Plain English summary: We collect your email address and role when you join our waitlist, and passport data when you register a piece. We use this to contact you about the platform and to issue your provenance passport. We do not sell your data. We do not share it with advertisers. The only unusual aspect of our service is that some passport records are anchored on a public blockchain — we explain what this means for you in Section 4.
1. Who we are
Provenance Passport Co. is a UK-based technology company issuing blockchain-backed digital provenance passports for high-value items. References to "we", "us", or "our" in this policy refer to Provenance Passport Co.
We are the data controller for personal data collected through this website and platform. If you have any questions about this policy or how we handle your data, please contact us at hello@provenancepassport.co.uk.
This policy applies to all personal data we collect through provenancepassport.co.uk and any associated platform services. It was last updated in June 2026.
2. What data we collect
Waitlist and enquiry data
When you join our founding member waitlist, we collect:
- Your email address
- Your role or category (e.g. furniture maker, auction house, collector)
- The date and time of your submission
Passport registration data
When you register a piece through our platform or submission form, we collect:
- Your name and business name
- Contact details (email, phone where provided)
- Details about the item being passported (materials, year, provenance history)
- Photos you upload of the item
- Any provenance notes or maker statements you provide
Technical data
When you visit our website, we may collect standard technical information including your IP address, browser type, and pages visited. This is collected via Google Analytics 4 only if you consent to analytics cookies.
3. Why we collect it
We collect and process your personal data on the following legal bases under UK GDPR:
Legitimate interests
We use your waitlist data to follow up on your enquiry, send you early access information, and keep you informed about Provenance Passport Co. You can opt out at any time by replying to any email or contacting us directly.
Contract performance
When you use our platform to register a piece and issue a passport, we process your data to provide that service — this is necessary to fulfil our agreement with you.
Consent
We use Google Analytics to understand how people use our website, but only where you have consented to analytics cookies via our cookie banner. You can withdraw consent at any time.
4. Blockchain records and your rights
Important: This section explains how blockchain technology affects your usual data rights. Please read it carefully.
Provenance Passport Co. anchors passport records on a public blockchain (the XRP Ledger). This is what makes our passports tamper-proof and permanent. However, it creates an important consideration regarding your data rights.
What we put on-chain
We are careful about what data we record on the blockchain. On-chain records contain only the passport identifier, a cryptographic hash of the passport data, and a timestamp. Personal information such as your name, contact details, and address is stored off-chain in our secure database — not on the public blockchain.
The right to erasure
UK GDPR gives you the right to request deletion of your personal data. We will honour this request for all data held in our systems — your name, contact details, and any identifiable information we hold will be deleted on request.
However, the on-chain record (the passport identifier and hash) cannot be removed once written to the blockchain. This is an inherent technical property of blockchain technology, not a choice we make. The on-chain record contains no personal information in isolation — it is a cryptographic reference that has no meaning without the off-chain data we will have deleted.
We believe this approach is compliant with UK GDPR under the principle of data minimisation — the on-chain data alone is not personal data as it cannot identify you without the off-chain context we will have removed.
Ownership and transfer records
When ownership of a passported item transfers, we record the transfer on-chain as an event. We do not record the buyer's name on-chain — only that a transfer occurred on a given date. Buyer identity is held off-chain and subject to your full erasure rights.
5. Who we share data with
We do not sell your personal data. We do not share it with advertisers. We share data only where necessary to provide our service:
- Netlify — our website and form submissions are hosted on Netlify (US-based). Netlify is GDPR compliant and we have reviewed their data processing terms.
- Pinata / IPFS — photos you upload are stored on IPFS via Pinata for permanent decentralised storage. Photos uploaded are considered public once stored on IPFS.
- Google Analytics — with your consent, anonymised usage data is shared with Google Analytics to help us understand how the site is used.
- Legal requirement — we may share data if required to do so by law or in response to a valid legal request.
All third-party providers we use are required to handle your data in accordance with applicable data protection law.
6. How long we keep data
- Waitlist data — retained until you ask us to remove it, or until 24 months after your last interaction with us, whichever is sooner.
- Passport records — retained for as long as the passport is active or until you request deletion. On-chain references persist indefinitely as described in Section 4.
- Photos on IPFS — photos stored on IPFS are permanent by design. We will remove our reference to them and cannot guarantee removal from the decentralised network itself.
- Analytics data — Google Analytics data is retained for 14 months per our GA4 settings.
7. Your rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right of access — you can request a copy of the personal data we hold about you
- Right to rectification — you can ask us to correct inaccurate data
- Right to erasure — you can ask us to delete your data (subject to the blockchain considerations in Section 4)
- Right to restrict processing — you can ask us to limit how we use your data
- Right to data portability — you can request your data in a portable format
- Right to object — you can object to processing based on legitimate interests
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time
To exercise any of these rights, contact us at hello@provenancepassport.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.
8. Cookies and analytics
Our website uses cookies in two categories:
Essential cookies
These are required for the website to function. They do not collect personal data and cannot be disabled.
Analytics cookies (optional)
With your consent, we use Google Analytics 4 to understand how visitors use our site — which pages are visited, how long people spend on the site, and where visitors come from. This data is anonymised and aggregated. We do not use it to identify you personally.
You can accept or decline analytics cookies via our cookie banner when you first visit the site. You can change your preference at any time by clearing your cookies and revisiting the site.
9. Contact us
If you have any questions about this privacy policy or how we handle your personal data, please get in touch:
Provenance Passport Co.
Email: hello@provenancepassport.co.uk
Website: provenancepassport.co.uk
Based in the United Kingdom
We aim to respond to all data requests within 30 days as required by UK GDPR.
We may update this policy from time to time. Any significant changes will be notified to registered users by email. The date at the top of this page reflects when the policy was last updated.