At a glance
- What we collect
- Identity and contact details, verification documents, wallet address and on-chain activity, payment and membership data, support messages, and technical data such as IP address and device information.
- Why
- To conclude and perform your membership contract, to meet legal obligations including anti-money-laundering and sanctions rules, to keep the service secure, and — only with your consent — for analytics and marketing.
- Who else sees it
- Verification, payment, hosting and support providers under contract; partners where needed to deliver a benefit you asked for; authorities where the law requires. We do not sell your data.
- The blockchain exception
- Wallet addresses and transactions are public and permanent. We cannot correct or delete them — for anyone. Consider using a dedicated wallet.
- Your rights
- Access, correction, deletion, restriction, portability, objection, and withdrawal of consent at any time. Write to help@naturo.space.
1Who is responsible
The controller for the processing described here is:
NĀTURO Reconnect LLC (in formation)
CEO: Volker Kapfer
Data protection and general enquiries: help@naturo.space
Where a different NĀTURO group entity is your contracting party for a particular service, that entity is the controller for the processing carried out for that service.
2What this Policy covers
This Policy applies to our website, the Dashboard, the Marketplace, member communications, the Founder Sale and connected services. It does not cover independent third parties — wallet providers, blockchain networks, marketplaces, payment providers, hotels, resorts and partners — which process data under their own policies.
3What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity data | Name, date of birth, nationality, country of residence | You; our verification provider |
| Contact data | Email address, postal address, telephone number | You |
| Verification data | Copy of official ID, liveness/selfie result, proof of address, verification status, sanctions and PEP screening results | You; verification provider |
| Blockchain data | Wallet address, transaction hashes, token holdings, on-chain activity | You; the public blockchain |
| Transaction data | Order details, amounts, currency, payment method and status, invoices, refunds | You; payment provider |
| Membership data | Level, member ID, entitlements, benefit usage, bookings | You; our systems; operators |
| Communication data | Support tickets, emails, chat messages, community and governance submissions | You |
| Technical data | IP address, device and browser data, operating system, language, timestamps, referrer, log data, cookie identifiers | Automatically |
| Usage data | Pages viewed, features used, session duration | Automatically; analytics only with your consent |
| Compliance data | Risk scores, screening results, audit logs, records of decisions | Our systems; screening providers |
Identity, contact, verification and payment data are necessary to conclude and perform the contract and to meet our legal obligations. Without them we cannot enter into or continue the contract. Everything else is optional.
We do not intentionally collect special categories of personal data. Where an identity document reveals such data incidentally, we process it only as necessary for verification and legal compliance, under Article 9(2)(g) GDPR or your explicit consent where required. The Services are not directed at persons under 18 and we do not knowingly collect their data; if you believe a minor has given us data, write to help@naturo.space and we will delete it.
4Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Concluding and performing the membership contract; providing the Dashboard, benefits, bookings and support | Contract — Art. 6(1)(b) GDPR |
| Identity verification, anti-money-laundering, sanctions and PEP screening, record keeping, regulatory reporting | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
| Fraud prevention, security monitoring, abuse detection, enforcing our terms | Legitimate interests — Art. 6(1)(f) |
| Eligibility and geographic screening (exclusion of U.S. Persons and restricted jurisdictions) | Legal obligation and legitimate interests — Art. 6(1)(c) and (f) |
| Service emails, contractual notices, changes to terms | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Newsletters, marketing and community updates | Consent — Art. 6(1)(a), withdrawable at any time |
| Optional analytics and marketing cookies | Consent — Art. 6(1)(a) |
| Establishing, exercising or defending legal claims; accounting and tax retention | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
| Corporate transactions, reorganisation, financing due diligence | Legitimate interests — Art. 6(1)(f) |
If you object to processing based on legitimate interests, we will assess your objection and stop unless we have compelling grounds that override your interests, or the processing is needed for legal claims.
5Who we share it with
We share personal data only where necessary, and only with recipients bound by confidentiality and — where they act as processors — by a data processing agreement:
- identity verification and sanctions screening providers;
- payment service providers and, where used, digital-asset payment processors;
- cloud hosting, storage, database, content-delivery and email providers;
- customer support and ticketing tools;
- analytics providers, where you have consented;
- blockchain infrastructure and node providers;
- hotels, resorts, venues, event organisers and partners, where needed to deliver a benefit you have requested;
- professional advisers — lawyers, auditors, accountants, tax advisers;
- insurers, and counterparties and their advisers in a corporate transaction;
- courts, regulators, tax authorities and law enforcement, where the law requires.
We do not sell personal data and we do not share it for cross-context behavioural advertising. A current list of our processors, including their locations and transfer mechanisms, is available on request from help@naturo.space.
6International transfers
We use service providers in a number of countries, including countries outside the EEA, the UK and Switzerland. Where personal data of individuals in the EEA, the UK or Switzerland is transferred outside those areas, we rely on an appropriate transfer mechanism — in particular the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), an adequacy decision where one applies, or another mechanism the law permits — together with supplementary technical and organisational measures where required.
You can request a copy of the relevant mechanism from help@naturo.space. Please note that data on a public blockchain is inherently accessible worldwide and that no transfer mechanism can restrict that access — see section 7.
