Privacy Policy according to Art 13, 14 GDPR – Fulfilment of Information Obligations
Last updated: September 2026
Thank you for visiting our website. Protecting your data is our top priority. This privacy policy explains in detail how we process your data.
This policy applies both to data processing within Coinfinity and to your use of our website. The legal basis for this data processing is the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
All references to persons apply equally to all genders. Any use of the masculine form is for readability purposes only.
1. General Data Processing
1.1. Controller
The controller within the meaning of Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is:
Coinfinity GmbH(hereinafter “Coinfinity”, “we”, “us”)
Griesgasse 10
8020 Graz, Austria
Phone: +43 316 711 744
Email:
datenschutz@coinfinity.co1.2. Data Subjects
Below we explain which groups of data subjects may be affected by data processing in connection with our business activities. The specific categories of data processed for each group are set out in Section 1.3.
● Website and app visitors: anyone who accesses our website or app, regardless of whether they hold a customer account.● Prospective customers: people who do not yet have a customer account with us but seek information about our services or contact us.● Natural persons (retail customers): people who buy, sell, or hold crypto-assets through a customer account with us.● Legal entities (business customers): companies and other legal entities that buy, sell, or hold crypto-assets through a business account with us, as well as their contact persons, authorised representatives, and beneficial owners.● Business partners and suppliers: companies with which we cooperate in the course of our own business operations, as well as their contact persons.● Newsletter subscribers: people who have subscribed to our newsletter, whether or not they are customers.● Support and general enquiries: people who contact us by email, phone, contact form, support chat, or social media, whether or not they are customers.● Job applicants: people who apply for a position with us.● Minors: people under the age of 18. As a rule, we do not process data relating to minors, since we do not enter into business relationships with minors.● Authors/creators: people whose works we use with their consent and, upon request, credit by name.1.3. Categories of Data
We process personal data that we obtain from you in connection with our business relationship and your use of our website and app, as well as, where applicable, data obtained from publicly available sources, credit reference agencies, screening service providers, and public authorities. The data we process falls broadly into the following categories:
● Contact data: e.g. title, first and last name, address, phone number, email address, date of birth. We collect this data in particular during registration, when subscribing to our newsletter, when you contact us, and in connection with business relationships with business partners and suppliers.● Verification data: e.g. identity document data and copies, recordings and biometric data from the video identification process, status as a politically exposed person, information for the purpose of verifying your place of residence. You provide this data to us in the course of registration and KYC verification pursuant to Section 6 of the Austrian Financial Markets Anti-Money Laundering Act (FM-GwG).● Financial and transaction data: e.g. bank details (IBAN, BIC), tax identification number, payment data.● Information and evidence relating to the source of funds: e.g. bank statements, purchase contracts, salary statements, tax assessments, or other suitable evidence, where such evidence is required.● Tax-related data: e.g. information on tax residency and self-certifications provided under the Austrian Crypto-Asset Reporting Act (see Section 6 of this privacy policy).● Log and usage data: e.g. IP address, date and time of access, device and browser information, operating system. Your browser or device transmits this data automatically each time you access our website or app.● Support and communication data: e.g. the content and history of your enquiries via contact form, support chat, ticketing system, or phone.● Marketing and interaction data: e.g. your usage behaviour on our website and in our app, data from cookies and similar technologies, interactions with newsletters and advertisements.● Photo, video, and audio data: e.g. in connection with events, interviews, or our community and media content.● Application data: e.g. contact details, CV, references, and other application documents.● Corporate and business partner data: e.g. company data, contact details of contact persons, contract data, bank details, as well as information on beneficial owners and authorised representatives. We may also process information from publicly accessible registers (e.g. the companies register, register of associations, land register) and media reports.Which of these categories of data are processed in a given case depends on the capacity in which you interact with us and the purpose of the processing. The relevant details are set out in the corresponding sections of this privacy policy.
1.4. Legal Bases
All data processing at Coinfinity is carried out in compliance with the GDPR and the Austrian Data Protection Act (DSG). We always process your personal data on the basis of at least one of the legal grounds set out below. When we ask you to provide additional personal data not listed here, we will inform you separately, at the time of collection, of the purpose and legal basis of that processing.
