Back to 21bitcoin

Privacy statement

last updated on 24.11.2025

5. Purposes and legal bases for processing data

For what purposes and on which legal basis is my personal data processed by FIOR Digital?
‍
All data processing at FIOR is carried out in accordance with the GDPR and the Austrian Data Protection Act (DSG). We always process your personal data on the basis of at least one of the legal bases set out below. If we ask you to provide further personal data not listed above, you will be notified of the purpose and legal basis for collecting and processing this data at the time of collection.

5.1 To fulfill contractual obligations (Article 6 (1) (b) GDPR)

The processing of personal data may be necessary to fulfill contractual or pre-contractual obligations towards you. The following data processing processes are, for example, covered by such a contractual obligation:

  • Overall delivery of our services, including all tasks required to operate, deliver and manage FIOR and the platform
  • Account management (e.g. continuous updating of customer data)
  • Fulfilling your orders (e.g. payment processing, chargebacks, proof of purchase and sale)
  • Implementation of the “referral program”
  • Customer service and support inquiries (e.g. contact due to complications, intercom)
  • Authentication process when you register and verify an account on our website (identity verification)
  • Analyzing and improving the quality and general user experience of our website (e.g. using performance tracking on our platform)
  • Data security and IT security on our website and security of our network (e.g. protection against identity theft and against incorrect or suspicious access to our websites)
  • Application process for new employees

5.2 To comply with legal obligations (Article 6 (1) (c) GDPR)

The processing of personal data may also be necessary to fulfill various legal obligations (e.g. FM-GwG, MiCAR, DORA, WiEReG,, etc.). The following data processing processes are, for example, covered by such legal obligations:

  • Contract management, bookkeeping and invoicing
  • Compliance and risk management
  • Know-your-customer measures such as authentication process (identity verification) and verification of the source of funds
  • Monitoring to combat fraud, misuse (e.g. for illegal purposes), money laundering , terrorist financing and bypassing of sanctions
  • Information as required by an official order as part of financial criminal proceedings or for general prosecution
  • Consultation of credit institutions to identify credit and default risks, etc.

5.3 To protect legitimate interests (Article 6 (1) (f) GDPR)

If necessary, data may be processed by FIOR or a third party in addition to fulfilling a contract to protect the legitimate interests of FIOR. The following data processing operations are, for example, affected by such a legitimate interest:

  • Prevention of fraud, misuse (e.g. for illegal purposes), money laundering, terrorist financing and bypassing of sanctions
  • Risk management and risk minimization, e.g. through inquiries to credit agencies, debtor registers or providers of business analyses
  • Identifying and verifying potentially erroneous or suspicious business cases and accesses to our websites or applications
  • Account management and processing of general customer inquiries
  • Measures to protect our customers and partners and to secure the network and information; including measures to protect our employees and FIOR property, e.g. video surveillance (72 hour deletion cycle) and measures taken by external data centers and service providers
  • Handling inquiries from authorities, lawyers, collection agencies as part of legal prosecution and enforcement of legal claims in the context of court proceedings
  • Market research and development of services and products
  • Processing of statistical data, performance data and general market research data via the website, mobile app or social media platforms (e.g. X, Instagram, LinkedIn, YouTube, etc.)
  • Processing customer preferences (e.g. language, region) using cookies on our website
  • Direct marketing and advertising (e.g. implementation of marketing strategies, customer contact, sending vouchers and advertising from FIOR and its partner companies)
  • Use of audio, video and photo data from public spaces (e.g. public events, trade fairs, etc.) for marketing and other representation purposes on our social media channels or website
  • Review of referral program performance

5.4 Based on consent (Article 6 (1) (a) GDPR)

If you have given us your consent to process your personal data, the processing will only take place for the purposes set out in the declaration of consent and to the extent agreed therein. Any consent you have given can be withdrawn at any time without giving reasons and with effect for the future if you no longer agree to the processing. For example, with your consent, we process data for the following purposes:

  • For using all functions of the mobile app (e.g. device permission, camera to scan QR codes, etc.)
  • Direct marketing and advertising (e.g. customer satisfaction surveys, newsletters, competitions and other promotional communications, etc.)
  • Analysis and tracking on our website for advertising purposes
  • Certain uses of audio, video and photo data (e.g. advertising films, interviews, etc.) for marketing and other representation purposes via various channels
  • Automated authentication process when you verify yourself (identity verification)
  • Application management system, recruitment process and processing of your application (e.g. voluntary storage of applicant data for 2 years, data transfer from your social media account when using the “Apply with LinkedIn” tool, see also point 11)

7. Recipients of personal data

Who receives my personal data?
‍
The protection and confidentiality of your personal data is very important to FIOR Digital. For this reason, we only transfer your personal data to the extent described below or as part of an instruction at the time your data is collected. We neither sell nor otherwise share your personal data with third parties for money.

