Whitechain Logo

WHITEWALLET PRIVACY POLICY

Last Updated: October 5, 2026

INTRODUCTION AND SCOPE OF THE POLICY

This Privacy Policy (hereinafter referred to as the “Policy”) governs the collection, processing, use, and disclosure of your Personal Data by Clear White Solutions Limited, registration number 2043789, having its registered address at: Intershore Chambers, P.O.Box 4342, Road Town, Tortola, British Virgin Islands (hereinafter referred to as the "Company", "we", "us", or "our") regarding all individuals accessing or using the Whitewallet mobile application, client software and bots on supported third-party messaging platforms (including Telegram) (collectively, the “Application”), as well as the promotional website https://whitewallet.app/ (the “Website”). The Website operates strictly as an informational landing page, whereas non-custodial wallet routing functionality is provided exclusively through the Application.

This Policy has been developed and enforced pursuant to Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”), the British Virgin Islands Data Protection Act, 2021 (hereinafter referred to as the “DPA”), and other applicable international data protection standards and regulations.

Unless explicitly defined herein, the terms used throughout this Policy shall carry the respective meanings ascribed to them in the Whitewallet Terms and Conditions or other relevant governing policies of the Company or applicable law.

This Policy constitutes the definitive governing framework for the Company’s data processing practices. In the event of any conflict, ambiguity, or inconsistency between the provisions of this Policy and any other document, agreement, or public statement issued by the Company regarding personal data processing, security, or regulatory compliance, the terms of this Privacy Policy shall strictly govern and supersede such conflicting provisions.

By accessing or using the Application or Website, or by accepting this Policy, you acknowledge that you have read and understood its terms and agree to the processing, storage, and usage of your personal data as described herein.

If you do not accept or agree to any provision contained within this Policy, you are strictly required to cease all access to and use of the Application and Website immediately.

SECTION 1: CATEGORIES OF PROCESSED DATA

1.1. In strict adherence to the principle of data minimization set forth in Article 5(1)(c) of the GDPR, the Company collects and processes only those categories of data that are strictly necessary to fulfill the specific operational, legal, and contractual purposes detailed in this Policy.

1.2. We obtain information through two primary mechanisms: (i) Personal Data provided directly and voluntarily by you through direct communication, feedback, or support channels, and (ii) technical and usage data automatically collected by our systems and application architecture during your access to or interaction with the Application or Website.

1.3. When you communicate with our Customer Support Team, submit technical inquiries, participate in surveys or promotional events, or provide product feedback, the Company processes:

  • Voluntary Contact Details: Email addresses, or messaging handles provided by you, processed strictly to the extent necessary to respond to and resolve your specific request.
  • Support & Inquiry Content: Narrative descriptions of technical issues, correspondence records, feedback submissions, and attached documentation (such as screenshots or system logs voluntarily provided by you).
  • Administrative Reference Identifiers: System-generated support ticket numbers, case IDs, or reference tokens used to manage, track, and administer your support requests.

1.4. When you launch, access, or interact with the Application, the Company automatically records limited technical, telemetry, and operational data, including:

  • Network & Device Identifiers: Internet Protocol (IP) address, technical device identifiers (e.g., Device ID, installation tokens), and network configuration attributes.
  • Coarse Location Data: Approximate, network-derived geographic location inferred exclusively from IP routing or network settings. The Application does not track, request, or store precise GPS location coordinates.
  • Product Interaction Data: Engagement metrics within the Application, including application launch events, interface taps, feature usage, clicks, scrolling activity, and view history.
  • Technical Diagnostic & Performance Data: Application crash logs, stack traces, and system performance metrics (such as launch times, application hang rates, and energy consumption metrics) used exclusively to monitor operational stability, detect bugs, and maintain service security.

1.5. For the purposes of applicable data protection laws, including GDPR and the BVI Data Protection Act, the Company acts as the Data Controller in respect of all data collected and processed through the Application, Website, and associated services. As the Data Controller, the Company independently determines the specific legal bases, operational purposes, and technical means governing the processing of your personal data.

1.6. We do not, under any circumstances, collect, transmit, or store:

  • Your Seed Phrase, private keys, or any wallet-recovery mechanism;
  • Any sensitive data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health-related information, or data concerning a natural person’s sex life or sexual orientation.

SECTION 2: PURPOSES AND LEGAL BASES OF DATA PROCESSING

2.1. In accordance with Article 5(1)(a) of the GDPR and relevant provisions of the BVI Data Protection Act 2021 (DPA), the Company is committed to processing your Personal Data lawfully, fairly, and in a transparent manner. Pursuant to Article 6 of the GDPR, every processing operation executed by Us rests upon a valid statutory legal basis.

