Legal

Privacy & Cookie Policy of Placerion

This Privacy & Cookie Policy explains how Placerion s.r.o. (“Placerion”, “we”, “us”, “our”) collects, uses, and protects your personal data when you access or use our Services.

“Services” means all functionality made available by Placerion, including:

• the Placerion website at www.placerion.com, app.placerion.com and any related subdomains,
  
  

• our web and mobile applications (the “Platform”),
  
  

• user account management, wallet connection features, Stamp purchases (on-chain and off-chain), minting, reward and referral functionality,
  
  

• interactions with QR codes at partner locations,
  
  

• customer support, operational notifications, and service-related communications,
  
  

• optional marketing communications (where legally permitted),
  
  

• and any other digital features, tools, or services provided by Placerion now or in the future.

1. Controller

Controller:
Placerion s.r.o.
Registered office: Trojmezní 1877/12190 00 Prague 9, Czech Republic
Company ID: 235 86 338
Email: [email protected]

“Personal data” means any information relating to an identified or identifiable natural person under the EU General Data Protection Regulation (GDPR).

We have not appointed a Data Protection Officer; you can contact us directly at the email above for any privacy-related questions.

2. What personal data we collect

We process only the data that we reasonably need for the purposes described below.

2.1 Account and profile data

• First name and last name (if you choose to provide them or they are provided via Social login)

• Email address

• Password (hashed) if you register directly with us

• Language and other profile settings (if applicable).
  
  
  

2.2 Social login (Google, Apple or other providers)

If you sign in via any third-party identity provider, we may receive:

• a unique identifier assigned by that provider,

• your name (where provided),

• your email address,

• your profile picture or avatar (if the provider offers it and you grant permission).
  
  
  

We do not receive your password for any of these services, and we never gain access to your credentials stored with those providers.

2.3 Wallet and blockchain data

When you connect a non-custodial wallet to your account on the Platform, we process:

• your public wallet address(es),

• information about Placerion-related NFTs (stamps) associated with that wallet,

• blockchain transaction identifiers (transaction hashes) related to Placerion stamp purchases or other on-chain interactions with our Platform.

We do not store or have access to your private keys and cannot initiate transactions on your behalf.

2.4 Stamp collection and location-related data

When you scan a QR code at a participating physical location and purchase or collect a Placerion stamp:

• we record which location the stamp belongs to,

• we record the time of collection/purchase,

• we link the stamp to your Placerion account and, where applicable, to your wallet.
  
  
  

We do not track your precise GPS position. “Location” here means the participating venue (e.g. a specific museum, café, or sports venue) where you scanned the QR code.

In the future, we may offer optional features that involve processing approximate or precise location data (for example, to verify physical presence at a Location). Such processing will only take place with your explicit consent and will be clearly explained at the time it is requested.

2.5 Payment and billing data

Card and similar payments (e.g. Apple Pay) are processed by Stripe or another integrated payment provider.

We receive:

• partial card information (e.g. last four digits, card brand) if provided by the processor,

• payment status (paid / failed / refunded),

• amount, currency, time of payment,

• transaction identifiers from the payment provider,

• related billing information required by law.
  
  
  

We do not store full card numbers or CVV; these are processed directly by the payment provider.

2.6 Communication and support

If you contact us (e.g. via email, contact form, or in-app support), we process:

• your contact details (such as email and name, if provided),

• the content of your message and our replies,

• technical metadata (such as time, IP address, and system logs, where relevant and technically necessary).
  
  
  

2.7 Marketing preferences and communication

If you opt in to receive marketing or product updates, we may process:

• your email address,

• your preferences regarding the type of updates you want to receive,

• simple metrics such as whether you opened our email or clicked on a link (where enabled).
  
  
  

At this stage, we plan to send:

• onboarding emails,

• product and feature updates,

• information about new locations or changes to the Platform.
  
  
  

2.8 Technical and usage data (including cookies)

When you visit our website or use the Platform, we automatically collect:

• IP address,

• browser type and version,

• device type, operating system,

• time and duration of visit,

• pages and screens viewed, buttons clicked, navigation patterns,

• referrer URL.
  
