Privacy Policy

This Privacy Policy explains how ShawarmaSec, which operates the DualGuard platform, collects and processes personal data. DualGuard facilitates Web3 security review contests, pre-launch bug bounty programmes, security reports, mitigation reviews, researcher participation and related security services. DualGuard may involve security researchers and other security professionals, including judges, lead judges, the supreme judge, guards, lead guards, contest managers, the community manager, technical writers, scopers and quoters, as well as protocol teams, service providers and the use of AI-assisted and other automated tools. Automated tools may include static analysers, fuzzers and provers. Of all the actors mentioned above, only guards, lead guards, judges, the lead judge and the supreme judge are expected to have created an account on the DualGuard platform.

The data controller is ShawarmaSec, a single-member société à responsabilité limitée with share capital of EUR 500, registered with the Paris Trade and Companies Register under number 989 917 026.

Registered office: 30 boulevard de Sébastopol, 75004 Paris, France.

ShawarmaSec’s registered business activities include blockchain code reviews, the exploitation of decentralised applications and the delivery of audit reports.

For privacy-related enquiries, please contact: privacy@dualguard.xyz

For postal correspondence: ShawarmaSec, For the attention of the Data Protection Contact, 30 boulevard de Sébastopol, 75004 Paris, France.

For certain processing activities involving information supplied by a client company, ShawarmaSec may act as a data processor on behalf of that client company. The applicable roles and responsibilities are determined by the relevant agreement.

This Privacy Policy applies to visitors to the DualGuard website and platform, security researchers and other security professionals, protocol teams, judges, guards, contest managers, community managers, scopers or quoters, security experts, technical writers, individuals who submit security reports, programme participants, reward or payment recipients, representatives of protocol teams and individuals who contact DualGuard or ShawarmaSec.

Depending on how you use the platform, we may process account and identification data such as your name, username, pseudonym, email address, account identifier, password credentials, language, country or region of residence and account status. Where you connect to DualGuard through a blockchain wallet, we may process the public wallet address, blockchain network, wallet connection data and related authentication or session information. We do not ask you to provide private keys, seed phrases, recovery phrases or wallet passwords.

We may process professional and researcher profile data, including professional experience, skills, areas of expertise, programming languages, certifications, public profiles, affiliations, contest history, judging history, rankings, scores and badges.

We may process programme and contest data, including registrations, eligibility, submissions, security reports, severity assessments, duplicate findings, report validation, communications, judge decisions, rankings, escalations, mitigation reviews, prize allocations and payment status.

We may process technical and security data, including IP addresses, device identifiers, browser information, operating system information, authentication logs, access dates and times, error logs, security logs, fraud indicators and session information.

Security reports are submitted anonymously by default and must remain anonymous. They must not contain information that reveals the security researcher’s identity, unless disclosure is strictly necessary for an authorised purpose. Reports may include code, logs, screenshots, proof-of-concept material, transaction identifiers, wallet addresses, IP addresses, technical records and other information relating to a vulnerability. Where such material contains personal data or information capable of identifying the researcher, it will be removed, minimised or retained only where strictly necessary for an authorised purpose. Final security reports may identify a researcher by username, where applicable, but will not include the researcher’s email address or legal name.

Where necessary to process a reward, payment, reimbursement or professional fee, we may process your legal name, date of birth, residential address, country of residence, country of tax residence, tax identification number, VAT number, professional or corporate status, company details, payment history, digital wallet address and information relating to on-chain transfers, including transaction identifiers, token type, network and amount. We may also process documents required for tax, accounting, sanctions-screening or identity-verification purposes where applicable. Tax information is not required merely to participate in a competition, but may be required before a payment or other legally regulated transaction.

DualGuard does not currently operate a general KYC process. Depending on the services offered, the nature and value of transactions, applicable anti-money-laundering, tax or other legal obligations, or the requirements of a payment or identity-verification provider, DualGuard may introduce identity-verification measures, including through ZK Passport. Any such processing will be subject to appropriate information, purpose limitation and safeguards. DualGuard may request tax forms only where a tax or reporting obligation actually applies. You must never provide your private key, recovery phrase, wallet password or any other secret that could provide access to digital assets.

