Legal  /  Privacy policy

Privacy Policy

Last Updated: September 14, 2026

This Privacy Policy (this “Policy”) describes how the 0verwatch Foundation, a Cayman Islands foundation company (the “Foundation,” “we,” “us,” or “our”), collects, uses, discloses, and protects information when the User uses the 0verwatch contributor network, website, tools, workspaces, reports, intelligence products, recovery-coordination services, communications, and all related features and functionality (collectively, the “Service”). It should be read together with the 0verwatch Terms of Service (the “Terms”).

By accessing or using the Service, the User acknowledges and agrees to the terms of this Policy. If the User does not agree to this Policy, the User shall not access or use the Service. Capitalized terms not defined here have the meaning given in the Terms.

1. Who We Are and Scope

0verwatch operates a coordinated contributor network that detects threats to digital assets, supports victims of theft and fraud, and pursues recovery, working with exchanges, custodians, wallet providers, and six contributor communities (developers, investigators, intelligence contributors, standards authors, legal professionals, and amplifiers).

This Policy applies to personal data the Foundation processes as operator of the Service. It does not apply to processing by independent contributors, partner institutions, or courts acting in their own capacity. Partner datasets made available inside the Service remain subject to the partner’s license and any additional handling rules the Foundation posts.

This Policy applies to Personal Data collected through the Service, the Foundation’s website, email communications, and any other channels through which the Foundation interacts with the User. It does not apply to information collected by third parties through their own websites, applications, or services, even if linked to or accessible from the Service.

Controller. For website, account, identity-assurance, staking, payout, and network-operation data, the Foundation is the controller. For certain case files prepared for litigation or regulatory engagement, another Foundation affiliate, purpose trust, protected cell, or legal-defense entity described in the Foundation’s entity stack may be a separate controller or processor. The Foundation shall identify the responsible entity where required by applicable law.

Processor. Where the Foundation processes Personal Data on behalf of a partner institution, exchange, or custodian under that party’s instructions (for example, when performing investigations or analytics services commissioned by that party), the Foundation acts as a processor. In such cases, the partner institution is the controller, and the Foundation processes Personal Data in accordance with a written data processing agreement with that controller. This Policy does not govern the Foundation’s processing as a processor; the User should refer to the relevant controller’s privacy policy for information about such processing.

2. Interpretation

“Personal Data” — Information that relates to an identified or identifiable individual.

“Usage Data” — Data collected automatically from use of the Service or its infrastructure.

“You” — The individual using the Service, or the organization on whose behalf that individual acts. “User” has the same meaning as “You.”

“Device” — Any device that can access the Service.

“Sensitive Personal Information” — Personal Data that reveals a consumer’s government-issued identification number, financial account information, precise geolocation, racial or ethnic origin, religious beliefs, health information, biometric data used for identification, or the contents of communications where the Foundation is not the intended recipient, as those categories are defined under applicable U.S. state privacy laws.

“Third Party” — Any person or entity other than the Foundation, the User, or a service provider processing data on the Foundation’s behalf.

“Processing” — Any operation performed on Personal Data, whether automated or manual, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

“Special Categories of Data” — Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, as defined under the GDPR.

“Data Protection Laws” — All applicable legislation and regulations relating to the Processing of Personal Data and privacy, including the GDPR, the UK GDPR, the Data Protection Act 2018, U.S. state privacy laws, the Cayman Islands Data Protection Act (2017), and any successor or replacement legislation.

