Privacy Policy

1.Who we are

This Privacy Policy explains how Disruptive Labs Ltd (“we”, “us”, “our”) collects, uses and protects your personal data when you use the Treasure Chess® platform, website, mobile application and related services (the “Services”).

We are the data controller for the personal data described in this policy. Our details are:

If you have any questions about this policy or how we handle your personal data, please contact us at hello@onchainchess.io.

2.The personal data we collect

We collect and use the following categories of personal data:

• Account data — your username, email address and the public wallet address you connect.
• Profile and preference data — settings, language and other preferences you choose.
• Gameplay and usage data — game history, results, rankings, leaderboard standings and how you interact with the Services.
• Transaction data — records of tournament entry fees, prizes, and NFT and token transactions associated with your Account or wallet address. Blockchain transactions are publicly recorded on the relevant network.
• Communications data — messages, feedback and support requests you send us, and our replies.
• Technical and device data — IP address, device and browser type, and similar information collected automatically when you use the Services.
• Cookie and analytics data — information collected through cookies and similar technologies (see section 9).
• Identity verification (KYC) data — where verification is required, your name, date of birth, address, identity document details and verification outcome. Verification checks are performed by specialist verification providers on our behalf and, for fiat-to-crypto transactions, by regulated on/off-ramp providers acting as independent controllers.

We do not intentionally collect special category data (such as data about health, race or beliefs), and we ask that you do not send it to us. We do not knowingly collect data from children (see section 10).

3.How and why we use your data, and our lawful bases

Under the UK GDPR we must have a lawful basis for using your personal data. The table below sets out what we use your data for and the lawful basis we rely on in each case.

Marketing and consent. Where we rely on consent (for example, to send marketing or to set non-essential cookies), you can withdraw it at any time — by using the unsubscribe link in our emails, adjusting your cookie settings, or contacting us. Withdrawing consent does not affect processing carried out before you withdrew it.

Legitimate interests. Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and you can object at any time (see section 7).

4.Blockchain data

Some processing is recorded on a public blockchain. You should understand that:

• transactions linked to your wallet address — such as game outcomes, tournament records and NFT activity — are recorded on the relevant blockchain and are public, permanent and outside our control;
• blockchain records generally cannot be changed or deleted, which means some of your rights (such as erasure) may not be capable of being applied to on-chain data; and
• a wallet address is treated as personal data where it can be linked to you, but the blockchain record itself is maintained by a decentralised network, not by us.

Where you ask us to delete your data, we will delete or anonymise the data we hold in our own systems, but we cannot alter data already written to a public blockchain.

5.Who we share your data with

We do not sell or rent your personal data. We share it only as set out below:

• Service providers (processors) who help us run the Services — for example hosting, analytics, customer support and security providers. They may only use your data on our instructions and under a written contract.
• Payment and blockchain infrastructure needed to process transactions you initiate.
• Professional advisers such as our lawyers, accountants and auditors, where necessary.
• Authorities and regulators where we are required to share data by law, or to establish, exercise or defend legal claims.
• A buyer or successor if we sell, transfer or reorganise our business, subject to appropriate protections.

The specific providers we currently use include:

• Supabase — database hosting and user authentication;
• Microsoft — cloud hosting and infrastructure;
• Polygon — the blockchain network used to record on-chain transactions;
• Payment processors — regulated providers that process fiat payments for entry fees and subscriptions, identified to you at checkout;
• Sequence (Horizon) — wallet-as-a-service infrastructure that provisions and secures player wallets;
• Regulated fiat-to-crypto on/off-ramp providers — we will name these on our website before on/off-ramp features go live. When you buy or sell cryptoassets through a ramp provider, it collects and processes your data (including KYC data) directly as an independent data controller under its own privacy policy, which we encourage you to read; and
• Identity verification providers — specialist KYC services that verify identity documents on our behalf.

We will keep this list current as our providers change.

6.International transfers

Some of our providers may be based outside the UK, which means your data may be transferred internationally. Where we transfer personal data outside the UK, we make sure it is protected by one of the following safeguards:

• the country has UK “adequacy” status, meaning its laws provide a similar level of protection; or
• we put in place the UK’s International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum; or
• another lawful transfer mechanism applies.

You can ask us for a copy of the safeguards we use by contacting us at hello@onchainchess.io.

7.Your rights

Under UK data protection law you have the following rights, which you can exercise free of charge in most cases:

• Access — to be told whether we hold data about you and to receive a copy of it.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have your data deleted in certain circumstances (subject to the blockchain limits in section 4).
• Restriction — to ask us to limit how we use your data in certain circumstances.
• Objection — to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Portability — to receive certain data in a structured, machine-readable format and to have it transferred where technically feasible.
• Withdraw consent — where we rely on consent, to withdraw it at any time.
• Not to be subject to solely automated decisions that produce legal or similarly significant effects; we do not currently carry out such decision-making.

To exercise any of these rights, contact us at hello@onchainchess.io. We will respond within one month, although we may extend this by up to two further months for complex requests, in which case we will tell you. We may need to verify your identity first.

Complaints. If you are unhappy with how we handle your data, you can complain to the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113. We would, however, appreciate the chance to address your concerns first.

8.How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this policy, and then delete or anonymise it. Our standard periods are:

Where we are required to keep data longer to comply with a legal, regulatory or accounting obligation, or to resolve disputes, we will retain it for that longer period.

9.Cookies and similar technologies

We use cookies and similar technologies to make the Services work and to understand how they are used. We group them as follows:

• Strictly necessary cookies — required for the Services to function (for example, to keep you signed in). These do not require consent.
• Analytics and performance cookies — help us understand how the Services are used so we can improve them.
• Functionality and preference cookies — remember your choices and settings.

Your consent. In line with UK law (PECR), we only set non-essential cookies — including analytics cookies — after you have given consent through our cookie banner. You can change or withdraw your choices at any time using the cookie settings on our website or your browser controls. The current list of cookies we use, their purpose and duration is set out in our Cookie Policy.

10.Children’s privacy

The Services are not intended for anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at hello@onchainchess.io and we will take steps to delete it.

11.How we protect your data

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls and secure storage. No system can be guaranteed completely secure, and you are responsible for keeping your Account credentials and wallet keys safe. If a data breach affects your rights, we will notify you and the ICO where the law requires.

12.Changes to this policy

We may update this policy from time to time. We will post the updated version on our website with a new “last reviewed” date, and where changes materially affect you we will give you reasonable notice by email or in-app notice. We will keep prior versions available on request.

13.How to contact us

For any privacy question or to exercise your rights, contact us at: