Privacy Policy

1. Controller

Token Engineering Labs GmbH, Ruthnergasse 145, 1210 Vienna, Austria, email: office@tokenengineeringlabs.com. TEL runs DermaToken on its own responsibility and alone decides the purposes and means of the data processing. Dr. Khalifa's practice is neither controller nor joint controller and does not receive data for its own processing.

2. Data we process

Sign-in data via our sign-in service Privy (email address, Google account or wallet address) and your wallet address.

Programme data: badges, DERMA balance, transfers, redemptions and the amounts (in EUR) for which DERMA were credited.

Referral data: invite code, the assignment between invited and inviting person, and referral rewards.

Proof of acceptance of the terms: wallet address, version, time and digital signature.

Technical data: for abuse prevention your shortened IP address is kept as a counter for up to 24 hours; hosting servers log technical access data.

We do not collect names, postal addresses or health data, and use no trackers.

3. Purposes and legal bases

Running the Programme, including the referral programme (Art. 6(1)(b) GDPR); proof of acceptance of the terms, and security (Art. 6(1)(f) GDPR); statutory retention duties (Art. 6(1)(c) GDPR). The data is required for participation.

4. Recipients

We use as processors: Privy, Inc. (sign-in, wallet), Supabase (database), Vercel Inc. (hosting) and a provider for the blockchain connection (currently Alchemy). Corresponding agreements are in place. Transfers to the USA rely on the EU-US Data Privacy Framework adequacy decision or standard contractual clauses.

Practice staff use the staff portal solely on our behalf and under our instructions, to hand out QR codes and rewards; they are bound to confidentiality. Please direct requests about your data to TEL only.

5. Public blockchain

As the Programme is in a test phase (Terms § 4), data processing and security measures may not yet be optimised. We apply appropriate technical and organisational measures but cannot rule out vulnerabilities.

Badges and DERMA are recorded on a public blockchain (Base). Wallet address, badge holdings, balance and transfers are visible there; the entries contain no names or contact details. Blockchain entries are permanent. Once your account is deleted, we hold no link between that address and you.

6. Retention

We keep your data while you participate. After your account is deleted, it is deleted unless statutory retention duties (e.g. § 132 BAO) apply.

7. Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at). You can delete your account yourself in the app under “Delete account”; for other matters you can reach us at office@tokenengineeringlabs.com.

8. Local storage

We use only technically necessary storage: language and theme choice, sign-in session and staff session.

Version: 2026-10-27.2