3. Categories of Data We Collect

3.1 Data You Provide

• Account and contact data: name, email, phone, organization, role, mailing address where needed for payouts or legal process.
• Identity-assurance and Know Your Customer (“KYC”) data: government-issued identification, liveness or proof-of-personhood verification, and sanctions or politically exposed person (“PEP”) screening results. The Foundation collects such KYC information solely upon, and as a condition precedent to, the payout of any claim, CVU settlement, or other distribution of funds to the User. The Foundation does not require KYC information as a condition of account creation, access to publicly available materials, or general use of the Service.
• Wallet and on-chain identifiers: public wallet addresses, signed verification messages, staking and slashing records, governance votes.
• Professional profile data: community membership, skills, rate expectations, licenses, bar admissions, and references.
• Work product and communications: submissions, Reports comments, case notes, evidence the User uploads, RFQs, invoices, and messages sent through the Service.
• Victim-intake data if the User is a victim or authorized representative: description of the incident, transaction hashes, exchange accounts, supporting documents, and contact preferences. The Foundation treats this as highly sensitive.
• Payment data: stablecoin or bank payout instructions, tax forms, and optional WATCH conversion elections. The Foundation does not collect seed phrases or private keys and shall never ask for them.

3.2 Usage Data

The Foundation automatically collects Device IP address, browser type and version, pages visited, date and time, time on page, referring URLs, unique device identifiers, mobile OS and browser, crash and diagnostic logs, and approximate location derived from IP. When the User accesses the Service from a mobile device, the Foundation may collect device type and mobile ID.

The Foundation may also collect information about the User’s interaction with the Service, including clickstream data, search queries entered within the Service, feature engagement metrics, and error or performance logs. Where the User accesses the Service through an application programming interface (“API”), the Foundation may log API call metadata, including timestamps, endpoints accessed, and authentication tokens used (but not their contents).

3.3 Tracking Technologies

The Foundation uses cookies and similar technologies (pixels, tags, local storage) to operate the Service, remember preferences, authenticate sessions, and measure usage.

• Necessary / essential cookies (session): required to authenticate users, prevent fraud, and deliver requested features. The Service may not function without them.
• Preference / functionality cookies (persistent): remember language, delivery-channel, and similar choices.
• Analytics cookies (persistent): help the Foundation understand feature use and reliability. The Foundation shall identify analytics providers in the Foundation’s cookie notice when live.
• Advertising / targeting cookies (persistent): The Foundation does not currently use advertising or targeting cookies, but reserves the right to do so in the future, with notice and consent where required by applicable law.

The User may instruct the User’s browser to refuse cookies. If the User refuses necessary cookies, parts of the Service may be unavailable. The Foundation does not use Flash cookies.

The Foundation honors Global Privacy Control (“GPC”) signals where required by applicable law. When the Foundation detects a GPC signal from the User’s browser, the Foundation shall treat it as a valid opt-out request for the sale or sharing of Personal Data, to the extent applicable under the relevant jurisdiction’s privacy law.

When the Foundation uses third-party analytics tools, those tools may include Google Analytics, which helps the Foundation measure traffic, understand feature use, and improve the Service. Google Analytics may collect information about the User’s use of the Service through cookies and similar technologies. The User may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on or using the controls provided by Google and the User’s browser. The Foundation shall identify analytics providers in the Foundation’s cookie notice when live.

3.4 Data from Partners and Public Sources

The Foundation may receive on-chain labels, tracing hops, sanctions-list hits, exchange or custodian referrals (subject to their notices), and publicly available blockchain data. Partner enrichment is gated by trust tier and handling label and is limited to what the underlying data license permits.

3.5 Aggregate and De-Identified Data

The Foundation may create aggregate, de-identified, or anonymized data from Personal Data by removing or modifying information that identifies, or could reasonably be used to identify, the User. Aggregate, de-identified, or anonymized data is not Personal Data and may be used for any lawful purpose, including research, analytics, benchmarking, and improving the Service, subject to applicable law.

3.6 Special Categories of Data

The Foundation does not intentionally collect Special Categories of Data. However, in limited circumstances, such data may be incidentally included in materials the User uploads (for example, evidence files or victim-intake submissions that reference health conditions or ethnic background). Where the Foundation becomes aware that it has received Special Categories of Data, the Foundation shall process it only to the extent strictly necessary for the purposes described in this Policy, on the basis of explicit consent, the establishment, exercise, or defense of legal claims, or another lawful ground under applicable Data Protection Laws. The Foundation applies heightened security and access controls to any Special Categories of Data it processes.

