Privacy Policy

1. Who We Are

TOBB.world is operated by the TOBB Imperial House of Technology ("we", "us", or "our"). We are the data controller for any personal information processed through this website.

2. What We Collect

We ask for as little as we can. There is one form on this site — the course signup — and it collects:

• Your email address. Required, because the course link has to go somewhere.
• Your first name. Optional. Leave it blank and the course still opens.
• Technical Data: Standard server logs, including your IP address, browser type, and time of access, used for security and debugging. We store a salted, keyed hash of the submitting IP address alongside a signup, to rate-limit abuse of the form.

We never ask for a wallet address, a seed phrase, or a phone number, and there is no field on this site in which to enter one. A subscriber list for people interested in a DeFi protocol is a phishing target, so we deliberately hold nothing worth stealing. Relatedly: TOBB emails never ask you to connect a wallet, enter a seed phrase, or approve a transaction. An email that does is not from us.

This site does not use cookies for analytics or tracking. Confirming your address sets one cookie, which does nothing but keep the course open on your device.

3. Why We Collect It

We process your information for these purposes and no others:

• To send you one confirmation email, and then to open the course for you.
• To send you the governance digest — only if you ticked the separate box for it.
• To maintain the security and integrity of the website, including limiting automated abuse of the form.

We do not sell your data, share it for advertising, or combine it with data from anywhere else.

4. Legal Basis for Processing

Under the GDPR and UK-DPA, we rely on the following legal bases:

• Consent (Art. 6(1)(a)): For the address you give us and for the governance digest. These are two separate permissions and we treat them separately — the marketing box is unticked by default, and the course opens whether or not you tick it.
• Legitimate Interests (Art. 6(1)(f)): For server logs and form rate-limiting, to ensure the security and performance of our infrastructure.

Nothing happens until you confirm. Submitting the form sends exactly one email to the address given. Until you click the link in it, you are not on any list and you receive nothing further. We record the exact wording you agreed to, so we can always answer the question of what you actually consented to.

5. Sub-processors

We use a limited number of trusted service providers to operate our platform:

• Vercel: Hosting and infrastructure (US/EU). Privacy Policy
• Neon: Postgres database holding subscriber records. Privacy Policy
• Resend: Sends the confirmation and digest emails. Privacy Policy
• Lark (Larksuite): Scheduling, when you book a call or live session. The booking form runs on Lark's own pages — the details you enter there go to Lark, not to this site. Privacy Policy

6. Data Retention

We keep your address while you are subscribed. If you unsubscribe, we keep a minimal record that you did so — this is deliberate: it is what stops a later import from quietly adding you back. If you would rather we erased everything, say so at the address below and we will delete it outright rather than merely suppress it.

An address that is submitted but never confirmed is not a subscriber and is removed. Technical logs are retained for a short period, typically 30-90 days, as required for security purposes.

A note on the former waitlist. An earlier version of this site carried a waitlist form for a namespace registry that was never launched. That form was retired, and in August 2026 we reviewed what it had captured. Every submission proved to be automated form abuse rather than a genuine sign-up: the names and organizations were machine-generated strings, though some of the email addresses appeared to be real addresses harvested from elsewhere and submitted without their owners' knowledge. Because no one had actually asked to hear from us, we did not email the list. We deleted the table outright and removed the form's endpoint. We kept an anonymized record of the abuse pattern — timestamps and request metadata, no names, addresses, or message text — to inform the protections on any future form.

7. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Request that we correct inaccurate information.
• Erasure: Request that we delete your data ("right to be forgotten").
• Portability: Request a transfer of your data to another service.
• Objection: Object to our processing of your data.
• Withdrawal: Withdraw your consent at any time.

To exercise these rights, contact us at the email address below. Every email we send also carries a one-click unsubscribe link that takes effect immediately — you never have to write to us to stop hearing from us.

8. International Transfers

As we use global infrastructure providers like Vercel, technical data may be transferred to or stored in locations outside the UK or EEA. Where such transfers occur, we ensure appropriate safeguards (such as Standard Contractual Clauses) are in place.

9. Children's Privacy

Our service is not directed at individuals under the age of 18. We do not knowingly collect information from children.

10. Changes and Contact

We may update this policy from time to time. Significant changes will be announced on our website.

Privacy Contact: privacy@tobb.world
Legal Contact: legal@tobb.world
General Inquiries: contact@tobb.world