1.4.1. Performance of a Contract (Art. 6 (1) (b) GDPR)
Processing personal data may be necessary for the performance of a contract, or steps preliminary to entering into one, with you. The following processing activities are, for example, covered by such a contractual obligation:
● Providing our services, in particular all tasks required for the operation, provision, and administration of coinfinity.co, portal.coinfinity.co and the "Coinfinity – Bitcoin kaufen" app● Registering a customer account and maintaining it on an ongoing basis (e.g. updating your customer data)● Carrying out KYC verification as part of entering into the contract● Executing customer orders● Handling customer service and support enquiries in connection with a contract● Establishing and managing business relationships with business partners and suppliers● Running our recruitment process1.4.2. Compliance with a Legal Obligation (Art. 6 (1) (c) GDPR)
Processing personal data may also be necessary to comply with various statutory obligations to which we, as a registered crypto-asset service provider (CASP), are subject (e.g. under the FM-GwG, MiCAR, WiEReG, the Austrian Crypto-Asset Reporting Act, and DORA). The following processing activities are, for example, covered by such legal obligations:
● Customer due diligence (KYC), including screening against PEP and sanctions lists and verifying the source of funds, pursuant to Section 6 FM-GwG● Identifying and documenting beneficial owners under the WiEReG (Beneficial Owners Register Act)● Collecting self-certifications and reporting to the tax authorities under the Crypto-Asset Reporting Act (DAC8, see Section 6 of this privacy policy)● Record-keeping, retention, and documentation obligations under MiCAR, the Austrian Federal Fiscal Code (BAO), and the Austrian Commercial Code (UGB)● Operating our complaints-handling procedure pursuant to Art. 71 MiCAR● Providing information to authorities in connection with tax criminal proceedings or other law enforcement matters1.4.3. Legitimate Interests (Art. 6 (1) (f) GDPR)
Where necessary, data may be processed beyond the performance of a contract in order to safeguard our legitimate interests or those of a third party. The following processing activities are, for example, covered by such a legitimate interest:
● Ensuring the security and functionality of our website and app (e.g. log files, IT security)● Preventing fraud, abuse, money laundering, and terrorist financing● Risk management, e.g. through checks against credit reference agencies or publicly accessible registers● Handling general customer enquiries and account administration● Asserting, exercising, or defending legal claims, including in court proceedings● Market research and further development of our services and products1.4.4. Based on Consent (Art. 6 (1) (a) GDPR)
Where you have given us your consent to process personal data, we will only process that data for the purposes set out in the consent declaration and to the extent agreed therein. You may withdraw consent at any time, without giving reasons and with effect for the future. For example, we process data based on your consent for the following purposes:
● Sending our newsletter● Using cookies and similar technologies for statistical, tracking, or advertising purposes● Using social media features and related advertising● Voluntary information provided as part of a job application or for further contact1.4.5. Special Categories of Personal Data (Art. 9 GDPR)
As part of our online identification process, we engage providers that perform an automated biometric comparison between a selfie video and your identity document. In doing so, we process special categories of personal data within the meaning of Art. 9 (1) GDPR.
This processing is necessary to fulfil our statutory identification obligation under Section 6 (4) FM-GwG. The legal basis is therefore Art. 6 (1) (c) GDPR in conjunction with Art. 9 (2) (g) GDPR (substantial public interest in preventing money laundering and terrorist financing pursuant to Section 21 (4) FM-GwG).
1.5. Disclosure of Data
We disclose your personal data to third parties only to the extent necessary to fulfil the purposes described in this privacy policy. Disclosure occurs, in particular, in the following cases.