We process personal data to create and manage accounts, authenticate users, including through connected blockchain wallets, register users for contests and programmes, receive and manage security reports, communicate reports to client companies, manage judging and audit activities, operate leaderboards and researcher profiles, process rewards and payments made through stablecoins or other on-chain tokens, record and reconcile on-chain transactions, comply with tax and accounting obligations, prevent fraud and abuse, protect the platform, investigate incidents, manage client programmes, communicate with users, handle complaints and appeals, improve the platform, publish or make available competition materials where the applicable client has authorised such publication, develop AI-assisted security tools and train or improve such tools where this is presented as a separate purpose and is subject to an appropriate legal basis and safeguards, send promotional communications where permitted and manage cookies and similar technologies.

The main legal bases are performance of a contract or pre-contractual measures, compliance with legal obligations, legitimate interests in cybersecurity and platform security, and consent where consent is required. Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Depending on the relevant programme and your account settings, DualGuard may display your pseudonym, profile name, ranking, score, badge, contest participation, report statistics or reward-related information. Public competitions are open to everyone by default and are not subject to eligibility criteria unless the applicable programme rules expressly provide otherwise. General presentation information such as the programme description, scope, timetable, rules and non-confidential technical context may be made available publicly or to DualGuard users. Subject to the client’s express authorisation and the applicable programme rules, DualGuard may also make competition materials available to DualGuard users for an extended or indefinite period, including source code, security reports, identified vulnerabilities, final vulnerability lists and discussions relating to judging or appeals. Before publication, DualGuard will seek to remove or minimise personal data that is not necessary for the publication. The continued availability of technical or historical materials does not by itself justify the indefinite retention or publication of personal data. Your legal name, residential address, date of birth, tax information, identity documents, bank details and private payment information will not be made public unless you expressly authorise publication or disclosure is required by law.

Security reports may contain confidential information belonging to the relevant client company or protocol. General information presenting a public competition may be made available publicly or to DualGuard users. Reports, source code, vulnerabilities, technical exchanges, judging materials and appeal discussions remain restricted until the applicable client and programme rules authorise their disclosure. Once publication has been authorised, the materials may remain available for an extended or indefinite period for transparency, open-source, educational, security, historical or research purposes, subject to the removal or minimisation of unnecessary personal data and confidential information belonging to third parties. For public and private competitions, participants must not disclose a suspected vulnerability, publish or communicate clues that could identify it, or ask questions that reveal a technical lead, except through the authorised DualGuard process or after official publication under the applicable rules. For private competitions, access to confidential client information may be subject to a confidentiality undertaking, non-disclosure agreement or equivalent contractual terms accepted before access is granted. For private competitions conducted anonymously, those terms will expressly prohibit the disclosure, direct or indirect identification or attempted identification of the client.

DualGuard may use automated, semi-automated or AI-assisted tools to help identify, classify, prioritise, deduplicate or assess submissions. Such tools may include static analysers, fuzzers, provers and other security-testing or analytical tools. The reuse of security reports, source code, vulnerability data or related materials to train, fine-tune, evaluate or improve AI systems constitutes a separate purpose from the operation of the competition and will be documented and subject to an appropriate legal basis. Where possible, DualGuard will use anonymised or strongly minimised technical data, separate technical materials from information identifying researchers, client representatives or other individuals, apply access controls and confidentiality obligations, and avoid using personal data that is not necessary for the AI purpose. DualGuard will not use a security report to train an AI system unless these conditions and appropriate security safeguards have been implemented.

DualGuard authorises security research only within the scope defined by the relevant programme or engagement. Researchers must test only authorised assets, comply with the applicable programme rules, avoid destructive testing unless expressly authorised, avoid unnecessary access to personal data, avoid modifying or exfiltrating data, stop testing where continued testing could cause material harm, report vulnerabilities through the designated channel, preserve only the minimum evidence necessary and delete unnecessary copies of personal data.

This Privacy Policy does not itself authorise testing of any system. Authorisation must arise from the relevant programme terms, client instructions or a separate written engagement.

