Legal

Coinbase NFT Privacy Policy

Last updated: April 20, 2022

This Privacy Policy describes how Coinbase Technologies, Inc. (“Coinbase Technologies,” “we”, “us” or “our”) handles personal information that we collect through the Coinbase NFT websites (nft.coinbase.com, coinbase.com/nft) that link to this Privacy Policy, as well as through social media, our marketing activities, and other activities described in this Privacy Policy (collectively, the “Coinbase NFT Service”).  Please take a moment to read this Privacy Policy carefully. If you have any questions about this Policy, please submit your request via our Support Portal. We may modify this Privacy Policy from time to time which will be indicated by changing the date at the top of this page. If we make any material changes, we will notify you by email (if you have an email address specified in your account), by means of a notice on our website prior to the change becoming effective, or as otherwise required by law.

1. ACCEPTANCE OF THIS PRIVACY POLICY

By accessing and using the Coinbase NFT Service, you signify acceptance to the terms of this Privacy Policy. We may provide additional "just-in-time" disclosures about certain data processing practices within the Coinbase NFT Service; these disclosures may supplement or clarify the privacy practices described here, or may provide you with additional choices about how we process your personal information.

If you do not agree with or you are not comfortable with any aspect of this Privacy Policy, you should immediately discontinue access or use of the Coinbase NFT Service.

2. THE PERSONAL INFORMATION WE COLLECT

Information you provide to us. Personal information you may provide to us through the Coinbase NFT Service or otherwise includes:

• Contact information, such as your first and last name, and email address.

• Personal Identification Information: Full name, date of birth, nationality, gender, signature, phone number, home address.

• Formal Identification Information: Government issued identity document and photograph such as Passport, Driver’s License, National or State Identity Card.

• Biometric Information: information generated to create a print or template of an individual’s face or voice, including from a photograph.

• Profile information, such as your username that you may set to establish an online account on the Coinbase NFT Service, biographical details, links to your profiles on social networks, interests, preferences, and any other information that you add to your account profile.  

• Communications that we exchange with you, including when you contact us through the Coinbase NFT Service, social media, or otherwise. 

• Transactional information, such as information relating to or needed to complete non-fungible token (NFT) purchases or sales on or through the Coinbase NFT Service which includes transactional details, fees, and sales prices. 

• Marketing information, such as your preferences for receiving our marketing communications and details about your engagement with them.

• User-generated content, such as profile pictures, photos, images, music, videos, comments, questions, messages, works of authorship, and other content or information that you generate, transmit, or otherwise make available on the Coinbase NFT Service, as well as associated metadata. Metadata includes information on how, when, where and by whom a piece of content was collected, how that content has been formatted or edited, and information that you can add or can have added to your content, such as keywords, geographical or location information, and other similar data. 

• Financial information, such as your linked virtual currency or wallet accounts, stored value accounts, and associated details.

Third-party sources. We may combine personal information we receive from you with personal information we obtain from these other sources:

• Public sources, such as government agencies, public records, social media platforms, public blockchain(s), and other publicly available sources.

• Marketing partners, such as joint marketing partners and event co-sponsors.

• Third-party services, such as social media services, that you use to log into, or otherwise link to, your Coinbase NFT account. This information may include your username, profile picture and other information associated with your account on that third-party service that is made available to us based on your account settings on that service. Please note that your use of third-party services is governed by the terms and privacy policies of those services, not ours.

Information collected automatically. We, our service providers, and our business partners may collect certain types of information automatically, such as information about your device, your usage of and interaction with the Coinbase NFT Service, and interaction with other online services. This information helps us address customer support issues, improve the performance of the Coinbase NFT Service, provide you with a streamlined and personalized experience, and protect your account from fraud or abuse, such as by detecting unauthorized access. Information collected automatically includes:

• Device information: such as your IP address (which can indicate your general geographic location), device type, operating system and version, manufacturer and model, browser name and version, screen resolution, device event information, hardware settings, memory usage), device identifiers, language settings.

• Online Identifiers, activity, and usage information: engagement with content on the Coinbase NFT Service or with communications from us, authentication data, click-stream data, public social networking posts, pages and links accessed on the Coinbase NFT Service or used to access the Coinbase NFT Service from a third party site. For information about data collected via cookies and similar technologies, please read our Cookie Policy.