● Disclosure to processors: We work with processors to whom personal data is disclosed in order to provide services efficiently. These include companies that carry out tasks such as verification, contract performance, payment processing, account management, newsletter distribution, and IT services.● Disclosure to credit institutions: In connection with processing payment transactions, we disclose data to the account-holding credit institution through which the transaction is processed. This involves KYC data on the customer, which the credit institution requires to fulfil its own statutory due diligence obligations. The relevant credit institution acts as an independent controller within the meaning of the GDPR.● Other disclosures: In certain cases, in particular to comply with legal obligations, personal data may be disclosed to authorities, in particular the competent supervisory authorities, tax and revenue authorities, as well as to courts, law enforcement authorities, and lawyers engaged by us in connection with legal disputes or to assert, exercise, or defend legal claims. Personal data may also be disclosed to auditors and tax advisors engaged by us in connection with the statutory audit of our annual financial statements and tax advisory services.1.6. Retention, Deletion, and Anonymisation of Data
Contractual retention obligations: Once a contractual relationship ends, or contractually agreed periods expire, personal data will be deleted or anonymised, provided no statutory retention obligations require otherwise.
Withdrawal of consent: If consent to the processing of personal data is withdrawn, the data will be deleted or anonymised, unless another legal basis applies to the processing.
Statutory retention obligations: The controller is subject to a wide range of statutory retention obligations. Personal data is deleted once these statutory retention periods have expired. It may occur that personal data must be retained for legal reasons despite the withdrawal of consent or the expiry of contractually agreed periods, and will only be deleted at a later point in time (once the relevant statutory periods have expired). The following EU regulations and Austrian laws (without claim to absolute completeness) apply to the controller in this respect:
● Austrian Financial Markets Anti-Money Laundering Act (FM-GwG)● Beneficial Owners Register Act (WiEReG)● Austrian Federal Fiscal Code (BAO)● Austrian Commercial Code (UGB)● Austrian Trade Act (GewO)● Austrian General Civil Code (ABGB)● Austrian Value Added Tax Act (UStG)● Austrian Whistleblower Protection Act (HSchG)● Digital Operational Resilience Act (DORA)● Austrian Data Protection Act (DSG)● General Data Protection Regulation (GDPR)● Austrian Crypto-Asset Reporting Act (Krypto-MPfG)● Markets in Crypto-Assets Regulation (MiCAR)2. Contacting Us
General: When you contact us by email, phone, via the contact form on our website, via our support chat, or via our social media channels, we process the data you provide to us in doing so, in particular your name, email address, phone number, customer number where applicable, and the content of your enquiry, in order to process and respond to it.
When you use our support tool, additional technical connection data is processed, such as IP address, date and time of access, and browser information.
If your enquiry constitutes a complaint within the meaning of our complaints-handling procedure under Art. 71 MiCAR, the principles described there apply in addition, and additional data may be collected as set out in the relevant form.
We delete the data collected in connection with contacting us once your enquiry has been fully processed and no statutory retention obligations apply (see Section 1.6).
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest). Where your enquiry relates to entering into a contract, for example questions about opening a customer account, we additionally rely on Art. 6 (1) (b) GDPR. Where the enquiry is a complaint handled under our statutory complaints-handling procedure, we rely on Art. 6 (1) (c) GDPR in conjunction with Art. 71 MiCAR.
3. Application Management
General: If you send us your application documents, we process the personal data contained therein for the purpose of personnel selection and filling the vacant position.
Legal basis: Art. 6 (1) (b) GDPR (steps preliminary to entering into, and performance of, a contract)
Retention for future opportunities: If we wish to keep you on file for potential future contact, we will approach you separately to request your consent. If you give us this consent explicitly, we will store your application documents. If no further opportunity to fill a position arises within one year of receiving your consent, we will delete your application documents in full.
Legal basis: Art. 6 (1) (a) GDPR (consent)
Job platforms: We use various online job platforms to recruit staff for our company. Anyone interested in working for us can apply directly via a form provided by the operator of the job platform. Applicants decide for themselves which data they provide when using such an online platform. Personal data entered and documents uploaded are forwarded to us by the operator of the job platform. Both the job platform and we ourselves process this data as controllers within the meaning of the GDPR. Please refer to the privacy policies of the respective job platform operators.
Legal basis: Art. 6 (1) (b) GDPR (steps preliminary to entering into, and performance of, a contract)
4. Social Media
When you visit our social media presence, personal data, including your IP address, is processed by the
respective provider, and cookies are used to collect data. You can find out exactly what information is transmitted in the privacy policy of the respective service. There you will also find information on how to
contact the provider and how to limit the processing of this data.
