Privacy Policy

[01] What information we collect

Information you provide to us

When you take the Risk Quiz, contact us, or otherwise interact with the Website, we may collect:

• — Quiz responses (e.g. answers about your crypto holdings, storage methods, and security practices)
• — Any other information you choose to send us in messages or enquiries

Information collected automatically

Through cookies and similar technologies (see our Cookie Policy):

• — IP address
• — Browser and device information
• — Pages visited and interaction data
• — Approximate geographic location

We do not knowingly collect special category personal data under Article 9 of the UK or EU GDPR.

[01a] Our EU and UK representatives

Under Article 27 of the UK GDPR and Article 27 of the EU GDPR, we have appointed Prighter Group (acting through its local partners) as our data protection representative and your point of contact for the following regions:

• — European Union (EU)
• — United Kingdom (UK)

Prighter provides an easy way for you to exercise your privacy rights (for example, requests to access, correct, or erase your personal data) and to raise any concerns about how we process your personal data. To contact us via our representative or to make use of your data subject rights, please visit: https://app.prighter.com/portal/14875999304.

Contacting Prighter does not affect your right to lodge a complaint with your local supervisory authority.

[02] How we use your information

We use your personal information to:

• — Operate the Website and deliver the Risk Quiz, Safety Guide and other content
• — Respond to your enquiries and messages
• — Protect the Website against abuse and malicious activity
• — Understand usage and improve our content
• — Comply with applicable laws and lawful requests

[03] Legal bases

Under UK GDPR and EU GDPR, we rely on one or more of the following legal bases:

• — Consent — for non-essential cookies.
• — Legitimate interests — in operating, securing and improving the Website.
• — Legal obligations — to comply with applicable laws.

[04] Sharing

We do not sell or rent your personal data. We share limited data with:

• — Service providers (hosting, analytics, cookie consent management)
• — Legal and regulatory authorities where required by law
• — Professional advisers (auditors, lawyers) under confidentiality duties
• — Affiliates within the Bron group, as needed and consistent with this Notice

[05] Cookies

See our Cookie Policy at www.seedphrasemuseum.org/cookies for details of cookies and similar technologies used on the Website and how to manage them.

[06] Retention

We retain personal information only as long as needed for the purposes described, then delete or de-identify it. No purpose requires retention longer than six (6) months from collection, unless law requires otherwise or we need the data to protect our rights.

[07] Security

We implement reasonable technical and organisational measures, including access controls and encryption in transit. No method of transmission over the internet is completely secure. Where legally required, we will notify affected users of a personal data breach.

[08] Minors

The Website is not intended for anyone under 18 years of age. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided personal information, please contact legal@bron.org.

[09] International data transfers

Bron Foundation is established in the Cayman Islands and operates globally. Your personal information may be transferred to and processed in countries other than your own, including the Cayman Islands, the United Kingdom, the European Economic Area, and the United States. Where required, we use appropriate safeguards, including:

• — European Commission Standard Contractual Clauses
• — The UK International Data Transfer Addendum to the EU SCCs (or the UK IDTA)
• — Other recognised transfer mechanisms, such as the UK Extension to the EU–US Data Privacy Framework where applicable

You may request information about our transfer safeguards by contacting legal@bron.org or our Article 27 representative.

[10] Your rights

Depending on where you live, you may have rights to:

• — Access your personal data
• — Correct inaccurate data
• — Request deletion
• — Restrict or object to processing
• — Withdraw consent
• — Data portability
• — Lodge a complaint with your local supervisory authority

To exercise these rights, contact us at legal@bron.org. If you are in the EU or UK, you may also contact our Article 27 representative (see above). UK residents may lodge a complaint with the Information Commissioner's Office: https://ico.org.uk.

[11] Updates to this Notice

We will update this Notice as needed to stay compliant. Updates will be posted on this page with a revised "Last updated" date.