3. HOW YOUR PERSONAL INFORMATION IS USED

We may use your personal information for the following purposes or as otherwise described at the time of collection:

1) To deliver the Coinbase NFT Service, including to

• provide, operate and improve the Coinbase NFT Service and our business;

• establish and maintain your user profile on the Coinbase NFT Service;

• personalize your experience with the Coinbase NFT Service; and

• communicate with you about the Coinbase NFT Service, including by sending notices, updates, alerts, support and administrative messages, and responding to your communications to us.

2) To conduct research and development, such as

• to analyze and improve the Coinbase NFT Service and our business. 

3) For marketing, including

• direct marketing communications. You may opt-out of our marketing communications at any time as described in the “Opt-out of marketing communications” section below. 

4) For compliance, protection, and account services, such as to

• comply with applicable laws or regulations (such as 18 U.S. Code § 2258A), lawful requests, and legal process, such as responding to subpoenas, search warrants, court orders, or requests from government authorities;

• protect our, your or others’ rights, safety or property (including by making and defending legal claims), and prevent fraud, harm, or abuse on or off the Coinbase NFT Service; 

• audit our internal processes for compliance with legal and contractual requirements or our internal policies; 

• enforce the terms and conditions that govern the Coinbase NFT Service; 

• prevent, identify, investigate and deter activity that is fraudulent, harmful, or violates the law or our policies, including cyberattacks and identity theft; and  

• verify your identity in order to assist with your account services requests.  This may include our (and our service providers’) collection, storage and verification of your photo identification or biometric identifiers. 

5) To create anonymous, aggregated or de-identified data. 

• We may create anonymous, aggregated or de-identified data from information about you and other individuals whose personal information we collect, by removing information that makes the data relatable to an identified or identifiable person.

• We may use and share this anonymous, aggregated or de-identified data for any lawful business purpose, including to better understand customer needs and behaviors, analyze and improve the Coinbase NFT Service, promote our business, conduct business intelligence and marketing, perform analytics or enable analytics provided by third parties, and detect security threats. 

4. LEGAL BASES FOR PROCESSING YOUR PERSONAL INFORMATION

Our legal bases for processing your information will depend on the personal information at issue, the specific context in which the personal information is collected and the purposes for which it is used. We generally only process your information where necessary to perform our contract with you (or to take steps at your request prior to entering into a contract with you), where we have a legitimate interest as part of operating our business, where we have a legal obligation, where we need to protect the public interest or a vital interest (yours or another person’s), or where we have obtained your consent to do so. Below is a list of how we use your personal information, as described above in Section 3, with the corresponding legal bases for processing. If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the "How to contact us" section below.

5. WHY WE SHARE YOUR PERSONAL INFORMATION WITH OTHER PARTIES

We may share your personal information with the following parties:

Other NFT users and the public. Your activity on Coinbase NFT is publicly visible. This means that others on or off of the Coinbase NFT Service may view information you make available through the Coinbase NFT Service, such as when you submit comments, reviews, survey responses, and engage with or share content. This information can be seen, collected, used by, and provided to anyone on or off the Coinbase NFT Service, including by being cached, copied, screen captured, transmitted or stored elsewhere (such as through search engines, APIs, and other tools).  Those viewing a public blockchain or a different NFT exchange can also view your NFT holdings and purchase/sale activity. You may, however, choose to limit whether certain information is visible on your Coinbase NFT profile - such as your email address and your NFT holdings. Your private messages with others on the Coinbase NFT Service are not publicly visible to others using the NFT Service.

Affiliates. Our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.

Service providers. Third parties that provide services on our behalf or help us operate Coinbase NFT or our business (such as hosting, information technology, customer support, identity verification, email delivery, marketing, consumer research and website analytics). Examples of the types of service providers we share personal information with include:

• Network infrastructure

• Cloud storage

• Payment processing

• Transaction monitoring

• Security

• Identity verification vendors

• Customer support

• Internet (e.g. ISPs)

• Data analytics

• Information Technology

• Marketing

Linked third-party services. If you choose to log into Coinbase NFT with, or otherwise link your Coinbase NFT account to, your social media account or another third-party website or application of your choice, we may be asked to share information about you with that third party, such as information relating to your profile. You should read the third party’s privacy policy and check your account settings on that service, which will govern their use of the shared information.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above. 

Business transferees. Acquirers and other relevant participants in business transactions (or negotiations of or due diligence for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Coinbase NFT or our affiliates (including, in connection with a bankruptcy or similar proceedings). 

6. OTHER SITES AND SERVICES

Coinbase NFT may contain links to websites, and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services you use.