7.1 Data transfer to public institutions and institutions

Your personal information may be transferred to public bodies or institutions (I) if we are required to do so by law or as part of legal proceedings, (II) if we believe that disclosure is necessary to prevent damage or financial loss, or (III) if it is related to an investigation of suspected or actual fraudulent or illegal activity.

7.2 Data transfer to third parties

Joint responsibility: If FIOR acts as a joint controller together with other parties, we may provide these third parties with personal data, and the processing is always based on at least one of the legal bases set out in point 7 above. In addition, in the case of joint responsibility, we only transfer your personal data on the basis of a sufficient agreement with the other responsible parties (Art 26 GDPR).
Other third parties: FIOR may transfer your personal data to other third parties with your consent for disclosure or for the purpose of fulfilling the contract or at the request of the customer even before the contract is concluded.

7.3 Data transfer to service providers

To a limited extent, we also transfer personal data to contract processors who provide services for us. Contract processors may only use or share this data to the extent necessary to provide services for FIOR or to comply with legal requirements. We contractually oblige such processors to ensure the confidentiality and security of your personal data that they process on our behalf.

8. Data processing on our website

8.1 Notice for website visitors

We store information on users’ devices (e.g., cookies) and access information already stored (e.g., IP addresses) via our website (or app). The specific types of information involved are described in the following sections.

  • Strictly Necessary Storage and Access
    Where storage or access is strictly necessary for us to provide a service expressly requested by the user (e.g., for the technical provision of a chatbot or to ensure IT security of the website/app), we rely on the applicable national legislation implementing the ePrivacy Directive (2002/58/EC), as well as Article 6(1)(f) GDPR (legitimate interests) or Article 6(1)(b) GDPR (performance of a contract), where appropriate.
  • Consent-based Storage and Access
    In all other cases (particularly for technologies used for analytics, statistics, or marketing), storage or access takes place only after the user has given explicit consent, in line with the relevant national provisions implementing the ePrivacy Directive (e.g., cookie consent) and Article 6(1)(a) GDPR (consent). Users can withdraw their consent at any time with future effect, for example via our cookie settings or within the app settings.
  • Subsequent Data Processing
    Any further processing of personal data collected via these technologies is carried out according to the General Data Protection Regulation (GDPR) and in line with the purposes described in this document (e.g., analytics, marketing, improving our services).

8.2 Informative use of our website

During the informative use of the website, i.e. when site visitors do not separately transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so that the legal basis is Art. 6 para. 1 s. 1 lit. f GDPR.

  • IP address
  • Date and time of the request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code
  • Amount of data transferred in each case
  • Website from which the request comes
  • Browser
  • Operating system and its interface
  • Language and version of the browser software

8.3 Web hosting and provision of the website

Our website is hosted by Webflow. The provider is Webflow, Inc., 398 11th St., Floor 2, San Francisco, CA 94103, USA. In doing so, the provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication data or contact data in the USA. Further information can be found in the provider's privacy policy at https://webflow.com/legal/eu-privacy-policy.

It is our legitimate interest to provide a website, so the legal basis of the described data processing is Art. 6 para. 1 s. 1 lit. f GDPR.

The legal basis of the transfer to a country outside the EEA are adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.

We use the content delivery network Cloudflare for our website. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The provider thereby processes the personal data transmitted via the website, e.g. content, usage, meta/communication data or contact data in the USA. Further information can be found in the provider's privacy policy at https://www.cloudflare.com/privacypolicy/.

We have a legitimate interest in using sufficient storage and delivery capacity to ensure optimal data throughput even during large peak loads. Therefore, the legal basis of the described data processing is Art. 6 para. 1 s. 1 lit. f GDPR.

