Privacy policy

Coinfinity GmbH's privacy policy

Version as of 02 June 2022
‍
Information about the collection of personal data
‍
Your data is processed exclusively on the basis of the EU GDPR, the DSG and the TKG. In the following, we provide information about the collection of your personal data. Personal data is any data that relates to you personally, e.g.: name, personal e-mail addresses, IP addresses, telephone numbers, etc.
The person responsible in accordance with Article 4 (7) of the EU General Data Protection Regulation (GDPR) is
Coinfinity GmbH,
Managing Partner: Max Tertinegg
Address: Griesgasse 10, 8020 Graz, Austria
Phone: +43 316 711 744
Email: office@coinfinity.co

The following applies to interested parties, business partners, customers and suppliers:
- We store the data from you that is necessary for mutual contract fulfilment. These include the following categories of data: customer or supplier master data, contact details of your employees, contract data or the data that you send us, for example, by e-mail. We do not process any sensitive data. We delete the data as soon as storage is no longer necessary or legal storage obligations have expired.
- Except in cases prescribed by law, data will only be passed on to third parties with your respective consent or to contractually bound processors.
- Legal bases: Art. 6 para. 1 lit b, c, f; when obtaining consent, art 6 para. 1 lit a GDPR

This privacy policy applies exclusively to the coinfinity.co website maintained by Coinfinity. If you are redirected to other websites via links on our website, please find out how your data will be handled directly on the target page. We cannot assume any responsibility or liability for content on third-party websites that are linked via our website.
‍‍

Collection of personal data when using our services

Using the website

Each time you access content on our website, data is temporarily stored which your browser transmits to our server and may allow identification. The following data is collected here:
- date and time of access
- IP address
- host name of the accessing computer
- Website from which the website was accessed
- Websites that are accessed via the website
- Page visited on our website
- Message as to whether the retrieval was successful
- Amount of data transferred
- Information about the browser type and version used
- operating system
The temporary storage of data is necessary for the completion of a website visit to enable the website to be delivered. Further storage in log files is carried out to ensure the functionality of the website and the security of the information technology systems. These purposes also include our legitimate interest in data processing (Article 6 (1) (f) GDPR).

Buying or selling via coinfinity.co

Before buying or selling cryptocurrencies via coinfinity.co, you must register on the website and then (in accordance with §6 FM-GWG) positively complete a “Know your customer” verification process (hereinafter “KYC”).

This verification may be carried out by an external service provider who carries out this process. As part of this registration or KYC verification and the subsequent ordering of cryptocurrencies (purchase or sale), the following personal data is collected: first name, last name, address details, date of birth, bank details, e-mail address, telephone number and identity details (presentation of a copy of an ID to carry out a KYC check).

We need this personal data to fulfill the contract and to meet legal requirements (Article 6 (1) (b) GDPR, Article 6 (1) (c) GDPR) and for the purpose of tracing visitors, verifying the effectiveness of advertising measures, displaying targeted advertising elements and messages, and for purposes of security and improving the quality of our offering based on our legitimate interest (Article 6 (1) (f) GDPR). Contact is made exclusively via e-mail addresses provided by the customer himself. You can unsubscribe from targeted advertising messages via the “unsubscribe” button at the bottom of every customer information we send.

We delete the data arising in this context after storage is no longer necessary or legal storage obligations or deadlines under the Financial Market Money Laundering Act have expired.
‍
newsletters

On our website, you also have the option to sign up for our newsletter. The newsletter is sent exclusively to e-mail addresses provided by interested parties themselves (Article 6 (1) (a) GDPR). In the event that you no longer wish to receive the newsletter, you can unsubscribe at any time by clicking on the “Unsubscribe” button at the end of every newsletter we send. The data collected for sending the newsletter — unless otherwise provided by law and the data is not processed on the basis of a separate legal basis — will be deleted after any unsubscription.‍

Support

For our online support and email delivery, we use Intercom, a tool from Intercom R&D Unlimited Company, Stephen Court, 18-21 Saint Stephens Green, Dublin 2, Ireland. Technical connection data (IP address, date/time of access, pages retrieved, browser information) as well as information about your inquiries and contact details (name, e-mail address) are processed. Although the use of Intercom does not require consent, the processing of your data is based on your consent in accordance with Article 6 (1) (a) GDPR or another applicable legal basis under GDPR. Your data is transferred to Intercom R&D Unlimited Company in Ireland. Nevertheless, it may happen that data is transferred from Europe to the USA, but we as a company have no influence on this. Details can be found here: Intercom & GDPR

When you contact us, the data you provide (e.g. email address, name, telephone number) will be stored by us in order to answer your request (Article 6 (1) (b) GDPR). We delete the data generated in this context after storage is no longer necessary and is not subject to any legal storage obligations.