4. How We Use Personal Data

The Foundation uses Personal Data to:

• Provide, maintain, secure, and improve the Service, including trust-tier gating, handling-label routing, and access control.
• Personalize the User’s experience and deliver content relevant to the User’s interests.
• Verify identity and control of wallets or packages; screen against sanctions and Restricted Person rules; detect sybil activity, infiltration, and reward farming. KYC verification is conducted solely in connection with the payout of claims or distributions as described in Section 3.1.
• Onboard contributors, assign or accept work, price work in CVU bands, settle payouts, and optionally convert CVUs to WATCH at an oracle rate.
• Operate staking, slashing, reputation, and governance records.
• Triage cases, preserve evidence (including hashing and trusted timestamping), coordinate investigations and legal pursuit, and communicate with authorized parties.
• Contact the User about the Service, security events, standing or slashing notices, and (with opt-out) service news similar to services the User already uses.
• Communicate with the User for marketing purposes where the User has opted in or where permitted by applicable law.
• Conduct internal research, testing, and product development, including training and improving algorithms and models used in the Service, provided that Personal Data used for such purposes is subject to appropriate safeguards including, where practicable, de-identification or pseudonymization.
• Verify and respond to data subject access requests, complaints, and other inquiries received by the Foundation.
• Enforce the Terms, protect victims, contributors, partners, and the Foundation, and meet legal obligations.
• Analyze usage trends and Service reliability, using aggregated or de-identified data where practicable.
• Evaluate or complete a merger, reorganization, or transfer of assets in which Personal Data is among the assets transferred.

Legal bases (where a GDPR-style framework applies) include: performance of a contract (the Terms); legitimate interests in operating a secure contributor and recovery network, preventing abuse, and improving the Service; compliance with legal obligations (sanctions, tax, lawful process); and consent where the Foundation relies on it (certain cookies, optional marketing, certain identity-assurance steps). The User may withdraw consent without affecting prior lawful processing.

Lawful Basis Mapping. The following table summarizes the primary lawful basis the Foundation relies on for each processing activity:

(a) Providing, maintaining, and improving the Service — Performance of contract (the Terms) and legitimate interests. (b) Identity verification, KYC, and sanctions screening — Legal obligation and legitimate interests in preventing financial crime. (c) Triage, evidence preservation, and investigation coordination — Legitimate interests in supporting victims and pursuing recovery. (d) Staking, slashing, reputation, and governance — Performance of contract (the Terms). (e) Contacting the User about the Service and security events — Performance of contract and legitimate interests. (f) Marketing and promotional communications — Consent (where required) or legitimate interests. (g) Analytics, research, and product development — Legitimate interests (with de-identification or pseudonymization where practicable). (h) Compliance with legal obligations — Legal obligation. (i) Business transactions (mergers, transfers) — Legitimate interests. Where the Foundation relies on legitimate interests, it has conducted a balancing assessment to ensure that the User’s rights and freedoms do not override those interests. The User may request details of any such assessment by contacting the Foundation at info@0verwatch.com.

5. Automated Decision-Making and Human Review

The Service uses assistive automation for triage de-duplication, severity pre-scoring, tracing enrichment, reputation scoring, KYC list screening, and pricing suggestions. Final decisions that have legal or similarly significant effects on a person — including trust-tier demotions, slashing on subjective breaches, and pay-affecting determinations — require genuine human review. Decisions below configured confidence thresholds route to humans. A sample of automated decisions is human-reviewed. Every such decision is logged. People in covered jurisdictions have the right not to be subject to solely automated decisions with legal or similarly significant effects; the Foundation designs the Service to honor that right.

Victim contact is human by design. Automation may format an intake; it does not send distressed-victim communications without a trained human.

