Privacy Policy

Copyright Record is committed to protecting personal information, maintaining the confidentiality of registered documents and safeguarding the privacy rights of individuals and organisations using its services.

This Privacy Policy describes how Copyright Record collects, processes, stores, protects, discloses and retains personal information in connection with its digital registration, certification, blockchain and NFT verification services.

Personal data is processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), as incorporated into Norwegian law through the Norwegian Personal Data Act (personopplysningsloven), and other applicable legislation.

The operator responsible for the Service is:

Legal Operator: Copyright Record
Trading Name: Copyright Record
Country: Norway
Privacy Contact: privacy@copyrightrecord.com
Website: https://copyrightrecord.com

Copyright Record acts as data controller where it determines the purposes and means of processing personal data. Where processing is undertaken on behalf of an institutional customer, the parties' respective responsibilities shall be determined in accordance with the GDPR.

This Policy applies to personal data processed in connection with:

• Customer account registration and management.
• Uploading and registration of digital documents.
• Cryptographic hashing and verification.
• Public and private registration certificates.
• Blockchain transactions and NFT issuance.
• Public registration and verification facilities.
• Payments and billing.
• Customer support and communications.
• Institutional and professional registrations.
• Security monitoring, compliance reviews and lawful investigations.

The Policy applies to individuals using the Service directly and, where relevant, individuals whose personal information is processed through documents registered by organisations or other authorised parties.

Copyright Record may collect and process personal information reasonably necessary to provide, secure and administer its services.

Such information may include names, email addresses, account identifiers, organisational details, authentication records, billing information, registration details, uploaded documents, cryptographic file hashes, certificates, blockchain references, wallet addresses, IP addresses and relevant security records.

Original uploaded documents may contain personal information relating to the registrant or other individuals.

Copyright Record does not require Customers to submit unnecessary personal information and applies the principle of data minimisation to its processing activities.

Payment card details are handled by the relevant payment service provider in accordance with its processing arrangements. Copyright Record may retain payment confirmations, transaction identifiers and billing information necessary for legitimate business and legal purposes.

Copyright Record processes personal data only where an appropriate lawful basis exists under Article 6 of the GDPR.

Processing necessary to create accounts, perform registrations, generate certificates, administer purchased services and provide verification facilities may be based on the performance of a contract under Article 6(1)(b).

Processing required for compliance with applicable tax, accounting, judicial or other statutory obligations may be based on Article 6(1)(c).

Processing necessary for legitimate security, fraud prevention, service integrity, compliance reviews and legal claims may be based on Article 6(1)(f), subject to an appropriate assessment of the rights and interests of affected individuals.

Consent under Article 6(1)(a) may be relied upon for specific optional processing where appropriate and legally valid.

Where special categories of personal data are processed, an applicable condition under Article 9 of the GDPR must also be established. Processing of personal data concerning criminal convictions and offences shall comply with Article 10 and applicable national law.

Acceptance of the Terms and Conditions does not constitute unrestricted consent to the processing or public disclosure of personal information.

Copyright Record operates a digital registration and public verification service.

The public registration certificate is intended to be publicly accessible and forms an essential part of the registration service.

By requesting registration, the Customer acknowledges that the designated public certificate and associated public verification information will be available for public access.

The public certificate may contain the registration identifier, title or description of the registered work, registration date, cryptographic hash, designated public registrant or issuing institution information, blockchain transaction reference, NFT identifier and other information necessary for verification.

Before registration is finalised, the Customer shall be informed of the information intended for public disclosure and required to acknowledge the public nature of the registration.

The Customer is responsible for providing accurate information and ensuring that they possess the necessary rights and authority to submit information designated for publication.

Where personal information relating to another individual is involved, an appropriate legal basis and any additional required safeguards must exist. A registrant's contractual acceptance does not, by itself, establish such a basis.

Public certificates and designated public registration information may be viewed, downloaded, copied, shared, indexed and independently retained by third parties.

The Customer acknowledges that information made public through the registration service may remain accessible to third parties after the original publication.

Copyright Record remains responsible for ensuring that its own processing and disclosure of personal data comply with applicable law.

Copyright Record uses public blockchain technology, including Polygon, to provide verifiable registration evidence and NFT-related services.

