Privacy notice

Provatek is the controller of the personal data described here. You can reach us about anything in this notice at hello@provatek.io.

The house whose portal you use is a separate controller for what it does with your details in making and delivering your piece, and its own notice covers that.

The site sets no cookies and runs no analytics. If you send an enquiry we hold what you type: your name, your organisation if you give one, your email address, what the enquiry concerns and your message, together with a one-way hash of your connection address and your browser identifier, which we keep to limit abuse of the form and cannot turn back into an address.

We use an enquiry to reply to it and to keep a record of the conversation. The lawful basis is our legitimate interest in answering people who write to us. Enquiries are kept for twenty-four months from the last message and then deleted.

A portal holds the wallet addresses you have proven, an email address if you have given and verified one, the tokens you have redeemed and the record of each redemption, the choices you made about a piece, the delivery name, address and phone number you gave and any later address you signed for, the history of the order as the house worked it, and the date, network address and browser of actions on your account, kept as a record of what was done and by whom.

We hold this to check that you hold or redeemed the token a piece belongs to, to make and deliver the piece, and to tell you when it moves. The lawful basis is the performance of the contract you enter when you redeem. Afterwards we keep the record to answer where a piece was sent and by whose authority, and to defend and pursue legal claims, which is a legitimate interest the house and its collectors share, and we keep what accounting and tax law require us to keep, which is a legal obligation.

The record of a redemption is kept for as long as the piece exists, because that is what a record is for. A delivery address is kept for seven years after delivery. Sign-in codes sent by email are stored only as a hash and expire within minutes. Wallet signatures are verified and the signed message is kept as the proof of a claim. Account records are deleted two years after the account was last used, unless an order on it is still open or a record above must be kept.

A portal sets two cookies, both needed for it to work and neither used for anything else: one that holds your session after you sign in, and one that remembers which wallet is connected so the page does not ask again on every visit. Cookies that are strictly necessary for a service you have asked for do not need your consent, and we set no others. There are no analytics or advertising cookies on any Provatek site.

Our database is in London. The portals run on Vercel, whose servers for our deployments are in London, though its network edge that terminates connections is worldwide. Email is sent through Postmark, which processes it in the United States under the UK Extension to the EU-US Data Privacy Framework, so that transfer rests on an adequacy decision. To read what a wallet holds, we send the wallet address, and nothing else, to the blockchain data providers we query, and when a wallet connects from a phone its messages pass through the WalletConnect relay encrypted end to end, so the relay cannot read them. Where any of these providers is outside the United Kingdom, the transfer is covered by an adequacy decision or by the International Data Transfer Agreement, and each is bound to us by a data processing agreement.

The house whose portal you use sees the orders on it, because it makes the pieces. Provatek’s own staff see it to operate the portal, under access that is resolved on every request and recorded. Nothing is sold, shared for marketing, or given to a marketplace. We disclose data where the law requires it, for example to a court or a regulator.

A public blockchain holds what it always held: the token, the wallet that holds it, and on Ethereum the wallet that redeemed it. That is public and permanent by the nature of the chain, is not controlled by us, and cannot be erased by anyone. Provatek writes nothing to a chain that identifies you.

You may ask what we hold about you and receive a copy, ask for it to be corrected, ask for it to be deleted, ask us to restrict what we do with it, object to processing based on legitimate interest, and receive the data you gave us in a form you can take elsewhere. We answer within one month; if a request is complex we may take up to two months more and will tell you. Some records cannot be deleted while a piece is being made or a legal obligation runs, and if we refuse any request we will say why. We make no decisions about you by automated means. Write to hello@provatek.io.

If you think we have handled your data wrongly, you have the right to complain to us. Write to hello@provatek.io with the subject line “Data protection complaint”, or use the form on this site. We acknowledge a complaint within thirty days, look into it, and tell you the outcome and what we have done about it without undue delay. You may also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, at any time and whether or not you have complained to us first.

This notice will change as the service does. The date below is the date of the current text, and a material change will be announced on the portal before it takes effect.