Legal & Regulatory Hub

1. Data Controller Identification

The Data Controller responsible for data processing on this platform pursuant to Article 4(7) GDPR is:

2. Local Storage & Cookie Transparency

Pursuant to the ePrivacy Directive and GDPR Article 6(1)(a)/(f), we document all storage keys used by this application to ensure security, loadout caching, and accessibility:

3. Blockchain Technology & GDPR Reconciliation

In accordance with legal consensus and the Court of Justice of the European Union (CJEU Breyer precedent), public blockchain wallet addresses (e.g. addr1...) constitute pseudonymous personal data.

4. Data Subject Rights (Articles 15–22 GDPR)

As an EU data subject, you hold statutory rights under Chapter III GDPR:

• Right of Access (Art. 15): Obtain confirmation and copy of off-chain records held about you.
• Right to Rectification (Art. 16): Correct inaccurate off-chain shipping or claim details.
• Right to Erasure (Art. 17): Request deletion of off-chain personal data (“Right to be Forgotten”).
• Right to Restriction of Processing (Art. 18): Restrict the processing of your data under statutory conditions.
• Right to Data Portability (Art. 20): Receive your off-chain data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to data processing based on legitimate interests.

To exercise any of these rights, contact our Data Protection desk at info@babysnek.io. We respond to all verified requests within 30 statutory days without charge.

5. Sub-Processor Directory (Article 28 GDPR)

1. Single Point of Contact (Articles 11 & 12 DSA)

In compliance with Articles 11 and 12 of the Digital Services Act, BabySNEK has designated single electronic points of contact:

2. Notice and Action Mechanism (Article 16 DSA)

If you identify content or material on this platform that you consider to be illegal under EU or national Member State law (such as copyright infringement in public galleries, impersonating ADA handles, or unlawful user identifiers), you may submit a substantiated notice via our contact email.

Valid notices must include: (a) precise URL/location, (b) description of alleged illegality, (c) legal basis, and (d) contact details of the notifier. Notices are reviewed within 5 business days and substantiated infringements are disabled promptly.

3. Recommender System & Ranking Transparency (Article 27 DSA)

We operate with full algorithmic transparency regarding how items, tokens, and achievements are ordered:

• Sneklets NFT Gallery: Sorted by statistical on-chain trait rarity (algorithmic rarity rank) or sequentially by token ID.
• Lockables Vaults: Ordered chronologically by mint number or grouped by locked ADA tier (Alpha 500 ADA > Enhanced 100 ADA > Standard 25 ADA).
• Arcade Highscores: Sorted strictly in descending order of validated score submitted through active game sessions.

4. Out-of-Court Dispute Settlement (Article 21 DSA)

In the event of unresolved disputes concerning content moderation decisions or platform actions, recipients of the service are entitled to select an independent certified out-of-court dispute settlement body in the European Union or access the European Commission’s Online Dispute Resolution platform at ec.europa.eu/consumers/odr.

1. System Classification: Minimal Risk

In accordance with Chapter II and Annexes III/IV of the European Union Artificial Intelligence Act (EU 2024/1689), all computational and automated systems deployed within the BabySNEK ecosystem are categorized as Minimal Risk / Non-High-Risk Systems subject to specific transparency obligations.

2. Article 50 Transparency Obligations

3. Prohibited AI Practices Attestation (Article 5 AI Act)

BabySNEK formally certifies that no software, algorithms, or services deployed on this platform employ:

• Biometric categorization, facial recognition, or remote biometric identification in public spaces.
• Emotion recognition technologies or subliminal behavioral conditioning.
• Social credit scoring or evaluative trustworthiness profiling.
• Exploitative dark patterns targeting cognitive vulnerabilities of minors or vulnerable groups.

1. Coordinated Vulnerability Disclosure (CVD)

In accordance with NIS2 Article 21 cybersecurity risk-management requirements, BabySNEK maintains an active Coordinated Vulnerability Disclosure policy and RFC 9116 security standard:

2. Incident Notification Protocol (Article 23 NIS2)

In the event of a significant cybersecurity incident affecting infrastructure integrity or user assets, BabySNEK follows the NIS2 reporting cadence:

3. Physical & Cryptographic Security Baselines

• NTAG424 DNA NFC Hardware: Physical chips embed AES-128 cryptographic rolling HMAC authentication (SUN protocol) to prevent URL cloning and physical token replay attacks.
• Cardano Transaction Integrity: Multi-sig scripts, Summon recovery vaults, and swap transactions are verified via CBOR byte auditing prior to client submission.
• Transport Security: Strict-Transport-Security (HSTS), TLS 1.3 encryption, and perimeter request rate-limiting to protect service availability.