Legal basis of the transfer to a country outside the EEA are adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.

8.4 Vacant positions

We publish vacant positions on our website, on pages linked to the website or on third-party websites.

The processing of the data provided as part of the application is carried out for the purpose of implementing the application process. Insofar as this is necessary for our decision to establish an employment relationship, the legal basis is Art. 88 para. GDPR. We have marked the data required to carry out the application process accordingly or refer to them. If applicants do not provide this data, we cannot process the application.
Further data is voluntary and not required for an application. If applicants provide further information, the basis is their consent (Art. 6 para. 1 s. 1 lit. a GDPR).

We ask applicants to refrain from providing information on political opinions, religious beliefs and similarly sensitive data in their CV and cover letter. They are not required for an application. If applicants nevertheless provide such information, we cannot prevent their processing as part of the processing of the resume or cover letter. Their processing is then also based on the consent of the applicants (Art. 9 para. 2 lit. a GDPR).

Finally, we process the applicants' data for further application procedures if they have given us their consent to do so. In this case, the legal basis is Art. 6 para. 1 s. 1 lit. a GDPR.

We pass on the applicants' data to the responsible employees in the HR department, to our data processors in the area of recruiting and to the employees otherwise involved in the application process.

If we enter into an employment relationship with the applicant following the application process, we delete the data only after the employment relationship has ended. Otherwise, we delete the data no later than six months after rejecting an applicant.

If applicants have given us their consent to use their data for further application procedures as well, we will not delete their data until one year after receiving the application.

8.5 Third parties

8.5.1 Google Analytics

We use Google Analytics for analytics. The provider is Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The provider processes usage data (e.g. web pages visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA.

The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.

The transfer of personal data to a country outside the EEA takes place on the legal basis adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.

The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at https://policies.google.com/privacy?hl=en-US.

8.5.2 Google Tag Manager

We use Google Tag Manager for analytics and for advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times) in the USA.

The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.

The transfer of personal data to a country outside the EEA takes place on the legal basis adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.

We delete the data when the purpose for which it was collected no longer applies. Further information is available in the provider's privacy policy at https://policies.google.com/privacy?hl=en-US.

8.5.3 Tally

We use Tally for our interactive forms on our website. The provider is Tally BV August Van Lokerenstraat 71, 9050 Ghent, Belgium. The provider processes identification/communication data (e.g. electronic identification data, form data). The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.

The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at https://tally.so/help/data-processing-agreement?utm_source=chatgpt.com

9. Data processing in the app

9.1 Downloading the app

Our app is ready for download at ​Apple App Store and Google's Play Store ​ (hereinafter "Stores"). When users download the app, the necessary information is transmitted to the stores, i.e. in particular, e-mail address, time of download, payment information and the individual device identification number. We have no influence on this data collection and are not responsible for it. We process the data only insofar as it is necessary for downloading the mobile app to the user's mobile device.

Users can also download this mobile app directly to their mobile device via our website. When downloading, further user data is processed via the website, which we inform about in the privacy policy of our website.

9.2 Hosting

Our app is hosted by ​AWS. The provider thereby processes the personal data transmitted via the app, e.g. on content, usage, meta/communication data or contact data. It is our legitimate interest to provide an app, so that the legal basis of the data processing is Art. 6 para. 1 s. 1 lit. f GDPR.

The provider hosts the app on servers in Ireland

9.3 Informative use of our app

When users use our app, we collect the data that is technically necessary for us to offer users the functions of our app and to ensure stability and security. This is our legitimate interest, so that the legal basis is Art. 6 para. 1 s. 1 lit. f GDPR.

The data processed to this extent are:

  • IP address
  • Date and time of the request
  • Time zone difference from Greenwich Mean Time (GMT)
  • Content of the request (concrete interface)
  • Access status/HTTP status code
  • Amount of data transferred in each case
  • Operating system and its interface
  • Language and version of the operating system

9.4 Access to functions or data

The app requests the user's access to functions of the end device or to data of the device in order to be able to execute functions of the app. By allowing access, the user gives consent to the associated data processing, so that the legal basis is Art. 6 para. 1 s. 1 lit. a GDPR. Users can revoke their consent at any time by terminating access in the settings of their end device. The revocation does not affect the lawfulness of the processing until the revocation.

