Privacy notice
How Provatek handles your information when you use this portal.
Who is responsible
This portal is operated by Provatek, which is the controller of the information this portal holds and is responsible for it. Asprey Studio makes and dispatches the pieces you redeem, and is a separate controller for what it does with your delivery details in doing so. Write to us about anything here at hello@provatek.io.
What we hold
The wallet addresses you sign in with. An email address, if you choose to add one. The delivery name, address and phone number you give for a piece, and any later address you sign for. Your choices for a piece, such as size and metal. The tokens you have redeemed and the record of each redemption. The date, network address and browser of actions on your account, kept as a record of what was done and by whom.
Why, and on what basis
To confirm you hold or redeemed the token a piece belongs to, to make the piece and send it to you, and to tell you when it moves if you have given an email address: this is the performance of the contract you enter when you redeem. To keep the record of a redemption, which cannot be reversed, and of every change to where a piece is sent, so that the studio can always say where a piece went and on whose authority, and so that claims can be defended: this is a legitimate interest that Provatek, Asprey Studio and collectors share. To keep what accounting and tax law require: this is a legal obligation. We make no decisions about you by automated means.
How long
Redemption records and the history of delivery addresses are kept permanently, because a redemption cannot be undone and the studio must be able to say where a piece was sent. Delivery details are kept for seven years after delivery. Sign-in codes are stored only as a hash, are deleted when used, expire within fifteen minutes, and are cleared within a day of expiring. An account that has not been used for two years is deleted, unless an order on it is still open or a record above must be kept.
Cookies
The portal sets two cookies, both needed for it to work: one holds your session after you sign in, and one remembers which wallet is connected so you are not asked again on every visit. Cookies that are strictly necessary for a service you have asked for do not need your consent, and we set no others. There are no analytics or advertising cookies.
Where it is held, and who processes it
The database is in London, held by Neon. The portal runs on Vercel, whose servers for this deployment are in London and whose network edge is worldwide. Email is sent by Postmark, which processes it in the United States under the UK Extension to the EU-US Data Privacy Framework. To read what a wallet holds we send the wallet address, and nothing else, to the blockchain data providers Alchemy and Xverse. When a wallet connects from a phone, its messages pass through the WalletConnect relay encrypted end to end, so the relay cannot read them. Where a provider is outside the United Kingdom, the transfer rests on an adequacy decision or on the International Data Transfer Agreement, and each provider is bound to us by a data processing agreement. Asprey Studio receives your delivery details and choices in order to make and send the piece.
The blockchain
A public blockchain holds the token, the wallet that holds it and, on Ethereum, the wallet that redeemed it. That is public and permanent by the nature of the chain, is not controlled by Provatek, and cannot be erased by anyone. The portal writes nothing to a chain that identifies you.
Your rights
You can ask what we hold about you and receive a copy, ask for it to be corrected, ask for it to be deleted where the record is not one we must keep, ask us to restrict what we do with it, object to processing based on legitimate interest, and receive the data you gave us in a form you can take elsewhere. We answer within one month, and if we refuse any part of a request we will say why. Write to hello@provatek.io.
Complaints
If you think we have handled your information wrongly, you have the right to complain to us. Write to hello@provatek.io with the subject line “Data protection complaint”. We acknowledge a complaint within thirty days, look into it, and tell you the outcome without undue delay. You may also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, whether or not you have complained to us first.
Changes
This notice will change as the portal does. A material change will be announced on the portal before it takes effect. Current text: September 2026.