6. Handling Labels and Need-to-Know

Trust tier and handling label are orthogonal. Sensitive attribution, victim identifiers, unremediated exploit detail, and legal-strategy material are concentrated at higher tiers and released only to persons with both the tier and a need-to-know clearance. Access is logged. Misuse is a Terms violation and may result in slashing, termination, and referral to authorities.

7. When We Share Personal Data

• Service providers who process data on the Foundation’s instructions (hosting, communications, identity verification, analytics, payments, oracles).
• Contributor counterparts and case participants who have the required tier and handling clearance, solely as needed to perform authorized work.
• Exchange, custodian, and wallet partners when the User or a victim has been referred through that channel or when a preservation or recovery step requires it, subject to partner terms.
• Professional advisers (counsel, auditors, forensic specialists) under confidentiality.
• Law enforcement, regulators, or courts where the Foundation believes disclosure is required or appropriate to comply with law, protect rights and safety, or investigate wrongdoing.
• A buyer or successor in a business transaction, with notice before Personal Data becomes subject to a different policy where practicable.
• Affiliates and governed entities in the 0verwatch stack (Foundation, recovery/lawfare cell or trust, legal-defense facility), required to honor this Policy or a policy at least as protective.
• Other parties with the User’s consent.
• Sub-Processors. The Foundation may engage sub-processors to assist in providing the Service. The Foundation requires each sub-processor to enter into a written agreement that imposes data-protection obligations no less protective than those set forth in this Policy, including obligations regarding confidentiality, security, data deletion or return, and cooperation with data-subject rights requests. The Foundation conducts due diligence before engaging a sub-processor and periodically reviews sub-processor compliance. A list of current sub-processors is available upon request to info@0verwatch.com.
• Categories of Personal Data disclosed for a business purpose. In the preceding twelve (12) months, the Foundation may have disclosed the following categories of Personal Data for a business purpose: identifiers (name, email, wallet address); internet or electronic network activity information; professional or employment-related information; geolocation data (approximate, derived from IP); and inferences drawn from the foregoing. These disclosures were made to service providers, professional advisers, law enforcement, and affiliates as described above.
• Sensitive Personal Information. The Foundation may collect Sensitive Personal Information as described in Section 3.1 (such as government-issued identification for KYC purposes). The Foundation uses and discloses Sensitive Personal Information only as reasonably necessary and proportionate to perform the Service, comply with legal obligations, and ensure security, and not for the purpose of inferring characteristics about the User. Where required by applicable law, the User has the right to limit the Foundation’s use and disclosure of Sensitive Personal Information.

The Foundation does not sell Personal Data. The Foundation does not share Personal Data for cross-context behavioral advertising as those terms are used in U.S. state privacy statutes.

8. International Transfers

The Foundation is established in the Cayman Islands. Personal Data may be processed in the Cayman Islands, the United States, the European Economic Area, the United Kingdom, and other countries where the Foundation’s providers or contributors operate. Those countries may not provide the same legal protections as the User’s home jurisdiction. Where required, the Foundation uses appropriate safeguards such as contractual clauses and access controls. The Foundation relies on appropriate safeguards for international transfers, which may include Standard Contractual Clauses approved by the European Commission, adequacy decisions, binding corporate rules, or the User’s explicit consent, as applicable. The User’s use of the Service and submission of information constitutes the User’s acknowledgement of these transfers.

For transfers from the United Kingdom, the Foundation may rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as issued by the UK Information Commissioner’s Office. The Foundation conducts transfer impact assessments where required to evaluate whether the laws of the destination country provide adequate protection for Personal Data.

9. Retention

The Foundation retains Personal Data only as long as needed for the purposes in this Policy, including to meet legal, tax, sanctions, dispute, and evidentiary obligations. Case and evidence records may be retained for the life of a matter plus applicable limitation periods, and longer where required to defend claims or comply with court orders. Usage Data is generally retained for a shorter period unless needed to secure or improve the Service or to meet a legal duty. Staking, slashing, and governance records may be retained as part of the public or permissioned chain history and internal ledgers. When Personal Data is no longer required for the purposes described in this Policy, the Foundation shall securely delete or anonymize it, unless retention is required by applicable law or regulation.

