Privacy Policy

01Data Controller

The data controller responsible for your personal data is:

This Privacy Policy explains how VIRTUS (virtus.gift) collects, uses, stores, and protects your personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applicable Romanian data protection law.

By using our website and services, you acknowledge that you have read and understood this policy. If you do not agree, please do not use virtus.gift.

02Data We Collect

Account & Purchase Data

When you create an account or place an order, we collect:

• Your name and email address
• Your billing address (if applicable)
• Order details: product purchased, tier, quantity, price
• Payment reference number (not card data — see Stripe below)

Medal & Dedication Content

To mint your digital medal, we collect and process:

• The recipient’s name as entered by you
• Your personal dedication text (up to 500 characters)
• The occasion selected
• Names of any co-signers you invite and their optional messages
• Co-signers’ email addresses (used solely to send the signing invitation)

Technical & Usage Data

• IP address and approximate geolocation
• Browser type and version, operating system
• Pages visited, time spent, referral source
• Cookie and session data (see Section 10)

Communications

• Emails you send us via info@virtus.gift
• Newsletter subscription data (name, email) if you subscribe to Virtue Alerts

03Legal Basis for Processing

04How We Use Your Data

We use the personal data we collect for the following purposes:

• To process your order, mint your medal on the Cardano blockchain, and generate the recipient’s memorial page
• To send order confirmation, medal delivery notification, and invoice by email
• To send co-signing invitations on your behalf to the email addresses you provide
• To issue legally compliant invoices under Romanian and EU tax law
• To respond to your customer support enquiries
• To send you newsletters and product updates, if you have subscribed and consented
• To improve our website, detect errors, and prevent fraudulent activity
• To comply with our legal obligations under Romanian and EU law

We do not use your data for automated individual decision-making or profiling that produces legal or similarly significant effects.

05Public Nature of Medal Data & Blockchain Permanence

By its nature, a VIRTUS digital medal is a public tribute. When you place an order, the following data is permanently and publicly recorded:

• The recipient’s name as entered by you
• Your dedication message
• The names of all co-signers
• The virtue medal type and occasion
• A unique transaction reference on the Cardano blockchain

This data is displayed on the publicly accessible memorial page at virtus.gift/medal/[unique-slug] and is permanently inscribed on the Cardano blockchain — a distributed public ledger.

Blockchain records cannot be deleted or modified, even upon request. Once a medal has been minted, VIRTUS has no technical ability to remove data from the Cardano blockchain. We can remove or restrict the memorial page on virtus.gift upon a valid legal request, but the blockchain record will remain permanent.

Do not include sensitive personal information such as home addresses, phone numbers, financial details, or health information in your dedication text or recipient name fields.

By completing a purchase, you confirm that you have obtained any consent necessary to include the recipient’s name and any co-signers’ names in a public, permanent digital tribute.

06Data Sharing & Third Parties

We do not sell your personal data. We share data only with the trusted service providers necessary to operate the platform:

All EU-based processors are bound by GDPR. Non-EU processors are subject to appropriate safeguards (Standard Contractual Clauses where applicable).

We may also disclose data to law enforcement or regulatory authorities where required by law.

07International Data Transfers

Some of our service providers (Google, Arweave, Cardano blockchain) operate outside the European Economic Area (EEA). Where data is transferred to countries that do not provide an equivalent level of data protection, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable

Note that data recorded on the Cardano blockchain is by nature global and cannot be geographically restricted. By consenting to medal minting, you acknowledge this inherent characteristic of blockchain technology.

08Data Retention

09Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): You may request deletion of your personal data where there is no overriding legal basis for retention. Note: data already recorded on the Cardano blockchain cannot be erased for technical reasons (Art. 17(3)(e) GDPR).
• Right to restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent (e.g. newsletter), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@virtus.gift. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or the supervisory authority of your EU member state of residence.

10Cookies

We use cookies and similar technologies to operate the website, process orders, and analyse usage. Our cookie management is handled through the WP Consent API, which allows you to manage your consent preferences.

For full details of the cookies we use, their purpose, and how to manage them, please see our Cookie Policy.

11Children’s Privacy

VIRTUS services are not directed at children under the age of 16. We do not knowingly collect personal data from individuals under 16 without verified parental consent. If you believe we have inadvertently collected data from a minor, please contact us immediately at info@virtus.gift and we will delete the data promptly.

12Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify registered users of material changes by email and will update the “Last updated” date at the top of this page. Continued use of virtus.gift after changes are posted constitutes your acceptance of the updated policy.

13Contact & Complaints

For any questions, requests, or concerns relating to your personal data or this Privacy Policy, please contact us:

Supervisory authority for data protection complaints: ANSPDCP — dataprotection.ro