1. PURPOSE
This Policy explains how Next Defi collects, uses, stores, shares and protects personal data when individuals access the nextdefi.uk website, create an account or use its products and services.
Personal data will be processed in accordance with applicable legislation, including, where relevant, the Brazilian General Data Protection Law, LGPD, the UK GDPR and other applicable data protection laws.
2. DATA CONTROLLER
The controller of personal data is:
Legal company name: NEXT DEFI UK
3. PERSONAL DATA WE MAY COLLECT
Next Defi may collect:
3.1. Registration information
Full name, date of birth, country, address, telephone number, email address, username and protected password.
3.2. Identification information
Identity document, CPF, passport, proof of address, photograph, selfie and other information required for identity verification.
3.3. Financial and digital asset information
Wallet address, network used, transaction identifiers, amounts transferred, assets used, fees, displayed balances and product-related history.
3.4. Exchange and API information
Name of the exchange, account identifier, permissions granted, connection status, orders, positions, trading history and other information required for the integration.
API keys must be stored using appropriate security measures. Any API used for IA Copy Trader must be configured without withdrawal authorisation.
3.5. Network and reward information
Referral code, sponsor, network structure, qualifications, rewards generated, rewards released, limits and history.
3.6. Technical information
IP address, device, browser, operating system, language, approximate location, access date and time, pages accessed and security logs.
3.7. Communications
Messages sent to support, requests, complaints, survey responses and communications made by email, Telegram or other channels.
3.8. Information obtained from third parties
Information received from identity providers, exchanges, blockchains, fraud prevention systems, partners and public sources, where permitted by law.
4. PURPOSES OF PROCESSING
Personal data may be used to:
- create and manage the account;
- verify identity and age;
- provide access to products;
- connect APIs and exchanges;
- process and record transactions;
- calculate rewards and qualifications;
- display histories within the dashboard;
- prevent fraud and unauthorised access;
- comply with legal and regulatory obligations;
- conduct sanctions checks and prevent money laundering;
- provide support;
- send operational and security alerts;
- improve Platform performance;
- investigate failures and incidents;
- establish, exercise or defend legal claims;
- send marketing communications where permitted;
- produce aggregated and anonymised statistics.
5. LAWFUL BASES FOR PROCESSING
Depending on the purpose and jurisdiction, processing may be based on:
- performance of a contract or steps taken before entering into a contract;
- compliance with a legal or regulatory obligation;
- legitimate interests, following an assessment of the rights of the data subject;
- consent;
- fraud prevention and security;
- the establishment, exercise or defence of legal claims;
- credit protection, where applicable;
- other lawful bases provided by law.
Where processing relies on consent, the User may withdraw that consent at any time without affecting processing carried out before its withdrawal.
6. SENSITIVE PERSONAL DATA AND BIOMETRICS
6.1. Biometric data or other sensitive personal data will only be processed where necessary for identity verification, fraud prevention or compliance with a legal obligation, in accordance with the applicable lawful bases.
6.2. Next Defi may use a specialist service provider to perform verification and will disclose that provider's involvement where required.
7. BLOCKCHAIN AND PUBLIC INFORMATION
7.1. Transactions carried out on a blockchain may be publicly available and linked to the relevant wallet address.
7.2. Confirmed blockchain records are normally permanent and cannot be erased or altered by Next Defi.
7.3. Although a wallet address does not directly reveal the name of the holder, it may be associated with an individual when combined with other information.
7.4. Erasure requests do not extend to public and immutable records that are not under Next Defi's technical control.
8. SHARING OF PERSONAL DATA
Personal data may be shared with:
- cloud and hosting providers;
- security and fraud prevention services;
- identity verification providers;
- exchanges connected by the User;
- blockchain networks;
- payment processors;
- communication, email and Telegram services;
- support and development companies;
- auditors, accountants and legal advisers;
- public authorities where required by law;
- companies within the same group where necessary and permitted;
- third parties involved in a reorganisation, acquisition or sale of the company.
