Privacy Policy

This Privacy Policy explains how dVIN Labs LTD ("dVIN Labs", "we", "us", or "our") collects, uses, discloses, and protects personal data when you visit our website at dvinlabs.com (the "Site") or communicate with us. We are committed to handling your personal data responsibly and in accordance with the Data Protection Act (As Revised) of the Cayman Islands (the "DPA") and, where applicable, other data protection laws described below.

1. Who We Are

The data controller responsible for your personal data is:

dVIN Labs LTD
190 Elgin Avenue
George Town, Grand Cayman
Cayman Islands KY1-9001
Email: info@dvinlabs.com

dVIN Labs LTD is a company incorporated in the Cayman Islands. For the purposes of the DPA, we are the "data controller" of the personal data described in this policy.

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact form data: when you submit an enquiry through our contact form (to book a call, discuss a partnership, or make a media enquiry), we collect your name, email address, organization or company name (or media outlet), your role or partnership type where provided, any deadline you specify, and the content of your message.
• Correspondence data: if you email us directly, we collect your email address and the contents of your correspondence.
• Technical data: when you visit the Site, our servers and infrastructure providers automatically process your Internet Protocol (IP) address, browser type and version, device and operating system information, time zone, referring pages, and the pages you visit. We also process IP addresses to apply rate limiting to our contact form as a measure against abuse and spam.
• Analytics data: we use Google Analytics, which collects information about how visitors use the Site through cookies and similar technologies (see Section 5 below).
• Blockchain data: if in the future you interact with smart contracts or blockchain-based features associated with our protocol, your public wallet address and transaction history will be processed and recorded on public blockchains.

We do not intentionally collect any special category (sensitive) personal data through the Site, and we ask that you do not include such information in messages you send us.

3. Blockchain Data Immutability Notice

Any data submitted to a public blockchain (such as Ethereum or Solana) is inherently public and immutable. Once recorded, this data cannot be deleted or altered by us or anyone else. We do not control public blockchains. If you choose to interact with smart contracts associated with our protocol, your public wallet address and transaction history will be permanently visible to anyone. To the extent you have rights of erasure or rectification under applicable law, those rights cannot be exercised against data recorded on a public blockchain.

4. How We Use Your Personal Data and Our Lawful Bases

We use your personal data only where we have a lawful basis to do so under the DPA and, where applicable, other data protection laws:

• To respond to your enquiries: we use contact form and correspondence data to respond to you, schedule calls, evaluate potential partnerships, and handle media requests. Lawful basis: taking steps at your request prior to entering into a contract, and our legitimate interests in operating and promoting our business.
• To operate, secure, and improve the Site: we use technical and analytics data to maintain the Site, prevent abuse (including rate limiting of the contact form), diagnose problems, and understand how visitors use the Site. Lawful basis: our legitimate interests in maintaining a secure, functional, and improving website.
• To comply with legal obligations: we may process personal data where necessary to comply with applicable law, regulation, court order, or the requests of competent authorities. Lawful basis: compliance with legal obligations.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not send marketing communications unless you have asked to receive them.

5. Cookies and Google Analytics

The Site uses Google Analytics, a web analytics service provided by Google LLC and its affiliates ("Google"). Google Analytics uses cookies and similar technologies to collect information about your use of the Site (such as pages viewed, time on site, approximate location derived from IP address, and device information) and to generate aggregated reports about site activity. Google processes this information on our behalf as a service provider.

You can control or opt out of analytics cookies in the following ways:

• Adjust your browser settings to refuse or delete cookies.
• Install the Google Analytics opt-out browser add-on, available from Google.
• Use any cookie controls presented on the Site, where available.

For more information about how Google handles data, see Google's privacy policy and its documentation on how Google uses information from sites that use its services.