2.2. Depending on your specific interactions with the platform, we process relevant categories of Personal Data for the following purposes:

  • To enable core wallet functions, including creating or importing non-custodial wallets, viewing digital asset balances, and facilitating transaction execution. Legal basis: Performance of a contract to which you are a party (Article 6(1)(b) GDPR) or execution of pre-contractual steps taken at your request;

  • To evaluate, administer, and respond to your requests, troubleshoot Application errors, and provide operational assistance. Legal Basis: Performance of a contract (Article 6(1)(b) GDPR) and the Company's Legitimate Interest (Article 6(1)(f) GDPR) in maintaining user satisfaction and resolving service issues;

  • To fulfill statutory requirements, defend legal claims, enforce our Terms and Conditions, and comply with lawful demands, warrants, or court orders from competent public or regulatory authorities. Legal Basis: Compliance with a legal obligation to which the Company is subject under applicable law (Article 6(1)(c) GDPR);

  • To analyze aggregate interaction metrics, monitor app stability, diagnose crash logs, evaluate performance via third-party telemetry and analytics tools, and develop new functionalities. Legal Basis: Legitimate Interest (Article 6(1)(f) GDPR) in securing, improving, and optimizing our software performance, or Consent (Article 6(1)(a) GDPR) where required by applicable regulations governing device tracking tools;

  • To deliver essential service updates, security alerts, and voluntary announcements concerning Application features, Website updates, and ecosystem events. Legal Basis: Legitimate Interest (Article 6(1)(f) GDPR) or your explicit Consent (Article 6(1)(a) GDPR) for direct opt-in communications, subject to your absolute right to opt out at any time.

2.3. Personal data may be processed for other purposes only when such objectives are transparently disclosed at the time of collection, authorized via explicit user consent, or executed under direct user instruction.

SECTION 3: DATA SHARING

3.1. The Company does not sell, rent, lease, or trade your Personal Data to any third party. Disclosures of Personal Data are strictly limited to instances where sharing is necessary to deliver the Application or Website services, fulfill contractual obligations, safeguard legitimate interests, or satisfy statutory legal requirements.

3.2. To ensure the continuous operation, technical delivery, and programmatic execution of the Application and Website, the Company reserves the right to disclose or render accessible necessary Personal Data, technical parameters, and system logs to third-party infrastructure providers, technical intermediaries, or operational partners. Such disclosures are executed strictly to the extent required to perform our contractual obligations, fulfill user-initiated protocol commands, or maintain overall network resilience and security pursuant to Article 6(1)(b) of the GDPR (Performance of a Contract) and Article 6(1)(f) of the GDPR (Legitimate Interests).

In accordance with the principles set forth above, your Personal Data may be disclosed to or accessed by the following authorized functional operational categories of recipients:

  • Cloud Infrastructure, Enterprise Security, and Hosting Providers: Cloud service hosting, data storage, enterprise security, and network monitoring platforms (including DDoS protection and load-balancing services) leveraged to preserve system stability, uptime, and operational integrity;

  • Telemetry, Diagnostic, and Performance Monitoring Vendors: Error-tracking, telemetry, log management, and application performance monitoring providers operating under strict Data Processing Agreements to identify network bugs, system latency, and software faults;

  • Authentication, Identity, and Session Protocol Intermediaries: Third-party identity authentication, OAuth, and connection protocol tools, strictly to the extent necessary to verify credentials, exchange tokens, or establish wallet session connections initiated directly by you;

  • Communications and Operational Notification Partners: Infrastructure partners and messaging platforms used to send essential notifications, administrative alerts, account updates, or critical operational communications;

  • Form Management and Data Collection Processors: Third-party form management and survey software providers, acting as Data Processors under formal data processing agreements to securely collect, structure, and route application forms and user responses;

  • Affiliated Corporate Entities: Our parent company, subsidiaries, or corporate affiliates (if any) solely to the extent necessary for internal administrative, operational, and software management purposes;

  • Professional Advisors and Independent Contractors: External legal counsel, auditors, accountants, financial advisors, compliance experts, and individual IT contractors bound by statutory or contractual duties of confidentiality, solely to enable them to render professional services to the Company;

  • Legal and Regulatory Compliance: We may disclose processed personal data when required by applicable laws or regulations, or when strictly necessary to comply with an enforceable mandate from a competent court, regulatory authority, or law enforcement body having lawful jurisdiction over the Company. Such disclosures are executed pursuant to valid, legally binding judicial orders, court warrants, subpoenas, or official regulatory requests issued by authorized public bodies within a jurisdiction to which the Company is legally subject.

