Privacy Policy
Last updated:
1. Who we are
1.1 This Privacy Policy explains how ICON Foundation, a foundation established under the laws of Switzerland, having its registered address at Gubelstrasse 11, 6300 Zug, Switzerland (“SODAX”, “we”, “us”), processes personal data when you use sodax.com, the SODAX Developer Portal, the SODAX Swaps API and SDK, the ICX-to-SODA token migration, and our support channels (together, the “Services”).
1.2 We are the controller for the processing described here. We process personal data in line with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). You can contact us about data protection at api@sodax.com. Where the GDPR requires it, we will appoint a representative in the European Union and publish its details in this Privacy Policy.
1.3 If you use a wallet, app or service built by a third party on the SODAX Swaps API (an “Integrator”), that Integrator is responsible for the personal data it collects about you, under its own privacy policy. This Privacy Policy covers only the data SODAX itself processes, including data we receive through API requests.
2. Data we collect
2.1 Data you give us: your name, email address and organisation when you create an account or contact us; Developer Portal settings, including the fee or receiving wallet addresses you register; Discord or Telegram usernames and messages when you contact us there; and, for Custom plans, contract and invoicing details.
2.2 Data collected automatically: IP addresses, API Key identifiers, request and response logs, quotes, timestamps, device and browser information, and usage and performance data for the API, the Developer Portal and sodax.com.
2.3 Blockchain data: wallet addresses, transaction hashes, amounts, assets and networks of Swaps routed through the Services, and other public on-chain data linked to those addresses.
2.4 Data from third parties: risk and sanctions information about wallet addresses from blockchain analytics providers, and information from Integrators or event organisers when you sign up through a referral link.
2.5 We never ask for your private keys or seed phrases. Apart from the biometric data described in Section 2.6, we do not collect special categories of personal data.
2.6 Identity verification data: if you request a token migration that requires compliance review, or where the law otherwise requires it, we collect through our identity verification provider, Sumsub: your full name, date of birth, nationality, country of residence and email address; images and data from your government-issued identity document; a selfie or short video for liveness detection and face matching; proof of address; and information about the source of your tokens, such as the acquisition date, the platform or counterparty, and evidence such as trade history, receipts or transaction hashes. We also receive the results of sanctions, politically exposed person (PEP) and adverse media checks. Face matching uses biometric data, which is sensitive personal data under the FADP and special category data under the GDPR.
3. Why we use your data
- Purpose
- Providing the Services: accounts, API Keys, the Developer Portal and routing Swaps
- Data
- Account data, Key data, wallet addresses, request data
- Legal basis (GDPR)
- Performance of a contract
- Retention
- For the life of your account, then 12 months
- Purpose
- Security, rate limiting and preventing abuse and fraud
- Data
- IP addresses, logs, request data
- Legal basis (GDPR)
- Legitimate interests
- Retention
- Logs: 90 days, longer where needed to investigate an incident
- Purpose
- Attributing usage and volume, and invoicing Custom plans
- Data
- Key data, fee wallets, transaction identifiers, volume, invoices
- Legal basis (GDPR)
- Performance of a contract; legal obligation (accounting)
- Retention
- Accounting records: 10 years as Swiss law requires
- Purpose
- Sanctions and address screening
- Data
- Wallet addresses, transaction data, IP-based location
- Legal basis (GDPR)
- Legal obligation; legitimate interests
- Retention
- As long as the law requires, up to 5 years
- Purpose
- Support and communication
- Data
- Contact details, messages
- Legal basis (GDPR)
- Performance of a contract; legitimate interests
- Retention
- 24 months after the last contact
- Purpose
- Improving the Services and publishing aggregated statistics
- Data
- Usage data, made aggregated or anonymised
- Legal basis (GDPR)
- Legitimate interests
- Retention
- Anonymised data may be kept indefinitely
- Purpose
- Identity verification and anti-money laundering checks for token migrations, including sanctions, PEP and source-of-funds review
- Data
- Identity and document data, selfie and biometric data, proof of address, source-of-funds information, screening results
- Legal basis (GDPR)
- Legal obligation; legitimate interests (preventing fraud, money laundering and the movement of stolen assets); explicit consent for biometric data
- Retention
- 5 years after the migration is completed or refused, or longer where the law or an ongoing investigation requires; biometric data only as long as needed for verification
- Purpose
- Website analytics and cookies
- Data
- Cookie and device data
- Legal basis (GDPR)
- Consent where required
- Retention
- As set in your cookie settings
- Purpose
- Complying with law, cooperating with authorities and protecting our rights
- Data
- Any of the above, as needed
- Legal basis (GDPR)
- Legal obligation; legitimate interests
- Retention
- As long as needed for the matter
Under the FADP, we process personal data for these purposes in line with the principles of lawfulness, good faith, proportionality and purpose limitation.