We would also like to point out that you use these services and their features at your own responsibility. This applies in particular to the use of interactive features (for example, sharing, commenting, or rating content).
The providers of these social media services have provided us with corresponding agreements, in most cases agreements on joint controllership of the data processing. Our use of social media platforms is based on our legitimate business interest.
Where we are required to fulfil data subject rights (see Section 10), you may contact either us or the provider of the relevant social media platform.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
4.1. Data Processing in Connection with Meta Services
We use services provided by Meta Platforms Ireland Ltd. ("Meta"), a company incorporated and operating under Irish law with its registered office at Merrion Road, Dublin 4, Ireland.
For further information, please refer to Meta's privacy policy at:
https://www.facebook.com/privacy/policy/?entry_point=facebook_page_footer4.2. Data Processing in Connection with X Services
Our website includes features of the X service (Twitter International Unlimited Company); we also operate an X channel. These features are provided by Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.
By using X and its button features, the pages you visit are linked to your X account and made visible to other users. Data is also transmitted to X in this process. We would like to point out that, as the provider of this website, we have no knowledge of the content of the data transmitted or how it is used by X. For further information, please refer to X's privacy policy at:
https://X.com/privacy?lang=en. You can change your privacy settings on X in your account settings at:
https://X.com/settings/account.
Legal basis: Art. 6 (1) (a) GDPR (consent)
5. Data Processing when using the Application
You can use our "Coinfinity – Bitcoin kaufen" app to register a customer account, carry out KYC verification, create a wallet, and buy and sell crypto-assets.
Every time you access the app, data that your device transmits to our server is temporarily stored. We use Google’s Firebase Performance Monitoring to monitor the performance and reliability of our app and to identify technical issues. In particular, this involves processing information regarding app launch times, screen display, network requests, device and operating system information, as well as pseudonymous installation identifiers and IP addresses. IP-related performance events are stored for 30 days. Installation-related and de-identified performance data is retained for 60 days.
To detect crashes and technical errors in our app, we use the Firebase Crashlytics service. In particular, this may involve processing information regarding the device and operating system, the app version, the time and technical sequence of a crash, as well as pseudonymous installation identifiers. The crash data and associated identifiers stored by Crashlytics are retained for 90 days.
For the data processing carried out in connection with registration, KYC verification, and the purchase and sale of crypto-assets, please refer to Sections 1.3 and 1.4 of this privacy policy.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
6. Data Processing under the Crypto-Asset Reporting Act (DAC8)
6.1. Collection of Data and Verification
As a reporting crypto-asset service provider within the meaning of the Austrian Crypto-Asset Reporting Act (Krypto-Meldepflichtgesetz; Krypto-MPfG), we are required to obtain a self-certification of tax residency from all crypto-asset users.
For
natural persons (retail customers), we collect, as part of a self-certification pursuant to Section 36 Krypto-MPfG, your first and last name, address, the state or states in which you are tax resident, your respective tax identification number (TIN), and your date of birth. This self-certification is a mandatory precondition for opening a customer account; without a valid and plausible self-certification, no business relationship will be established.
For
legal entities (business customers), we collect the corresponding information about the entity pursuant to Section 37 Krypto-MPfG (registered name, address, tax residency, TIN).
Legal basis: Art. 6 (1) (c) GDPR (legal obligation)
6.2. Changes to relevant Data
If your information regarding tax residency, or other circumstances relevant to the self-certification, changes, you are required to notify us.
Legal basis: Art. 6 (1) (c) GDPR (legal obligation)
6.3. Disclosure and Retention of Data
We disclose the data collected, together with the relevant transaction information, to the competent tax office once a year. The tax office, in turn, forwards this data annually to the competent authorities of all participating jurisdictions as part of the automatic exchange of information (Section 21 Krypto-MPfG); this includes both EU Member States and certain third countries with which a corresponding mutual assistance agreement is in place.
We retain the information processed in connection with this reporting obligation for ten years following the end of the relevant reporting period, after which it is deleted (Section 20 (4) and Section 39 Krypto-MPfG).
