PRIVACY POLICY

DLT Tech SHPK (hereinafter the “Service Provider”, “NFTiFay”, “we”, “our”, or “us”) develops and operates the NFT marketplace platform (hereinafter the “Platform”). In the course of providing our services (hereinafter the “Service”), we process personal data relating to you.

We are committed to protecting your personal data. We process personal data in accordance with applicable data protection laws, including, where applicable, the EU General Data Protection Regulation (GDPR) and Albania’s Law No. 124/2024 on Personal Data Protection. KPMG+1

1. Data Controller

The controller of your personal data is:

DLT Tech SHPK
Address: 8R912+CP6, Rruga Janos Hunyadi, Tiranë, Albania
Email: [email protected]

2. Categories of Personal Data

We may collect and process the following personal data about you:

First name and surname
Email address
Phone number
Wallet address
Information about your transactions on the Platform
Identity document(s), where required (e.g., KYC)
Proof of residence, where required
Payment-related information (where applicable)
Additional information required for KYC / AML compliance
Device and usage information (e.g., IP address, browser type, operating system, and similar technical identifiers)

3. Purposes and Legal Bases of Processing

We process your data for the following purposes (and legal bases, where applicable):

To manage contractual and pre-contractual relations (GDPR Art. 6(1)(b))
To create and manage user profiles and accounts (GDPR Art. 6(1)(b))
To provide customer support and operate the Platform (GDPR Art. 6(1)(b) and/or 6(1)(f))
To ensure security and proper technical functioning of the Platform (GDPR Art. 6(1)(f))
To prevent and detect fraud and to comply with anti-money laundering / counter-terrorism financing obligations (GDPR Art. 6(1)(c) and/or 6(1)(f))
To manage payments, disputes, and rights-related requests (GDPR Art. 6(1)(f); and/or 6(1)(c) where legally required)
Where required, to rely on your consent for specific processing activities (GDPR Art. 6(1)(a))

Some personal data may be mandatory. If you do not provide it, we may be unable to provide all or part of our Services.

4. Recipients of Personal Data

We may share personal data with:

Subcontractors and service providers (e.g., hosting providers, payment processors, identity verification/KYC providers, security service providers)
Legal or regulatory authorities where required by law or lawful request
Auditors, accountants, legal counsel, and AML compliance professionals

Where required, third parties are engaged under appropriate contractual safeguards (including data processing agreements).

5. Your Rights as a Data Subject

Subject to legal limitations, you may have the right to:

Access your personal data
Correct inaccurate data
Request deletion of your personal data (“right to be forgotten”), where applicable
Object to processing
Restrict processing
Data portability
Withdraw consent (where processing is based on consent)

To exercise your rights, contact us at [email protected].

You may also have the right to lodge a complaint with the competent supervisory authority, including the Commissioner for the Right to Information and Personal Data Protection (Albania). DLA Piper Veri Koruma+1

6. Profiling / Monitoring

To comply with AML obligations and to protect the Platform, we may use monitoring and third-party tools to detect fraud or suspicious activity. This may involve profiling, subject to applicable law.

7. Storage (Retention) of Personal Data

We retain personal data for as long as your account is active and as needed to provide the Service. We may retain certain data for longer where necessary:

To comply with legal obligations (including AML/financial compliance)
To establish, exercise, or defend legal claims
For security, fraud prevention, and dispute resolution

8. Transfers Outside the EEA

Where personal data is transferred outside the European Economic Area (EEA) and the GDPR applies, we implement appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms. European Commission

9. Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or loss. Access to personal data is limited to authorized personnel under confidentiality obligations.

10. Links to Other Websites

The Platform may contain links to third-party websites. This Privacy Policy applies only to our Platform. We are not responsible for the privacy practices or content of third-party sites.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date. Where required, we may request your acceptance of materially updated terms.

12. Contact Us