In determining the appropriate retention period, the Foundation considers the amount, nature, and sensitivity of the Personal Data; the potential risk of harm from unauthorized use or disclosure; the purposes for which the Foundation processes the Personal Data and whether those purposes can be achieved through other means; and applicable legal, regulatory, tax, accounting, or other requirements.

Hashed evidence and trusted timestamps are designed to remain verifiable; the underlying file may be retained or deleted according to handling rules and legal hold.

10. Security

The Foundation uses commercially reasonable administrative, technical, and physical measures appropriate to the sensitivity of the data, including encryption in transit, encryption of Reports at rest or in delivery where the User supplies a public key, access control by tier and handling label, and audit logging of sensitive access. No method of transmission or storage is 100% secure. The User is responsible for the security of the User’s wallets, keys, devices, and designated delivery channels. The Foundation is not responsible for interception or loss resulting from the User’s credentials or third-party messaging services. The Foundation also conducts regular security assessments and vulnerability testing, provides employees with training on data protection, and maintains incident response procedures. Where required by applicable law, the Foundation shall notify affected individuals and relevant authorities of data breaches within the timeframes required by law.

The Foundation conducts Data Protection Impact Assessments (“DPIAs”) where Processing is likely to result in a high risk to the rights and freedoms of individuals, including when deploying new technologies, processing Special Categories of Data at scale, or engaging in systematic monitoring. The Foundation maintains a record of Processing activities as required under applicable Data Protection Laws.

11. Do Not Track Signals

Certain browsers transmit “Do Not Track” (“DNT”) signals. The Service does not currently respond to DNT signals because no uniform standard for interpreting or honoring DNT signals has been adopted. If a standard is established that the Foundation is required to follow, the Foundation shall update this Policy accordingly.

12. California “Shine the Light”

Under California Civil Code Section 1798.83, California residents who have an established business relationship with the Foundation may request information regarding the Foundation’s disclosure of Personal Data to third parties for their direct marketing purposes during the preceding calendar year. The Foundation does not disclose Personal Data to third parties for their direct marketing purposes.

13. Your Rights

Depending on the User’s jurisdiction (including the EEA/UK, certain U.S. states, and other regimes), the User may have rights to access, correct, delete, or port Personal Data; to restrict or object to certain processing; to withdraw consent; and to appeal the Foundation’s decision on a request. The User may also have the right to lodge a complaint with a supervisory authority.

How to exercise rights. The User may email info@0verwatch.com (or the address posted on the Site) from the address associated with the User’s account and describe the request. The Foundation may need to verify the User’s identity. The Foundation shall not discriminate against the User for exercising privacy rights.

Verification. When the Foundation receives a privacy request, the Foundation may verify the User’s identity by matching information provided in the request against information the Foundation has on file. The Foundation may ask the User to provide additional information reasonably necessary to verify the request. If the Foundation cannot verify the User’s identity to a reasonable degree of certainty, the Foundation may decline the request and shall explain the reason for the denial.

Limits. The Foundation may decline or limit a request where another exception applies: attorney-client or litigation privilege; ongoing investigation; sanctions or fraud-prevention needs; rights of other individuals (especially victims and uninvolved third parties); blockchain immutability of public records the User signed; or where the request is manifestly unfounded or excessive. Handling labels and victim-safety rules may prevent the Foundation from disclosing certain records even to a contributor who once had access.

