1. DATA CONTROLLER
The Data Controller is Vechain Foundation San Marino s.r.l, with registered office at Via Consiglio dei Sessanta, 99 – Dogana – Republic of San Marino.

2. PURPOSE AND LEGAL BASIS OF THE PROCESSING
Vechain processes your personal data for the following purposes:

a) Promotion and sale of products and services of Vechain, including the performance of market research (so-called direct marketing). The legal basis that legitimizes the consequent processing is your consent, which you are free to give or not and that you can, however, withdraw at any time writing to gdpr@vechain.org. The provision of data necessary for these purposes is not mandatory and the refusal to provide them does not determine any negative consequences, except the inability to receive commercial communications.
b) Promotion of brand and public/sports events of Vechain by publishing (on official social media channels) photos and videos of the various events you may attend and during which you may be photographed/videorecorded. In this case by participating in these events you know that you may be photographed or videorecorded: if you would prefer to not to be photographed or videorecorded, please inform our staff. The provision of your images is not mandatory and will remain your property, will only be used for increasing awareness about the impact of our work, and the refusal to provide them does not determine any negative consequences.
c) Need to perform a contract, to which you are a party or to perform pre-contractual and/or contractual activities at your request, including, for example, your request to acquire a Vechain wallet1 or to enter in the community: this includes all those activities of acquiring information prior to the conclusion of a contract and sending information and updates on it. These needs represent the legal basis that legitimizes the consequent processing. The provision of the data necessary for these purposes represents, depending on the case, a contractual obligation or a necessary requirement for the conclusion of the contract; without them, Vechain may be unable to establish the relationship or to execute it.
d) Need to monitor the perception of its products, campaigns through research carried out on information in the public domain: in the pursuit of this interest, Vechain may process some personal data referring to online users and users of social media, forums, blogs, other digital sites or digital media. The legal basis of the processing is the legitimate interest of Vechain to understand the public sentiment about its brand and to monitorthe perception of its products, services or campaigns.

3. CATEGORIES OF PERSONAL DATA PROCESSED
Vechain processes personal data:

a) collected directly from you during events, subscriptions, etc., which include, by way of example, anagraphic data and contact data (e.g. first name, last name, mobile phone number, e mail, wallet address);
b) collected directly from you taking pictures/videos during events; and
c) analyzes data present in social media and various online sources, including forums, blogs and online sites, intentionally made public by you (among which there could be personal data referring to yourself). Such information may also include personal data such as personal details (e.g name, surname, alias, e mail address, etc.), and such personal data are processed mainly in an aggregate manner for the purposes described above.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA
Your data may be processed:

• by natural persons and legal entities as appointed data processors or autonomous data controllers, e.g. partners and affiliates as necessary, or also third-parties service providers who assist Vechain with the running of websites, data hosting, marketing and other IT services;
• for the purposes described at letter b), c) and d) of art. 2, Vechain may make use of platforms and analysis activities of external suppliers, who will act as autonomous data controllers or as data processors appointed by Vechain;
• and/or by natural persons as persons authorized to process personal data (with respect to the data necessary for the performance of the tasks assigned to them) belonging to the following categories: workers employed by Vechain or seconded to it, temporary workers, interns, consultants and employees of the external companies appointed as data processors.

In addition, Vechain may disclose personal information about you if it is under a duty to disclose or share them in order to comply with any legal obligation or lawful government or public authority request.

5. TRANSFER OF DATA TO THIRD COUNTRIES
Vechain informs you that personal data may be transferred from country not belonging to European Union or to European Economic Area (so-called Third Countries) to Europe and viceversa, recognized by the European Commission as having an adequate level of protection of personal data or, otherwise, only if an adequate level of protection of personal data compared to that of the European Union is contractually guaranteed by Vechain suppliers located in the Third Country (e.g through the signing of standard contractual clauses provided by the European Commission) and that the exercise of the rights of the data subject is always ensured. Further information can be requested by writing to info-sanmarino@vechain.org.

6. RIGHTS OF THE DATA SUBJECTS
Privacy Regulations grant to you as data subject specific rights, including the right to know what personal data is held by Vechain and how it is used (right of access), to obtain the updating, rectification or, if interested, integration of such data, as well as their erasure, transformation into anonymous form or limitation, etc.

7. PERIOD OF DATA STORAGE AND RIGHT TO ERASURE (i.e. RIGHT TO BE FORGOTTEN)
Vechain processes and keeps your personal data for longer than is necessary for the purposes for which they were collected and processed.
At the end of the applicable retention period, personal data relating to data subjects will be deleted or stored in a form that does not permit identification of the data subject (e.g., irreversible anonymization), and will be retained in a form that does not permit identification, unless their further processing is necessary for one or more of the following purposes: i) resolution of pre-litigation and/or litigation initiated before the expiry of the retention period; ii) to follow up investigations/inspections by internal control functions and/or external authorities initiated before the expiry of the retention period; iii) to follow up requests from San Marino and/or foreign public authorities received/notified to Vechain before the expiry of the retention period.

8. METHODS OF EXERCISING RIGHTS
In order to exercise the rights set forth in paragraph 6, you may apply to: VeChain Fondation S.r.l. Data Controller for San Marino gdpr@vechain.org, Via Consiglio dei Sessanta, 99 – Dogana – Republic of San Marino.
The deadline for the reply is one (1) month, which may be extended by two (2) months in particularly complex cases; in these cases, the Controller will provide at least one interim communication within one (1) month. The exercise of the rights is, in principle, free of charge; the Controller reserves the right to charge a fee in the event of manifestly unfounded or excessive requests (including repetitive ones).

9. COMPLAINT OR REPORT TO THE PERSONAL DATA PROTECTION AUTHORITY

Vechain informs you that you have the right to file a complaint or a report to the San Marino Data Protection Authority or alternatively to appeal to the judicial authority.