MAINNET· live since 2020BLOCK #32,732,450FINALITY 5.00sOPS / BLOCK 0VALIDATORS 11 · 5 ORGSTOTAL XBN 369B XBNCIRCULATING 74.10B XBNHFBA CONSENSUS · 3–5s FINALITYMAINNET· live since 2020BLOCK #32,732,450FINALITY 5.00sOPS / BLOCK 0VALIDATORS 11 · 5 ORGSTOTAL XBN 369B XBNCIRCULATING 74.10B XBNHFBA CONSENSUS · 3–5s FINALITY
Bantu
Legal · Privacy

Privacy Policy.

The Bantu Blockchain Foundation collects very little, sells nothing, and operates on the principle that the public blockchain itself is the source of public truth — and your private keys are your private business.

Effective · 14 May 2026
Version 2.0 · Jurisdiction: Republic of Seychelles

Contents

  1. 1. Overview
  2. 2. Who is responsible (data controller)
  3. 3. What we collect
  4. 4. How we use information and our legal bases (GDPR Art. 6)
  5. 5. Cookies and similar technologies
  6. 6. Who else processes your information (processors)
  7. 7. International data transfers
  8. 8. How long we keep your information
  9. 9. Security
  10. 10. Your privacy rights
  11. 11. How to exercise your rights
  12. 12. Children's privacy
  13. 13. The Bantu blockchain is a public ledger
  14. 14. Third-party services and links
  15. 15. Do Not Track and Global Privacy Control
  16. 16. Updates to this policy
  17. 17. Contact

1. Overview

The Bantu Blockchain Foundation (referred to in this policy as 'the Foundation', 'BBF', 'we', 'us') is a non-profit organisation incorporated in the Republic of Seychelles. This Privacy Policy explains, in plain language, what information we collect when you interact with bantufoundation.org or services operated by the Foundation, why we collect it, how long we keep it, who we share it with, and the rights you have under applicable data-protection law.

We have written this policy to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the EU ePrivacy Directive, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), Brazil's Lei Geral de Proteção de Dados (LGPD), Canada's PIPEDA, South Africa's POPIA, Singapore's PDPA, and other comparable privacy frameworks. Where a regional law gives you stronger rights than this policy describes, that regional law prevails.

We follow a principle of data minimisation: we collect the smallest amount of information we can while still operating the site, communicating with you, and improving the public materials we publish. We do not sell personal information. We do not share personal information with advertisers. We do not build cross-site profiles. We do not use automated decision-making that produces legal effects on visitors.

2. Who is responsible (data controller)

The Foundation is the data controller for personal information processed through bantufoundation.org and Foundation-operated channels. Our registered office is in Seychelles. You can reach the privacy contact at general contact. We have appointed an internal Data Protection point of contact reachable through that same address.

Where this policy refers to 'Foundation-operated services', it means: the public website at bantufoundation.org and its localised paths; the Foundation's email channels (info@, operations@, security@, grants@, governance@); the Foundation's official social-media presences; and Foundation-hosted developer documentation, dashboards, and explorer mirrors. It does not cover third-party validators, exchanges, wallets, or community-run infrastructure that interact with the Bantu blockchain. Those parties publish their own policies.

3. What we collect

Information you give us directly

When you fill out a form, send an email, or apply for a grant, we collect what you choose to send us:

  • Contact form: name, email address, organisation (optional), the content of your message.
  • Grant or partnership enquiry: project description, requested amount, links to public materials you provide.
  • Email correspondence: anything contained in the message you sent us.
  • Newsletter or events subscription (if enabled): email address and the country you supplied.

Information collected automatically

When you visit the site, our edge infrastructure (Cloudflare Workers) logs standard request metadata so the site can serve you and so we can investigate abuse:

  • IP address (truncated and rotated after 30 days in our analytics layer; full IP retained only in security logs for a maximum of 14 days).
  • User-agent string (browser and operating-system family).
  • Requested URL, HTTP status, response size, and timing.
  • Referrer header (the page that linked you here), if your browser sent one.
  • Geographic region inferred from your IP at city or country granularity (used to route to the nearest edge and apply locale defaults).

Information from cookies and similar technologies

See Section 5 for the full breakdown. In short: we set only strictly-necessary cookies by default (locale preference, consent record). Analytics cookies are only loaded if you explicitly opt in through the cookie banner. We do not use advertising or remarketing cookies.

Information we do NOT collect

For clarity, the Foundation does not collect:

  • Your blockchain wallet private keys — the Foundation cannot see them, recover them, or freeze your assets.
  • Special categories of personal data (race, ethnicity, political opinions, religious beliefs, trade-union membership, genetic or biometric data, health data, data on sex life or sexual orientation) — we have no need for any of it.
  • Payment-card data — the Foundation does not process card payments through this site.
  • Government-issued identifiers, unless you voluntarily send them to us in the body of an email (e.g. for KYC during a grant disbursement, handled separately under contract).

4. How we use information and our legal bases (GDPR Art. 6)

We use information only for the purposes described below, and only on a lawful basis. The relevant legal basis under EU/UK GDPR is shown for each purpose in brackets.