U.S. state rights. Residents of states with consumer privacy laws may request to know, delete, or correct personal information and to opt out of sale or targeted advertising. The Foundation does not sell personal information or engage in targeted advertising as defined in those laws. Authorized agents may submit requests subject to verification. Where applicable, California residents may also have the right to: (a) know the categories and specific pieces of personal information collected; (b) request deletion of personal information; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information, although the Foundation does not sell personal information; (e) limit the use and disclosure of sensitive personal information; (f) exercise these rights without discrimination; and (g) receive a response to a verifiable consumer request within forty-five (45) days, subject to an extension of an additional forty-five (45) days with notice where reasonably necessary.

Nevada Residents. Nevada residents may submit a verified request to opt out of the sale of certain covered information. The Foundation does not currently sell covered information as defined under Nevada law. To submit a request, the User may contact the Foundation at info@0verwatch.com.

Right to Appeal. In certain jurisdictions (including Virginia, Colorado, Connecticut, and other states with applicable privacy laws), the User has the right to appeal the Foundation’s decision on a privacy request. To appeal, the User may contact the Foundation at info@0verwatch.com within a reasonable period after receiving the Foundation’s response. The Foundation shall respond to an appeal within the timeframe required by applicable law. If the appeal is denied, the User may contact the relevant state attorney general.

EEA/UK representatives. If the Foundation appoints an EU or UK representative, contact details shall be posted on the Site.

EEA/UK Rights — Additional Detail. Under the General Data Protection Regulation (“GDPR”) and UK GDPR, the User has the right to: (a) request access to the User’s Personal Data; (b) request rectification of inaccurate or incomplete Personal Data; (c) request erasure of Personal Data where there is no compelling reason for continued processing; (d) restrict processing in certain circumstances; (e) data portability, meaning the right to receive Personal Data in a structured, commonly used, and machine-readable format; (f) object to processing based on legitimate interests or for direct marketing purposes; and (g) not be subject to solely automated decisions with legal or similarly significant effects. The Foundation shall respond to a verified request within one (1) month, subject to an extension of up to two (2) additional months where the request is complex or numerous requests have been received, with notice to the User of the extension and the reasons.

Right to Data Portability. Where Processing is based on the User’s consent or a contract, and the Processing is carried out by automated means, the User has the right to receive the Personal Data provided to the Foundation in a structured, commonly used, and machine-readable format (such as CSV or JSON). The User may also request that the Foundation transmit such data directly to another controller where technically feasible. This right does not apply to Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

14. Children’s Privacy

The Service is not directed to anyone under 18, and the Foundation does not knowingly collect Personal Data from children. If the User believes that the Foundation has collected Personal Data from a minor, the User may contact the Foundation, and the Foundation shall delete such Personal Data. The Terms separately require the User to be 18 or older. In the United States, the Foundation complies with the Children’s Online Privacy Protection Act (“COPPA”) and does not knowingly collect Personal Data from children under 13. If the Foundation discovers it has collected Personal Data from a child under 13, the Foundation shall promptly delete such information.

15. Victims and Sensitive Case Data

If the User submits a victim intake, the Foundation shall use the User’s data to triage, preserve evidence, and — only if a matter is accepted — to coordinate pursuit. The Foundation shall not publish the User’s identity as a victim without a lawful basis or the User’s informed agreement. Humans handle victim contact. The Foundation may share limited data with partner institutions or counsel as needed for preservation or recovery. Outcomes are never guaranteed. The User may request deletion of intake materials that are not subject to legal hold; if a hold applies, the Foundation shall explain what the Foundation can and cannot delete.

16. WATCH Token and Staking Data

When the User stakes WATCH, participates in governance, or elects to convert CVU payouts into WATCH, the Foundation processes data associated with those activities, including staking amounts, trust-tier assignments, slashing events, governance votes, oracle-rate conversion records, and circuit-breaker status. This data is used to operate the staking and governance systems described in the Terms, to enforce slashing within Charter ranges as determined by the Trust and Safety Council, and to maintain the integrity of the contributor network. Staking and governance records may be recorded on-chain and, once confirmed, cannot be deleted or modified by the Foundation. The Foundation may also process data related to Sponsorship Pool allocations, Recovery and Lawfare Pool participation, and Community Rewards distributions. Trust tiers above basic access may involve identity-assurance measures. For the avoidance of doubt, formal KYC verification in connection with WATCH-related activities is required solely upon payout or distribution, as set forth in Section 3.1. Such data is retained as described in Section 9 (Retention) and shared only as described in Section 7 (When We Share Personal Data).