The data processed or access functions used in this respect are

  • Camera and microphone
  • ​OS built in functions ​

9.5 Data processing for the provision of functions

In the app, we process data in order to provide the user with functions of the app. The legal basis for the processing is the usage agreement concluded with the user via the app.

The data processed to this extent are:

  • Location and Universal Unique Identifier of the endpoint device (UUID)​

9.6 User account

Users can open a user account in the app. We process the data requested in this context to fulfill the respective user contract concluded for the account, so that the legal basis for the processing is Art. 6 para. 1 s. 1 lit. b GDPR. We delete the data when users delete their user account.

9.7 Processing of ID Card Data

As part of the identity verification or age verification process, users may present their ID card data. These data are processed solely for the purpose of conducting the relevant queries. The processing is based on the fulfillment of a legal obligation or contractual necessity (Art. 6(1) sentence 1 lit. c or b GDPR). Data is stored only if necessary for the fulfillment of the purpose and will be deleted immediately after the verification or query is completed.

9.8 Crypto-Asset Services

We offer the ability to trade, transfer and custody crypto-assets via our app. During the transaction process, we involve external service providers who only receive the personal data necessary to deliver their respective services. This data processing is carried out for the purpose of fulfilling the contract concluded with users (Article 6(1)(b) GDPR).

9.9 Third-party tools

To ensure effective and legally compliant operations, we use a range of third-party tools. Below is a list of the areas in which the tools are used and the legal basis on which the data is processed.

9.9.1 Processing on the basis of Art. 6 para. 1 s. 1 lit. a GDPR
  • Analytics - Processing of meta/communication data (e.g. device information, IP addresses)

The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it.

9.9.2 Processing on the basis of Art. 6 para. 1 s. 1 lit. b GDPR
  • Identity checks of Client - Processing of personal identification data (e.g. ID documents, biometric data) and meta/communication data (e.g. device information, IP addresses)

The data will be deleted when the purpose of its collection no longer applies and there is no obligation to retain it.

9.9.3 Processing on the basis of Art. 6 para. 1 s. 1 lit. c GDPR
  • Blockchain transaction analysis - Processing of Transaction data and meta/communication data (e.g. IP addresses)
  • Compliance with regulatory requirements in the area of financial transactions - Processing of financial transaction data and meta/communication data (e.g. IP addresses)

The data will be deleted when the purpose of its collection no longer applies and there is no obligation to retain it.

9.9.4 Processing on the basis of Art. 6 para. 1 s. 1 lit. f GDPR
  • Hosting - Processing of usage data (e.g. web pages visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses)
  • Application security - Processing of content data (e.g. entries in online forms) and meta/communication data (e.g. device information, IP addresses)
  • Email services, document management and team communication - processing of content data (e.g. emails, documents) and meta/communication data (e.g. IP addresses, device information)
  • Internal workflows - processing of Content data (e.g. tickets, comments) and meta/communication data (e.g. IP addresses)
  • Customer communication and support - processing of meta/communication data (e.g. IP addresses, device information)
  • System performance monitoring and error analysis - processing of meta/communication data (e.g. log files, IP addresses, device information)
  • Telephone customer communication - processing of communication data (e.g. call data, call recordings) and meta/communication data (e.g. IP addresses, telephone numbers)
  • Collection and management of customer feedback - processing of content data (e.g. feedback contributions) and meta/communication data (e.g. IP addresses)
  • Internal documentation and collaboration - processing of content data (e.g. notes, documents) and meta/communication data (e.g. IP addresses)
  • Anti-money laundering and fraud prevention - processing of content data (e.g. transaction details) and meta/communication data (e.g. IP addresses, device information)

The data will be deleted when the purpose of its collection no longer applies and there is no obligation to retain it.

9.9.5 Transfer of data outside of the EEA

In certain cases, data is also processed by third-party service providers outside the EEA. Processing is carried out on various legal bases;

  • The legal basis for the transfer to a country outside the EEA are adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
  • The legal basis for the transfer to a country outside the EEA are standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR. The security of the data transferred to the third country is guaranteed because the third-party service provider has undertaken to comply with these clauses.