Blockchain transactions may contain cryptographic references, transaction identifiers, token information, wallet addresses and other registration-related metadata.

NFT artwork, designated public certificate images and associated metadata may be accessible through blockchain networks, decentralised storage systems, NFT viewers and independent third-party platforms.

Information published through these systems may be replicated internationally and may not be technically removable in its entirety.

Customers acknowledge that public blockchain transactions and NFT-related records may be permanent and accessible without requiring continued operation of Copyright Record's website.

Before publication, Copyright Record shall apply appropriate data minimisation and privacy safeguards to reduce the risk of unnecessary personal information being recorded permanently.

Cryptographic hashes, blockchain addresses and other identifiers may constitute personal data where they relate to an identified or identifiable individual.

Copyright Record shall not intentionally publish confidential original documents, private certificates or unnecessary personal information as part of ordinary blockchain or NFT registration.

The permanent nature of blockchain technology does not remove Copyright Record's obligations under the GDPR.

Original uploaded documents and private registration certificates are treated as confidential materials.

Public registration does not automatically make the original uploaded document or private certificate publicly accessible.

Copyright Record shall implement appropriate technical and organisational measures to protect these materials against unauthorised access, disclosure, modification or replacement.

Original documents may be processed for registration, certificate generation, integrity verification, legitimate administration, authorised compliance activities and other lawful purposes.

Private documents shall not be disclosed to unrelated third parties without an appropriate legal basis.

Public registration certificates and verification records shall remain distinct from the underlying confidential original files.

Customers remain responsible for downloading and independently preserving their registration documents in accordance with the Terms and Conditions.

Copyright Record maintains a restricted administrative access policy for confidential original documents.

Access to original files for senior compliance review shall be limited to one specifically designated and authorised official operating through the protected Super Administrator role.

Such access shall be protected by multi-factor authentication, appropriate authorisation controls and security logging.

For compliance review purposes, the Super Administrator's permissions shall be limited to authorised retrieval and downloading of the original file.

The Super Administrator shall not be authorised to amend, overwrite, replace or substitute an original registered document.

Any investigative copy shall be handled separately from the original registered file.

Administrative access shall be permitted only where necessary for a legitimate and lawful purpose and shall be subject to appropriate confidentiality and accountability requirements.

Ordinary administrative and customer support personnel shall not have unrestricted access to confidential original documents.

Automated system processing necessary to operate the registration service shall remain subject to appropriate technical security safeguards.

Copyright Record may process documents submitted by schools, universities, awarding bodies, research institutions, notaries, legal professionals, businesses and other authorised organisations.

Such documents may contain personal information relating to students, graduates, researchers, employees, clients and other individuals.

Institutional Customers must ensure that the submission, registration and any public disclosure of personal information are lawful.

Where an institution determines the purposes and means of processing personal data, it may act as data controller.

Where Copyright Record processes personal data on the institution's behalf and instructions, Copyright Record may act as data processor, subject to an appropriate agreement under Article 28 of the GDPR.

Copyright Record may act as an independent controller for its own account management, security, compliance, billing or other independently determined lawful processing activities.

Institutional registration shall not automatically authorise disclosure of confidential student records, academic results, personal identifiers or other protected information.

Special safeguards shall apply where required for children's personal data or other sensitive information.

Copyright Record may retain original uploaded files, certificates and related registration information on its controlled systems.

Such retention supports the operation of the registration service and may also serve administrative, verification, security and lawful compliance purposes.

Complimentary document storage does not constitute a separately purchased permanent backup service.

Personal information shall be retained only for as long as necessary for the relevant lawful purpose, subject to applicable legal obligations.

Retention is determined according to the nature of the information and the applicable purpose:

• Account information is retained while required for account administration and any justified period following closure.
• Registration and certificate information is retained while necessary for the lawful provision of registration and verification services.
• Original documents held through complimentary storage are subject to the applicable document-retention arrangements.
• Financial and accounting information is retained for the periods required by applicable law.
• Security, compliance and investigation records are retained only for periods justified by legitimate security, legal or regulatory requirements.

Where personal information is no longer required and no lawful basis for continued retention exists, it shall be deleted or anonymised as appropriate.

