Illuvium Privacy Policy

Effective: 13 April 2023: Last Updated: 13 April 2023

Introduction

In this Privacy Policy, “Illuvium”, “us”, “we” or “our” means the Illuvium decentralised autonomous organisation (DAO). We are committed to operating with the highest level of integrity and respecting your privacy. This Privacy Policy, as may be amended by us from time to time, sets out the details relating to your data relationship with the Illuvium DAO and its authorised representative (Illuvium DAO Data Representative) that owns, and is responsible for collecting, using, storing, processing and disclosing your Personal Information in respect of our Services and your interactions with the Illuvium DAO, which include but are not limited to your participation in our Discord, online publications through for example, Medium and our social media channels (Illuvium DAO Activities).

The appointment terms, responsibilities and obligations of the Illuvium DAO Data Representative is subject to change based on the prevailing model of Illuvium DAO governance and proposals approved by Illuvium DAO governance as it adapts to accommodate emerging laws and clarifications on how existing laws apply to DAOs.

Your access to and use of the Services and the Interface are conditioned on Your acceptance of and compliance with this Privacy Policy.

By providing Personal Information to us, you consent to the Illuvium DAO Data Representative’s collection, use and disclosure of your Personal Information in accordance with this Privacy Policy and any other arrangements that apply between us including the Illuvium DAO Data Representative. We may change our Privacy Policy from time to time by publishing changes to it on our website (illuvium.io/privacy-policy). We encourage you to check our website periodically to ensure that you understand our current Privacy Policy.

If you are a resident of:

A. the European Union, supplementary terms at ANNEXURE A relating to the GDPR apply;
B. the United States, supplementary terms at ANNEXURE B apply (including some terms which only apply to California residents).

Details of the Illuvium DAO Data Representative and Authorisation are at ANNEXURE C.

Please read these additional terms carefully as they supplement these Terms and form part of our agreement with you.

Interpretation

Account means a unique account created for You to access the products or Services or parts of our Service made available through our Interface.
Personal Information or Personal Data includes information or an opinion about an individual that is reasonably identifiable. For example, this may include your name, age, gender, postcode and contact details. It may also include financial information, including your credit card information.
Services means access of the Illuvium Website for the purpose of staking, claiming sILV2 and the burning of ILV rewards, purchase of D1sks, the reveal of items packaged in D1sks, bonding of Illuvitars and accessories and the associated consolidation and burning of individual NFTs to produce new NFTs and any other activity that we make available to you through the Website and which requires the disclosure of your Personal Information or Personal Data.

What personal information do we collect?

The categories of Personal Information the Illuvium DAO Data Representative may collect and process depends upon the nature of your dealings with us and may include:

Personal details: name; gender, date of birth, nationality, tax residency;
Contact details: email address; address, mobile number, social media account;
Interaction details: activity details of your interactions with Illuvium DAO including products purchased, Services used, activity details of related purchases, preferences, interactions;
Payment details: payment and transaction information, including your bank and credit card details;
Technical information: your device ID, device type, geo-location, computer and connection information, statistics on page views, traffic to and from our websites, ad data, IP addresses and web log information;
Blockchain transactions: any bids, offers, buys, sells, transfers (including involving staking and liquidity provision), fees, withdrawals, claims, mints, burns, or other like interactions associated with your IP address, your Ethereum public address, your Immutable X public address or other public address;
Customer support: details of the Services we have provided to you or that you have enquired about, including any additional information necessary to deliver those Services and respond to your enquiries; and
Feedback information: : information you provide to us through surveys.

How do we collect personal information?

We may collect Personal Information about you when You:

Visit our Interface;
Register an Account via our Interface;
Make a purchase or place an order using our Interface;
Communicate with us through correspondence, chats, email, or when you share information with us from other social applications, Services or websites;
Make enquiries, report suspicious market activity or submit comments, bug reports, ideas, or other feedback about the Interface and our Services;
Connect your compatible Ethereum wallet to the Illuvium Interface, create an Immutable X wallet and connect the Immutable X wallet to the Illuvium Interface, sign a blockchain transaction or otherwise interact with the suite of smart contracts that comprise the Illuvium protocol from time to time;
Interact with our Interface, Services, Illuvium DAO Activities, content and advertising; or join a mailing list;
Participate in a competition, promotion or survey; and
Post a review, rating, comment, or other user-generated content on one of our websites or applications; and
Invest in the Illuvium DAO or enquire as to a potential investment or donation to support the Illuvium DAO.