  
  

We collect this data via standard web technologies, including cookies and similar tools (see section 6).

3. Purposes of processing and legal basis (GDPR)

We process your personal data only where we have a valid legal basis under GDPR. We rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR)

• Legitimate interests (Art. 6(1)(f) GDPR)

• Consent (Art. 6(1)(a) GDPR)

• Legal obligation (Art. 6(1)(c) GDPR)
  
  
  

To avoid repetition, the table below summarises what we do, why, and which legal basis we rely on:

Purpose

What we do

Main legal basis

Account creation and login

Create and manage your Placerion account, allow login via email/password, Google/Apple or other provider

Performance of a contract

Wallet connection

Link your non-custodial wallet to your account, display your Placerion NFTs

Performance of a contract; legitimate interests (operating a Web3 platform)

Stamp collection and location linking

Let you scan QR codes at venues, record that you collected a stamp at a specific location and time

Performance of a contract; legitimate interests (fraud prevention, platform integrity)

Payments and invoicing

Process payments via Stripe, record transactions, keep invoices

Performance of a contract; legal obligation (tax, accounting)

Communication and support

Respond to your questions, handle support requests and feedback

Performance of a contract; legitimate interests (service quality)

Analytics and product development

Analyse usage of the website and Platform (e.g. sessions, pages visited), improve features and UX

Legitimate interests; consent where required (non-essential analytics cookies)

Security and abuse prevention

Detect and prevent fraudulent or abusive behaviour, secure accounts and infrastructure

Legitimate interests

Marketing communication

Send you updates about new locations, features or Placerion news

Consent (Art. 6(1)(a) GDPR); in limited cases legitimate interests for strictly service-related communications to existing users

Legal compliance and disputes

Comply with legal obligations, respond to official requests, defend our rights

Legal obligation; legitimate interests

When we rely on consent, you are always free to withdraw it at any time (see section 11). When we rely on legitimate interests, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.

4. Recipients and third-party processors

We share personal data only where necessary and under appropriate contractual safeguards.

4.1 Infrastructure and hosting

We use Google Cloud Platform (GCP) or similar EU-compatible cloud infrastructure to host and operate the Platform.

• Role: data processor

• Data: account data, wallet and stamp data, technical logs, etc.
  
  
  

4.2 Payment processor – Stripe

We use Stripe (or a similar payment provider) to process card and related payments.

• Role: independent controller and/or processor (depending on context)

• Data: payment details, transaction metadata, status, partial card data
  
  
  

For more details, please see the privacy policy of the relevant payment provider.

4.3 Analytics – e.g. Google Analytics

We may use Google Analytics 4 (GA4) or similar analytics tools to understand how users interact with our website and Platform. GA4 is configured to anonymise IP addresses and does not allow us to directly identify individual users.

• Data: IP address (which may be truncated), device details, browser settings, pages visited, cookies.

• Role: processor or independent controller, depending on configuration.

Where required by law, we will request your consent before placing non-essential analytics cookies.

4.4 Communication and email tools

We may use third-party services for:

• transactional emails (account verification, security alerts),

• product and update emails (where permitted),

• support and ticketing systems.

These providers act as our processors and access your data only to the extent necessary to provide their services.

4.5 Development and professional providers

We may share personal data with:

• IT and development partners,

• security consultants,

• legal and accounting advisors.

All such partners are bound by confidentiality and, where required, by data processing agreements.

We do not sell your personal data.

5. International data transfers

Our operations are primarily based in the European Union. Some of our service providers (for example Google or Stripe) may process data in countries outside the EU/EEA, including the United States.

When we transfer your personal data outside the EU/EEA, we ensure that:

• there is an adequacy decision by the European Commission, or

• appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), and, where necessary, additional technical and organisational measures.

6. Cookies and similar technologies

6.1 What are cookies?

Cookies are small text files stored on your device when you visit our website or use our Platform. They allow the site to recognise your device and remember information about your visit.

