d3 Vaultd3 Vault

GDPR

Privacy policy

1) Introduction and controller contact details

1.1 Thank you for visiting our website. This policy explains how we handle your personal data when you use the site. Personal data means any information that can identify you.

1.2 The controller for processing on this website under the GDPR is Alexander Denner, D3 Chain, Andersenstrasse 4, 59557 Lippstadt, Germany, Tel.: +49 17642849702, email: kontakt@d3chain.com. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

2) Data collected when you visit the website

2.1 If you only browse the site without registering or sending us information, we collect only the data your browser sends to the server (server log files). When you open the site we collect the following data that is technically required to display it:

  • The page visited
  • Date and time of access
  • Amount of data transferred in bytes
  • Referrer / source
  • Browser used
  • Operating system used
  • IP address (anonymised where applicable)

Processing is based on Art. 6(1)(f) GDPR: our legitimate interest in the stability and functionality of the website. The data is not passed on or used otherwise. We may review the logs later if there are concrete indications of unlawful use.

2.2 This website uses SSL/TLS encryption to protect the transmission of personal data and other confidential content (for example enquiries to us). You can recognise an encrypted connection by “https://” and the padlock in the browser bar.

3) Hosting

The website d3vault.eu is hosted by Vercel Inc. (USA); the API is hosted by Railway Corporation (USA, railway.app). Both process technical operations data to provide the service. Where data is transferred to the USA or other third countries, this is based on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework where the provider participates.

4) Cookies and analytics

4.1 Technically necessary storage in the browser arises at sign-in (HttpOnly cookie d3_vault_key for the API key) and for your cookie-banner choice (local storage d3-vault-analytics). The dashboard does not work without the sign-in cookie. You can restrict or delete cookies and local storage in your browser.

4.2 With your consent (Art. 6(1)(a) GDPR) we use Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent: Google LLC, USA). Page views, approximate location, and device/browser data are measured. The script (measurement ID G-1PWJJDEB5M) loads only after you click “Accept” on the banner. If you click “Reject”, no analytics take place. You can withdraw consent at any time via cookie settings, or by deleting the local-storage entry d3-vault-analytics and reloading the page.

Cookies or similar storage may be set and data may be transferred to the USA. Where Google participates in the EU-US Data Privacy Framework or uses Standard Contractual Clauses, we rely on that for the transfer. Google truncates IP addresses where the service provides for that. Further information: https://policies.google.com/privacy.

5) Contact

5.1 When you contact us (for example via the contact form or email), personal data is processed solely to handle and answer your request and only to the extent required.

The form on d3vault.eu opens an email from your device to kontakt@d3chain.com. We process name, email, optional company, requested plan and message in order to answer enquiries and — if a contract is concluded — to provision access.

The legal basis is our legitimate interest in answering your request under Art. 6(1)(f) GDPR. If the contact aims at a contract, Art. 6(1)(b) GDPR is an additional legal basis. Your data is deleted when the matter is closed, unless statutory retention duties apply.

6) Processing to perform the contract (Vault)

After access is provisioned you send product-passport data to the API. We process that data to perform the contract (Art. 6(1)(b) GDPR): storing a copy, hash, timestamp and public resolve URL as agreed. You or your company remain responsible for the content of the passport data.

For RFC 3161 timestamps we send cryptographic hashes to a time-stamping authority. The hashes are not plaintext product data and are not used for marketing.

Ingest with a primary system on d3passport.com, d3dpp.com, d3bpass.com or d3bpp.com is refused.

7) Data-subject rights

7.1 Applicable data-protection law grants you the following rights vis-à-vis us as controller with regard to the processing of your personal data (conditions in the cited legal bases):

  • Right of access, Art. 15 GDPR;
  • Right to rectification, Art. 16 GDPR;
  • Right to erasure, Art. 17 GDPR;
  • Right to restriction of processing, Art. 18 GDPR;
  • Right to be informed, Art. 19 GDPR;
  • Right to data portability, Art. 20 GDPR;
  • Right to withdraw consent, Art. 7(3) GDPR;
  • Right to lodge a complaint, Art. 77 GDPR.

For Lippstadt the competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW). Contact for privacy requests: kontakt@d3chain.com.

7.2 RIGHT TO OBJECT

Where we process your personal data on the basis of a balancing of interests because of our overriding legitimate interest, you have the right to object to that processing at any time on grounds relating to your particular situation, with effect for the future.

If you object, we will stop processing the data concerned. Further processing remains reserved if we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

If we process your personal data for direct marketing, you have the right to object at any time to processing for such marketing. You may object as described above.

If you object, we will stop processing the data concerned for direct-marketing purposes.

8) Retention of personal data

Retention of personal data is determined by the legal basis, the processing purpose and — where applicable — statutory retention periods (for example commercial and tax law).

Where processing is based on explicit consent under Art. 6(1)(a) GDPR, the data is stored until you withdraw consent.

Where statutory retention periods apply to data processed for contracts or similar obligations under Art. 6(1)(b) GDPR, the data is deleted routinely after those periods, unless it is still required to perform or initiate a contract and/or we have no remaining legitimate interest in further storage.

Where processing is based on Art. 6(1)(f) GDPR, the data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Integrity evidence (hashes, timestamps) is kept as long as the service purpose or legal duties require.

Unless other information in this policy on specific processing situations provides otherwise, stored personal data is deleted when it is no longer needed for the purposes for which it was collected or otherwise processed.

As of 12 Oct 2026 (d3 Vault, Google Analytics only after consent)