We may also collect Personal Information when we receive your Personal Information from third parties who legally provide it to us (including further to recruitment activities).

Why do we collect, use and disclose Personal Information?

We may use your Personal Information to:

Enable you to access and use our Services;
Operate, protect, improve and optimise our Interface and Services,Illuvium DAO Activities, and our users’ experience, such as to perform analytics, conduct research and for advertising and marketing;
Send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;
Send you marketing and promotional messages and other information that may be of interest to you, including information sent by, or on behalf of, our business partners that we think you may find interesting;
Administer rewards, surveys, contests, or other promotional activities or events sponsored or managed by us or our business partners;
Comply with our legal obligations, resolve any disputes that we may have with any of our users, enforce our terms and other agreements, or to protect the rights, property or safety of Illuvium DAO participants or others;
Consider your employment or other application; and
for any other purpose with your consent.

The Illuvium DAO Data Representative may disclose your Personal Information to a trusted third party who holds other information about you. This third party may combine that information in order to enable it and us to develop anonymised consumer insights so that we can better understand your preferences and interests, personalise your experience and enhance the products and Services you receive or Illuvium DAO Activities you interact with.

Disclosure of Personal Information:

The Illuvium DAO Data Representative may disclose Personal Information for the purposes described in this Privacy Policy to:

Our employees and related bodies corporate of the Illuvium DAO or the Illuvium DAO Data Representative;
third party suppliers and third party service providers (including providers for the operation of our websites and/or our business or in connection with providing our Services and Illuvium DAO Activities to you);
Professional advisers, dealers and agents;
Payment systems operators (eg merchants receiving card payments);
Our existing or potential agents, business partners or partners;
Our sponsors or promoters of any competition that we conduct via our Services and Illuvium DAO Activities;
Anyone to whom our assets or businesses (or any part of them) are transferred;
Specific third parties authorised by you to receive information held by the Illuvium DAO Data Representative; and/or
Other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law.

International Transfer of Personal Information:

The Illuvium DAO Data Representative may disclose Personal Information outside of your country of residence to third party suppliers and cloud providers located outside the EU/EEA in countries such as Australia or the USA. The Illuvium DAO Data Representative is responsible for putting in place suitable technical, organisational and contractual safeguards to ensure that any transfer is carried out in compliance with applicable data protection rules, except where the country to which the data is transferred has already been determined by the European Commission to provide an adequate level of protection.

Security:

The Illuvium DAO Data Representative is responsible for designing Illuvium DAOsystems with your security and privacy in mind. The Illuvium DAO Data Representative may hold your Personal Information in either electronic or hard copy form. By appointing the Illuvium DAO Data Representative, and by the terms of that appointment, the Illuvium DAO and its Data Representative take reasonable steps to protect your Personal Information from misuse, interference, and loss, as well as unauthorised access, modification, or disclosure. Due to the emerging and uncertain nature of a DAO, the appointment of a Data Representative to own and control the data collected is a necessary step to prevent unauthorised access to your Personal Information. The Illuvium DAO Data Representative uses a combination of physical, administrative, personnel and technical measures (such as encryption protocols and software) to protect your Personal Information.

Direct Marketing:

The Illuvium DAO Data Representative and/or our carefully selected business partners may send you direct marketing communications and information about our Services and Illuvium DAO Activities. This may take the form of emails, SMS, mail, or other forms of communication. You may opt-out of receiving marketing materials by contacting us using the details below or the opt-out facilities provided (e.g., an unsubscribe link).

Your Rights:

Subject to applicable law, you are entitled to the following rights:

Right to access: you have the right to obtain confirmation that your Personal Information is processed and obtain a copy of it as well as specific information related to its processing;
Right to rectify: you can request the rectification of Personal Information that is inaccurate or add to it;
Right to delete: you can, in some cases, have your Personal Information deleted;
Right to object: you can object, for reasons relating to your circumstances, to the processing of your Personal Information;
Right to limit the processing: in certain circumstances, you have the right to limit the processing of your Personal Information;
Right to portability: you can request to receive your Personal Information in a structured, commonly used, and machine-readable format, or, when this is possible, that we communicate your Personal Information on your behalf directly to another data controller;
Right to withdraw your consent: for processing requiring your consent, you have the right to withdraw your consent at any time; however, exercising this right does not affect the lawfulness of any processing based on your prior consent;
Right to set instructions relating to the use of your Personal Data post mortem: you have the right to define instructions relating to the retention, deletion, and communication of your Personal Information after your death;
Right to complain to the relevant data protection authority.