  • Operating the website and routing requests — to serve pages, defend against abuse, and apply security headers. [Legitimate interest in running and protecting the site.]
  • Responding to your messages — to reply to contact, grant, and partnership enquiries. [Legitimate interest, and where applicable, steps prior to entering a contract.]
  • Improving the site and the materials we publish — anonymised, aggregate analytics on which pages and case studies are read, only if you opt in. [Your consent under GDPR Art. 6(1)(a).]
  • Security and abuse investigation — short-lived security logs to investigate intrusion attempts, scraping, denial-of-service. [Legitimate interest in protecting the Foundation, the site, and its users.]
  • Legal compliance — responding to lawful disclosure requests, satisfying record-keeping obligations. [Compliance with a legal obligation.]
  • Optional newsletter (if you subscribe) — to send periodic updates you have asked for. [Your consent; you can withdraw it at any time using the unsubscribe link.]

We never process your personal information for purposes that are incompatible with the ones disclosed here. If we ever propose to use information for a materially new purpose, we will update this policy and, where the law requires it, ask for your consent again.

5. Cookies and similar technologies

A cookie is a small text file stored by your browser. We also use the equivalent local-storage APIs to remember your locale and your consent choice. We classify cookies and storage entries into three categories, only the first of which is set without your consent.

CategoryPurposeExamplesDefault state
Strictly necessaryRequired for the site to function: remembering your language, holding your consent record so we don't ask twice, CSRF protection on contact forms.NEXT_LOCALE · bantu_consent_v1 (localStorage)Always on — cannot be disabled.
AnalyticsAggregate, anonymised metrics on which pages are useful. IP anonymisation is enabled at source. 90-day retention.Google Analytics 4 (_ga, _ga_*).Off by default. Loaded only after you opt in.
MarketingReserved for future event or community campaigns. Not active at the time this policy was published.None currently set.Off by default. Will only load with explicit consent.

You can change your choice at any time using the 'Manage cookie preferences' button below or in the site footer. Withdrawing consent does not affect the lawfulness of processing carried out under your previous consent.

6. Who else processes your information (processors)

The Foundation does not sell, rent, or barter personal information. We share only what is strictly necessary with carefully selected service providers (processors) who act on our written instructions and under appropriate data-protection agreements (including EU Standard Contractual Clauses where applicable).

ProcessorPurposeHosting region
Cloudflare, Inc.Edge hosting, DDoS protection, request routing, KV cache for incremental site rendering.Global anycast network.
Google LLC (Google Analytics 4)Optional, consent-gated aggregate analytics with IP anonymisation.EU/US dual-region; data-transfer safeguards in place.
Email infrastructure (e.g. Google Workspace)Sending and receiving Foundation correspondence.Provider-managed.

We may also disclose information if we are legally required to do so by a competent authority with valid jurisdiction, or if disclosure is necessary to defend the Foundation's rights, the safety of users, or the integrity of the public Bantu network. Where lawfully possible, we will notify the affected person before disclosure.

7. International data transfers

The Foundation operates from Seychelles. Our processors maintain data centres in multiple jurisdictions; when you visit the site, request metadata may be processed at an edge node geographically close to you (Europe, North America, Africa, Asia-Pacific).

For transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland to countries that have not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, or other approved transfer mechanisms. For transfers from Brazil, we follow the international-transfer requirements of LGPD Art. 33. You can request a copy of the relevant safeguards by writing to general contact.

8. How long we keep your information

We retain personal information only for as long as we need it for the purpose we collected it, plus any retention period required by law. The specific periods are:

DataRetention period
Edge request logs (IP, user-agent, path, timing)14 days; longer only where needed to investigate a specific security incident.
Analytics records (when opted in)90 days, after which they are aggregated and disassociated from any pseudonymous identifier.
Email correspondenceUp to 24 months after the last interaction, then archived for legal-record purposes where required.
Grant or partnership enquiriesUp to 36 months after the decision, for due-diligence audit trails.
Consent recordsUntil you withdraw consent or 24 months — whichever is shorter — at which point we will ask again.

After the retention period expires, we either irreversibly delete the information or anonymise it so that you can no longer be identified from it.

9. Security

We protect personal information using a combination of technical and organisational measures appropriate to the risk:

  • TLS 1.2+ everywhere on the public site; HTTP Strict Transport Security with preload enabled.
  • Content Security Policy, Subresource Integrity for third-party scripts, X-Content-Type-Options and Referrer-Policy headers.
  • Edge-level DDoS protection and rate-limiting on contact endpoints.
  • Principle of least privilege for staff and contractors accessing operational systems; multi-factor authentication on all administrative accounts.
  • Encrypted backups with limited retention, separated from production credentials.
  • Regular review of dependencies; coordinated-disclosure channel at security team for researchers.

No system can be made absolutely secure. If we ever become aware of a personal-data breach that creates a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where the law requires it, and we will inform affected individuals without undue delay using the contact details we hold for them.