Personal data may be accessed by authorised employees, officers, contractors, consultants, judges, guards and other security professionals working for ShawarmaSec or DualGuard. Access is granted according to role, the need to know, the specific competition or engagement and applicable confidentiality obligations. Clients and service providers may be established in any country, subject to applicable data protection requirements and contractual or technical safeguards. Where a provider is a minor, participation and access to personal data will be permitted only where the relevant programme expressly allows it, applicable law permits it and appropriate age-related safeguards and information requirements have been addressed.

Information relating to a programme, report or security review may be shared with the relevant client company and its authorised personnel. We may use service providers for hosting, cloud infrastructure, content delivery, authentication, wallet connectivity, communications, support, payment or blockchain infrastructure, identity verification, fraud prevention, analytics, security monitoring, accounting and technical operations. Our current hosting and infrastructure providers include Amazon Web Services (AWS) and Cloudflare. We do not use Stripe for payments. We may also use GitHub or comparable code-repository services, including for repositories that may be archived for security, operational, evidentiary or continuity purposes. For all competitions, the programme rules, platform terms and electronic registration process will prohibit participants from disclosing suspected vulnerabilities, clues or technical leads before authorised publication. For private competitions, access to confidential client information may require acceptance of a non-disclosure agreement or equivalent confidentiality terms. For private competitions conducted anonymously, the applicable terms will expressly prohibit disclosure or attempted identification of the client. Where the client authorises publication of competition materials, the applicable terms will specify the categories of materials that may be made available, the intended audience and the possibility of extended or indefinite availability.

We may disclose information to courts, regulators, law enforcement authorities, tax authorities, legal advisers, auditors and other professional advisers where necessary to comply with a legal obligation or establish, exercise or defend legal claims. DualGuard does not sell personal data.

Some recipients, service providers, infrastructure providers, wallet or blockchain service providers, repository providers, contractors or other business partners may be located outside the European Economic Area, or may access personal data from outside the European Economic Area. DualGuard may also work regularly with non-European service providers and professional partners. Where personal data is transferred outside the European Economic Area, DualGuard will rely on an appropriate transfer mechanism under applicable data protection law, such as an adequacy decision or standard contractual clauses. The specific mechanism will depend on the country and provider concerned.

Before implementing a relevant transfer, DualGuard will assess the circumstances of the transfer and, where necessary, implement additional safeguards such as encryption, pseudonymisation, access restrictions, separation of environments and logging. The countries concerned and the applicable transfer mechanism may vary depending on the provider and service used. Information about the relevant transfer mechanism, the principal countries concerned and the safeguards implemented may be obtained by contacting privacy@dualguard.xyz.

DualGuard may collect and process payment and tax information only where necessary to satisfy applicable legal, accounting or reporting obligations or to process a payment or other regulated transaction. Payments may be made by transfers of stablecoins or other tokens on a blockchain, and participants may connect to the platform through a blockchain wallet. Depending on the participant’s status and the relevant transactions, the platform may need to collect information concerning identity, residence, tax residence, tax identification number, professional or corporate status, payments, commissions, wallet addresses, transaction identifiers, token type, network and payment accounts. Tax information is not mandatory merely to participate in a competition.

The tax treatment of rewards, fees or payments depends on the participant’s circumstances and the nature of the activity. DualGuard does not provide individual tax advice. Each participant remains responsible for determining and declaring their own tax and social-security obligations unless applicable law provides otherwise.

Personal data is retained only for as long as necessary for the purposes described in this Privacy Policy. DualGuard does not retain personal data indefinitely merely because it is not sold or otherwise monetised, and a client’s authorisation to publish competition materials does not by itself justify indefinite retention of personal data. Technical or historical materials such as source code, security reports, vulnerability lists and judging or appeal discussions may remain available for an extended or indefinite period where the client has authorised publication and the continued availability is justified by transparency, open-source, educational, security, historical, research or evidentiary purposes. Before publication and during periodic reviews, DualGuard will remove, anonymise or minimise personal data that is not necessary for those purposes.