The retention of publicly recorded blockchain information is subject to the additional technical and legal considerations set out in this Policy.

Copyright Record may engage third-party providers for payment processing, hosting, infrastructure, technical maintenance, security, communications and other legitimate operational requirements.

Such providers may process personal information only to the extent necessary for their relevant functions and in accordance with their applicable legal responsibilities.

Where a provider acts as a processor, appropriate contractual and security arrangements shall be established under Article 28 of the GDPR.

Payment processing may involve Stripe or another payment provider identified during the relevant transaction.

Certain providers may act as independent controllers for specific processing activities, including compliance with their own legal obligations.

Copyright Record shall not sell private uploaded documents or disclose their contents to unrelated third parties for independent marketing purposes.

Details of relevant recipients, processor categories and applicable international transfer arrangements shall be provided in accordance with GDPR transparency requirements.

Copyright Record is operated from Norway and may provide registration and verification services to Customers internationally.

Where personal information is transferred outside the European Economic Area, Copyright Record shall comply with applicable requirements under Chapter V of the GDPR.

Where necessary, appropriate transfer mechanisms and supplementary safeguards shall be established.

Public blockchain networks and decentralised infrastructure may involve international replication of data.

Copyright Record shall assess the legal and technical implications of such publication and apply appropriate safeguards before personal information is made publicly available.

Copyright Record reserves the right to conduct targeted compliance reviews where credible information indicates suspected fraud, serious misuse, unlawful material or other violations of the Terms and Conditions.

Any review involving personal data shall be supported by an appropriate legal basis and limited to what is necessary and proportionate.

Copyright Record may report credible suspected criminal conduct to competent law enforcement or regulatory authorities where reporting or disclosure is legally required or otherwise lawfully permitted.

Relevant information may be disclosed in response to valid court orders, binding legal obligations or other legally enforceable requests.

Such information may include original registered documents, certificates, registration records, account information and relevant security or payment records.

Requests shall be assessed for legal validity, necessity and appropriate scope.

Where permitted by law, affected individuals may be informed of relevant disclosures. Notification may be withheld where legally prohibited or where necessary to protect a legitimate investigation or urgent protective action.

A suspected violation does not automatically establish criminal wrongdoing.

Copyright Record may suspend, restrict or terminate accounts in accordance with its Terms and Conditions and applicable law.

Where an account is suspended or terminated, access to account-based services and complimentary storage may be restricted.

Such action does not automatically require the immediate deletion of all associated personal information.

Relevant information may be retained where necessary to comply with legal obligations, preserve evidence, investigate serious misconduct or establish, exercise or defend legal claims.

Continued processing following termination must have an appropriate legal basis and remain subject to applicable retention requirements.

Personal information shall not be retained indefinitely solely because an account was suspended or a complaint was received.

Individuals whose personal information is processed by Copyright Record may exercise the rights available under the GDPR, subject to applicable statutory conditions and exceptions.

These rights include:

15.1 Right of Access

The right to obtain confirmation of whether personal information is processed and to request access to applicable information under Article 15.

15.2 Right to Rectification

The right to request correction of inaccurate personal information under Article 16.

Rectification shall not authorise the substitution of a different document under an existing registered cryptographic fingerprint.

15.3 Right to Erasure

The right to request deletion of personal information where the conditions of Article 17 are satisfied.

15.4 Right to Restriction

The right to request restriction of processing under Article 18.

15.5 Right to Data Portability

The right to receive applicable personal information in a structured, commonly used and machine-readable format where Article 20 applies.

15.6 Right to Object

The right to object to certain processing activities under Article 21.

15.7 Rights Concerning Automated Decision-Making

The protections applicable under Article 22 where decisions are based solely on automated processing and produce legal or similarly significant effects.

15.8 Withdrawal of Consent

Where processing relies on consent, individuals may withdraw consent in accordance with Article 7.

Withdrawal shall not affect the lawfulness of processing undertaken before withdrawal.

Requests may be submitted to:

privacy@copyrightrecord.com

Copyright Record shall respond without undue delay and ordinarily within one month, subject to lawful extensions and appropriate identity verification.

Copyright Record recognises the right to erasure under Article 17 of the GDPR.