If you have any questions or objections about how the Illuvium DAO Data Representative collects and processes your Personal Information, or if you would like to exercise any of the above rights, please contact them using the information below.

Security:

We may hold your personal information in either electronic or hard copy form. We take reasonable steps to protect your personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure and we use a number of physical, administrative, personnel and technical measures to protect your personal information.

Data Retention:

The Illuvium DAO Data Representative may hold your Personal Information for as long as it is reasonably necessary to enable you to access and use our Services and interact with Illuvium DAO Activities. The Illuvium DAO Data Representative may retain your Personal Data wholly or partly for a longer or shorter period under applicable laws or any other lawful reason. The data retention periods may be altered from time to time based on regulatory or other changes.

Cookies:

Our Services and Illuvium DAO Activities may contain links to third-party web sites or services that are not owned or controlled by the Illuvium DAO. The Illuvium DAO has no control over, and assumes no responsibility for, the content, privacy policies, or practices of any third party web sites or services. All token transactions made through the Interface are facilitated and run through your compatible Ethereum wallet (e.g. MetaMask, a Third-party Extension). Certain non-fungible tokens (NFTs) are transferred and minted using the Immutable X platform (Third-party Platform). The Illuvium interface enables access to an Ethereum-based suite of applications (e.g. staking, rewards, vesting, claiming, exchange, auctions) allowing users to interact with the smart contracts deployed to the Ethereum blockchain to assist with facilitating token activities.By using a Third-party Extension, a Third-party Platform, or any other Third-party services to access our Services you agree that you are governed by the terms of service and privacy policy for the applicable Third-party Extension,applicable terms for the Third-party Platform, or the terms and privacy policy of any other Third-party services. For example, the MetaMask Terms of Service and Privacy Policy are available at metamask.io/terms.html and metamask.io/privacy.html respectively, but may be updated from time to time. In addition, the Immutable X Protocol Licence Agreement is available at support.immutable.com/hc/en-us/articles/4404514460303-Immutable-X-Protocol-Licence-Agreement. You acknowledge and agree that the Illuvium DAO nor the Illuvium DAO Data Representative shall not be responsible or liable, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any such third-party content, goods or services available on or through any such web sites or services. We strongly advise You to read the terms and conditions and privacy policies of any third-party web sites or services that You visit.

Use of third-party software:

Our Services may contain links to third-party web sites or services that are not owned or controlled by the Company. The Company has no control over, and assumes no responsibility for, the content, privacy policies, or practices of any third party web sites or services. All cryptocurrency transactions made through the Illuvium website are facilitated and run through your compatible Ethereum wallet (e.g. MetaMask, a Third-party Extension). Certain non-fungible tokens (NFTs) are transferred and minted using the Immutable X platform (Third-party Platform). The Illuvium website is the interface for an Ethereum-based suite of applications (e.g. staking, rewards, vesting, claiming, exchange, auctions) allowing users to interact with the smart contracts deployed to the Ethereum blockchain to assist with facilitating cryptocurrency transactions.By using a Third-party Extension, a Third-party Platform, or any other Third-party services to access our Services you agree that you are governed by the terms of service and privacy policy for the applicable Third-party Extension,applicable terms for the Third-party Platform, or the terms and privacy policy of any other Third-party services. For example, the MetaMask Terms of Service and Privacy Policy are available at metamask.io/terms.html and metamask.io/privacy.html respectively, but may be updated from time to time. In addition, the Immutable X Protocol Licence Agreement is available at support.immutable.com/hc/en-us/articles/4404514460303-Immutable-X-Protocol-Licence-Agreement. You acknowledge and agree that the Company shall not be responsible or liable, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any such third-party content, goods or services available on or through any such web sites or services. We strongly advise You to read the terms and conditions and privacy policies of any third-party web sites or services that You visit.

Security:

The Illuvium DAO Data Representative may hold your Personal Information in either electronic or hard copy form. While We take reasonable steps to protect your Personal Information from misuse, interference and loss, as well as unauthorised access, modification or disclosure and we use a number of physical, administrative, personnel and technical measures to protect your Personal Information, we cannot guarantee its absolute security.