7. HOW WE PROTECT AND STORE PERSONAL INFORMATION

We understand how important your privacy is, which is why Coinbase Technologies maintains (and contractually requires third parties it shares your information with to maintain) appropriate physical, technical and organizational measures to protect the security and confidentiality of the personal information you entrust to us.

We store your personal information securely throughout the life of your Coinbase NFT account.  We will only retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting obligations, preventing abuse or harm, or resolving disputes. While retention requirements vary by jurisdiction, examples of our typical retention periods for different aspects of your personal information are described below.

• Personal information, such as basic identification information may be retained after account closure to comply with applicable legal obligations.

• Biometric Information may be retained for up to three years from the date of collection (up to one year for Texas residents)  after account closure, unless otherwise required by applicable law 

• Contact Information such as your name, email address and telephone number for marketing purposes is retained on an ongoing basis until you unsubscribe. Thereafter we will add your details to our suppression list to ensure we do not inadvertently market to you.

• Content that you post on our website such as support desk comments, photographs, videos, blog posts, and other content may be kept after you close your account for audit, abuse prevention and crime prevention purposes (e.g. for seven years to prevent a known fraudulent actor from opening a new account).

• Information collected via technical means such as cookies and other similar tools is kept for a period of up to one year from expiry of the cookie.

We protect your personal information by maintaining physical, technical, and organizational measures, such as firewalls and data encryption, and physical and technical access controls. However, we cannot guarantee that loss, misuse, unauthorized acquisition, or alteration of your data will not occur. Please recognize that you also play a vital role in protecting your own personal information. When registering with Coinbase NFT, it is important to choose a password of sufficient length and complexity, to not reveal this password to any third-parties, and to immediately notify us if you become aware of any unauthorized access to or use of your account.

Furthermore, we cannot ensure or warrant the security or confidentiality of information you transmit to us or receive from us by Internet or wireless connection, including email, phone, or SMS, since we have no way of protecting that information once it leaves and until it reaches us. If you have reason to believe that your account is no longer secure, please contact us using the contact information provided in the “How to contact us” section below.

8. CHILDREN

The Coinbase NFT Service is not intended for use by anyone under 18 years of age. If you are under 18 years of age, please do not provide any personal information through the Coinbase NFT Service. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us using the contact information provided in the “How to contact us” section below. If we learn that we have collected personal information through the Coinbase NFT Service from a child without the consent of the child’s parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.  If there is any personal information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent our further processing or use of this personal information.

9. CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on Coinbase NFT or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of Coinbase NFT after the effective date of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy.

10. INTERNATIONAL TRANSFERS

To facilitate our global operations, we may transfer, store, and process your personal information within our affiliates, third-party partners, and service providers based throughout the world, including Ireland, Germany, Singapore, Japan, the UK, the US, the Philippines, and possibly other countries. We will protect your personal information in accordance with this Privacy Policy wherever it is processed and will take appropriate contractual or other steps to protect the relevant personal information in accordance with applicable laws. We contractually obligate recipients of your personal information to agree to at least the same level of privacy safeguards as required under applicable data protection laws. 

We rely primarily on Standard Contractual Clauses (as approved by relevant national data protection regulators) to facilitate the international and onward transfer of personal information from one country to another, to the extent the recipient country is considered to not provide an adequate level of data protection. This includes transfers of non-US customer data to our US-based operating entity, Coinbase Technologies. We may also rely on judicial adequacy decisions confirming an adequate level of data protection in the jurisdiction of the party receiving the information, or derogations in specific situations.

By communicating electronically with Coinbase Technologies, you acknowledge and agree to your personal information being processed in this way. If you have a complaint about our privacy practices and our collection, use or disclosure of personal information please submit your request via our Support Portal.

11. YOUR CHOICES

Access or update your information. If you have registered for an account with us through the Coinbase NFT Service, you may review and update certain account information by logging into the account. 

Opt-out of marketing communications. You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails.  

Depending on applicable law where you reside, you may also be able to assert certain rights related to your personal information identified below. Your access to these rights may be limited or denied: (a) when denial of access is required or authorized by law; (b) when granting access would adversely affect the rights and freedoms of others; (c) to protect our rights and properties; (d) where the request is frivolous or vexatious, or for other reasons.

Access and data portability: You may request that we provide you a copy of personal information held by us. This information will be provided without undue delay subject to a potential fee associated with gathering of the information (as permitted by law). In certain circumstances, you may request to receive your personal information in a structured, commonly used and machine-readable format, and to have us transmit your personal information to another data controller.

