Privacy notice

pending: Name and address of the controller

pending: Contact for data protection, and the data protection officer if one is appointed

Reading WhatTheChain needs no account. The public website sets no cookies, shows no advertising and loads no scripts, fonts or images from third parties.

When you open a page, the server processes the technical data of the request, such as the IP address, the time, the requested address and the browser identification, to deliver the page and to keep the service secure. Legal basis: Art. 6 (1) (f) GDPR.

On guides and country pages, your browser may ask this website once which country the connection comes from, so it can offer the guides for that country. The answer is the country code that the content delivery network adds to the request; it is not logged, not stored and not linked to an account. Legal basis: Art. 6 (1) (f) GDPR.

pending: Hosting provider, location and retention period of server logs

WhatTheChain measures its reach with Umami, an analytics tool that works without cookies. It runs under this website’s own address.

Two of its counts are events: when a knowledge self-test is finished, and when the last step of a learning path is marked as done. The self-test event carries nothing else; the learning-path event carries only the path’s name. Neither carries your answers, which steps you marked, or anything that identifies you.

pending: Data collected, retention and legal basis

If you choose a display theme (Day or Lamplight), the choice is stored in your browser’s local storage under the key “wtc-theme”. It does not leave your device and is removed when you return to the system setting. Legal basis: § 25 (2) no. 2 TDDDG.

If you mark steps of a learning path as done, the page stores which steps in your browser’s local storage under the key “wtc:progress:v1”. It does not leave your device and is never sent to WhatTheChain; the progress code you can copy holds the same data. Clearing a path’s progress, or this website’s data in your browser, removes it. Legal basis: § 25 (2) no. 2 TDDDG. The only exception: when you mark the last step of a path as done, the reach measurement counts that the path was finished (see “Reach measurement”); which steps you marked is never sent.

If you dismiss a message in the bar above the header, the page stores that message’s id in your browser’s local storage under the key “wtc:announcement:dismissed”, so it stays hidden. If you answer the country suggestion, your answer is stored under “wtc:country-suggestion”, so it is not asked again. Neither leaves your device. Legal basis: § 25 (2) no. 2 TDDDG.

If you subscribe to rating alerts, WhatTheChain stores your email address, the language you subscribed in, the topics you chose and the dates you subscribed, confirmed and unsubscribed. Nothing else: no name, no account, and no tracking pixels or tracked links in the emails. Legal basis: your consent, Art. 6 (1) (a) GDPR.

We first send one email with a confirmation link (double opt-in). Nothing else is sent until you open it, and an unconfirmed address is deleted after 7 days. Every email has a personal link to change your topics or to unsubscribe with one click; unsubscribing withdraws your consent for the future.

After you unsubscribe, your address is deleted within 30 days. Only a one-way hash of it may be kept, so that an address that asked for no more email is not written to again.

pending: Email delivery provider and where it processes the data

If you report an error on a page, WhatTheChain stores the page, its language, your text and the date. If you give an email address, it is used only to answer your report. No account is needed, no cookie is set, and no IP address is stored: to limit the number of reports, only a keyed one-way hash of it is counted, for one day. Legal basis: Art. 6 (1) (f) GDPR (correcting our pages); for the answer, Art. 6 (1) (b) GDPR.

A report and the address are deleted one year after the report was answered or closed.

When you pass the exam, WhatTheChain issues your credential as a signed file (Open Badges 3.0). It contains the name you gave for the credential, the level, the exam language, the exam version, the date of issue and the credential’s number; no email address. You download it from the exam pages. Its verification page is public only if you switch it on.

A fingerprint (hash) of the credential file is recorded in a transaction on the Bitcoin blockchain, together with the fingerprints of other credentials, so that anyone can check when the file existed. The fingerprint stays there for good and cannot be deleted, but it reveals nothing without the file: not your name, nor anything else in it.

On the exam pages you can download your exam data or delete it. Deleting it removes our copy of your credentials and all records of your exam at once. It does not reach files you have already downloaded, which can still be checked, nor the fingerprint on Bitcoin.

The documents WhatTheChain signs credentials with (its public keys and issuer profile) and the revocation lists are public, so that anyone can check a credential. They name no candidate.

Under the GDPR you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21), and the right to lodge a complaint with a supervisory authority (Art. 77).

pending: Date of this notice