Responsible body
Privacy contact for KryptoEuro: compliance@kryptoeuro.com.de. Use this address for information, rectification, erasure, objection, and other data protection inquiries. The official Telegram manager is also available for purely scheduling and order coordination.
The complete legal identity and registerable address of the controller have not yet been stated. These mandatory details must be added by the operator; the brand name and contact email do not replace them. Neither a designated data protection officer nor an EU representative is claimed.
Scope and Data Protection Law
This declaration applies to the website and the KryptoEuro services described herein. For processing within the scope of the General Data Protection Regulation, the GDPR applies; additionally, national data protection and telecommunications regulations and, if applicable, the Swiss Data Protection Act or British data protection law may apply.
The selected card country, payout currency, website language, and your place of residence are different details. From the domain name, country list, or use of EUR, neither a specific operator domicile nor official authorization follows.
Categories and Origin of Personal Data
We distinguish the following data types. The scope and necessity depend on whether you are merely reading, using an account, or requesting an order:
- Contact and account data: email address, optional Telegram contact, authentication identifier, and information on the registration process.
- Card and payout data: cardholder name, card number, card country, selected payout currency, and the amounts calculated in the order.
- Order and transaction data: Order ID, cryptocurrency, network, amount, receiving address, transaction ID, timestamps, status and order-related communication.
- Cash requests: requested city or individually entered location, country, EUR or CHF, amount, selected token and details for appointment scheduling.
- Technical usage data: IP address, browser and device information, pages visited, time, error and security events, as well as analytical identifiers if applicable.
- Verification documents: proof of identity or origin, if they are actually required for a specific order and requested separately.
Purposes and legal bases
A legal basis is determined for the respective processing purpose, not generally for all data:
- Inquiry, account, order processing, appointment scheduling and payout: Art. 6 para. 1 lit. b GDPR, insofar as necessary for contract initiation or performance.
- Legally required checks, evidence, or storage: Art. 6(1)(c) GDPR, exclusively to the extent that the specific operator is actually subject to a corresponding obligation.
- Fraud prevention, IT security, technical error analysis and legal defense: Art. 6 para. 1 lit. f GDPR after weighing the affected interests.
- Analysis subject to consent or non-essential access to your device: Art. 6 (1) (a) GDPR and the respective applicable device and cookie law. Consent must be obtained effectively and remains revocable.
Customer account, card order, and cash request
During an online inquiry, the necessary contact, card, and order data are collected for processing. The registration process can prepare a customer account for the provided email address and send a registration link. Associated orders and their processing status are displayed in the account.
A cash request serves primarily for coordinating an individual appointment. The same data requirements as for a card withdrawal do not automatically apply to this. In particular, do not send copies of ID cards or full card details to a Telegram contact unsolicited.
Without the information necessary for a specific order, it cannot be processed. Optional contact details are voluntary. Merely reading the public pages does not require a customer account or entering card details.
Authentication and email via Clerk
An external Clerk instance is used for registration. Clerk processes in particular email addresses, user and session identifiers, information on the registration method, and technical security data. Registration links and verification steps are part of this authentication flow.
KryptoEuro receives the login status required for assigning an account and its orders. The specific processing and retention by the provider depend on their service, contractual terms, and the installed instance. A login via Clerk is not consent to Microsoft Clarity.
Telegram communication and internal notifications
When you contact the official manager @Krypto_Euro, Telegram processes your communication according to its own terms. Voluntarily submitted messages and profile information may be used by the manager to process your inquiry. There is no public KryptoEuro channel for order data.
Internal bot notifications can transmit order and contact information to explicitly authorized operators. This processing serves handling purposes and is to be distinguished from public posts or disclosure to any Telegram users.
Telegram is not an assured confidential transmission channel for sensitive documents. Use the compliance email for data protection inquiries. Never share seed phrases, private keys, PINs, or card verification codes.
Blockchain, AML and external price sources
Blockchain addresses and transaction identifiers may be personal in connection with an order. Public blockchains are viewable by third parties; confirmed entries cannot be retroactively deleted by KryptoEuro. Deleting our internal mapping does not remove a public blockchain transaction.
In the event of a specific need for verification, proof of identity or the origin of assets may be requested. It is not claimed that KryptoEuro is subject to a specific anti-money laundering registration solely based on this statement or performs an identity check for every visitor.
Rate and currency queries are made via public data sources. Such a rate query is not equivalent to transmitting your email address or card number to a rate source. For an external AML service opened separately by you, its own privacy notices also apply.
Microsoft Clarity and usage analysis
Microsoft Clarity is integrated into the website. The service may process usage workflows, clicks, scrolls, device and browser information, identifiers, and IP-related technical data to generate session recordings or aggregated analyses. Microsoft may access information on the terminal device or use cookies.
In the current technical state, the Clarity script is loaded upon page call; a separate consent manager is not yet integrated. This statement and the mere use of the website do not replace required consent. Before operation requiring consent, the operator must set up an effective selection and withdrawal option or deactivate the corresponding analysis.
No specific masking of all input fields, no specific storage location, and no fixed Clarity deletion period are guaranteed as long as these settings are not verified. Enter sensitive information only in the designated order fields.