4. Blockchain data
4.1 Transactions on public blockchains, including sending and receiving addresses and amounts, are publicly visible and permanent. SODAX does not operate these blockchains and cannot change or delete data recorded on them.
4.2 A wallet address on its own may not identify you, but it can become personal data when combined with other information, for example your account or IP address. We treat wallet addresses linked to you as personal data, and we limit, separate or delete the off-chain data we hold when it is no longer needed.
5. Automated screening and identity verification
5.1 Before a Swap is executed, wallet addresses are checked automatically against sanctions lists and risk information, including by the permissioned solver that fills Swaps. If an address is flagged, the Swap may be refused or delayed without manual review. You may contact us at api@sodax.com to give your view and ask for the decision to be reviewed by a person (Art. 21 FADP; Art. 22 GDPR).
5.2 Identity verification is carried out on our behalf by Sumsub, using automated document checks, liveness detection and face matching. We ask for your explicit consent before biometric data is processed. If you do not consent, you may ask us about another way to verify your identity, but we may be unable to process your request without verification. SODAX makes the final decision on each request, and you may ask for a person to review it at api@sodax.com.
7. International transfers
7.1 We may transfer personal data to the recipients above, in particular in the states of the European Economic Area (EEA) and in the United States. Transfers to countries recognised as providing adequate protection (by the Swiss Federal Council under the FADP or by the European Commission under the GDPR), such as the states of the EEA and the United Kingdom, rely on that recognition. For transfers to the United States, we rely on the recipient’s certification under the Swiss-U.S. Data Privacy Framework for transfers subject to the FADP, and under the EU-U.S. Data Privacy Framework for transfers subject to the GDPR, where the recipient is certified. For other countries, we use standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission, or rely on an exception the law allows, such as performing a contract with you. You can ask us for a copy of the safeguards used.
8. Retention and security
8.1 We keep personal data only as long as needed for the purposes in Section 3, or longer where the law requires it, and then delete or anonymise it.
8.2 We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls and logging, to protect personal data. No system is completely secure, and you are responsible for keeping your API Keys and wallets secure.
9. Your rights
9.1 Subject to the law, you have the right to access your personal data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, withdraw consent at any time, and ask for a person to review an automated decision. Note that we cannot delete public blockchain data (Section 4).
9.2 To exercise your rights, contact us at api@sodax.com. We may ask you to verify your identity, and we will normally reply free of charge within 30 days.
9.3 You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, or, if you are in the EU or UK, to your local data protection authority.
11. Other matters
11.1 Children. The Services are not intended for anyone under 18, and we do not knowingly collect their data.
11.2 Third-party services. Wallets, Integrators, blockchains and other third-party services you use with the Services have their own privacy policies, and we are not responsible for them.
11.3 Changes. We may update this Privacy Policy and will post the new version with its date. If changes are material, we will tell you by email or in the Developer Portal.
11.4 Contact. ICON Foundation, Gubelstrasse 11, 6300 Zug, Switzerland; api@sodax.com.