You are responsible for safeguarding the password that You use to access the Services and for any Illuvium DAO Activities or actions under Your password, whether Your password is with Our Service or a Third-Party Service.You agree not to disclose Your password to any third party. You must notify us immediately upon becoming aware of any breach of security or unauthorised use of Your Account.

Links:

Our Interface may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage you to read them before using those websites.

Making a complaint:

If you have concerns about how we or the Illuvium DAO Data Representative have handled your Personal Information, you can contact the Illuvium DAO Data Representative using the details below. Please include your name, email address and clearly describe your complaint. The Illuvium DAO Data Representative will acknowledge your complaint and respond to you within a reasonable period. If you think the Illuvium DAO Data Representative has failed to resolve the complaint satisfactorily we will provide you with information about further steps you can take. You also have the right to contact your local data protection authority.

Contact Us, Data Controller:

For questions or requests please contact us at privacy@illuvium.io

ANNEXURE A - SUPPLEMENTARY TERMS - GDPR

In addition to the terms defined in this document, the following terms apply specifically to European Union residents per the GDPR. We use the terms Personal Information and Personal Data interchangeably within our Privacy Policy, noting that the relevant term shall apply based on the operation of relevant privacy and data laws to you.

Data Controller for the purposes of the GDPR (General Data Protection Regulation), refers to the Illuvium DAO (or in this case the Illuvium DAO Data Representative)as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.

Data Processor for the purposes of the GDPR means any natural or legal person who processes the data on behalf of the Illuvium DAO. It refers to third-party companies or individuals employed or engaged by the Illuvium DAOto facilitate the Service or Illuvium DAO Activities, to provide the Service or Illuvium DAO Activities on behalf of the Illuvium DAO, to perform services related to the Service or Illuvium DAO Activities or to assist the Illuvium DAO in analysing how the Service is used or Illuvium DAO Activities are interacted with.

Personal Data for the purposes of the GDPR means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.

The Illuvium DAO Data Representative is the Data Controller for Personal Data collected in connection with providing our Services and Illuvium DAO Activities. The Illuvium DAO Data Representative generally collects your Personal Data directly from where you are based and may store it on servers outside the EU or the European Economic Area (EEA) in countries such as Australia or the USA, where data protection standards may be lower than in the EU/EEA.

The Illuvium DAO Data Representative undertakes to respect the confidentiality of Your Personal Data and to guarantee You can exercise Your rights under the GDPR.

If You are within the EU you have the right under the GDPR to:

Access, correct, update or delete the information We have on You: If you are unable to perform these actions yourself, please contact Us to assist You.
Object to processing of Your Personal Data: This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation that makes You want to object to our processing of Your Personal Data. You also have the right to object where We are processing Your Personal Data for direct marketing purposes.
Request the transfer of Your Personal Data: We will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which You initially provided consent for Us to use or where We used the information to perform a contract with You.
Withdraw Your consent: You have the right to withdraw Your consent on using your Personal Data. If You withdraw Your consent, We may not be able to provide You with access to certain specific functionalities of the Service.

Exercising Your GDPR Data Protection Rights:

You may exercise Your rights of access, rectification, cancellation and opposition by contacting Us by using the information below. Sometimes, the Illuvium DAO Data Representative may not be able to provide you with access to all of your Personal Information and, where this is the case, we will tell you why. We may also need to verify your identity when you request your Personal Information. If you think that any Personal Data we hold about you is inaccurate, please contact the Illuvium DAO Data Representative and they will take reasonable steps to ensure that it is corrected. You have the right to complain to a Data Protection Authority about our collection and use of Your Personal Data. For more information, if You are in the European Economic Area (EEA), please contact Your local data protection authority in the EEA.

Exercising Your GDPR Data Protection Rights:

ANNEXURE B - SUPPLEMENTARY TERMS - CALIFORNIA

This privacy notice section for California residents supplements the information contained in Our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of California, unless otherwise stated that it applies to United States residents generally.