10. Your privacy rights

Depending on where you live, you have a number of rights over the personal information we hold about you. The list below covers all the rights we recognise globally. You may exercise these rights free of charge, except where requests are manifestly unfounded or excessive (in which case we may charge a reasonable fee or refuse to act, and tell you why).

EU / UK / EEA / Switzerland (GDPR & UK GDPR)

  • Right of access — confirmation of whether we process your data and, if so, a copy.
  • Right to rectification — correction of inaccurate or incomplete data.
  • Right to erasure ('right to be forgotten') — deletion in the cases set out in GDPR Art. 17.
  • Right to restriction of processing — limit how we use your data in defined situations.
  • Right to data portability — receive your data in a structured, commonly used, machine-readable format.
  • Right to object — to processing based on legitimate interest, and to direct-marketing processing at any time.
  • Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.
  • Right to lodge a complaint with your national supervisory authority.

California (CCPA / CPRA)

  • Right to know what categories of personal information we have collected, the sources, the purposes, and the categories of third parties we shared it with in the prior 12 months.
  • Right to delete personal information we have collected from you, subject to the statutory exceptions.
  • Right to correct inaccurate personal information.
  • Right to opt out of the 'sale' or 'sharing' of personal information for cross-context behavioural advertising — we do not sell or share personal information, so there is nothing to opt out of, but you may still submit a request to confirm.
  • Right to limit the use of sensitive personal information — we do not collect sensitive personal information.
  • Right to non-discrimination for exercising any of the above rights.

Brazil (LGPD)

  • Confirmation of processing and access; correction of incomplete, inaccurate, or out-of-date data; anonymisation, blocking, or deletion of unnecessary or excessive data; data portability; information about with whom your data has been shared; information about the possibility of withholding consent and the consequences; revocation of consent.

Canada (PIPEDA), South Africa (POPIA), Singapore (PDPA), and other jurisdictions

We honour rights to access, correction, withdrawal of consent, and complaint to the relevant regulator (the Office of the Privacy Commissioner of Canada; the Information Regulator of South Africa; the Personal Data Protection Commission of Singapore; or the equivalent in your jurisdiction).

11. How to exercise your rights

Send a request to general contact. Describe what you are asking for. Where we cannot verify your identity from the email address on file, we may ask for additional information strictly necessary to confirm we are dealing with the right person. We will respond within 30 days where the law requires it, and within 45 days for CCPA-class requests, with one extension permitted where reasonably necessary.

You also have the right to complain to a supervisory authority. In the EU, that is the data-protection authority of your country of residence; in the UK, the Information Commissioner's Office (ICO); in California, the California Privacy Protection Agency (CPPA); in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD). We would appreciate the chance to address your concern first, but you are not required to contact us before going to the regulator.

12. Children's privacy

bantufoundation.org is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information to the Foundation, contact general contact and we will delete it. In jurisdictions where a higher age threshold applies (for example 13 under COPPA in the United States), the local threshold governs.

13. The Bantu blockchain is a public ledger

The Bantu blockchain itself is open and permissionless. Every transaction, account address, and asset transfer that has ever been recorded on the chain is permanently visible to anyone running a Horizon-compatible client. The Foundation does not publish this information — the protocol does. We cannot remove records from the ledger. We can only help you understand what is and isn't private about how you use it.

Wallet addresses are pseudonymous, not anonymous. If you publicly associate your address with your real-world identity (in a public post, on an exchange profile, in a tweet), anyone can link your on-chain activity back to that identity. Self-custody means you hold both your private keys and your privacy. We recommend using fresh addresses for sensitive transfers, and we encourage you to read the Foundation's guidance on operational privacy before transacting at scale.

14. Third-party services and links

bantufoundation.org links to third-party platforms — exchanges, wallets, validators, RPC providers, ecosystem applications, social-media profiles, and code repositories. When you click out, you are leaving the Foundation's site and are subject to that third party's privacy policy and terms. The Foundation does not control and is not responsible for the privacy practices of those services. We encourage you to read their policies before sharing information with them.

15. Do Not Track and Global Privacy Control

We honour the Global Privacy Control (GPC) browser signal. If your browser transmits a GPC header, we treat it as a valid opt-out of 'sale' and 'sharing' under CCPA/CPRA-class laws and we will not load analytics until you explicitly opt in through the cookie banner. We do not currently respond to legacy 'Do Not Track' headers because the standard was deprecated, but the practical effect — no third-party advertising trackers, no cross-site profiling — is the same on this site regardless.

16. Updates to this policy

We may amend this policy from time to time. Material changes will be announced at least 30 days in advance on the Foundation's news channel and, where we have your email and the change requires it, by direct notice. The effective date and version at the top of this page show the version currently in force. Earlier versions are archived and available on request.

17. Contact

For any question about this policy or about how the Foundation processes your personal information, write to general contact. For security-sensitive concerns or coordinated disclosure of vulnerabilities, use security team. Our registered office is in the Republic of Seychelles. Postal correspondence can be addressed to the registered office; please email first so we can confirm the current mailing address.

Change your mind?

You can revisit your cookie choices at any time.