3.3. In the context of any structural business transition, including a merger, acquisition, joint venture, divestiture, assignment, or sale of Company assets, processed data (including system logs, workspace metrics, and technical datasets) may be transferred to the acquiring legal entity as an integrated component of the underlying transaction. Following such a corporate event, the transferee entity shall assume data controller status over the relevant processing operations. Your continued interaction with the Application or Website, following the completion of the transfer, shall serve as acknowledgment of the operational transition. Any such transfer remains contingent upon the legal successor agreeing to safeguard your Personal Data under privacy standards no less protective than those set forth in this Privacy Policy.

3.4. The Company reserves the right to irreversibly anonymize your Personal Data through technical measures so that it can no longer be associated with or used to identify an individual, directly or indirectly. Under the GDPR and the DPA, anonymized information ceases to constitute Personal Data. Consequently, the Company may retain, process, and utilize such anonymized, statistical, or aggregated data indefinitely for software research, operational development, system performance analysis, and service optimization without further notice to you or the requirement of additional approval.

3.5. If you choose to publish reviews, ratings, or public comments regarding Whitewallet on independent third-party marketplaces or digital platforms (including the Apple App Store, Google Play Store, or external public forums), any Personal Data or content voluntarily disclosed by you becomes accessible to the public. The Company assumes no responsibility or liability for the privacy practices, content governance, or data processing activities of such independent third-party platforms.

3.6. We may invite you to participate in optional surveys or submit direct product feedback to assist us in evaluating user experience and improving the Application or Website. If you elect to participate, the collection and processing of Personal Data contained within your survey responses are conducted strictly on the basis of your explicit Consent (Article 6(1)(a) GDPR). Your participation remains entirely voluntary, and you retain the right to withdraw your consent or decline participation at any time.

3.7. Certain software features accessible within the Application are operated exclusively by independent third-party service providers. Interacting with these features involves the client-side transmission of necessary technical parameters (e.g., wallet address(es), network and token identifiers, transaction amounts and parameters, signed transactions or messages, and technical data such as your IP address and device information) directly to these external infrastructure layers. Such third parties act as independent Data Controllers, and the Company assumes no legal liability for their operational processing, privacy compliance, or security measures.

SECTION 4: INTERNATIONAL DATA TRANSFER

4.1. Where Personal Data collected from individuals in the European Economic Area (EEA) is transferred to, stored, or processed in third countries outside the EEA, to guarantee that such Personal Data receives a level of protection equivalent to that guaranteed within the European Union, all cross-border data transfers strictly comply with the requirements of Chapter V of the EU GDPR and equivalent provisions under the BVI Data Protection Act 2021 (DPA).

4.2. Where data is transferred to jurisdictions that have not received an official adequacy decision from the European Commission, the Company relies on lawful transfer mechanisms, primarily the European Commission's approved Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) of the GDPR.

SECTION 5: DATA RETENTION

5.1. In strict adherence to the principle of storage limitation under Article 5(1)(e) of the GDPR and equivalent provisions of the BVI Data Protection Act 2021 (DPA), the Company retains Personal Data only for as long as reasonably necessary to fulfill the operational purposes for which it was collected, maintain active support interactions, or satisfy applicable legal, statutory, regulatory, and reporting obligations.

5.2. Specific retention schedules for processed Personal Data are evaluated dynamically based on the following statutory and operational criteria:

  • Personal Data processed to provide support, support correspondence, or core functionality is retained for the duration of your active interaction with the Application or Website;

  • Personal Data (including technical logs or communications) necessary to enforce our Terms and Conditions, resolve ongoing disputes, or establish, exercise, and defend legal claims is retained for the duration of the applicable statutory limitation periods under governing law. Please be aware that deleting or uninstalling the Application from your device, or requesting the erasure of your Personal Data pursuant to Article 17 of the GDPR, does not compel the immediate deletion of data that the Company is statutorily required to retain under applicable law, or data strictly necessary to defend against pending legal actions. In such cases, your Personal Data will be restricted from active processing and retained solely until the applicable statutory retention period expires;

  • The volume, nature, and degree of sensitivity of the Personal Data, alongside the underlying legal basis for its processing.

5.3. Notwithstanding standard operational deletion schedules, system event logs, security audit trails, and technical network metadata (including IP logs associated with Application or Website breaches, DDoS mitigation, network anomalies, or suspected system abuse) are exempted from immediate deletion. Such operational data is retained strictly to the extent required to investigate technical security incidents, prevent fraud, and safeguard network integrity pursuant to Article 6(1)(f) GDPR (Legitimate Interests).