7. Data Processing when using our Website
7.1. Informational use of the Website
When our website is used purely for informational purposes, we only collect the personal data that your browser transmits to our server (server log files). When you access our website, we collect the data that is technically necessary to display the website to you and to ensure its stability and security:
● IP address● Date and time of the request● Time zone difference relative to Coordinated Universal Time (UTC)● Content of the request (specific page)● Access status/HTTP status code● Referring website● Browser● Operating system and its interface● Language and version of the browser softwareThis data is not combined with other personal data sources. We reserve the right to review this data retrospectively if we become aware of concrete evidence of unlawful use, and to pass the data on to law enforcement authorities in the event of a cyberattack. Beyond this, the data is not disclosed to third parties.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
7.2. Cookies
Cookies are stored on your device when you visit our website. Cookies are small text files that are assigned to the browser you use and stored on your hard drive. They allow us, or third-party providers, to collect certain information. Cookies cannot execute programs or transmit viruses to your computer.
The information contained in cookies is used, for example, to determine whether you are logged in, what data you have already entered, or to recognise you as a returning user when a connection is established between our web server and your browser.
We distinguish between technical cookies, which serve solely to ensure that a website functions properly, and cookies requiring consent, which are set by us or third-party providers for the purposes of statistical analysis, tracking, or advertising/marketing.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest; for technical cookies), Art. 6 (1) (a) GDPR (consent; for all other cookies).
7.3. Data Transfer
We cannot rule out that, when you visit our website, personal data may be transferred to an unsafe third country (i.e. a country outside the EEA that does not offer an adequate level of data protection). Where this is the case, we indicate this directly in the description of the relevant external service in this privacy policy.
The GDPR requires appropriate safeguards under Art. 46 GDPR be in place for any transfer of data to an unsafe third country or to an international organisation.
Where personal data is processed in a third country, or by a recipient in the United States that has not committed to the EU-US Data Privacy Framework, the following risks cannot currently be ruled out for you as a data subject:
● Your personal data could potentially be passed on by the relevant service provider to other third parties beyond the original purpose of performing the contract.● You may not always be able to effectively assert or enforce your right to information against the relevant service provider.● There may be a higher likelihood of incorrect data processing occurring, as the technical and organisational measures used to protect personal data may not, in every respect, meet the quantitative and qualitative standards required under the GDPR.By giving your consent via the consent banner to the use of external services and the setting of the relevant cookies, you expressly consent to the possible transfer of your personal data to unsafe third countries.
Legal basis: Art. 6 (1) (a) GDPR (consent)
7.4. Registration and Login on the Website
You have the option to register a customer account on our website via
portal.coinfinity.co, or to log in. To do so, we require login credentials consisting of your email address and a password of your choice.
The following information is mandatory when registering: first name and last name, email address, and a password of your choice. You may optionally provide an individual referral code. You can edit your submitted information in your account settings at any time. We generate a customer number, which is also linked to your customer account. You can log into our website with your login credentials at any time.
Legal basis: Art. 6 (1) (b) GDPR (steps preliminary to entering into, and performance of, a contract)
7.5. Newsletter Subscription
You can subscribe to our newsletter by providing us with your email address. You can unsubscribe at any time. To do so, use the unsubscribe link included in every newsletter, or send an email to
support@coinfinity.co.
To ensure that the subscription genuinely comes from you, we use what is known as a double opt-in process. After you subscribe, you will receive a confirmation email containing a link. Only once you click this confirmation link is your subscription activated and your address added to the mailing list. This ensures that no one can use your email address without your knowledge, and that your consent to receive the newsletter has been given explicitly.
Once you unsubscribe, we will no longer use your data to send the newsletter.
If we have no business relationship with you and are not subject to any statutory retention obligations, your data will be deleted once you unsubscribe from the newsletter.
For sending our newsletter, we use the self-hosted software Sendy, which operates via the email delivery service Amazon SES (Amazon Web Services). Sendy itself is software licensed by us and operated on our own infrastructure; there is no ongoing data processing carried out by the software manufacturer. The technical delivery of emails, and the related processing of your email address, is carried out via Amazon Web Services; please see the section on Amazon Web Services in this privacy policy for further details.