Correction of incomplete or inaccurate personal information: You may request that we correct any of your personal information held by Coinbase Technologies that is incomplete or inaccurate, by logging in to your account and clicking the Profile or My Account tab.

Erasure: You may request to erase your personal information, subject to applicable law. 

Withdraw consent: To the extent the processing of your personal information is based on your consent, you may withdraw your consent at any time. This withdrawal will not affect the lawfulness of Coinbase Technologies’ processing based on consent before your withdrawal.

Restriction of processing: In some jurisdictions, applicable law may give you the right to restrict or object to us processing or transferring your personal information under certain circumstances. We may continue to process your personal information if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law.

Automated individual decision-making, including profiling: Coinbase Technologies relies on automated tools to, for example, help determine whether a transaction or a customer account presents a fraud or legal risk. In some jurisdictions, you have the right not to be subject to a decision based solely on automated processing of your personal information, including profiling, which produces legal effects concerning you, or similarly significantly affects you, save for the exceptions applicable under relevant data protection laws.

• Marketing communications: You can opt-out of receiving marketing communications from Coinbase Technologies. Direct marketing includes any communications to advertise or promote our products and services. We will only contact you by electronic means based on our legitimate interests, as permitted by applicable law, or your consent. If you do not want us to send you marketing communications, please go to your account settings to opt-out or submit a request via our Support Portal. 

  • To the extent we can rely on legitimate interest under the applicable law, we will only send you information about Coinbase NFT that are similar to those which were the subject of a previous sale or negotiations of a sale to you. We will contact you by electronic means for marketing purposes only if you have consented to such communication. You may raise such objections with regard to initial or further processing for purposes of direct marketing, at any time and free of charge.

Declining to provide information. We need to collect personal information such as your name, and a crypto wallet to provide certain services. If you do not provide the information we designate as required or mandatory, we may not be able to provide those services.

Linked third-party platforms. If you choose to connect to Coinbase NFT through your social media account or other third-party platform, you may be able to use your settings in your account with that platform to limit the information we receive from it. If you revoke our ability to access information from a third-party platform, that choice will not apply to information that we have already received from that third party.

12. CALIFORNIA PRIVACY RIGHTS

This section describes how we collect, use, and share Personal Information of California residents in our capacity as a “business” under the California Consumer Privacy Act (“CCPA”) and their rights with respect to that Personal Information. For purposes of this section, the term “Personal Information” has the meaning given in the CCPA but does not include information exempted from the scope of the CCPA.  

Your California privacy rights. California residents have the rights listed below under the CCPA. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law. Note, however, that these rights extend only to information that is maintained or controlled by Coinbase Technologies as part of your NFT account or through your direct interactions with us and will not apply to information that is maintained publicly or that is otherwise outside of Coinbase Technologies’ control. 

• Information. You can request the following information about how we have collected and used your Personal Information during the past 12 months:

  • The categories of Personal Information that we have collected.

  • The categories of sources from which we collected Personal Information.

  • The business or commercial purpose for collecting and/or selling Personal Information.

  • The categories of third parties with which we share Personal Information.

  • The categories of Personal Information that we sold or disclosed for a business purpose.

  • The categories of third parties to whom the Personal Information was sold or disclosed for a business purpose.

• Access. You can request a copy of the Personal Information that we have collected about you during the past 12 months. 

• Deletion. You can ask us to delete the Personal Information that we have collected from you.

• Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the CCPA.  

We do not sell your personal information in our ordinary course of business and will never sell your personal information to third parties without your explicit consent.

Exercising your right to information, access and deletion. You may submit requests to exercise your right to information, access or deletion by logging into your account and submitting a request under account settings.  

Personal information that we collect, use and disclose. The chart below summarizes the Personal Information we collect by reference to the categories of Personal Information specified in the CCPA (Cal. Civ. Code §1798.140), and describes our practices currently and during the 12 months preceding the effective date of this Privacy Policy. The terms in the chart refer to the categories of information, sources, purposes and third parties described above in this Privacy Policy in more detail. Information you voluntarily provide to us, such as in free-form webforms, may contain other categories of personal information not described below. In addition to the disclosures described in the chart below, we disclose Personal Information as described in the How we share your personal information section above.

13. HOW TO CONTACT US

If you have questions or concerns regarding this Privacy Policy, please contact us on our Support page, or by writing to us at the address of our operating entity (248 3rd Street, #434 Oakland, CA, 94607).