5.4. In alignment with the principle of data minimization, the Company systematically conducts periodic reviews of all stored Personal Data against operational necessity and legal constraints. Once Personal Data is no longer required for its specified processing purposes or upon the expiration of statutory retention thresholds, the Company ensures that such data is either:

  • Permanently purged and securely deleted from active and backup infrastructure; or

  • Irreversibly anonymized for long-term technical analytics, research, and service optimization.

SECTION 6: DATA SECURITY

6.1. In strict compliance with Article 32 of the GDPR and relevant provisions of the BVI Data Protection Act 2021 (DPA), the Company implements appropriate technical, organizational, and administrative safeguards to protect your Personal Data against unauthorized or unlawful processing, accidental loss, destruction, alteration, damage, or disclosure. Taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the risk to the rights and freedoms of natural persons, our security infrastructure includes:

  • Technical and Electronic Measures: Industry-standard encryption protocols applied to Personal Data both in transit and at rest, pseudonymization, and data anonymization mechanisms. Computer systems, servers, and database file storage are protected by strict log-in restrictions, firewalls, redundant infrastructure, regular software vulnerability patching, and continuous telemetry monitoring by our technical security team to maintain system confidentiality, integrity, availability, and resilience;

  • Management and Administrative Measures: Internal administrative access to Personal Data and database systems is strictly restricted on a "need-to-know" and "need-to-use" basis. All employees, system engineers, platform operators, and independent contractors are bound by legally enforceable non-disclosure agreements (NDAs) and contractual confidentiality duties. System patch configurations, privacy policies, and security rules are subject to routine internal audits;

  • Physical and Facility Measures: Tangible data media, physical infrastructure, and server environments containing or processing Personal Data are maintained in secure facilities governed by strict physical access controls to prevent unauthorized physical entry or hardware tampering.

6.2. While the Company employs robust safeguards to protect your Personal Data, security is a shared operational responsibility. You acknowledge and agree that you are responsible for maintaining the security of your own digital environment. You are strictly required to take reasonable precautions to protect your personal device, access credentials, and connected accounts.

The Company never has access to, nor stores, your Seed Phrase or private keys. The sole responsibility for securing, storing, and safeguarding your Seed Phrase rests exclusively with you.

6.3. While the Company makes every reasonable effort to secure your Personal Data using industry-standard protocols, no method of electronic transmission over the Internet or digital storage architecture can be guaranteed as completely immune to security breaches. By providing Personal Data to Us and using the Application or Website, you acknowledge and assume the inherent risks involved in Internet-based interactions.

To the fullest extent permitted by applicable law, the Company shall not be liable for any loss, corruption, or unauthorized access to Personal Data resulting from technical failures, hacking, third-party attacks, or incidents beyond our reasonable control, provided such events are not the direct result of the Company's deliberate actions or gross negligence.

If you suspect, identify, or become aware that your interaction with the Application or Website is no longer secure, or if you believe your Personal Data or local wallet environment has been compromised, you are urged to notify our security response team immediately at support@whitewallet.app so that emergency protective measures can be executed.

SECTION 7: PRIVACY RIGHTS

7.1. Depending on your location, and applicable data protection laws, you may exercise the following rights regarding your Personal Data:

  • Right of Access — You may request confirmation whether we process your personal data and, if so, obtain a copy of that data.

  • Right to Rectification — You may request the correction of inaccurate or incomplete active configuration parameters within your Application settings. This right applies strictly to User-configurable variables and programmatically excludes any retrospective modification of automatically recorded historical machine telemetry, share logs, or network validation metrics, except where mandatory statutory obligations apply or where processing takes place outside non-amendable public ledger structures.

  • Right to Erasure — You may request the deletion of your personal data, subject to legal obligations that may require us to retain certain information.

  • Right to Restriction of Processing — You may request that we restrict the processing of your personal data in certain circumstances.

  • Right to Data Portability — You may request to receive the specific technical variables you have directly provided to the Application under contract in a structured, commonly used, and machine-readable format. In strict accordance with applicable regulations, this right shall not adversely affect the rights, freedoms, or trade secrets of others, and explicitly excludes any extraction rights over our proprietary software logic, application source code, or internal infrastructure metrics, save for user-provided data required to be portable pursuant to Article 20 of GDPR.

  • Right to Object — You have the right to object to the processing if it is carried out on a legal basis other than consent.

  • Right to Lodge a Complaint — You have the right to lodge a complaint with a competent supervisory authority if you believe we have infringed your rights.