7Blockchain data: public, permanent, not erasable
Wallet addresses, transaction hashes, amounts, timestamps and token holdings are recorded on a public blockchain. That record is replicated across independent nodes worldwide, is readable by anyone, and cannot be altered, restricted or deleted — not by us, and not by anyone else.
If your wallet address can be linked to you — through an exchange, a public profile, a domain name or your own disclosure — your transaction history may become identifiable. If that matters to you, consider using a wallet dedicated to this purpose.
As a result, the rights to rectification, erasure and restriction cannot be given effect for on-chain data. We will give effect to those rights in our own off-chain systems. We do not operate any blockchain and are not the controller of the distributed ledger itself.
Where a credential has to be invalidated, we do that by updating our off-chain records and, where technically available, the token metadata or an on-chain status flag — not by deleting the historic record, which is impossible.
8How long we keep it
| Data | Retention |
|---|---|
| Contract, order and invoice data | For the duration of the contract, then for the applicable statutory accounting, tax and limitation periods |
| Verification and anti-money-laundering records | Five years after the end of the relationship, or longer where the law requires |
| Support and communication data | Duration of the relationship plus a reasonable period for follow-up and claims |
| Marketing consent records | Until withdrawal, plus a period to evidence the consent |
| Server and security logs | 90 days, longer where needed for a security investigation |
| Cookie data | As stated in section 12 |
| On-chain data | Permanent, and outside our control |
When a period expires we delete the data or irreversibly anonymise it, unless continued retention is required for a pending legal claim or by law.
9Your rights
Where the GDPR or an equivalent regime applies to you, you have the right to:
- obtain confirmation of processing and access to your data (Art. 15);
- have inaccurate data corrected (Art. 16);
- have data erased where a ground applies (Art. 17);
- restrict processing in defined circumstances (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interests, and to object at any time to direct marketing (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3));
- lodge a complaint with your supervisory authority (Art. 77).
Write to help@naturo.space to exercise a right. We respond within one month, extendable by two further months for complex requests — we will tell you if we need the extension. We may need to verify your identity first, and we may have to decline a request where the law permits, for example where complying would breach a retention duty under anti-money-laundering law or affect the rights of others.
If you are in the United States
Where a U.S. state privacy law applies to you, you may have the right to know what personal information we collect, to access, correct and delete it, to obtain a portable copy, to opt out of sale or of sharing for targeted advertising and of certain profiling, and not to be treated differently for exercising those rights. You may use an authorised agent. We do not sell personal information and do not share it for cross-context behavioural advertising. Requests and appeals go to help@naturo.space.
10Automated decisions
We use automated screening for sanctions, fraud and geographic eligibility. Where a screening result would lead to refusal or termination, a person reviews the case before a final decision, unless the law requires immediate action. We do not profile for advertising purposes.
11Security
We apply appropriate technical and organisational measures: encryption in transit and, where appropriate, at rest; access control on a need-to-know basis; multi-factor authentication for administrative access; network segregation; logging and monitoring; secure development practices; vendor assessment; and confidentiality obligations for staff and contractors.
No system is completely secure and we do not warrant absolute security. Where a personal data breach occurs that is likely to result in a risk to your rights, we notify the competent authority and, where required, the individuals affected, within the applicable deadlines.
12Cookies and similar technologies
Cookies are small text files stored on your device by your browser. We also use comparable technologies such as local storage, session storage, pixels, tags and SDKs. A first-party item is set by our site, a third-party item by an embedded provider; a session item is deleted when you close the browser, a persistent one remains for a defined period.
| Category | What it does | Consent |
|---|---|---|
| Strictly necessary | Session and login state, wallet-connection state, security and fraud prevention, load balancing, storing your cookie choices | Not required — the site cannot function without these |
| Functional | Remembers language, currency, region, interface settings and dismissed notices | Set only with your consent where consent is required |
| Analytics | Measures how the site is used, in aggregate, so we can improve it | Only with your consent |
| Marketing | Measures campaign performance and, where used, limits advertising frequency | Only with your consent |
The exact items currently in use — names, providers, purposes and durations — are listed in the detail view of our consent banner, which is generated from the live configuration. Your cookie choices are stored for 12 months.
Managing your choices. Use the consent banner, or the “Cookie settings” link in the site footer, to change your choices at any time. You can also block or delete cookies in your browser settings — blocking strictly necessary cookies will stop parts of the site from working. Where your browser transmits a Global Privacy Control or comparable signal, we honour it as an opt-out where the law requires.
Third-party providers process data under their own privacy notices and may act as independent controllers for their own purposes. Their use may involve transfers outside your country — see section 6. Cookies are stored only as long as needed for their purpose, or until you delete them or withdraw consent.
13Changes and complaints
We update this Policy when our services, our providers or the law change. The current version and its effective date are shown on this page; we notify material changes by email or via the Dashboard, and ask for your consent where a change requires it.
If something is wrong, please contact help@naturo.space first so we can try to put it right. You always keep the right to complain to the supervisory authority in your country of residence, place of work, or the place of the alleged infringement.