy Regulations.”
1. DATA CONTROLLER
VeChain determines what information is collected and how it is processed, and therefore is considered the data controller under Privacy Regulations.
2. PURPOSE AND LEGAL BASIS OF THE PROCESSING
VeChain processes your personal data for the following purposes:
a) Promotion and sale of products and services of VeChain, including the performance of market research (so-called direct marketing). The legal basis that legitimizes the consequent processing is your consent, which you are free to give or not and that you can, however, withdraw at any time writing to privacy@vechain.org. The provision of data necessary for these purposes is not mandatory and the refusal to provide them does not determine any negative consequences, except the inability to receive commercial communications.
b) Promotion of brand and public/sports events of VeChain by publishing (on official social media channels) photos and videos of the various events you may attend and during which you may be photographed/videorecorded. In this case, by participating in these events you know that you may be photographed or videorecorded: if you would prefer to not to be photographed or videorecorded, please inform our staff. The provision of your images is not mandatory and will remain your property, will only be used for increasing awareness about the impact of our work, and the refusal to provide them does not determine any negative consequences.
c) Need to perform a contract, to which you are a party or to perform pre-contractual and/or contractual activities at your request, including, for example, your request to establish a VeChain wallet or to enter the community: this includes all those activities of acquiring information prior to the conclusion of a contract and sending information and updates on it. The provision of such data is necessary for us to fulfill our obligations under the contract in connection with the provision of such services to you.
d) Need to monitor the perception of its products, campaigns through research carried out on information in the public domain: in the pursuit of this interest, VeChain may process some personal data referring to online users and users of social media, forums, blogs, other digital sites or digital media. The legal basis of the processing is the legitimate interest of VeChain to understand the public sentiment about its brand and to monitor the perception of its products, services or campaigns.
3. CATEGORIES OF PERSONAL DATA PROCESSED AND SOURCES OF SUCH DATA
VeChain processes personal data:
a) Contact data (e.g. first name, last name, mobile phone number, email, wallet address). This data is collected directly from you during events, subscriptions, etc.,
b) Photographs and Video. This data is collected directly from you taking pictures/videos during events; and
c) Connected Social Media and Public Information. We may collect and process available information present in social media content and various online sources, including forums, blogs and online sites, intentionally made public by you (among which there could be personal data referring to yourself). Such information may also include personal data such as personal details (e.g., name, surname, alias, e mail address, etc.), and such personal data are processed mainly in an aggregate manner for the purposes described above.
4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA
Your data may be processed:
• Affiliated Entities. We may share data with affiliated entities of VeChain as necessary for VeChain to operate its business, and for marketing and promotional activities.
• Processors. We may share data with natural persons and legal entities appointed data processors who assist VeChain with processing activities on VeChain’s behalf, such as the running of websites, data hosting, marketing, security, and IT services;
• Brand Partners. To independent controllers that may be engaging in joint marketing efforts, event sponsorship, or other event participation, based on your participation in such event, marketing campaign, or other sponsorship engagement.
• As part of a Business Transfer. We may disclose or share your information as part of a corporate business transaction, such as a merger or acquisition, joint venture, corporate reorganization, financing, or sale of company assets, or in the unlikely event of insolvency, bankruptcy, or receivership, in which such information could be transferred to third parties as a business asset in the transaction.
• For Legal Process And Protection. We may disclose or share your information to satisfy any law, regulation, legal process, governmental request, or where we have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to: (1) enforce or apply our agreements; (2) protect our interests, property, or safety of others; (3) in connection with claims, disputes, or litigation; and (4) to protect our brand and our brand partners.
• Consent. Where consent is relied upon, we may share your data with entities whom you have consented to receive such data.
5. TRANSFER OF DATA TO THIRD COUNTRIES
VeChain informs you that personal data may be transferred from countries not belonging to the European Union or to the European Economic Area (so-called Third Countries) to Europe and vice versa, recognized by the European Commission as having an adequate level of protection of personal data or, otherwise, only if an adequate level of protection of personal data compared to that of the European Union is contractually guaranteed by VeChain suppliers located in the Third Country (e.g., through the signing of standard contractual clauses provided by the European Commission) and that the exercise of the rights of the data subject is always ensured. Further information can be requested by writing to privacy@vechain.org.
6. RIGHTS OF THE DATA SUBJECTS
Privacy Regulations grant to you the right to:
• Access, rectify, or erase any personal information we process about you;
• Data portability – that is, asking us to transfer your personal information to any third party of your choice;
• Restrict or object to our processing of your personal information; and
• Where applicable, withdraw your consent at any time for any processing of your personal information.
To exercise your rights, please see the Methods of Exercising Rights in Art. 9 below.
7. PERIOD OF DATA STORAGE AND RIGHT TO ERASURE (i.e. RIGHT TO BE FORGOTTEN)
VeChain processes and keeps your personal data no longer than is necessary for the purposes for which they were collected and processed.
At the end of the applicable retention period, personal data relating to data subjects will be deleted or stored in a form that does not permit identification of the data subject (e.g., irreversible anonymization), and will be retained in a form that does not permit identification, unless their further processing is necessary for one or more of the following purposes: i) resolution of pre-litigation and/or litigation initiated before the expiry of the retention period; ii) to follow up investigations/inspections by internal control functions and/or external authorities initiated before the expiry of the retention period; iii) to follow up requests from local and/or foreign public authorities received/notified to VeChain before the expiry of the retention period.
8. METHODS OF EXERCISING RIGHTS
In order to exercise the rights set forth in paragraph 6, you may send your requires to: privacy@vechain.org.
The deadline for the reply is one (1) month, which may be extended by two (2) months in particularly complex cases; in these cases, the Controller will provide at least one interim communication within one (1) month. The exercise of the rights is, in principle, free of charge; the Controller reserves the right to charge a fee in the event of manifestly unfounded or excessive requests (including repetitive ones).
9. COMPLAINT OR REPORT TO THE PERSONAL DATA PROTECTION AUTHORITY
If you have a complaint about our use of your personal data or our response to your request(s) regarding your personal data, you may submit a complaint to the data protection supervisory authority in your jurisdiction. We would, however, appreciate the opportunity to address your concerns before you approach a data protection regulator and welcome you to first direct an inquiry to us.
Last Updated: November 2025