Personal Information for the purpose of the California Consumer Privacy Act (CCPA) means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You. Under CCPA, personal information does not include: Publicly available information from government records, deidentified or aggregated consumer information, information excluded from the CCPA’s scope, such as health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.
Business for the purpose of the CCPA refers to the Illuvium DAO (or in this case the Illuvium DAO Data Representative)as the legal entity that collects Consumers’ Personal Information and determines the purposes and means of the processing of Consumers’ Personal Information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ Personal Information, that does business in the State of California.
Consumer for the purpose of the CCPA means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in California for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the California who is outside California for a temporary or transitory purpose.
Do Not Track (DNT) is a concept that has been promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites. Provisions regarding Do Not Track references herein apply to all residents of the United States.
Sale, for the purpose of the CCPA (California Consumer Privacy Act), means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer’s personal information to another business or a third party for monetary or other valuable consideration.

Collection of Personal Information:

Over the past 12 months, we have collected the personal information from You as provided in the “What Personal Information do we collect?” section above. This does not mean that all examples listed above were in fact collected by Us, but reflects our good faith belief to the best of our knowledge that some of that information from those examples may have been collected. For example, certain Personal Information would only be collected if You provided such personal information directly to Us.

Sources of Personal Information:

We obtain the Personal information listed above from the following categories of sources:

directly from You, for example, from the forms You complete on our Service, preferences You express or provide through our Service, or from Your purchases on our Service;
indirectly from You, for example, from observing Your activity on our Service;
automatically from You, for example, through cookies We or our Third Party Service Providers set on Your Device as You navigate through our Service; and
from Third-Party Service Providers, for example, we may use Third-Party services monitor and analyse the use of our Service, to handle payment processing, or to otherwise provide the Services to You.

Use of Personal Information for Business Purposes or Commercial Purposes:

We may use or disclose personal information We collect for “business purposes” or “commercial purposes” (as defined under the CCPA) as described herein this Privacy Policy and as described to You when collecting Your personal information or as otherwise set forth in the CCPA.

Share of Personal Information:

We may share Your Personal Information to the entities We have described herein this Privacy Policy, including but not limited to the entities listed above in the “To whom do we disclose your Personal Information?” section of this Privacy Policy.

Disclosure of Personal Information for Business Purposes or Commercial Purposes:

We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of personal information for business or commercial purposes:

Category A: Identifiers;
Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e));
Category C: Protected classification characteristics under California or federal law;
Category D: Commercial information; and
Category F: Internet or other similar network activity

Please note that the categories listed above are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact disclosed, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been disclosed.

When we disclose personal information for a business purpose or a commercial purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

There has been no Sale by us of the Personal Information that we have collected from you or may collect from you.

Your Rights under the CCPA:

The CCPA provides California residents with specific rights regarding their personal information. If You are a resident of California, You have the following rights:

The right to notice:

You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.

The right to request:

Under CCPA, You have the right to request that We disclose information to You about Our collection, use, sale, disclosure for business purposes and share of personal information. Once We receive and confirm Your request, We will disclose to You:

the categories of personal information We collected about You;
the categories of sources for the personal information We collected about You;
our business or commercial purpose for collecting or selling that personal information;
the categories of third parties with whom We share that personal information;
the specific pieces of personal information We collected about You;
the categories of Personal Information we disclosed.

The right to delete Personal Data:

You have the right to request the deletion of Your Personal Data, subject to certain exceptions. Once we receive and confirm Your request, we or the Illuvium DAO Data Representative as applicable will delete (and direct our third party service providers to delete) Your personal information from our records, unless an exception applies. We ro the Illuvium DAO Data Representative as applicable may deny Your deletion request if retaining the information is necessary for us or our third party service providers to:

complete the transaction for which We collected the personal information, provide a good or service that You requested, take actions reasonably anticipated within the context of our ongoing business relationship with You, or otherwise perform our contract with You;
detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
debug products to identify and repair errors that impair existing intended functionality.
exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);
engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if You previously provided informed consent;
enable solely internal uses that are reasonably aligned with consumer expectations based on Your relationship with Us;
comply with a legal obligation; and
make other internal and lawful uses of that information that are compatible with the context in which You provided it.

The right not to be discriminated against:

You have the right not to be discriminated against for exercising any of Your consumer’s rights, including by:

denying goods or Services or Illuvium DAO Activities to You;
charging different prices or rates for goods or Services or Illuvium DAO Activities, including the use of discounts or other benefits or imposing penalties;
providing a different level or quality of goods or Services or Illuvium DAO Activities to You; and
suggesting that You will receive a different price or rate for goods or Services or a different level or quality of goods or Services or Illuvium DAO Activities.

