Privacy Policy

Privacy Policy

This Privacy Policy explains how Mario Boss Ltd ('we', 'us', or 'our') collects, uses, and protects your personal information when you use our Crypto Will service. We are committed to protecting your privacy and complying with UK data protection laws, including the General Data Protection Regulation (UK GDPR). Crypto Will is a trading name of Mario Boss Ltd.

1. Who We Are

Mario Boss Ltd is a company registered in England and Wales with company number 12441354. Our registered office is at 20-22 Wenlock Road, London, England, N1 7GU.

For any data protection queries or to exercise your rights under UK GDPR, please contact us at: [email protected] or write to our registered office address.

2. What Information We Collect

We collect only the minimum personal information necessary to provide our Crypto Will service:

  • Personal identification: Your name and email address
  • Billing information: Payment details processed securely through trusted payment processors
  • Company information: Optional company name if you choose to provide it
  • Partial will data: Encrypted fragments of your crypto inheritance information (not complete private keys or recovery phrases)
  • Account information: Login credentials and account preferences
  • Technical data: IP addresses, browser information, and access logs for security purposes

We do not collect biometric data, behavioural profiling information, or use automated decision-making systems.

3. How We Use Your Information

We use your personal information for the following purposes:

  • Service provision: To provide and maintain your Crypto Will account and store your partial inheritance data
  • Payment processing: To process subscription payments and manage billing
  • Account security: To authenticate your identity and protect your account from unauthorised access
  • Service updates: To notify you of important service changes, security updates, or account issues
  • Legal compliance: To comply with applicable laws and regulations
  • Customer support: To respond to your queries and provide technical assistance

4. Legal Basis for Processing

We process your personal information based on the following legal grounds:

  • Contract performance: Processing necessary to provide our service and fulfil our contractual obligations
  • Consent: Where you have given explicit consent for specific processing activities
  • Legitimate interests: For service security, fraud prevention, and business operations
  • Legal obligations: To comply with applicable laws and regulations

5. How We Store and Secure Your Data

We implement robust security measures to protect your personal information:

  • Encryption in transit: All data is protected by SSL encryption during transmission
  • Encryption at rest: Your data is stored encrypted in secure databases
  • Access controls: Role-based access ensures only authorised personnel can access your information
  • Regular security audits: We regularly review and update our security practices
  • Secure infrastructure: Our servers are hosted in secure, compliant data centres

Your partial crypto will data is stored in an encrypted format that cannot be accessed without proper authentication. We maintain strict internal policies to ensure data security and staff confidentiality.

6. Who We Share Your Data With

We do not sell, trade, or rent your personal information to third parties. We only share your information in the following limited circumstances:

  • Payment processors: Trusted services like Stripe or PayPal to process subscription payments (they have their own privacy policies)
  • Legal requirements: When required by law, court order, or regulatory authority
  • Service providers: Essential technical service providers who assist in operating our platform (under strict confidentiality agreements)
  • Business transfer: If our business is sold or merged, your information may be transferred to the new owner

All third-party service providers are carefully selected and bound by data protection agreements to ensure your information remains secure.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal information:

  • Right of access: Request a copy of the personal information we hold about you
  • Right to rectification: Request correction of inaccurate or incomplete information
  • Right to erasure: Request deletion of your personal information (subject to legal obligations)
  • Right to restrict processing: Request limitation of how we use your information
  • Right to object: Object to processing based on legitimate interests
  • Right to data portability: Request transfer of your data to another service provider
  • Right to withdraw consent: Withdraw consent for processing activities that require it

To exercise any of these rights, contact us at [email protected]. We will respond within one month and may require identity verification.

8. Data Retention

We retain your personal information for as long as necessary to provide our service and comply with legal obligations:

  • Active accounts: While your subscription remains active
  • Cancelled accounts: Up to 90 days after cancellation to allow for account reactivation
  • Legal requirements: Longer if required by law or for legal proceedings
  • Financial records: Payment information retained for tax and accounting purposes as required by law

You can request earlier deletion of your data by contacting us, subject to any legal obligations we may have.

9. Cookies and Tracking

Our website uses both essential cookies and optional analytics cookies to provide and improve our service.

Essential cookies (always active):

  • Session cookies for user authentication
  • Security cookies to prevent cross-site request forgery
  • Preference cookies to remember your language settings
  • Consent cookies to remember your privacy preferences

Analytics cookies (optional, requires consent):

  • Umami analytics cookies to understand website usage patterns
  • Performance tracking to improve user experience

You can manage your cookie preferences through our cookie banner or disable cookies in your browser settings. Disabling essential cookies may affect the functionality of our service, but you can opt out of analytics cookies without impacting core features.

10. International Data Transfers

Your personal information is processed and stored within the United Kingdom. If we need to transfer data outside the UK, we will ensure appropriate safeguards are in place, including adequacy decisions or standard contractual clauses.

