Privacy Policy

1. Who we are

NFT Global Validity (“NFTValidity”, nftvalidity.com) is operated by EUROPEAN CENTRE QUALITY TAX CONSULTANCY L.L.C., Dubai, United Arab Emirates (trade licence 1247331) (“ECQ”, the “Company”, “we”). For personal data processed to operate the website, manage accounts, administer orders and issue its own assessments, the Company generally determines the purposes and means of processing and acts as a data controller. For data processed strictly on documented instructions of an institutional customer, the parties may agree in writing that the Company acts as a processor, with a separate data processing agreement where required.

Privacy contact: info@ecqnext.com, +971 58 595 9012.

Postal address: Office 601, Building B8, Al Barsha 1, Dubai, United Arab Emirates.

This Policy describes the Company’s processing under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR) or other mandatory law. The applicability of those regimes depends on the particular processing activities and individuals concerned.

2. Categories of information

Depending on your use of the Services, we may process:

• Account and contact data: name, company, job title, email, telephone number, account settings and correspondence.
• Case and evidence data: NFT/token identifiers, blockchain addresses and transaction hashes, smart-contract references, timestamps, document and file metadata, contracts, signature evidence, digital trails, communications, factual statements and other material submitted for assessment.
• Identity and third-party data: information needed to verify the identity or authority of a participant, signatory or contact, only where necessary and lawful; this may include information about people who are not our direct customers.
• Transaction and administration data: orders, invoices, payment status, tax information and billing records, the bank details shown on payments you make to us by bank transfer, and card payment details processed by Stripe; we do not receive or store full card numbers.
• Technical and security data: IP address, device/browser information, authentication records, approximate usage information, system logs, error records and security events.
• Review and certification data: communications with reviewers, verification steps taken, findings, limitations, certificate identifiers, review status, corrections and revocation history.

Please do not submit private wallet keys, seed phrases, or sensitive personal information that is unnecessary for the agreed scope. Publicly accessible blockchain information may become linked to identifiable individuals when combined with other records.

3. Where data comes from

We obtain information from you, your authorised representatives, other persons lawfully participating in verification, contracted reviewers, and lawfully accessible public sources (including public blockchain records) where relevant to a specific assessment. If you supply third-party information, you must have a lawful basis to do so. Where law requires that we notify a third party directly, we will do so or use an applicable lawful exception.

4. Why we process information

We use data to create and manage accounts; assess evidence and prepare Company-issued private digital results; verify identity or authority where relevant; respond to requests or challenges; communicate with authorised parties; deliver and validate certificates; process payments and keep required accounting records; detect abuse and secure systems; and comply with legal obligations or establish, exercise or defend legal claims.

Where GDPR applies, the legal basis will depend on the activity and may be contractual necessity, a legal obligation, legitimate interests (such as security, fraud prevention and maintaining defensible assessment records), or consent where that is required. We assess the relevant basis for third-party information separately. We do not treat a person’s appearance in an NFT or contract as automatic consent to every form of processing.

Direct marketing and optional analytics, where used, will rely on an appropriate lawful basis and any cookie or communications consents required by applicable law. You can opt out of marketing at any time.

5. Professional reviewers and other recipients

We share the minimum information reasonably necessary for the particular purpose with authorised Company personnel and contracted technical or legal experts. Depending on a specific case, relevant professional recipients may include Szkalka Ügyvédi Iroda (Budapest, Hungary), through Dr. Tamás Szkalka, and Akram Al Hashmi Advocacy & Legal Consultants (Akram Legal), United Arab Emirates. Not every professional partner receives every case. Their involvement, confidentiality arrangements and their data-protection role depend on the engagement.

We also use the following service providers under appropriate agreements:

• Hetzner Online GmbH (Germany): hosting of the NFTValidity platform, case files and databases.
• Google (Google Workspace): company email.
• Cloudflare, Inc. (United States, global network): content delivery and protection of the website against attacks and misuse; it processes IP addresses and technical request data.
• Our bank: receipt of payments made by bank transfer.
• Stripe (payment processor): card payments of the primary assessment fee; it processes the card and billing details you enter on its payment page.