17. On-Chain and Public Data

Wallet addresses, signatures, stakes, slashes, and votes the User broadcasts on a public blockchain are public by design. The Foundation cannot un-publish a confirmed on-chain record. Off-chain profile and identity-assurance data are not automatically published.

18. Links to Other Sites

The Service may link to partner, explorer, exchange, or counsel sites the Foundation does not operate. Their privacy practices are their own. The User shall review those policies before providing data to them.

19. Changes to This Policy

The Foundation may update this Policy from time to time. The Foundation shall post the new Policy on this page and update the “Last Updated” date. Where required, the Foundation shall provide additional notice (email or prominent Site notice) before material changes take effect. For material changes, the Foundation shall endeavor to provide at least thirty (30) days advance notice before such changes take effect. Changes are effective when posted unless a later date is stated. The User’s continued use of the Service after the effective date constitutes acknowledgement of the updated Policy.

The Foundation shall maintain an archive of prior versions of this Policy, which the User may request by contacting info@0verwatch.com.

20. Your Choices

The User has the following choices regarding Personal Data:

• Communications preferences. The User may opt out of non-essential communications (such as marketing emails or service news) by following the unsubscribe instructions in the relevant communication or by contacting the Foundation at info@0verwatch.com. Opting out of non-essential communications does not affect the Foundation’s ability to send transactional or service-related messages (such as security alerts, account notices, slashing notices, and legal-process notifications).
• Cookie preferences. The User may manage cookie preferences through the User’s browser settings or, when available, through the Foundation’s cookie preference center. For more information, see Section 3.3 (Tracking Technologies).
• Account deletion. The User may request deletion of the User’s account and associated Personal Data by contacting the Foundation at info@0verwatch.com. Deletion is subject to the exceptions described in Section 9 (Retention) and Section 13 (Your Rights).
• Wallet disconnection. The User may disconnect a verified wallet from the User’s account at any time through the Service. Disconnection does not delete on-chain data, which remains public as described in Section 17 (On-Chain and Public Data).

21. Contact

Questions about this Policy or privacy requests: info@0verwatch.com. Legal notices under the Terms: info@0verwatch.com (see Section 22 of the Terms). Postal contact, if required, shall be posted on the Site once the Foundation’s registered office details are finalized.

If the User is not satisfied with the Foundation’s response to a privacy request or complaint, the User may contact the relevant data protection authority or supervisory body in the User’s jurisdiction. EEA and UK residents may find a list of supervisory authorities at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

22. Complaints

The User has the right to make a complaint at any time to the relevant supervisory authority for data protection issues in the User’s jurisdiction. For EEA residents, this is the supervisory authority of the EU Member State in which the User resides or works, or in which the alleged infringement occurred. For UK residents, the supervisory authority is the Information Commissioner’s Office (“ICO”), which can be contacted at https://ico.org.uk/make-a-complaint/. For Cayman Islands residents, complaints may be directed to the Office of the Ombudsman of the Cayman Islands. The Foundation requests that the User attempt to resolve any concerns with the Foundation first by contacting info@0verwatch.com before escalating to a supervisory authority.

23. Governing Law

This Policy and any dispute arising out of or in connection with it (including non-contractual disputes) shall be governed by and construed in accordance with the laws of the Cayman Islands, without regard to conflict-of-law principles. Nothing in this Section limits the User’s rights under mandatory data protection legislation in the User’s jurisdiction, including the GDPR or UK GDPR where applicable, which shall continue to apply to the extent required.