Privacy Policy

PetChain CRM is a blockchain-backed pet rescue case management system operated for authorised rescue organisations and their staff. The platform is accessible at petchaincrm.co.uk.

For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), the data controller is the rescue organisation that operates this CRM instance. If you have questions about how your data is used, please contact us at admin@petchaincrm.co.uk.

We collect and process the following categories of personal and animal data:

• Staff accounts: Name, email address, hashed password, two-factor authentication state, session tokens, and audit log entries.
• Animal records: Animal name, species, breed, microchip number, photographs, owner details, veterinary records, and NFT token identifiers recorded on the XRP Ledger.
• Owner records: Name, contact details, address, risk assessments, and adoption history.
• Mobile intake submissions (PetChainMOB): Submitted animal data, photographs, GPS location metadata, and the submitting device's API key identifier.
• Vet portal records: Veterinary professional name, registration number, uploaded clinical documents, and session credentials.
• Usage data: Server access logs, IP addresses, and browser information collected automatically when you use the platform.

We use the data we collect for the following purposes:

• Operating the CRM and providing access to authorised staff.
• Registering animals on the XRP Ledger as NFTs and maintaining on-chain metadata via the public animal API endpoint.
• Processing mobile intake submissions and managing the approval workflow.
• Detecting duplicate microchip registrations and preventing fraudulent or harmful animal transfers.
• Maintaining audit trails for regulatory and welfare compliance.
• Sending system notifications and password reset emails.
• Improving platform security and investigating misuse.

We rely on the following legal bases under UK GDPR:

• Legitimate interests: Operating a rescue case management system, maintaining animal welfare records, and preventing microchip fraud.
• Contract: Processing staff account data to provide access to the platform under agreed terms.
• Legal obligation: Retaining audit records where required by animal welfare legislation.
• Consent: Where we rely on consent (e.g. optional notifications), you may withdraw it at any time.

Animal records minted as NFTs on the XRP Ledger (XRPL) include a URI that points to a public metadata endpoint on this server. That endpoint may return the animal's name, species, microchip number, photograph URL, and other registry fields.

Important: NFT token identifiers and on-chain transaction data written to the XRPL are immutable — they cannot be deleted or amended once confirmed on the ledger. The metadata served by our endpoint can be updated or removed, but the on-chain token record itself is permanent.

We do not write personal data about individual humans directly to the blockchain. Animal identifiers (name, chip number) are written as part of the NFT minting process and are visible to anyone who queries the XRPL.

We do not sell personal data. We may share data with:

• XRPL network nodes: NFT token data is broadcast to the public XRP Ledger as part of the minting process.
• Google Sheets (Google LLC): The animal master sheet is used as an authoritative data source for chip numbers and token repair operations. Data is processed under Google's data processing terms.
• Xaman (XUMM): Transaction signing payloads are sent to the Xaman API to facilitate XRPL wallet signing. No personal data beyond the transaction payload is transmitted.
• Hosting infrastructure: Our hosting provider processes data on our behalf under a data processing agreement.
• Regulatory bodies: We may disclose data where required by law or to protect animal welfare.

We retain animal records, audit logs, and intake submissions for as long as the rescue organisation operates this CRM instance, or as required by applicable animal welfare legislation. Staff account data is deleted within 30 days of account closure. Server access logs are retained for up to 90 days. Blockchain records on the XRPL are permanent and cannot be deleted.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate personal data.
• Erase personal data (subject to our legal obligations and the immutability of blockchain records).
• Restrict or object to processing.
• Data portability where processing is based on consent or contract.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at admin@petchaincrm.co.uk. We will respond within one calendar month.

We implement technical and organisational measures to protect personal data, including hashed password storage, session token management, role-based access controls, API key authentication for mobile submissions, and audit logging of all data modifications. Access to the Cruelty Register is restricted to authorised administrators. Despite these measures, no system is completely secure; please report any suspected security issues to admin@petchaincrm.co.uk.

PetChain CRM uses session cookies and browser local storage to maintain your authenticated session and persist UI preferences (such as column order in the National Registry). We do not use third-party advertising or tracking cookies. Essential session cookies are set when you log in and are deleted when your session expires or you log out.

We may update this privacy policy from time to time. The effective date at the top of this page will reflect the date of the most recent revision. Continued use of the platform after a revision constitutes acceptance of the updated policy.