Privacy Policy
Version v2025.01 · Effective 2025-01-01. This policy explains how Global AI DAO ("we" / "Global AI DAO") collects, uses, stores, shares and protects your personal information.
Policy
1. Data Controller
This site uses the Global AI DAO brand. The legal controller's identity, registration and representative details remain pending verification; obtain and verify them before sharing sensitive information or signing. Initial inquiries collect name, work email and industry, plus voluntary additional details.
Contracting & responsibility disclosure
When providing services to customers we may act as a processor on the customer's instructions; such arrangements are governed by a separate Data Processing Agreement (DPA).
Customer business data and personal information are not written to a blockchain. Confirm project processing region, model providers, retention and deletion in a data agreement. Website events record pages, sessions, language and submission outcomes; form contents are not sent as event properties.
2. Scope
3. Categories of personal data we collect
- Identity & contact: name, company, role, work email, phone, country / region.
- Business communications: needs you submit, attachments, meeting notes and correspondence.
- Technical & log data: IP address, device, OS, browser, access time, referer, page path.
- Cookies & similar tech: see Cookie Policy。
- Compliance data: KYC / KYB / sanctions-screening information where required by law or customer due diligence.
We do not proactively collect sensitive personal data (race, religion, biometrics, health). If genuinely necessary, we will inform you separately and obtain explicit consent.
4. Purposes & legal bases
| Purpose | Legal basis (GDPR / PIPL) |
|---|---|
| Respond to inquiries, provide quotes, conclude and perform contracts | Contract / pre-contract (GDPR 6(1)(b); PIPL 13(2)) |
| Maintain and improve the site, secure it, prevent fraud | Legitimate interest (GDPR 6(1)(f)); necessary for information security (PIPL 13(5)) |
| Comply with statutory duties (tax, AML, regulatory filings) | Legal obligation (GDPR 6(1)(c); PIPL 13(3)) |
| Marketing emails, event invitations, industry insights | Consent (GDPR 6(1)(a); PIPL 13(1)), withdrawable at any time |
| Participation in DAO governance, on-chain activity and voting | Contract performance combined with legitimate interest |
5. Sharing & disclosure
- Affiliates: for unified customer service and internal administration;
- Trusted vendors: cloud, email, support, payments, audit, security monitoring etc., bound by DPAs and the minimisation principle;
- Professional advisers: lawyers, accountants, auditors;
- Authorities: pursuant to lawful, valid requests or where necessary to protect a substantial public interest;
- Counterparties: in mergers, acquisitions or restructurings, with prior confidentiality obligations.
6. Cross-border data transfers
7. Storage & retention
We retain personal data only for as long as necessary for the purposes set out in this policy, then delete or anonymise it. Typical retention ranges:
| Data category | Retention range |
|---|---|
| Inquiry forms and business communications | 24 months from the last interaction |
| Customer contracts and performance records | 5–10 years after termination (per local law) |
| KYC / KYB and AML records | At least 5 years after end of relationship (FATF) |
| Website access and security logs | 6–18 months |
| Marketing subscriptions and consent records | Deleted within 24 months of consent withdrawal |
| Tax and finance records | 10 years (per tax law) |
8. Security measures
9. Your rights
- Be informed, access and obtain copies of your data;
- Rectify inaccurate or incomplete data;
- Erasure (the "right to be forgotten");
- Restriction of, or objection to, processing;
- Data portability (structured, common, machine-readable format);
- Withdraw consent without affecting prior processing lawfulness;
- Not be subject to decisions based solely on automated processing (incl. profiling) that significantly affect you;
- Lodge a complaint with a supervisory authority (e.g. EU member-state DPA, China CAC).
Please email privacy@globalaidao.org and we will respond within 30 days (GDPR) or 15 working days (PIPL).
10. Automated decisions & profiling
11. Protection of minors
12. Policy updates
13. Contact us
- General: privacy@globalaidao.org
- DPO: dpo@globalaidao.org
- EU Representative: eu-rep@globalaidao.org
Exercise your right to erasure
Under GDPR Art. 17 and PIPL Art. 47 you may request deletion of personal information about you. Submit the form below — we will send a confirmation email and verify your identity and complete the request within 30 days. You may track the request status via privacy@globalaidao.org using the request ID.
Changelog
- 新增跨境数据传输的标准合同条款（SCC）说明。
- 明确 KYC / KYB 合规信息的收集范围与法律依据。
- 细化用户访问、更正、删除与撤回同意的行权流程。
- 增加 ISO 27001 / SOC 2 安全控制描述。
- 更新数据保留期限说明。
- 首次发布隐私政策。
Defined scope. Accountable delivery.
Staged pricing & acceptance
Discovery, pilot and rollout have separate scope and fees. Contracts define baselines, evaluation samples, acceptance metrics and responsibility. Results are not unconditionally guaranteed.
Customer business data stays off-chain
Business records and personal data are not written to a blockchain. Confirm deployment region, model providers, access, retention and deletion in writing before work begins.
Clear contracting & delivery responsibility
Before signing, obtain and verify the legal entity, registration, jurisdiction, delivery owner and dispute terms. DAO collaboration does not replace contractual responsibility.