Legal basis: Art. 6 (1) (a) GDPR (consent)
8. Data Processing in Connection with Google Services
We use services provided by Google Ireland Limited ("Google"), a company incorporated and operating under Irish law with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland.
For further information, please refer to Google's privacy policy at:
https://policies.google.com/privacy?hl=en.
The integration of Google services causes further Google services to load on our website, such as Google APIs, Google reCAPTCHA, Google Tag Manager, Google Static, and Google Fonts.
8.1. Google Analytics
We use Google Analytics on our website, a tool that allows us to analyse how our website is used. Google Analytics allows us to see how many people visit our website and how long they stay. In any case, the service is loaded only after you have successfully logged in to the app or the website.
In doing so, Google Analytics processes, among other things, your IP address in order to analyse your use of the website, generate reports on website activity, and provide further services relating to the use of the website. Your IP address is not combined with other Google data in this process. Google may disclose this information to third parties where required by law, or where third parties process this data on Google's behalf.
The use of this service results in personal data being transferred to the United States, or such a transfer cannot be ruled out. Google has certified itself under the European Commission's adequacy decision on the EU-US Data Privacy Framework for the transfer of personal data to the United States, meaning that such a transfer is permissible under Art. 45 GDPR.
You can prevent cookies from being stored on your computer by adjusting the relevant settings in your browser. Please note, however, that in this case you may not be able to make full use of all functions of our website.
Further information on the terms of use and data protection can be found at:
https://marketingplatform.google.com/about/analytics/terms/us/ or under
https://policies.google.com/privacy?hl=en8.2. Google APIs
We use Google APIs on our website to load further Google services and ensure the full functionality of our website. Google APIs are a set of interfaces that facilitate communication between the Google services implemented on our website. In doing so, Google may collect personal data, such as your IP address.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
8.3. Google Fonts
We use Google Fonts on our website. To ensure a consistent and visually appealing display of fonts and icons, your browser loads the required fonts into your browser cache. This requires your browser to establish contact with Google Fonts' servers, which means that Google Fonts becomes aware that our website was accessed using your IP address.
You can find out which data Google collects, and how it is used, at:
https://policies.google.com/privacy?hl=enLegal basis: Art. 6 (1) (a) GDPR (consent)
8.4. Google Gstatic
Gstatic is a domain used by Google to load static content under a separate domain name, in order to reduce bandwidth usage and improve network performance for the end user.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
8.5. Google reCAPTCHA
We use the Google reCAPTCHA service to determine whether a specific input in our contact or newsletter form was made by a human or a computer. Google assesses whether you are human or a computer based on the following data: the IP address of the device used, the website you are visiting on which the CAPTCHA is embedded, the date and duration of your visit, recognition data relating to the type of browser and operating system used, your Google account, if you are logged into Google, mouse movements within the reCAPTCHA fields, and tasks in which you are asked to identify images.
Further information is available at:
https://cloud.google.com/security/products/recaptcha.
Legal basis: Art. 6 (1) (a) GDPR (consent)
8.6. Google Tag Manager
We use Google Tag Manager on our website, which allows us to implement and manage website tags, such as tracking codes or conversion pixels. Google Tag Manager collects data on the website and forwards it to connected analytics tools, which store and evaluate that data. Google Tag Manager itself collects certain data (e.g. IP address) but does not store it and has no access to it. It merely functions as an interface between the website and the analytics software.
Further information is available at:
https://marketingplatform.google.com/intl/en_uk/about/tag-manager/ Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
8.7. YouTube
We operate a YouTube channel and have embedded YouTube videos on our website, hosted at
http://www.YouTube.com. The operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, California 94066, USA. YouTube, LLC is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube videos in enhanced privacy mode. With this setting, YouTube does not store cookies when you visit our website. A connection to YouTube's servers is only established once you start playing an embedded video. YouTube then uses cookies to collect data and carry out statistical analysis. In doing so, YouTube is informed which pages you visit. If you are logged into YouTube, your data is directly linked to your account. YouTube uses your data for advertising and market research purposes.