7.2. To exercise any valid privacy rights outlined in Section 7.1, requests must be transmitted directly to support@whitewallet.app.

7.3. Pursuant to Article 11(2) and Article 12(6) of the GDPR, as the Company does not maintain user identity databases or centralized account records, the execution of any data subject request under Section 7.1 is strictly conditional upon the user providing verifiable proof of technical control over the connected device, wallet, or requested dataset. To preserve infrastructure security and prevent unauthorized data extraction, we reserve the right to require Users to authenticate their authorization through platform-designated validation procedures. Failure to satisfy these technical authentication thresholds shall result in the rejection of the request due to the objective impossibility of verifying the identity of the data subject.

SECTION 8: CHILDREN’S PRIVACY

8.1. The Application and Website are strictly intended for adult users and are not directed to, marketed to, or designed for children. The Company does not knowingly solicit, collect, store, or process Personal Data from individuals under the age of eighteen (18) years (or the applicable statutory age of majority and digital consent in your jurisdiction). If you are under eighteen (18) years of age or the applicable legal threshold, you are strictly prohibited from downloading, accessing, or using the Application or Website, and from transmitting any Personal Data through our interfaces.

8.2. If the Company discovers or is formally notified that it has inadvertently collected or processed Personal Data from a child under the applicable legal age limit without verified parental or legal guardian consent, the Company will initiate immediate internal verification procedures. Upon confirmation, the Company will execute all necessary technical and organizational measures to permanently purge and delete such data from our active databases, system logs, and operational storage without undue delay.

8.3. If you are a parent or legal guardian and have reason to believe that your child has provided Personal Data to Us without appropriate verifiable consent, please contact our Privacy Team immediately at support@whitewallet.app so that prompt remedial and deletion measures can be executed.

SECTION 9: AUTOMATED DECISION-MAKING PROHIBITION

9.1. The Company does not utilize Personal Data collected through the Application or Website for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR.

9.2. While technical features, decentralized node interactions, or smart contract interfaces may execute automated programmatic logic initiated directly by the User, such automated routing does not constitute automated individual decision-making, behavioral scoring, or profiling under applicable data protection legislation. All administrative and compliance determinations remain subject to human review and oversight.

SECTION 10: CHANGES TO THIS POLICY

10.1. The Company retains the unilateral right to amend, update, modify, or overhaul any portion of this Privacy Policy at any time to reflect shifting regulatory mandates, technical infrastructure optimizations, or operational data-routing modifications. Any updated version of this Policy will be deployed directly within the Application and published on the Website, with the dynamic "Last Updated” modified at the very top of the document.

10.2. For material modifications that substantially alter the scope, categories, or legal bases of data processing, the Company shall provide a general conspicuous announcement within the Application or on the Website prior to or concurrent with the implementation of such updates to satisfy corporate transparency benchmarks.

SECTION 11: DISPUTE RESOLUTION

11.1. This Privacy Policy, alongside any non-contractual obligations or infrastructural data disputes arising out of or in connection with it, shall be governed by, and construed exclusively in accordance with, the laws of England and Wales, without reference to its choice of law or conflict of laws principles. Subject to the regulatory carve-out specified in Section 11.2, any controversy, claim, technical divergence, or dispute arising out of or relating to this Policy, including its formation, interpretation, breach, or validity, shall be referred to and finally and exclusively resolved by binding, confidential, individual arbitration under the Arbitration Rules of the London Court of International Arbitration (LCIA) in force at the time of commencement. The seat, or legal place, of the arbitral proceedings shall be London, United Kingdom. The tribunal shall consist of one single independent arbitrator selected in strict accordance with the LCIA Rules, and the language to be utilized throughout the entire proceedings shall be English.

11.2. In strict conformity with applicable data protection frameworks, nothing in this Section shall impair or prejudice the statutory right of users residing within the EEA or other applicable jurisdictions to lodge an administrative complaint with a competent supervisory data protection authority or bring claims before their local competent courts where such consumer rights are mandatory under law.

11.3. This Privacy Policy is executed in the English language. In the event of any operational discrepancy, translation variance, or interpretive contradiction between the English version and any translated version deployed within the Application or on the Website, the English language text shall control, govern, and prevail in all circumstances.

SECTION 12: CONTACT US

If you have any questions regarding this Policy, please do not hesitate to contact us using the contact details below:

Clear White Solutions Limited
Registration Number: 2043789
Registered Address: Intershore Chambers, P.O.Box 4342, Road Town, Tortola, British Virgin Islands
Email: support@whitewallet.app