Next Defi will not sell personal data as a standalone business activity unless valid authorisation has been obtained and clear information has been provided to the data subject.
9. INTERNATIONAL TRANSFERS
9.1. Personal data may be processed in countries other than the country in which the User resides.
9.2. In such circumstances, Next Defi will use legally permitted safeguards, such as contractual clauses, adequacy decisions or other applicable mechanisms.
9.3. International transfers will comply with the LGPD, UK GDPR or other legislation applicable to the particular circumstances.
10. RETENTION PERIODS
10.1. Personal data will be retained for as long as necessary to:
- provide the services;
- comply with legal obligations;
- prevent fraud;
- resolve disputes;
- establish, exercise or defend legal rights;
- maintain accounting and regulatory records.
10.2. After an account has been closed, certain information may remain stored for the applicable statutory retention periods.
10.3. Personal data that is no longer required will be securely erased or anonymised, except for public blockchain records.
11. SECURITY
Next Defi will adopt technical and organisational measures appropriate to the relevant risks, including, where applicable:
- encryption of sensitive information;
- access controls;
- two-factor authentication;
- activity logging;
- security monitoring;
- permission restrictions;
- backups;
- reviews of internal access;
- incident response procedures.
No system is completely invulnerable. The User must also protect their devices, passwords, email account, wallet, API and authentication methods.
12. SECURITY INCIDENTS
Where a security incident may result in a relevant risk or harm to data subjects, Next Defi will take appropriate containment and investigation measures and will notify the relevant authorities and affected individuals where required by law.
13. RIGHTS OF THE DATA SUBJECT
Depending on the applicable legislation, the data subject may request:
- confirmation that processing is taking place;
- access to personal data;
- correction of incomplete or outdated personal data;
- anonymisation, restriction or erasure of unnecessary personal data;
- data portability, where applicable;
- information about data sharing;
- review of automated decisions, where applicable;
- objection to certain processing;
- withdrawal of consent;
- restriction of processing;
- the right to lodge a complaint with the relevant authority.
Requests may be sent to nextdefi.uk. Next Defi may verify the identity of the person making the request before responding.
14. AUTOMATED DECISION-MAKING
14.1. The Platform may use automation for security, fraud prevention, monitoring, operational risk classification and product operation.
14.2. Where a decision based solely on automated processing produces legal effects or otherwise significantly affects the data subject, they may request information and human review where provided by law.
15. COOKIES
15.1. The website may use:
- strictly necessary cookies;
- security cookies;
- preference cookies;
- analytics cookies;
- advertising cookies, where authorised.
15.2. Non-essential cookies will be subject to consent where required by law.
15.3. The User may manage their preferences through the cookie settings panel.
16. MARKETING COMMUNICATIONS
16.1. Next Defi may send news, product information and marketing communications where there is a valid lawful basis.
16.2. The User may unsubscribe from marketing communications. Essential security and account operation messages may continue to be sent.
17. CHILDREN
The Platform is not intended for anyone under the age of 18. If an account belonging to a minor is identified, it may be suspended and the relevant personal data will be processed in accordance with applicable law.
18. EXTERNAL LINKS AND SERVICES
The Platform may contain links to or integrations with third parties. Next Defi does not control the privacy practices of those third parties. The User should review their respective privacy policies.
19. CHANGES TO THIS POLICY
This Policy may be updated to reflect legal, regulatory, technological or operational changes.
Material changes will be communicated through the Platform, by email or through another appropriate channel.
20. CONTACT
Questions and requests relating to privacy should be sent to:
Data Controller: NEXT DEFI UK
WEBSITE: nextdefi.uk
21. DATA PROTECTION AUTHORITIES
Where applicable, the data subject may lodge a complaint with the relevant data protection authority, including:
Brazil: Brazilian National Data Protection Authority, ANPD.
United Kingdom: Information Commissioner's Office, ICO.