Privacy Policy - Galaxia Science Platform

Last Updated: December 6, 2025
Effective Date: December 6, 2025

1. Introduction

Galaxia Science ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

2. Data Controller

Data Controller: Galaxia Science
Contact: privacy@galaxia.xyz
Address: [Company Address]

3. Information We Collect

3.1 Information You Provide

Identity Information: Name, government ID, proof of address
Wallet Information: Ethereum addresses, transaction history
KYC/AML Data: Source of funds, beneficial ownership information
Profile Information: Bio, website, social media links
Communication Data: Emails, support tickets, complaints

3.2 Automatically Collected Information

Transaction Data: All on-chain and off-chain transactions
Usage Data: Platform interactions, page views, features used
Technical Data: IP address, device information, browser type
Location Data: IP-based geolocation for jurisdiction detection

3.3 Third-Party Information

Blockchain Data: Public blockchain transaction data
KYC Providers: Identity verification results
Sanctions Lists: Screening results from OFAC, UN, EU lists

4. Legal Basis for Processing (GDPR)

We process your personal data based on:

Legal Obligation: AML/KYC compliance, regulatory reporting
Contract Performance: Providing Platform services
Legitimate Interest: Fraud prevention, security, business operations
Consent: Marketing communications (where applicable)

5. How We Use Your Information

5.1 Service Provision

User authentication and account management
Grant creation and funding
Transaction processing
Customer support

5.2 Compliance

KYC/AML verification
Sanctions screening
Transaction monitoring
Regulatory reporting (SARs, STRs, CTRs)
Tax reporting (where required)

5.3 Security

Fraud prevention
Risk assessment
Security monitoring
Incident response

5.4 Legal Requirements

Responding to legal requests
Enforcing Terms of Service
Protecting rights and safety
Complying with court orders

6. Data Sharing and Disclosure

6.1 Service Providers

We share data with:

KYC/AML Providers: Identity verification services
Sanctions Screening Services: OFAC, UN, EU list providers
Cloud Providers: Hosting and infrastructure
Analytics Providers: Usage analytics (anonymized)

6.2 Regulatory Authorities

We may disclose data to:

Financial intelligence units (FIUs)
Law enforcement agencies
Regulatory bodies
Tax authorities
As required by law or court order

6.3 Business Transfers

In case of merger, acquisition, or sale, your data may be transferred to the acquiring entity.

6.4 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

7. International Data Transfers

7.1 Cross-Border Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards:

Standard Contractual Clauses (SCCs)
Adequacy decisions
Binding Corporate Rules (where applicable)

7.2 EU-US Transfers

For EU users, transfers to the US comply with GDPR requirements and use approved transfer mechanisms.

8. Data Retention

8.1 Retention Periods

Transaction Records: Minimum 5 years (AML requirement)
KYC/AML Data: 5 years after account closure
Complaint Records: 5 years
Marketing Data: Until consent withdrawn
Technical Logs: 2 years

8.2 Legal Holds

Data may be retained longer if subject to legal hold or ongoing investigation.

8.3 Deletion

After retention periods, data is securely deleted or anonymized.

9. Your Rights (GDPR & CCPA)

9.1 Access

Request a copy of your personal data.

9.2 Rectification

Correct inaccurate or incomplete data.

9.3 Erasure ("Right to be Forgotten")

Request deletion of your data (subject to legal retention requirements).

9.4 Restriction

Request limitation of processing in certain circumstances.

9.5 Data Portability

Receive your data in a structured, machine-readable format.

9.6 Objection

Object to processing based on legitimate interests.

9.7 Withdraw Consent

Withdraw consent for processing (where applicable).

9.8 Complaints

File complaints with supervisory authorities:

EU: Your local data protection authority
UK: Information Commissioner's Office (ICO)
US: State attorney general (CCPA)

10. Data Security

10.1 Security Measures

Encryption at rest (AES-256)
Encryption in transit (TLS 1.3+)
Access controls and authentication
Regular security audits
Incident response procedures

10.2 Breach Notification

In case of data breach:

GDPR: Notification within 72 hours to supervisory authority
Users: Notification without undue delay if high risk
US: As required by state breach notification laws

11. Cookies and Tracking

11.1 Cookies Used

Essential: Required for Platform functionality
Analytics: Usage analytics (with consent)
Preferences: User preferences and settings

11.2 Cookie Management

You can manage cookie preferences in your browser settings or our cookie consent banner.

12. Children's Privacy

The Platform is not intended for users under 18. We do not knowingly collect data from children. If we discover such data, we will delete it immediately.

13. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for their privacy practices. Review their privacy policies.

14. Changes to Privacy Policy

We may update this Privacy Policy. Material changes will be notified:

Email notification
Platform notification
Updated "Last Updated" date

15. Contact Us

Data Protection Officer: dpo@galaxia.xyz
Privacy Inquiries: privacy@galaxia.xyz
Address: [Company Address]

16. Jurisdiction-Specific Rights

16.1 California (CCPA)

California residents have additional rights under CCPA. See our CCPA supplement.

16.2 EU/UK (GDPR)

EU/UK residents have rights under GDPR. See sections 9 and 10.

16.3 Other Jurisdictions

Additional rights may apply based on your jurisdiction.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy.