Data Processing Agreement

Last updated: December 16, 2024

1. Minimal Data Collection Policy

GuardScan operates on a minimal data collection policy for cryptocurrency threat education. Token contract addresses are processed using publicly available blockchain data and deleted within 7 days. We do not store personal financial information or private keys.

2. Data Processing Activities

  • Analysis of token smart contracts using publicly available blockchain data
  • Pattern recognition for educational identification of potential risks
  • Metadata extraction for security and fraud pattern assessment
  • Anonymous aggregation of threat patterns for service improvement
  • IP address logging for abuse prevention and geographic analytics

3. Legal Basis for Processing

Processing is based on legitimate interests (Article 6(1)(f) GDPR) for cybersecurity education and fraud prevention purposes. Users consent to analysis by submitting token contract addresses to our educational service.

4. Data Categories Processed

  • Token Contract Data: Public blockchain addresses and smart contract code
  • Analysis Results: Risk scores, pattern identification, and educational insights
  • Technical Data: IP addresses, browser information for security purposes
  • Usage Analytics: Service performance and feature usage statistics

5. Data Subject Rights

  • Right to information about processing activities and educational purposes
  • Right to access analysis results and processing information
  • Right to object to processing (discontinue using the service)
  • Right to data portability (analysis results provided immediately)
  • Right to rectification of inaccurate personal data
  • Right to lodge complaints with supervisory authorities

6. International Data Transfers

Cryptocurrency analysis may involve processing in different geographic regions for optimal blockchain data access. All transfers comply with GDPR requirements using Standard Contractual Clauses and adequate protection measures.

7. Security Measures

  • End-to-end encryption for all data transmissions and API communications
  • Secure processing environments with blockchain network access controls
  • Regular security audits and vulnerability assessments
  • Incident response procedures for data breaches or security events
  • Access logging and monitoring for all system interactions

8. Data Retention Policy

Token contract addresses are deleted within 7 days of analysis. Educational analysis results may be retained for up to 12 months for service improvement. Anonymized threat patterns may be retained indefinitely for algorithm training. Technical logs are retained for up to 90 days for system operation and security purposes.

9. Third-Party Integrations

Our service may integrate with blockchain data providers and threat intelligence services. All third-party processors are bound by data protection agreements and process data only for specified educational and security purposes.

10. Contact for Data Protection

For data protection inquiries, contact our Data Protection Officer at dpo@guardscan.io