The use of this service results in personal data being transferred to the United States, or such a transfer cannot be ruled out. Google has certified itself under the adequacy decision for the transfer of personal data to the United States. The European Commission has concluded that personal data transferred from the EU to a company in the United States certified under the EU-US Data Privacy Framework benefits from an adequate level of protection, meaning that such a data transfer is permissible under Art. 45 GDPR.
The integration of YouTube causes further Google services to load on our website, in particular Google Doubleclick, Google APIs, Google Video, Google Photos, Google Static, and Google Fonts.
For further information on data protection at YouTube, please refer to the provider's privacy policy at:
https://policies.google.com/privacy?hl=enLegal basis: Art. 6 (1) (a) GDPR (consent)
9. Other External Services
9.1. Amazon CloudFront CDN (AWS)
Amazon CloudFront is a content delivery network (CDN) operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg.
This CDN service allows website content, such as videos or other large media files, to be delivered quickly and reliably. To achieve this, proxy servers temporarily cache files locally, improving download speeds. Using the Amazon CloudFront CDN helps us optimize the loading speed of our website.
In doing so, the CDN service processes the IP address of the website visitor. The IP address is automatically deleted again from CloudFront's logs.
Further information can be found in Amazon Web Services' privacy policy at:
https://aws.amazon.com/privacy/Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
9.2. Amazon Web Services (AWS)
Our website uses a cloud hosting solution provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg. AWS provides the infrastructure and resources required to operate and provide the website. As AWS acts as a cloud provider, data is stored and processed on AWS servers.
When using AWS, certain data, such as IP addresses and access times, may be logged in order to ensure the security and operation of the website.
Further information can be found in Amazon Web Services' privacy policy at:
https://aws.amazon.com/privacy/.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
9.3. Cloudflare (CDN)
Our website uses a content delivery network (CDN) provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA.
This CDN service allows website content, such as videos or other large media files, to be delivered quickly and reliably. To achieve this, proxy servers temporarily cache files locally, improving download speeds. Using the Cloudflare CDN helps us optimize the loading speed of our website.
In doing so, the CDN service processes the IP address of the website visitor. The IP address is automatically deleted again from Cloudflare's logs.
Further information can be found in Cloudflare's privacy policy at:
https://www.cloudflare.com/security-policy/.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
9.4. JsDelivr CDN
We use the jsDelivr CDN on our website to ensure fast loading times. This is an open-source service provided by the Polish software company ProspectOne, Królewska 65A/1, 30-081 Kraków, Poland.
This CDN service allows website content, such as videos or other large media files, to be delivered quickly and reliably. To achieve this, proxy servers temporarily cache files locally, improving download speeds. Using the jsDelivr CDN helps us optimize the loading speed of our website.
In doing so, the CDN service processes the IP address of the website visitor. The IP address is automatically deleted again from jsDelivr's logs.
Further information can be found in jsDelivr's privacy policy (available in English) at:
https://www.jsdelivr.com/terms.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
9.5. Webflow
Our website uses the services of Webflow, a platform for building and managing websites, operated by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, California 94103, USA. Webflow provides a visual design and hosting tool that allows us to build and operate our website professionally.
The personal data collected on this website is stored on our hosting provider's servers. This primarily includes IP addresses, metadata, communication data, website access data, and other data generated through use of the website.
Our hosting provider will only process your data to the extent necessary to fulfil its contractual obligations, and will follow our instructions with respect to this data.
Information on Webflow's privacy policy can be found (in English) at:
https://www.webflow.com/privacy.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
10. Your Rights
You have the following rights with respect to your personal data:
● Right to access, rectification, and erasure● Right to restriction of processing● Right to object to processing● Right to data portability● Right to lodge a complaint with the Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna, Austria, Phone: +43 1 52 152-0
Email: dsb@dsb.gv.atIf you believe that we have violated Austrian or European data protection law in processing your data, and that this has infringed your rights, we ask that you contact us so that we can clarify any questions that may arise.
Please direct any such requests or concerns by email to
support@coinfinity.co, or contact us using the contact details provided above.
11. Changes to this Privacy Policy
We reserve the right to make changes to this privacy policy from time to time. Any changes to this privacy policy will be published by us on this page. Please refer to the version of this privacy policy currently in effect.
