Privacy Policy

1. Who We Are and Data Controller

Arcana Crypto LTD ("Arcana", "we", "us", "our") is a private limited company incorporated in England and Wales, Company Number 16371124, with registered office at 12 Pullman Gardens, London, SW15 3DF, United Kingdom.

We act as Data Controller for the personal data described in this Policy and are registered with the Information Commissioner's Office (ICO) under registration reference C1918773.

We provide cryptocurrency wallet recovery, blockchain forensic investigation, security consulting and related digital-asset services.

1.1 Data Protection Contact

We have not appointed a statutory Data Protection Officer because our processing activities do not meet the mandatory criteria under Article 37 UK GDPR. The point of contact for all data protection enquiries is:

2. Scope

This Policy covers personal data of:

• Clients and prospective Clients of our Services;
• Authorised representatives, beneficial owners, directors and trustees of corporate Clients;
• Visitors to the Site;
• Third parties whose personal data is processed in the course of investigations (see section 5).

3. What Personal Data We Collect

4. Special Category Data and Criminal Offence Data

4.1 Special Category Data (Article 9 UK GDPR)

We do not actively seek special category data. Where such data is incidentally processed (e.g. biometric data in passport chips, or health-related information voluntarily provided), we rely on:

• Article 9(2)(f) — processing necessary for the establishment, exercise or defence of legal claims;
• Article 9(2)(g) read with DPA 2018, Schedule 1, Part 2, paragraph 10 — preventing or detecting unlawful acts; and
• Article 9(2)(a) — explicit consent, where freely given.

4.2 Criminal Offence Data (Article 10 UK GDPR)

Our investigative work routinely involves processing data relating to criminal offences (theft, fraud, money laundering, sanctions evasion). We rely on:

• DPA 2018, Schedule 1, Part 2, paragraph 10 — preventing or detecting unlawful acts;
• DPA 2018, Schedule 1, Part 3, paragraph 33 — establishment, exercise or defence of legal claims; and
• DPA 2018, Schedule 1, Part 2, paragraph 12 — preventing fraud.

An Appropriate Policy Document (APD) is maintained in respect of this processing, as required by DPA 2018, Schedule 1, Part 4.

5. Personal Data of Third Parties (Article 14 UK GDPR)

In the course of investigations, we may process personal data of individuals who are not our Clients (e.g. counterparties to suspect transactions, beneficial owners identified through blockchain analytics). Where direct notification under Article 14 would be impossible, disproportionate, or would prejudice the investigation, we rely on the Article 14(5)(b), (c) or (d) exemptions. We document our reliance on such exemptions.

6. How and Why We Use Your Data

We do not engage in data selling, data brokering or behavioural advertising.

7. Automated Decision-Making and Profiling (Article 22 UK GDPR)

We use automated tools for sanctions screening, PEP screening, KYC verification and blockchain risk-scoring. No decision producing legal or similarly significant effects is taken solely by automated means. All outputs are reviewed by a human before any onboarding, refusal or termination decision is taken.

You have the right to obtain human intervention, express your point of view and contest any decision.

8. Who We Share Your Data With

An up-to-date list of our material sub-processors is available on written request to support.arcanacrypto@protonmail.com.

9. International Transfers

Where personal data is transferred outside the United Kingdom, we rely on one or more of:

• UK adequacy regulations (which currently include all EEA member states);
• The International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
• Other valid Article 46 transfer mechanisms; or
• Article 49 derogations where applicable.

Providers currently operating outside the UK include Chainalysis (US) and certain cloud infrastructure providers. We select providers offering appropriate UK/EU data protection safeguards.

10. Cookies and Similar Technologies (PECR)

Strictly necessary cookies are placed without consent (PECR Reg. 6(1)). Analytics cookies require prior consent. A cookie consent banner is presented on first visit.

11. Marketing Communications

B2C clients: We will only send marketing emails with your explicit prior consent (PECR Reg. 22). You may withdraw consent at any time.

B2B clients: We may send relevant marketing under the soft opt-in rule (PECR Reg. 22(3)) where you are an existing client and the communication relates to similar services.

12. How Long We Keep Your Data

13. Your Rights Under UK GDPR

• Access (DSAR) — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data. Note: where we have a legal obligation to retain data (e.g. AML records under MLR 2017 reg. 40), we cannot erase such data until the retention period expires.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object to direct marketing — you have an absolute right to object at any time.
• Object to other processing — where we rely on legitimate interests (Art. 6(1)(f)), you may object; we will cease unless we can demonstrate compelling legitimate grounds.
• Withdraw consent — you may withdraw consent at any time without affecting prior processing.
• Automated decision-making — the right to human review of any solely automated decision.

13.1 How to Exercise Your Rights

13.2 Right to Complain

14. Security

We implement appropriate technical and organisational measures, including:

• Encryption of data at rest (AES-256) and in transit (TLS 1.3 minimum);
• Role-based access controls on a need-to-know basis;
• Segregation of client data and secure key management;
• Secure deletion and destruction procedures;
• Written confidentiality undertakings from staff and contractors;
• Logging, monitoring and periodic security review.

In the event of a personal data breach, we will notify the ICO within 72 hours (UK GDPR Art. 33) and affected data subjects without undue delay where required by Art. 34.

15. Children

Our Services are contractual in nature and provided only to persons aged 18 or over. Although the UK age of digital consent under DPA 2018 s.9 is 13, we do not knowingly collect personal data from any individual under 18.

16. Terms of Engagement

This Privacy Policy should be read alongside our Terms of Engagement & Service Agreement, which govern the provision of our services and contain additional provisions relating to data handling, confidentiality and client obligations. A copy is provided at the start of each engagement and is available on request.

17. Changes to This Policy

We may update this Policy from time to time. The Version and Last updated fields at the top reflect any changes. Material changes will be communicated to active Clients by email.

18. Contact Us