11. Categories of Personal Information (CCPA Disclosure)

For California residents, we collect the following categories of personal information as defined under the California Consumer Privacy Act (CCPA):

  • Identifiers: Name, email address, account username
  • Commercial information: Subscription details, payment history
  • Internet activity: Website usage data through Umami analytics (with consent)
  • Professional information: Company name (optional)
  • Other personal information: Encrypted partial cryptocurrency inheritance data

Sources: We collect this information directly from you when you create an account, make purchases, or use our service.

Business purposes: We use this information for service provision, account management, security, legal compliance, and with your consent, website analytics.

12. California Consumer Privacy Rights

If you are a California resident, you have the following rights under the CCPA and CPRA:

  • Right to know: Request information about the personal information we collect, use, and share
  • Right to delete: Request deletion of your personal information (subject to legal exceptions)
  • Right to correct: Request correction of inaccurate personal information
  • Right to opt-out: We do not sell or share personal information for cross-context behavioral advertising
  • Right to limit sensitive personal information: Request limitations on use of sensitive personal information
  • Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at [email protected] or write to our registered address. We will verify your identity and respond within 45 days.

13. We Do Not Sell Personal Information

We do not sell, rent, or trade your personal information to third parties. We do not share personal information for cross-context behavioral advertising. In the past 12 months, we have not sold personal information of consumers, including minors under 16 years of age.

If our practices change, we will update this policy and provide appropriate opt-out mechanisms as required by law.

14. Canadian Privacy Rights

For Canadian residents, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA):

  • Collection notification: We notify you when we collect personal information and explain why
  • Consent: We obtain your consent for collection, use, and disclosure of personal information
  • Access rights: You can request access to your personal information we hold
  • Correction rights: You can request correction of inaccurate information
  • Withdrawal of consent: You can withdraw consent at any time (subject to legal/contractual restrictions)
  • Complaint process: You can complain to the Privacy Commissioner of Canada if unsatisfied with our response

For Canadian privacy inquiries: [email protected] or Privacy Commissioner of Canada: www.priv.gc.ca

15. Data Location and International Transfers

Your personal information is primarily processed and stored within the United Kingdom and European Economic Area using secure, GDPR-compliant data centers.

We may transfer data internationally for the following purposes:

  • Payment processing: To secure payment processors (Stripe, PayPal) in compliance with their privacy policies
  • Technical infrastructure: To cloud service providers with appropriate data protection agreements
  • Legal compliance: When required by law or regulatory authorities

All international transfers are protected by appropriate safeguards including adequacy decisions, standard contractual clauses, or other approved mechanisms under applicable data protection laws.

16. Australian Privacy Rights

For Australian residents, we comply with the Privacy Act 1988 and Australian Privacy Principles (APPs):

  • Collection notice: We notify you about collection of personal information and our privacy practices
  • Access and correction: You can request access to and correction of your personal information
  • Data quality: We take reasonable steps to ensure personal information is accurate and up-to-date
  • Data security: We protect your personal information from misuse, interference, loss, and unauthorized access
  • Cross-border disclosure: We may transfer your data overseas with appropriate protections
  • Anonymity option: Where practical, you can deal with us anonymously or using a pseudonym

If you have privacy concerns, you can complain to us first at [email protected]. If unsatisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au

Data breach notification: If we experience a data breach likely to result in serious harm, we will notify you and the OAIC as required by law.

17. Additional Jurisdictions and Emerging Laws

We monitor privacy laws globally and may update our practices to comply with emerging regulations in jurisdictions where we have users, including:

  • Brazil (LGPD): Lei Geral de Proteção de Dados compliance for Brazilian residents
  • Singapore (PDPA): Personal Data Protection Act requirements
  • Japan (APPI): Act on Protection of Personal Information compliance
  • India (DPDP): Digital Personal Data Protection Act requirements

For specific privacy inquiries related to these jurisdictions, please contact us at [email protected] and specify your location.

18. Cryptocurrency-Specific Disclosures

Given the nature of our cryptocurrency inheritance service, please note:

  • Financial service classification: Our service may be considered a financial service in some jurisdictions
  • Cross-border inheritance: Cryptocurrency inheritance may have different legal implications depending on your residence and the location of beneficiaries
  • Tax implications: We recommend consulting tax professionals regarding cryptocurrency inheritance in your jurisdiction
  • Regulatory compliance: We comply with applicable anti-money laundering (AML) and know-your-customer (KYC) requirements where legally required
  • Data retention: Some financial regulations may require longer data retention periods than standard privacy laws

We do not provide legal or financial advice. Please consult qualified professionals regarding the legal implications of cryptocurrency inheritance in your jurisdiction.

19. Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by email and update the 'Last updated' date below.

Continued use of our service after changes constitutes acceptance of the updated Privacy Policy.

21. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or need to make a complaint, please contact us:

  • Email: [email protected]
  • Post: Data Protection Officer, Mario Boss Ltd, 20-22 Wenlock Road, London, England, N1 7GU
  • Data Protection Authority: You also have the right to complain to the Information Commissioner's Office (ICO) if you believe we have not handled your personal information properly

Last updated: August 1, 2025