Cookies, local storage and language setting
For authentication and secure sessions, technically necessary cookies or comparable storage mechanisms may be used. The voluntarily chosen language is saved in the browser under kryptoeuro.manual-language and in the cookie kryptoeuro_language. The language cookie is set for a duration of up to one year; a saved manual language preference takes precedence over automatic detection.
Local browser storage has no automatic expiration time identical to a cookie. You can delete or block cookies and website data via browser settings. This may require a re-login or language selection. Deleting local website data does not automatically delete the customer account or existing orders.
Necessary session and language settings must be distinguished from analytical identifiers. Consent for non-necessary technologies must not be inferred from the mere continuation of an exchange.
Recipients and access authorization
Access is restricted to individuals requiring data for processing, security, or legal defense. Additional recipients may include hosting and infrastructure providers, authentication and communication service providers, payment service providers currently engaged, and, where applicable, consultants or competent authorities.
Data disclosure occurs for specific purposes and not solely because a provider or partner is linked on the website. Depending on the actual role, recipients are processors, independent controllers, or bodies legally authorized to receive data. A specific concluded data processing agreement is not claimed here without proof.
Transfers outside the European Economic Area
Clerk, Microsoft, Telegram and their affiliated infrastructure may also process data outside the European Economic Area. The actual processing location and the respective subcontractors depend on the service used and its configuration; an exclusive EU storage location is not guaranteed.
Insofar as the GDPR is applicable, such transfers require a permissible basis under Chapter V, such as a relevant adequacy decision or appropriate safeguards like effectively agreed standard contractual clauses, with additional protective measures if necessary. We do not claim that a specific certification or transfer agreement exists without examination. Information on the safeguards actually used for your data can be requested from the data protection contact.
Storage duration
Account data is required for the existing customer relationship and the necessary authentication. Order and communication data are retained for processing, billing, evidence, and, where applicable, the enforcement or defense of claims. Legal deadlines apply only to the extent that they are actually relevant for the specific operator and the specific data category.
For technical logs and analytical information, the security purpose, necessity, system settings, and the requirements of the respective service are decisive. The website does not currently contain a verified, uniform automatic deletion schedule for all data types; in particular, no flat-rate deletion after an arbitrary number of days or years is promised.
In the event of a deletion request, it is examined which data can be removed and which must be retained in a restricted manner due to a continuing legal obligation or for the purpose of legal defense. An account or session logout is not a deletion of existing order documents.
Security measures and limits
Card numbers are stored in encrypted form in the application; customer-related views may be limited to the last four digits. Authorized entities for processing may require the necessary payout data. This does not imply an assurance that all personal data is end-to-end encrypted.
Secure connections, access restrictions, and the protection of access credentials are essential protective measures. No internet service can guarantee complete security. Report suspicious access or accidentally transmitted sensitive information immediately. KryptoEuro does not require a seed phrase, private wallet key, card PIN, or CVV code for an inquiry.
Your Rights
You can exercise your rights at compliance@kryptoeuro.com.de. Describe your request and, if possible, the affected email address or order identifier. Do not send an unredacted copy of your ID as a precaution; if identity verification is necessary, it must be limited to the extent required.
As far as the GDPR applies, we generally respond to data subject requests within one month of receipt. In cases of legally permissible extension, you will be informed of the reasons and further duration within this period. Legal exceptions and legitimate retention obligations may limit individual rights.
- Information about your personal data and a copy pursuant to Art. 15 GDPR.
- Correction of incorrect and completion of necessary information pursuant to Art. 16 GDPR.
- Erasure and restriction of processing under the conditions of Art. 17 and 18 GDPR.
- Data portability, provided the requirements of Art. 20 GDPR are met.
- Objection to processing based on legitimate interests under Art. 21 GDPR; there is an unrestricted right to object to direct marketing.
- Revocation of consent for the future. The legality of processing until the revocation remains unaffected.
- Complaint to a competent data protection supervisory authority, in particular at your habitual residence, place of work, or place of an alleged infringement. A prior complaint to us is not a requirement.
Automated processes and human inquiries
Rate calculation, amount limits, network check, payment status, and certain security steps can be automated. Automatic calculation is not equivalent to a comprehensive credit assessment. If you have questions about a rejection or a verification status, you can request an explanation and a review by a responsible employee.
If in an individual case an exclusively automated decision with legal or similar significant effect within the meaning of Art. 22 GDPR is used, the legal requirements and special information and protection obligations must be fulfilled. This declaration does not provide blanket consent to such a decision.
Minors and third-party personal data
The exchange services are aimed at adults. Do not transmit data of third-party cardholders or other third parties without a permissible basis. If you suspect that we hold data of a minor or data transmitted without authorization, please contact the privacy contact.
External websites and changes to this declaration
When opening external links, you leave our website. The respective provider processes connection and, if applicable, account data according to their own rules; a link is not a guarantee of data protection compliance by this provider.
This declaration must be adapted to the actual technical and organizational status, especially when changing service providers, analysis functions, operator details, or deletion periods. Significant changes must not be treated retroactively as already granted consent. The respectively published version on kryptoeuro.com.de is authoritative.