We also use other similar technologies (such as local storage, pixels, scripts), but for simplicity we refer to them collectively as “cookies”.

Cookies are not programs, cannot run code or spread viruses on their own.

6.2 Types of cookies we use

We use both:

• Session cookies – temporary cookies deleted when you close your browser. They help you move around the site and use basic features.

• Persistent cookies – remain on your device for a defined period or until you delete them. They allow us to remember your preferences (e.g. language, login status).

Depending on their purpose, our cookies fall into the following categories:

(a) Strictly necessary cookies

These cookies are essential for the operation of the website and Platform. They allow you to:

• navigate the website,

• log into secure areas,

• keep your session active,

• maintain security and prevent abuse.

Without these cookies, some services cannot be provided. These cookies do not require consent under GDPR but you can still block them in your browser (though the site may not work properly).

(b) Functional / preference cookies

These cookies:

• remember your choices (such as language or display settings),

• improve your user experience,

• may store whether you have already seen or accepted certain notices.

If these cookies are not strictly necessary, we will rely on your consent where required by law.

(c) Analytics cookies

Analytics cookies help us understand:

• how many visitors we have,

• which pages are most frequently visited,

• how users move around the website,

• what we should improve.

We may use tools such as Google Analytics for this purpose. Where required by law, we ask for your consent before using analytics cookies. If you do not consent, we either will not use them or will use only strictly necessary basic logging. 

Where required by law, analytics cookies are activated only after you provide your consent, and data collection may be limited or adjusted based on your consent preferences.

(d) Marketing / tracking cookies (if used)

If we ever use cookies for marketing, retargeting, or tracking across sites, these will be used only with your explicit consent and will be clearly described in more detail (including the third parties involved).

Currently, Placerion does not rely on aggressive advertising technologies such as third-party ad networks on our main Platform, but this may change in the future. If it does, we will update this Policy and request your consent as required.

6.3 How we use cookie data

Using cookies, we may:

• keep you logged in while you browse the Platform,

• remember your language and other preferences (if applicable),

• secure your session and prevent misuse,

• generate anonymised or aggregated statistics about usage.

We do not use cookies to identify you personally in a way that would allow us to track your broader web activity outside our Platform.

6.4 Managing cookies

You can manage cookies in several ways:

1. Browser settings
   Most browsers accept cookies automatically. You can usually change your settings to:
   
   
   

   • block all cookies,

   • block only certain types, or

   • delete cookies that have already been stored.
     
     
     

2. Cookie banner / preference centre (if available)
   Where provided, you can use our cookie banner to accept or reject non-essential cookies directly.
   
   
   

3. Third-party opt-out tools
   Some analytics and advertising providers offer their own opt-out tools (for example, Google’s opt-out browser add-on for Analytics).
   
   
   

If you disable or reject cookies, some features of the website or Platform may not function properly, and your user experience may be reduced.

Where required by law, non-essential cookies are used only after you provide your explicit consent via our cookie banner or preference centre.

7. How long we keep your data

We keep your personal data only for as long as necessary for the purposes for which it was collected, or as long as required by law.

In particular:

• Account and profile data: stored for as long as you have an active account. Once you delete your account, we delete or anonymise these data, unless we must keep some information for legal reasons.

• Wallet and stamp data (off-chain records): stored for as long as you maintain your account, to display your collection and ensure the proper functioning of the Platform. After account deletion, we anonymise or remove personal links to the extent possible.

• Blockchain data (on-chain): transactions and public addresses recorded on the blockchain cannot be changed or deleted by us. However, we minimise our off-chain processing of this data and limit links to your identity. We do not control public blockchains and are not a controller of personal data independently published on such blockchains.

• Payment and billing data: kept for the period required by law (e.g. tax and accounting rules), typically several years after the relevant transaction.

• Communication and support data: kept for the time necessary to handle your request and, where appropriate, for a reasonable period to protect our legal interests.