Business partners and suppliers

As part of a business relationship with customers and suppliers, the provider processes personal data for the following purposes:
- Communication with business partners about products, services and projects, e.g. processing inquiries from a customer or supplier
- Planning, execution and administration of the business relationship between the provider and the business partner: processing orders, collection of payments, for accounting and billing, invoicing, deliveries
- Order processing, e.g. as part of the KYC process
- Compliance with legal requirements, e.g. tax storage obligations
- settlement of legal disputes, defense of legal claims, enforcement of existing contracts,

The following categories of personal data may be processed for the above purposes:
- Contact details such as name, title, address, telephone number, email address, delivery, and billing addressees
- Information that is necessary to process as part of a project or the execution of a contractual business relationship with the provider, or that is provided voluntarily by contact persons
- Information from publicly available sources

The data you provide is necessary to achieve the above purposes and to fulfill the contract or to carry out pre-contractual measures (Article 6 (1) (b) GDPR). Without this data, the individual purposes described may not be achieved or we may not be able to conclude the contract with you.

minors

It is pointed out that all processing of personal data may only be used by persons who have reached the age of 14. The use of our systems and tools and the resulting processing of data from users below this age limit is prohibited without the consent of parents/legal guardians. Should such data processing nevertheless occur, we will stop processing this data as soon as we become aware of it.

In principle, no business relationships are entered into with minors.

Payment service provider

If you choose a payment service provider as part of the ordering process, you agree that we collect the personal data necessary to process the purchase and an identity and credit check and transfer it to the payment service provider you have chosen.

We currently use the following payment service providers:
SOFORT, Klarna GmbH, Theresienhöhe 12, 80339 Munich, Germany. Contact: https://www.sofort.de/sofort-kontakt.html, privacy policy: https://www.sofort.de/datenschutz.html‍

Data transfer
‍
For the purposes explained in this privacy policy, we will transfer your (personal) data to third parties if necessary.

Our contract processor to assist with customer verification on coinfinity.co is Onfido Limited, with an address at 3 Finsbury Avenue, London EC2, 2PA, United Kingdom. Onfido Limited's privacy policy can be found at https://onfido.com/privacy/.

Our contract processors for the fulfilment of §6 FM-GWG are DataVendor GmbH with the address Heinrich-Kneissl-Gasse 18, 1140 Vienna and IVXS UK Limited with the address 86-90 Paul Street, London EC2A 4NE, United Kingdom. IVXS UK Ltd.'s privacy policy can be viewed at https://complyadvantage.com/privacy-notice/.

To send our newsletter, we use the HubSpot newsletter service, which is operated by HubSpot Germany GmbH. HubSpot's privacy policy can be viewed here: https://legal.hubspot.com/de/privacy-policy.

In addition, personal data may be exchanged with our subsidiary Kurant GmbH in order to ensure the proper and efficient purchase and sale of cryptocurrencies through mutual support measures. Both Coinfinity and Kurant use the data only within the scope of their respective operational or contractual purpose and only to the extent that is essential to achieve this purpose.

Within our organization, those bodies or employees who need it to fulfill contractual or legal obligations and as a result of data processing based on our legitimate interests will receive your data.

Cookies

Cookies are small files that make it possible to store specific, device-related information on the user's access device (PC, smartphone, etc.). On the one hand, they make websites easier to use and therefore for users (e.g. storage of login data). We store information that is necessary for the operation of the website in cookies. However, these are not filled with personal data that could be read by third parties. Users can influence the use of cookies. You can set up your browser so that it informs you when cookies are set and only allow you to do so in individual cases. By refusing cookies in the browser or deleting them regularly, you can also prevent conclusions from being drawn about your behavior. When cookies are deactivated, the functionality of our website may be limited.‍

‍‍Use of plug-ins

Google services

We have signed a contract with Google Ireland Limited (“Google”), a company registered and operated under Irish law (registration number: 368047) based at Gordon House, Barrow Street, Dublin 4, Ireland. Nevertheless, it may happen that data is transferred from Europe to the USA, but we as a company have no influence on this.