6. How We Share Your Personal Data

We do not sell your personal data. We share personal data only with:

• Service providers (data processors): third parties who process personal data on our behalf and under our instructions, including SMTP2GO (email delivery of contact form notifications and confirmations), Google (analytics), and our website hosting and infrastructure providers.
• Professional advisers: lawyers, accountants, auditors, and insurers where reasonably necessary.
• Affiliated companies: our affiliated ventures (such as Club dVIN and dVIN AI / Bacchus) only where necessary to respond to an enquiry you direct to them, or otherwise with your consent.
• Authorities and other parties where required by law: courts, regulators, law enforcement, or other parties where disclosure is required by applicable law or is necessary to protect our rights, safety, or property.
• Business transfers: a purchaser or prospective purchaser in connection with any merger, acquisition, financing, or sale of all or part of our business, subject to appropriate confidentiality protections.

7. International Transfers

We are established in the Cayman Islands, and our service providers process data in other jurisdictions, including the United States and Europe. This means your personal data may be transferred to, stored, and processed in countries other than your own, which may have data protection laws different from those of your jurisdiction. Where we transfer personal data internationally, we take steps designed to ensure it receives an adequate level of protection consistent with the DPA and, where applicable, other data protection laws — including transferring to recipients that are subject to appropriate contractual commitments, such as standard contractual clauses, or other lawful transfer mechanisms.

8. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to respond to and follow up on enquiries, to maintain business records, and to satisfy legal, regulatory, tax, accounting, or reporting requirements. When personal data is no longer required, we delete or anonymize it. Data recorded on public blockchains is permanent and beyond our ability to delete.

9. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful loss, misuse, unauthorized access, alteration, and disclosure, including encrypted transmission (HTTPS), access controls, and anti-abuse measures such as rate limiting. Access to personal data is limited to those who have a business need to know it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights Under the Cayman Islands DPA

Under the DPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of your personal data in certain circumstances (excluding immutable blockchain records).
• Object to, or request the cessation of, processing of your personal data in certain circumstances, including for direct marketing purposes.
• Not to be subject to decisions based solely on automated processing that significantly affect you.
• Complain to the Office of the Ombudsman of the Cayman Islands, which supervises compliance with the DPA, if you believe your personal data has been handled in breach of the DPA.

To exercise any of these rights, contact us at info@dvinlabs.com. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by the DPA.

11. Additional Information for Visitors in the EEA and UK

If you are located in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation or UK GDPR may apply to our processing of your personal data. In addition to the rights described above, you have the right to request restriction of processing, the right to data portability, the right to withdraw consent at any time where processing is based on consent (without affecting the lawfulness of processing before withdrawal), and the right to lodge a complaint with your local data protection supervisory authority. Our lawful bases for processing are described in Section 4. Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms; you may object to such processing at any time.

12. Additional Information for California Residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), may provide you with additional rights. In the preceding twelve months we have collected the categories of personal information described in Section 2 (identifiers such as name, email, and IP address; professional information such as organization and role; and internet activity information such as analytics data). We collect this information from you directly and from your device, for the business purposes described in Section 4, and disclose it to the service providers described in Section 6. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. Subject to applicable exemptions, you have the right to know what personal information we collect, to request deletion or correction, and not to be discriminated against for exercising your rights. You may submit requests to info@dvinlabs.com.

13. Children

The Site is not directed at children, and our services relate to alcoholic beverages and financial infrastructure intended for adults and institutions. We do not knowingly collect personal data from anyone under the age of 18 (or the age of legal majority in their jurisdiction). If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Third-Party Websites

The Site contains links to third-party websites, including our affiliated ventures Club dVIN and dVIN AI / Bacchus. This Privacy Policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any website you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. The updated version will be posted on this page with a revised "Last updated" date. Material changes will be highlighted on the Site where appropriate. Your continued use of the Site after an update constitutes acceptance of the revised policy.

16. Contact Us

If you have any questions about this Privacy Policy, our privacy practices, or wish to exercise your rights, please contact us at:

dVIN Labs LTD
190 Elgin Avenue
George Town, Grand Cayman
Cayman Islands KY1-9001
Email: info@dvinlabs.com