Exercising Your CCPA Data Protection Rights:

California residents may make a request pursuant to your rights under the CCPA by contacting us at privacy@illuvium.io.

Only You, or a person registered with the California Secretary of State that You authorise to act on Your behalf, may make a verifiable request related to Your personal information.

Your request to Us must:

provide sufficient information that allows Us to reasonably verify You are the person about whom we collected personal information or an authorised representative; and
describe Your request with sufficient detail that allows Us to properly understand, evaluate, and respond to it,

The Illuvium DAO or the Illuvium DAO Data Representative cannot respond to Your request or provide You with the required information if we cannot verify Your identity or authority to make the request and confirm that the personal information relates to You. We will disclose and deliver the required information free of charge within 45 days of receiving Your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice. Any disclosures we provide will only cover the 12-month period preceding the verifiable request’s receipt. For data portability requests, we will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.

“Do Not Track” Policy as Required by California Online Privacy Protection Act (CalOPPA):

Our Service does not respond to Do Not Track signals.

Children’s Privacy:

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers. If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent’s consent before We collect and use that information.

Your California Privacy Rights (California’s Shine the Light law):

Under California Civil Code Section 1798 (California’s Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their Personal Data with third parties for the third parties’ direct marketing purposes. If you’d like to request more information under the California Shine the Light law, and if You are a California resident, You can contact Us using the contact information provided below.

California Privacy Rights for Minor Users (California Business and Professions Code Section 22581):

California Business and Professions Code section 22581 allows California residents under the age of 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted. To request removal of such data, and if You are a California resident, You can contact Us using the contact information provided below, and include the email address associated with Your account. Be aware that Your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Contact Us

For further information about our Privacy Policy or practices, or to access or correct your Personal Information, or make a complaint, please contact us using privacy@illuvium.io.

ANNEXURE C - ILLUVIUM DAO DATA REPRESENTATIVE & AUTHORISATION

Illuvium Labs Pty Ltd, Illuvium Labs FZCO or Illuvium Merchandise FZCO, or any one of them (herein Delegate) will collect, legally own, use, store, process and disclose Customer Data, which it will manage in accordance with the terms of this delegation.

Whilst the Illuvium DAO should beneficially own the Customer Data, if such ownership is recognised by applicable law, the legal uncertainty and lack of consistent recognition of a DAO as a distinct legal person could result in adverse consequences for Customer Data collected from Illuvium participants.

As such, in exercising the delegated powers, functions and duties granted to the Delegate by the DAO, the Delegate will exercise extreme caution before complying with any proposal that may be approved by the DAO for the sharing or use or otherwise in relation to Customer Data, or any request under applicable laws made by a government agency or other actor for or in relation to Customer Data.

Customer Data means any data, information, compilation or list containing Personal Information or other details in relation to Illuvium participants which is:

or is intended to be, collected, stored or processed by the DAO in accordance with applicable laws and with regard to the Undertaking given in this Authorisation and as a condition to the delegation of powers, functions and duties in relation to Customer Data; and
otherwise generated, compiled, stored or processed by the DAO in accordance with applicable laws and with regard to the Undertaking given by the Delegate in Authorisation.

Undertaking

The Delegate undertakes, to the extent of any proposed use of Customer Data or Protected Data that is revenue generating and in accordance with applicable laws, that if applicable law sees the Delegate as owning the Customer Data beneficially then the Delegate will treat the DAO as a joint venture partner in its own right with distinct legal personality and agree an appropriate form of output to be received by the DAO with the Illuvium Council or in accordance with the prevailing model of DAO governance.

The parties acknowledge that:
the Delegate is appointed as the authorised representative (Illuvium DAO Data Representative);
The Delegate, as the Illuvium DAO Data Representative appointed under this Authorisation owns and is responsible for collecting, using, storing, processing and disclosing Customer Data;
All Customer Data will be dealt with in accordance with the delegation of authority made to the Delegate by the DAO and applicable laws; and
The appointment terms, responsibilities, and obligations of the Delegate, as Illuvium DAO Data Representative are subject to change based on the prevailing model of Illuvium DAO governance and proposals approved by Illuvium DAO governance as it adapts to accommodate emerging laws and clarifications on how existing laws apply to DAOs.