Privacy Policy.

Last updated: 26 May 2026

1.Who we are

This Privacy Policy explains how DCK D. GLOBAL LTD ("DCK", "we", "our", "us") collects, uses, and protects personal data of visitors to roininja.agency (the "Site") and our clients. DCK operates the ROININJA brand, a Web3 marketing services provider.

2.Data we collect

2.1 Information you provide through forms

When you submit our "Get Web3 audit" form, we collect:

• First and last name
• Business email address
• Phone number
• Description of your business
• Approximate monthly revenue range
• Approximate marketing spend range
• Average client lifetime value (LTV) range
• Your preferred engagement start window

Form submissions are processed through Netlify Forms, operated by Netlify, Inc. (a US-based service).

2.2 Information collected automatically

When you visit the Site, we automatically collect:

• IP address (used for fraud detection, then anonymised in analytics)
• Device type, browser type and version, operating system
• Pages visited, time spent on page, scroll depth
• Referrer (the page you came from)
• Approximate geographic location at country/city level
• Language preference

This data is collected through Google Tag Manager and Google Analytics 4.

2.3 Cookies and similar technologies

We use the following categories of cookies on the Site:

3.Legal basis for processing

Under UK GDPR Article 6 and the Data Protection Act 2018, we rely on the following bases:

4.Who we share data with

We share personal data only with:

4.1 Processors acting on our instructions

• Netlify, Inc. (United States) — website hosting, form submission processing
• Google LLC (United States) — Google Tag Manager, Google Analytics 4
• Our employees and contractors within DCK, under written confidentiality and data processing agreements, on a need-to-know basis

4.2 Other recipients

• Professional advisors (lawyers, accountants, auditors) under confidentiality
• Public authorities when required by applicable law or court order
• A successor entity in the event of a merger, acquisition, or sale of all or substantially all assets, subject to equivalent privacy protections

We do not sell personal data. We do not share data with advertising platforms.

5.International transfers

Some of our processors are based outside the UK, primarily in the United States. When personal data is transferred outside the UK, we rely on one or more of the following safeguards:

• The UK International Data Transfer Agreement (IDTA) with our US processors
• The EU–US Data Privacy Framework where the processor is certified
• The Standard Contractual Clauses issued by the European Commission, where applicable

We carry out transfer impact assessments where required. You may request copies of the safeguards by contacting info@roininja.agency.

6.How long we keep your data

7.Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Access — request a copy of personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure ("right to be forgotten") — request deletion, subject to legal retention obligations
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests, including direct marketing
• Withdraw consent — at any time where processing relied on consent (this does not affect lawfulness of prior processing)

To exercise any of these rights, email info@roininja.agency. We respond within 30 days. We may need to verify your identity before fulfilling certain requests.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) — see ico.org.uk/make-a-complaint.

8.Security

We implement administrative, technical, and physical safeguards including:

• HTTPS/TLS encryption for all Site traffic
• Restricted internal access to client data on a need-to-know basis
• Multi-factor authentication on internal systems and key vendor accounts
• Vendor due diligence and data processing agreements with all subprocessors
• Regular review of security posture and subprocessor compliance

No system is fully secure. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals where required by law.

9.Children

The Site and our services are intended for businesses and adults. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have collected data from a minor, please contact info@roininja.agency and we will delete it.

10.Automated decision-making

We do not engage in automated decision-making (including profiling) that produces legal effects on you or significantly affects you. Marketing tooling may use behavioural data for segmentation, but no automated decisions about individuals are made on that basis.

11.Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or law. We will publish updates here with a new "Last updated" date. Material changes affecting how we use existing data will be notified to affected individuals where reasonably possible.

12.Contact

For any privacy-related question or to exercise your rights: