UBUNɅTION Privacy Policy

UBUNTU NATION AG, c/o Interconsulting Group AG, Chamerstrasse 176, 6300 Zug, Switzerland, e-mail info@ubunation.com ("UBUNɅTION", "we") is responsible for the processing described here. We comply with the Swiss Federal Act on Data Protection (FADP) and, where they apply to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR. We have no data protection officer; please write to info@ubunation.com with any data protection question.

We only process the data we need to run the Platform and our campaigns. Where the GDPR applies, the legal basis is the performance of our contract with you, a legal obligation, our legitimate interests or your consent, as indicated below.

• Visiting the Platform. Our hosting provider records technical data in server logs (IP address, date and time, pages opened, referring website, browser and device type, language, error messages) so that we can deliver the website, keep it secure and fix faults (legitimate interest). Logs are deleted after 12 months at the latest.
• Account and profile. E-mail address, username, password or one-time login codes (via Amazon Cognito), account settings and any profile information you choose to add, such as display name, avatar, bio, country and links (contract). Kept until you close your account, plus 30 days.
• Donations and collectibles. E-mail address, campaign, number of collectibles, amount, currency, date, payment method, the payment provider's transaction reference, your country of residence and, where the provider transmits them, your name and billing details, and the status of the payment (completed, refunded, charged back). For cryptocurrency payments we also receive the transaction hash and the sending wallet address from TransFi. We never receive full card numbers. We use this data to process your donation, assign your collectible, forward the Charity Partner's share, send confirmations, handle refunds and chargebacks, prevent fraud and abuse, comply with legal requirements and keep our accounts (contract, legal obligation, legitimate interest). Payment records are kept for 10 years as required by Swiss accounting law.
• Donation receipt from the Charity Partner. Only at your request do we pass your name, address and donation amount on to the Charity Partner so that it can issue you a receipt (consent).
• Public display. Campaign pages and the home page show recent donations with the username and avatar of the donor and the collectible received; profile pages show what the account holder has entered. Without an account you appear as "Anonymous". You control your profile, can change or remove it at any time in your settings and can ask us to hide it (contract and your own choice).
• Reward rounds. For the rewards from the Voices (Section 6 of the Terms of Use) we process your e-mail address, username, campaign and participation period, for a registration without a donation also your name, and the records of the allocation. To ensure that each person takes part only once, we match e-mail addresses and accounts (legitimate interest in a fair allocation). For selected persons we additionally process name, postal address, telephone number and handover details. We pass on to the Voice or partner providing the reward only the data needed for the handover, and we publish a selected person's first name or username only with their consent. Allocation records are kept for 12 months; handover data until the handover is complete and statutory retention periods have expired.
• Voices. Name, image, bio, links, statements, content provided for the campaign and verification information, published on the Voice profile and used to promote the campaigns the Voice supports (contract, consent).
• Newsletter. E-mail address, name if given, subscription data and open and click statistics, processed via Mailchimp (consent). You can unsubscribe at any time via the link in every newsletter; we then delete your newsletter data.
• E-mails and support. Login codes, donation confirmations, reward-round notifications and account notices are sent via Amazon SES; e-mails you send us are kept as long as needed to handle your request (contract, legitimate interest).
• Analytics and advertising. Only with your consent, as described in Section 4.
• Charity Partners. Charity Partners receive aggregate campaign statistics (amounts, number of donations, countries) and the monthly settlements without personal data. We pass on personal data to a Charity Partner only with your consent, for example for a donation receipt or if you opt in to its updates, or where needed to hand over a fixed reward that the Charity Partner provides.

The following providers process personal data on our behalf under data processing agreements:

We may also disclose data to our accountants, auditors and legal advisers (bound by confidentiality), to payment providers and banks in connection with fraud investigations or chargebacks, and to courts and authorities where the law requires it or where we need to establish, exercise or defend legal claims. If UBUNTU NATION AG or the Platform is transferred to another company, data may be transferred to the acquirer under the same protections.

When you first visit the Platform, a cookie banner lets you choose whether we may use analytics and marketing technologies. You can change your choice at any time via the "Cookie settings" link in the footer or by deleting cookies in your browser.

We are based in Switzerland, which the European Commission recognises as providing adequate data protection. Some providers are located in the EU or the USA. For providers in the USA we rely on their certification under the EU-U.S. and Swiss-U.S. Data Privacy Framework or, where a provider is not certified, on the EU Standard Contractual Clauses with the Swiss addendum and additional safeguards where necessary. You can request a copy of these safeguards by e-mail.

To prove the authenticity and uniqueness of collectibles, we may record a cryptographic fingerprint (hash) of a collectible's artwork together with its number on a public blockchain. We do not write your name, e-mail address or any other personal data to the blockchain. Blockchain entries are public and permanent and cannot be changed or deleted; the link between a collectible and you exists only in our own systems and is removed when your account is deleted.

Server logs up to 12 months; account and profile data until you close your account plus 30 days; payment and donation records 10 years; allocation records 12 months after the cut-off date, handover data until the handover is complete; registrations without a donation up to 12 months after the cut-off date; newsletter data until you unsubscribe; support e-mails until your request has been handled; analytics and advertising data according to the retention settings of the tool (Google Analytics: 14 months). Data needed to establish, exercise or defend legal claims is kept until the claims are time-barred.

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict its processing, to receive the data you provided in a machine-readable format, to object to processing based on our legitimate interests, to object to direct marketing at any time, and to withdraw any consent with effect for the future. Write to info@ubunation.com; we may ask you to verify your identity. Payment records that we must keep under accounting law and entries on a public blockchain (which contain no personal data) cannot be deleted. You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland, or, if you live in the EU or the EEA, with the data protection authority of your country.

Connections to the Platform are encrypted (TLS); the Platform is hosted on AWS with access controls; payment data is handled exclusively by PCI-DSS certified payment providers and we store no card numbers. The Platform is not directed at persons under 18, and we do not knowingly process children's data. We make no decisions about you based solely on automated processing; payment providers may run automated fraud checks under their own responsibility.

We update this Privacy Policy when our services, providers or the law change; the current version is published on the Platform with its date, and registered users are informed by e-mail about material changes. Contact: UBUNTU NATION AG, c/o Interconsulting Group AG, Chamerstrasse 176, 6300 Zug, Switzerland, info@ubunation.com.