This policy explains how we process the personal data of visitors to the AerariumChain marketplace and, once available, of people who create an account or buy. It covers this site, buyer accounts and purchases.
1. Data controller
Werea Srl (Wired Enterprise Re-Enhancement of Assets S.r.l.), via Lamarmora 13/c, 20900 Monza (MB), Italy, VAT IT08833540969, certified email werea@legalmail.it ("AerariumChain", "we"). Our US subsidiary AerariumChain Corp. may process data on our behalf under an intragroup agreement. For any request, write to our privacy contact: dpo@aerariumchain.com.
2. What data and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Browsing and sign-in data (IP address, browser and user agent, pages requested, date and time) | Running the site, access security, abuse prevention; sign-in sessions store IP address and user agent for access security | Legitimate interest (art. 6.1.f GDPR) | Up to 12 months in the hosting provider's logs; sign-in sessions up to 30 days |
| Cookie and language preferences | Remembering your choices | Legal obligation and legitimate interest | 6 months (consent), until cleared from the browser (language) |
| Usage statistics (Google Analytics 4, anonymised IP) | Understanding how the site is used and improving it | Consent (art. 6.1.a) | 14 months |
| Name and email | Sending you news about works and museums (optional checkbox at registration) | Consent (art. 6.1.a GDPR) | Until you withdraw consent |
| Data you send us by email (name, email, message, work of interest) | Answering purchase, license or information requests | Pre-contractual steps and legitimate interest (art. 6.1.b and f) | 24 months after the last contact |
| Account and purchase data (name, email, billing data, orders, licenses, units in custody, wallet addresses for transfers) | Managing accounts, orders, deliveries, licenses and support | Contract (art. 6.1.b) | For the life of the account; tax records 10 years |
| Tax and accounting data | Legal obligations | Legal obligation (art. 6.1.c) | 10 years |
We do not process special categories of data and we do not take decisions based solely on automated processing.
3. Payments and blockchain
Payments are processed by Stripe on Werea Srl's account: we do not store full card details. NFTMicro units in custody are recorded in our systems; if you ask for a transfer to your wallet, the address and the transaction on the public Algorand blockchain become public and, by the nature of the technology, cannot be changed or erased.
4. Recipients
- Amazon Web Services EMEA SARL (hosting, Ireland), processor;
- Google Ireland Ltd and Google LLC (statistics and measurement, only with consent);
- Stripe (Stripe Payments UK Ltd / Stripe Payments Europe Ltd), for payments, also as independent controller for fraud prevention;
- SweetHive Ltd (United Kingdom), processor, which provides the account platform (accounts are created on SweetHive) and, temporarily, collects payments on behalf of Werea Srl;
- Twilio Inc. (SendGrid, United States), processor, for sending transactional emails;
- Algonode (algonode.cloud): work pages read public Algorand blockchain data from this service directly from your browser, so Algonode receives your IP address;
- the museum that published the work, for the data needed to issue a license or fulfil an order;
- advisers and authorities, where the law requires.
5. Transfers outside the European Economic Area
Some providers process data in the United Kingdom (SweetHive Ltd, Stripe Payments UK Ltd), on the basis of the European Commission's adequacy decision, or in the United States (for example Google LLC and Twilio Inc.). Transfers to the United States rely on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
6. Your rights
You can ask for access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest; you can withdraw consent at any time (for cookies, with the "Cookie preferences" link at the bottom of every page) without affecting earlier processing. Write to our privacy contact: dpo@aerariumchain.com. You may lodge a complaint with the Italian data protection authority (garanteprivacy.it) or the authority of your country.
7. Minors
The site is not aimed at children under 16; purchases are reserved for adults.
8. Changes
We will publish any change here, with the update date.