DKAM & BluckTrust infrastructure
Trust & Privacy

Legal, privacy and compliance

These pages describe how DKAM handles identity, credential and capability data, what controls are in place today, and what is on the compliance roadmap. They are maintained by the DKAM team and updated as the platform matures.

Privacy Policy

Last reviewed: 2026. Maintained by the DKAM team.

1. Who we are

DKAM operates the DKAM platform and the Bluck capability identity from Cape Town, London and Manchester. Formal company and regulatory documentation is available to counterparties on request.

2. Our data model in plain English

DKAM is built as a holder-centric platform. The individual is the primary holder of sensitive credential material. DKAM acts mainly as a trust, verification, permissions, scoring and discovery layer. We keep central handling of raw personal data to the minimum needed to operate the ecosystem.

  • Held by you, on the holder side of your Bluck: raw identity documents, transcripts, certificates, employment evidence, encrypted sensitive records. These stay under your control and are selectively disclosed.
  • Held centrally by DKAM: your account, your wallet linkage, verified issuer references, hashes and status of anchored credentials, consent and access events, discovery metadata, scoring signals, and platform audit records.

3. What we collect

  • Account information: name, email, password hash, authentication factors, wallet-linked identifier.
  • Verification metadata: who verified a claim, when, at what level, and the audit trail of changes.
  • Credential anchors: hash, issuer reference, timestamp and status. Never the raw document itself.
  • Consent and access events: who you have granted access to, for what purpose and for how long.
  • Technical data: device, browser, IP address and security logs needed to operate the service.

4. Why we collect it

  • To operate the Bluck and verification flows you have chosen to use.
  • To allow you to grant, scope and revoke access to your record.
  • To maintain a tamper-evident history of issuance, attestation and access events.
  • To keep the platform secure and to meet legal obligations.

5. Lawful basis

We rely primarily on your consent for capability data and on legitimate interest for security and platform operation. Where DKAM is engaged by an organisation as a processor, the relevant agreement defines the basis and instructions.

6. Sharing

DKAM does not sell personal data. Personal and detailed capability data are shared only when you grant consent, scoped to a purpose and a time window, and where possible as proofs rather than raw documents. Organisations that verify or issue records can see what they themselves have contributed and the items you have shared with them.

7. Your rights

You can access, correct, export and delete your personal data. Integrity records such as credential-anchor hashes and audit-log entries are kept in a minimised, tamper-evident form so that historical trust decisions can still be validated. See Data Correction & Disputes and Deletion & Consent Withdrawal.

8. Retention

Personal data is retained while your account is active and for a limited period afterwards to satisfy legal, security and audit obligations. Credential anchors, integrity records and access logs may be retained in a minimised form for tamper-evidence even after the underlying record is removed on the holder side.

9. Security

See the Security page for the current security posture and roadmap.

10. Contact

For any privacy enquiry, use the Contact page and select Privacy / Data Request.