• Marketing data: kept until you withdraw your consent or object to processing, or for the maximum period allowed by law for such activities.

• Cookies and analytics: stored according to their specific lifetime (session or persistent), which you can also influence via your browser and preferences.
  
  
  

Once the relevant retention period expires, we delete or irreversibly anonymise your data.

8. Security of your data

We implement appropriate technical and organisational measures to protect your personal data, including:

• encryption in transit (e.g. HTTPS) and, where appropriate, at rest,

• access controls and authentication for staff and systems,

• regular software updates and security patches,

• backups and monitoring,

• internal policies and training for personnel with access to personal data.
  
  
  

No system is completely secure, and we cannot guarantee absolute protection. However, we do our best to safeguard your data.

You are responsible for:

• choosing a strong and unique password,

• keeping your login details confidential,

• protecting your wallet and private keys,

• using up-to-date software and security measures on your device.
  
  
  

9. Children and minors

The Platform is not intended for children under 16 years of age.

By creating an account and using the Platform, you confirm that you are at least 16 years old, or that you are using the Platform with the consent and supervision of a parent or legal guardian.

We do not knowingly collect personal data from children under 16. If we learn that such data has been collected, we will delete it as soon as reasonably possible. 

10. Your rights under GDPR

Under GDPR, you have the following rights (subject to legal conditions and exceptions):

1. Right of access
   You can request confirmation whether we process your personal data and obtain a copy of such data.
   
   
   

2. Right to rectification
   You can request correction of inaccurate or incomplete personal data.
   
   
   

3. Right to erasure (“right to be forgotten”)
   You can request deletion of your personal data, for example if it is no longer needed, you withdraw consent, or the processing is unlawful.
   Note: This does not apply to data we must retain by law or data stored on public blockchains, which we cannot alter.
   
   
   

4. Right to restriction of processing
   You can request that we restrict processing of your data in certain situations (e.g. while we verify its accuracy).
   
   
   

5. Right to data portability
   You can request that we provide your personal data in a structured, commonly used and machine-readable format and, where technically possible, transmit it to another controller.
   
   
   

6. Right to object
   You can object at any time to processing based on our legitimate interests, including profiling on that basis. We will then no longer process your data for that purpose, unless we demonstrate compelling legitimate grounds.
   You can also always object to direct marketing; we will then stop sending you marketing emails.
   
   
   

7. Right to withdraw consent
   Where processing is based on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
   
   
   

8. Right to lodge a complaint
   You can lodge a complaint with your local data protection authority.
   In the Czech Republic, the authority is:
   Úřad pro ochranu osobních údajů (UOOU) – www.uoou.cz.

11. How to exercise your rights

To exercise any of your rights, please contact us at:

Email: [email protected]
Postal address:
Placerion s.r.o.
Trojmezní 1877/12190 00 Prague 9, Czech Republic

We may need to verify your identity (for example, by asking you to log in to your account or provide certain information) to prevent unauthorised access to your data.

We will respond to your request within one month of receipt. In complex cases, this period may be extended by up to two further months; if so, we will inform you about the extension and reasons.

12. External links and third-party sites

The Platform may contain links to third-party websites or services (e.g. wallet providers, partner locations, social networks, block explorers).

We are not responsible for the privacy practices or content of such third-party sites. We recommend that you review their privacy policies before providing any personal data.

13. Changes to this Policy

We may update this Privacy & Cookie Policy from time to time, for example:

• to reflect changes to our services,

• to comply with new legal or regulatory requirements,

• to clarify text or improve transparency.
  
  
  

The updated version will be published on our website with an updated “Last updated” date. For material changes, we may also notify you via email or in-app notification.

We encourage you to review this Policy periodically to stay informed about how we use and protect your data.

14. Contact

If you have any questions, comments, or concerns regarding this Privacy & Cookie Policy or our data practices, please contact us:

Placerion s.r.o.Registered office: Trojmezní 1877/12190 00 Prague 9, Czech RepublicCompany ID: 23586338Email: [email protected]