Last Updated: January 1, 2025
NHBCoin is operated by Nehborly, Inc. (“we,” “us,” “our”). This Privacy Policy (“Policy”) explains how we collect, use, disclose, and safeguard information related to the NHBCoin website, interfaces, and related services (collectively, the “Services”).
This Policy applies to personal data processed through the Services. It should be read together with our Terms & Conditions. Capitalized terms not defined here have the meanings in the Terms.
We use essential cookies for security and session management, and limited analytics for performance and abuse prevention. You can manage cookies in your browser; disabling may impact functionality.
We implement administrative, technical, and physical safeguards proportionate to the risks (e.g., encryption in transit, access controls, logging). No method is 100% secure; residual risk remains.
We retain personal data only as long as necessary for the purposes described in this Policy, including legal, tax, accounting, security, and compliance requirements. On-chain data may persist publicly indefinitely.
We may process and store personal data outside your country of residence, including in the United States and other jurisdictions where we or our service providers operate. Where cross-border transfer restrictions apply (e.g., EEA/UK), we implement safeguards designed to comply with applicable legal requirements.
| Transfer From | Transfer To | Safeguard Mechanism |
|---|---|---|
| EEA / UK | United States (Nehborly, Inc.) | EU Standard Contractual Clauses (SCCs) + UK Addendum and supplementary measures (encryption, access controls). |
| EEA / UK | Third-Party Vendors (Cloud, Analytics, KYC, Email) | SCCs or equivalent mechanisms; vendor due diligence; contractual data protection obligations. |
| Global | Other jurisdictions where vendors operate | Adequacy decisions where available, or SCCs/approved safeguards. |
We monitor legal developments (e.g., Schrems II) and update safeguards as required. To request a copy of SCCs (subject to redaction), contact privacy@nehborly.net.
Subject to law and jurisdiction, you may request access, correction, deletion, restriction, portability, or objection to certain processing. Contact: privacy@nehborly.net. We may need to verify your identity and will respond within timelines required by applicable law.
For marketing or non-essential email preferences, use the unsubscribe link in those emails. Service/transactional emails may still be required.
If you are in the EEA, UK, or another jurisdiction with comparable laws, the following apply only to the minimum extent required by law and subject to legal limits:
| Right | Description |
|---|---|
| Access | Request confirmation of processing and obtain a copy of personal data. |
| Rectification | Correct inaccurate or incomplete personal data. |
| Erasure (“Right to be Forgotten”) | Request deletion in certain circumstances (e.g., no longer necessary, consent withdrawn, unlawful processing). |
| Restriction | Request restriction of processing in certain cases (e.g., contested accuracy, pending objection). |
| Portability | Receive data provided by you in a structured, commonly used, machine-readable format; request transfer where feasible. |
| Objection | Object to processing based on legitimate interests or direct marketing, to the extent permitted by law. |
| Withdraw Consent | Withdraw consent at any time where processing is based on consent (does not affect prior lawful processing). |
| Complaint | Lodge a complaint with your supervisory authority if you believe your rights are violated. |
Our Services do not currently respond to browser “Do Not Track” signals. We honor applicable privacy rights provided by law where we operate.
For purposes of Article 27 of the EU GDPR and the UK GDPR, Nehborly, Inc. has appointed the following representative for individuals and supervisory authorities in the EEA and the UK:
Data Protection Representative (EEA & UK)
Email: uk@nehborly.net
EEA/UK residents may contact our representative on issues related to processing of personal data and GDPR/UK-GDPR compliance.
In accordance with Articles 13, 14, and 30 of the EU GDPR and UK GDPR, we maintain internal Records of Processing Activities. The following is a public summary of primary categories of processing:
| Category | Types of Data | Purpose of Processing | Legal Basis (where applicable) | Retention |
|---|---|---|---|---|
| User Accounts | Email, login data, preferences | Create/manage accounts; provide Services | Contract performance; legitimate interests | Active account + up to 3 years after closure |
| Wallet & On-Chain Data | Public wallet address, transaction hashes | Display balances; facilitate on-chain actions | Contract performance; legitimate interests | Indefinite (public blockchain) |
| KYC / AML Verification | ID, proof of address, sanctions-screening data | Regulatory compliance; fraud prevention | Legal obligation | As required by AML laws (typically 5–7 years) |
| Communications | Email messages, support requests | Respond to inquiries; send notices; support | Legitimate interests; contract performance | Up to 3 years after correspondence closes |
| Marketing (optional) | Email, cookies/analytics | Send promotional content (with opt-in consent) | Consent | Until consent is withdrawn |
| Security & Compliance Logs | IP addresses, device/browser info, audit logs | Detect/prevent abuse; protect security | Legitimate interests; legal obligation | Typically 12–24 months, unless required longer |
This summary is not exhaustive. Detailed records are maintained internally to comply with Article 30 and may be provided to supervisory authorities upon lawful request.
We maintain safeguards to protect personal data; however, incidents may occur. In the event of a personal data breach, we will:
Notification may be delivered by email, website notice, or other legally permissible means. We may delay notification at the request of law enforcement where immediate disclosure could jeopardize an investigation or national security.
Our Services are not directed to or intended for children under 18. We do not knowingly collect personal data from individuals under 13 (COPPA – US) or below the age of digital consent set by local law (typically 13–16 under GDPR/UK-GDPR).
By using the Services, you represent and warrant that you meet the minimum age requirement in your jurisdiction.
Nothing in this Policy shall exclude, limit, or restrict any rights, remedies, or protections you may have under mandatory, non-waivable data protection, privacy, or consumer laws in your jurisdiction (“Mandatory Privacy Laws”).
We may update this Policy and will post the new Effective Date. Material changes will be communicated by email and/or website notices. Continued use of the Services after changes constitutes acceptance.
Privacy inquiries and data subject requests: privacy@nehborly.net
Nehborly, Inc., Delaware, USA