Account data is retained for the duration of the account and for a period thereafter that is reasonably necessary to manage closure, prevent fraud, resolve disputes and establish, exercise or defend legal claims. Client-related data and competition records are accessible to authorised providers only for the duration of the relevant competition or engagement and for any subsequent period reasonably necessary for remediation, audit, dispute resolution, security monitoring or evidentiary purposes. Where the client authorises publication, technical materials may remain available for an extended or indefinite period, but personal data contained in those materials will be deleted, anonymised, minimised or placed in a restricted archive when it is no longer necessary for the relevant purpose. Payment, accounting, tax and identity-verification data are retained for the periods required by applicable legal obligations. Support and communication data are retained for as long as necessary to handle the request and any related dispute or claim. Security and access logs are retained for a limited period appropriate to security monitoring and incident investigation, unless a longer period is required for an incident, audit or legal claim. Repositories and related technical records may be archived where reasonably necessary for security, operational, evidentiary or continuity purposes. Retention periods are reviewed at least annually and whenever there is a material change to a processing purpose, system, provider, programme or applicable legal obligation. Data is deleted, anonymised or placed in a restricted archive when active access is no longer necessary.

Where data no longer needs to be retained in an active system but must be kept for legal or evidentiary purposes, it may be transferred to a restricted archive. At the end of the applicable retention period, data will be deleted or irreversibly anonymised.

ShawarmaSec implements technical and organisational measures appropriate to the risks presented by the processing activities. These measures may include encryption in transit and at rest, access control, role-based permissions, multi-factor authentication, segregation of environments, restricted access to security reports, logging and monitoring, backup and restoration procedures, vulnerability management, incident response procedures and confidentiality obligations.

No system can guarantee absolute security. Where a personal data breach is likely to create a risk to the rights and freedoms of individuals, ShawarmaSec will comply with the notification obligations applicable under data protection law.

DualGuard may use strictly necessary cookies or similar technologies for authentication, security, session management and user preferences. The current DualGuard landing page uses Google Analytics for audience measurement, and the consent mechanism is managed through the applicable Google Analytics consent configuration. Non-essential analytics cookies and similar technologies on the landing page will be activated only after the required consent has been obtained. The platform is expected to rely primarily on strictly necessary cookies and similar technologies for authentication, security and wallet-session functionality. If non-essential analytics, advertising, personalisation or other trackers are introduced on the platform, they will be used only where the required consent has been obtained or another lawful basis applies. The Cookie Policy must explain the cookies and trackers used, their purposes, providers, duration, international transfers, consequences of refusal and the mechanism for changing consent choices.

Subject to applicable law, you may request access to your personal data, rectification, erasure or restriction of processing. You may also have a right to data portability and may object to processing based on legitimate interests. You may withdraw consent where processing is based on consent.

To exercise your rights, contact privacy@dualguard.xyz or write to ShawarmaSec, For the attention of the Data Protection Contact, 30 boulevard de Sébastopol, 75004 Paris, France. We may request information reasonably necessary to verify your identity and prevent unauthorized disclosure.

You may lodge a complaint with the competent supervisory authority. In France, the supervisory authority is the Commission nationale de l’informatique et des libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

DualGuard may permit participation from the age of 15 for public and private competitions, subject to the applicable programme rules, the law of the participant’s country and any additional safeguards required for minors. Where the processing relies on consent for an online service offered directly to a minor, DualGuard will apply the consent and parental-authorisation requirements applicable in the relevant jurisdiction. In France, a minor may consent alone to such processing from the age of 15. For younger minors, consent must be given jointly by the minor and the holder or holders of parental authority. Information provided to minors will be drafted in clear and accessible terms. A competition or feature may nevertheless be reserved for individuals aged 18 or over where this is justified by the nature of the information accessed, the confidentiality obligations, the legal or contractual conditions for receiving rewards or payments, the need to complete identity, tax or anti-money-laundering checks, the terms of a wallet or payment provider, the enforceability of the relevant contract or other applicable legal requirements.

We may update this Privacy Policy to reflect changes to the DualGuard platform, ShawarmaSec’s activities, applicable law, service providers or data protection practices. The updated version will be published on the platform with a new update date. Where a change is material, we will provide additional notice where required by applicable law or appropriate in light of the nature of the change.

ShawarmaSec
30 boulevard de Sébastopol 75004 Paris France

Privacy email: privacy@dualguard.xyz