Where a valid erasure request is received, Copyright Record shall assess the applicable legal requirements and take appropriate action concerning personal information held within systems under its control.

Deletion may be subject to lawful exceptions, including compliance with legal obligations or the establishment, exercise or defence of legal claims.

Public blockchain transactions and decentralised records may be technically immutable and independently replicated.

As a result, removal from Copyright Record's own website or databases may not automatically remove copies held by independent networks or third parties.

Technical immutability does not automatically override the GDPR or extinguish an individual's statutory rights.

Copyright Record shall address applicable rectification, restriction and erasure obligations through lawful and appropriate technical and organisational measures.

Where personal data cannot be processed through a particular blockchain architecture in compliance with applicable legal requirements, such processing shall not be undertaken.

Copyright Record shall maintain technical and organisational security measures appropriate to the risks associated with its processing activities.

Such measures may include authentication controls, multi-factor authentication, access restrictions, encryption where appropriate, security monitoring, audit logging, secure communications, backup protections and incident response procedures.

Security controls shall be reviewed and updated where reasonably necessary.

In the event of a personal data breach, Copyright Record shall assess and document the incident in accordance with the GDPR.

Where Article 33 requires notification to the competent supervisory authority, notification shall be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Affected individuals shall be notified where Article 34 requires notification because the breach is likely to result in a high risk to their rights and freedoms.

Copyright Record may use cookies and similar technologies necessary for account authentication, session management, website security and the operation of requested services.

Non-essential cookies, analytics or tracking technologies shall be used only in accordance with applicable Norwegian and European privacy and electronic communications requirements.

Where consent is required, users shall be provided with appropriate information and a valid means of giving, refusing and withdrawing consent.

Further information concerning cookies, providers, purposes and storage periods shall be provided through the applicable cookie notice or consent interface.

Copyright Record may contact Customers regarding their accounts, registration confirmations, payments, security matters, service changes and other communications necessary for the administration of the Service.

Marketing communications shall be sent only where permitted by applicable law.

Where consent is required, it shall be obtained separately and may be withdrawn.

Customers shall be provided with an appropriate means of objecting to or unsubscribing from promotional communications.

Personal information shall not be used for unrelated marketing purposes without an appropriate legal basis.

Copyright Record may use automated processing to calculate cryptographic hashes, create certificates, issue blockchain transactions, administer payments, verify registrations and identify potential security incidents.

Where automated processing involves personal data, it shall be conducted in accordance with applicable GDPR requirements.

Decisions producing legal or similarly significant effects that fall within Article 22 shall be subject to the applicable safeguards and rights.

Automated indications of suspicious activity shall not be treated as conclusive evidence of criminal misconduct without appropriate assessment.

Individuals may contact Copyright Record concerning the collection, use, disclosure, retention or protection of their personal information.

All data protection enquiries should be directed to:

Copyright Record — Data Privacy and Protection
Email: privacy@copyrightrecord.com
Website: https://copyrightrecord.com

Individuals also have the right to lodge complaints with a competent data protection supervisory authority.

The Norwegian supervisory authority is:

Datatilsynet — Norwegian Data Protection Authority
Website: https://www.datatilsynet.no

Nothing in this Policy restricts an individual's mandatory rights to pursue complaints or judicial remedies under applicable data protection legislation.

Copyright Record reserves the right to amend this Privacy Policy where necessary to reflect changes in legislation, technology, security requirements or its processing activities.

The effective date shall be updated following publication of a revised policy.

Material changes shall be communicated where legally required.

Personal information shall not be processed for incompatible new purposes without compliance with applicable requirements concerning lawful bases, transparency and other safeguards.

This Privacy Policy shall be interpreted in accordance with applicable Norwegian and European Economic Area data protection legislation, including the GDPR and the Norwegian Personal Data Act.

The jurisdiction provisions contained in Copyright Record's Terms and Conditions shall not limit mandatory rights under data protection law, including access to competent supervisory authorities or judicial remedies.

Nothing in this Policy constitutes a waiver of rights that cannot lawfully be excluded.

COPYRIGHT RECORD

Digital Registration, Public Verification, Confidentiality and Personal Data Protection

Privacy Contact: privacy@copyrightrecord.com

Website: https://copyrightrecord.com