For the USA, there is currently no adequacy decision by the EU Commission within the meaning of Article 45 (1), (3) of the General Data Protection Regulation (GDPR). This means that the EU Commission has not yet positively determined that the country-specific level of data protection in this country corresponds to that of the European Union under the GDPR (Article 46 appropriate guarantees).

The GDPR requires so-called appropriate guarantees for data transfer to a third country or to an international organization, Art. 46 (2), 3 GDPR. These are not available for the abovementioned country of destination.

Possible risks that cannot currently be ruled out for you as the person concerned in connection with the above information include:
- Your personal data could possibly be passed on by Google USA to other third parties (e.g. US authorities) beyond the actual purpose of order fulfillment.
- You may not be able to sustainably assert or enforce your information rights against Google USA.
- There may be a higher probability that incorrect data processing may occur, as the technical organizational measures to protect personal data do not fully meet the requirements of the GDPR in terms of quantity and quality.

With your consent to the processing of (advertising and marketing) cookies, you explicitly consent to the transfer of data to the USA. You can revoke this consent informally by e-mail at any time. Data processing that took place before you withdrew your consent is not affected by the withdrawal and is therefore legally compliant.

Legal basis: Article 6 (1) (a) GDPR
‍

‍‍Google Analytics

This website uses Google Analytics, a web analysis service. Google Analytics uses so-called “cookies”, text files that are stored on your computer and which enable an analysis of your use of the website. The information generated by the cookie about your use of the website, such as:
- browser type/version,
- operating system used,
- referrer URL (the previously visited page),
- host name of the accessing computer (IP address),
- time of the server request,

are usually transferred to a Google server and stored.

The IP address transmitted by your browser as part of Google Analytics is collected to ensure the security of the service and to provide us with information about which country, region or city our users come from. This is also known as IP location determination. In Google Analytics, collected IP addresses are anonymized using so-called IP masks.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and Internet usage to the website operator. You can prevent cookies from being saved by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.

If Google Analytics has been implemented in apps or websites together with other Google advertising products, such as Google Ads, additional advertising IDs may be collected. Users can disable this feature in Google's advertising settings and change their settings for this cookie.

This website uses the “Activate IP anonymization” function (i.e. that Google Analytics includes the code “gat. _anonymizeIp ();” was extended to ensure anonymized collection of IP addresses (so-called IP masking). As a result, your IP address will be abbreviated beforehand by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and abbreviated there.

According to Google, Google will use the information obtained to evaluate your use of the website, to compile reports on website activity and to provide us with other services related to website activity and Internet usage. The IP address transmitted by your browser as part of Google Analytics is not combined with other data from Google. However, Google may transfer this information to third parties if this is required by law or if third parties process this data on behalf of Google. You can prevent cookies from being saved by setting your browser software accordingly. However, we would like to point out that in this case you may not be able to use all functions of the websites to their full extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the websites (including your anonymized IP address) and from processing this data by Google by clicking on the following link (https://tools.google.com/dlpage/gaoptout?hl=de) download and install the available browser plug-in.

You can find more information about terms of use and data protection at https://www.google.com/analytics/terms/de.html or under https://support.google.com/analytics/answer/6004245?hl=de.
‍‍

‍‍HubSpot

For our online marketing activities, we use the functions and services of HubSpot from our service provider HubSpot Germany GmbH (Unter den Linden 26, 10117 Berlin, Germany).

We have concluded a contract with HubSpot Germany GmbH (“HubSpot”), a company registered and operated under German law (registration number: 184578 B) with registered office at: Am Postbahnhof 17, 10243 Berlin. Nevertheless, it may happen that data is transferred from Europe to the USA, but we as a company have no influence on this.

For the USA, there is currently no adequacy decision by the EU Commission within the meaning of Article 45 (1), (3) of the General Data Protection Regulation (GDPR). This means that the EU Commission has not yet positively determined that the country-specific level of data protection in this country corresponds to that of the European Union under the GDPR (Article 46 appropriate guarantees).

The GDPR requires so-called appropriate guarantees for data transfer to a third country or to an international organization, Art. 46 (2), 3 GDPR. These are not available for the abovementioned country of destination.

