Privacy Policy

1. Information We Collect

Echo Novas collects information necessary to provide our services, including account information, transaction data, and usage information. We collect only the minimum information required for service delivery.

2. How We Use Information and Legal Basis

We use collected information to provide and improve our services, process transactions, communicate with users, and ensure platform security. We do not sell user information to third parties.

Under UK GDPR, we process personal data based on the following lawful bases:

• Contract: To perform our contractual obligations, including processing purchases, activating digital access products, and providing access to services.
• Legal Obligation: To comply with applicable laws and regulations, including tax reporting, fraud prevention, and regulatory compliance.
• Legitimate Interests: To improve our services, ensure platform security, prevent fraud, and communicate important updates about our services.
• Consent: For optional communications such as marketing emails, where you have explicitly consented to receive such communications.

3. Information Sharing and International Transfers

We may share information with partner platforms as necessary to provide access and entitlement services. We may also share information when required by law or to protect our rights and security.

Data Processors: We use third-party service providers to process personal data on our behalf, including:

• Cloud hosting and infrastructure providers (for platform operations)
• Email service providers (for transactional and support communications)
• Payment processors (for processing transactions)
• Analytics providers (for understanding platform usage and improving services)

International Transfers: Some of our service providers may be located outside the UK and European Economic Area (EEA). When we transfer personal data outside the UK/EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO)
• Adequacy decisions by the UK government or European Commission
• Other legally recognized transfer mechanisms

4. Data Security

We implement industry-standard security measures to protect user information. However, no method of transmission over the internet is 100% secure.

5. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Account Information: Retained while your account is active and for a reasonable period after account closure to comply with legal obligations and resolve disputes.
• Transaction Data: Retained for a minimum of 7 years to comply with tax and financial reporting obligations.
• Communication Records: Retained for up to 3 years after the last communication, unless required longer for legal purposes.
• Marketing Consent: Retained until you withdraw consent or opt out of marketing communications.

After the retention period expires, we securely delete or anonymize personal data in accordance with our data retention policies.

6. Your Rights

Under UK GDPR and EU GDPR (where applicable), you have the following rights regarding your personal data:

• Right of Access: You have the right to request access to your personal data and receive a copy of the data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
• Right to Restriction of Processing: You have the right to request that we limit how we use your personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
• Right to Object: You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your data protection rights have been violated. You can contact the ICO at ico.org.uk.

To exercise any of these rights, please contact us at privacy@echonovas.com. We will respond to your request within one month.

7. Cookies and Tracking

We use cookies and similar technologies to improve user experience and analyze platform usage. We may use analytics services to understand how users interact with our platform and to improve our services.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of our platform.

8. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through our platform or email.

9. Contact

For questions about this Privacy Policy or to exercise your data protection rights, please contact us:

• Privacy inquiries: privacy@echonovas.com
• General inquiries: nft@echonovas.com
• Or through our contact page