We may further share data with an authorised counterparty if a verification step requires contact and there is a lawful basis, or with authorities and courts where required by law. We do not sell customers’ case materials or personal information to data brokers.

A law firm may act as an independent controller for information it is legally obliged to process in its professional capacity; where relevant, its own privacy notice and confidentiality requirements also apply. We do not promise that all information transmitted through our portal is legally privileged.

6. International processing

The Company operates in the UAE, hosts the platform with Hetzner Online GmbH in Germany (European Union), delivers the website through the global network of Cloudflare, Inc. and may engage professionals in Hungary and other locations. Personal data may therefore be accessed or transferred internationally for the specified purposes. Such transfers take place only under the conditions of applicable data-protection law: to a country with an adequate level of protection, under appropriate contractual safeguards, or where the transfer is necessary to perform a contract. Information on the relevant arrangements may be requested at info@ecqnext.com.

7. Confidentiality and information security

We apply organisational and technical safeguards appropriate to the nature of the information and the risks, including encrypted connections (HTTPS), role-based access restrictions, access logging and regular backups. The Company operates a quality management system certified to MSZ EN ISO 9001:2015 (certificate no. 2364834) and an information security management system certified to MSZ ISO/IEC 27001:2023 (certificate no. 8679973). Both certificates were issued by MARTON Szakértő Iroda Kft. (Budaörs, Hungary), a management system certification body accredited by the Hungarian National Accreditation Authority (NAH-4-0047/2023), and are valid until 29 November 2026 subject to annual surveillance audits. The certified scope is the Company’s accounting, bookkeeping and tax consultancy activities. The certificates evidence the Company’s organisational quality and information-security controls; they do not certify the NFTValidity service as such, any individual assessment or its outcome. Copies are available on request and at https://ecqnext.com. Specific controls may vary by system and provider and are not represented as infallible.

We may retain secure records sufficient to establish what material was examined, what decision was made and whether a certificate was later corrected or revoked.

We cannot control the public nature, permanence or independent replication of information already committed to a public blockchain. Please do not send us unnecessary personal data for publication on-chain. The Company cannot delete a public blockchain record created by another party.

8. Retention and deletion

We keep personal data only for as long as reasonably necessary for the relevant purpose, including service delivery, validation of issued assessments, challenge handling, security, accounting, legal compliance and the establishment or defence of claims. Unless a longer period is required by law or by a pending challenge or claim, the following periods apply:

Information no longer required will be deleted, anonymised or securely archived. Mandatory retention rules prevail over requests for immediate deletion. Public blockchain records are outside our deletion control.

9. Your privacy rights

Subject to the law that applies to your circumstances and relevant exemptions, you may request information or access to your personal data, correction of inaccuracies, erasure, restriction of processing, objection to certain processing, portability where available, withdrawal of consent where applicable, and appropriate review of certain automated decisions. You may also raise a complaint with the relevant data-protection authority where a right to do so exists.

Contact info@ecqnext.com, identifying your request. We may reasonably verify your identity before disclosing or changing protected records, and we will respond within 30 days. A request to erase personal data may be limited where records must be retained for legal reasons or the integrity of a certificate’s audit trail; in such cases we will explain the lawful limitation where required.

10. Automated analysis and human review

The software may automatically gather, organise, compare and flag digital information. A digital trace alone does not establish every underlying legal or factual conclusion. Where the agreed review requires professional judgment, the final assessment is informed by the relevant review process. If a fully automated decision with significant legal effects is introduced, we will provide the notices and safeguards required by applicable law.

11. Cookies and third-party websites

The website uses only strictly necessary cookies for form security, sign-in and protection against misuse. We do not use analytics, advertising or third-party tracking cookies. Details are set out in our Cookie Policy (https://nftvalidity.com/cookies). Third-party sites and wallets linked from our platform have their own privacy practices.

12. Changes and contacts

We may update this Privacy Policy when our practices, systems or legal obligations change. We will show the effective date and give any further notice required by applicable law.