Possible risks that cannot currently be ruled out for you as the person concerned in connection with the above information include:
- Your personal data could possibly be passed on by HubSpot USA to other third parties (e.g.: US authorities) beyond the actual purpose of order fulfillment.
- You may not be able to sustainably assert or enforce your information rights against HubSpot USA.
- There may be a higher probability that incorrect data processing may occur, as the technical organizational measures to protect personal data do not fully meet the requirements of the GDPR in terms of quantity and quality.

With your consent to the processing of (advertising and marketing) cookies, you explicitly consent to the transfer of data to the USA. You can revoke this consent informally by e-mail at any time. Data processing that took place before you withdrew your consent is not affected by the withdrawal and is therefore legally compliant.

Legal basis: Article 6 (1) (a) GDPR

Facebook Pixel

So-called “Facebook pixels” from the social network Facebook, which is operated in Europe by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”), are used.

With the help of the Facebook pixel, Facebook is able to identify visitors to our offer as a target group for displaying ads, so-called “Facebook ads.” Accordingly, we use the Facebook pixel to display the Facebook ads placed by us only to Facebook users who have also shown an interest in our website. This means that with the help of the Facebook pixel, we want to ensure that our Facebook ads match the potential interest of users and are not annoying. With the help of the Facebook pixel, we can also understand the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad.

The Facebook pixel is directly integrated by Facebook when you visit our websites and can save a so-called cookie, i.e. a small file, on your device. If you then log in to Facebook or visit Facebook while logged in, your visit to our website will be noted in your profile. The data collected about you is anonymous to us and therefore does not provide us with any conclusions about the identity of the users. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible. The processing of data by Facebook is carried out within the framework of Facebook's data usage policy. Accordingly, you can find more information about how the remarketing pixel works and how Facebook ads are displayed in general, in Facebook's data usage policy: https://www.facebook.com/policy.php.

You can object to the collection by the Facebook pixel and the use of your data to display Facebook ads. To do this, you can visit the page set up by Facebook and follow the instructions on usage-based advertising settings there: https://www.facebook.com/settings?tab=ads or explain the objection via the EU page http://www.youronlinechoices.com/. The settings are platform-independent, i.e. they are adopted for all devices, such as desktop computers or mobile devices.‍

‍We have concluded a contract with Facebook Ireland Ltd. (Facebook”), a company registered and operated under Irish law (registration number: 462932) based at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Nevertheless, it may happen that data is transferred from Europe to the USA, but we as a company have no influence on this.

For the USA, there is currently no adequacy decision by the EU Commission within the meaning of Article 45 (1), (3) of the General Data Protection Regulation (GDPR). This means that the EU Commission has not yet positively determined that the country-specific level of data protection in this country corresponds to that of the European Union under the GDPR (Article 46 appropriate guarantees).

The GDPR requires so-called appropriate guarantees for data transfer to a third country or to an international organization, Art. 46 (2), 3 GDPR. These are not available for the abovementioned country of destination.

Possible risks that cannot currently be ruled out for you as the person concerned in connection with the above information include:
- Your personal data could possibly be passed on by HubSpot USA to other third parties (e.g.: US authorities) beyond the actual purpose of order fulfillment.
- You may not be able to sustainably assert or enforce your information rights against HubSpot USA.
- There may be a higher probability that incorrect data processing may occur, as the technical organizational measures to protect personal data do not fully meet the requirements of the GDPR in terms of quantity and quality.

With your consent to the processing of (advertising and marketing) cookies, you explicitly consent to the transfer of data to the USA. You can revoke this consent informally by e-mail at any time. Data processing that took place before you withdrew your consent is not affected by the withdrawal and is therefore legally compliant.

Legal basis: Article 6 (1) (a) GDPR

Rights of data subjects

You have the following rights vis-à-vis us with regard to personal data concerning you:
- Right to information, correction and deletion
- Right to restrict processing
- Right to object to processing
- Right to data portability

You also have the right to complain to the supervisory authority, which is the Austrian data protection authority:
Austrian data protection authority
Barichgasse 40-42
1030 Vienna
Telephone: +43 1 52 152-0
email: dsb@dsb.gv.at

Contact for data protection

For data protection questions, notifications or requests, please use the following contact address:
Coinfinity GmbH
Griesgasse 10
8020 Graz, Austria
Phone: +43 316 711 744
Email: datenschutz@coinfinity.co‍‍