Privacy Policy

Last Updated 17.07.2025
Effective Date 17.07.2025

1. General

1.1 This Privacy Policy explains how we use your Personal Data in connection with usage of our Services, access, or use of the relevant areas of our Website, or when any agent provides your Personal Data to us or any agent dealing with us on your behalf.

1.2 Odin Pay s.r.o. is a company duly incorporated and registered under the laws of the Czech Republic, company number: 223 56 312, with its registered office at Olšanská 54/3 Prague 3 Žižkov 130 00, Czech Republic.

1.3 The Company is applying for authorisation as a CASP under MiCA and is supervised by Czech National Bank.

1.4 We are a Personal Data Controller and are responsible for the processing of your Personal Data.

1.5 By accessing or using the Website, you confirm that you have read, understood, and agreed to be bound by this Privacy Policy and any additional terms referenced herein. If you do not agree, you must not use or access the Website.

2. Definitions

The following terms have the meaning as defined below:

3. What Do We Offer?

3.1 Our platform provides a range of services designed to deliver value, convenience, and security to our users. Detailed information about the services we offer can be found in the Terms & Conditions, Customer Agreement.

4. Purposes And Legal Basis For Processing Personal Data

4.1 We only process your Personal Data where we have a lawful basis to do so in accordance with Article 6 of the GDPR. Each processing activity is linked to a specific purpose and justified by one or more of the lawful bases outlined below.

4.2 To create and manage your Account, verify your identity, and provide you with access to our Platform and Services. This is necessary for the performance of the Customer Agreement with you (Article 6(1)(b) GDPR).

4.3 To comply with our legal obligations as a crypto-asset service provider, including AML/CTF requirements, tax reporting, and regulatory oversight under applicable laws, including MiCA and Czech legislation. This processing is necessary for compliance with legal obligations (Article 6(1)(c) GDPR).

4.4 To monitor and improve the security of our systems, prevent fraud, detect abuse, and ensure technical integrity. These activities are based on our legitimate interest in safeguarding our business and Customers (Article 6(1)(f) GDPR).

4.5 To provide Users’ support, respond to your inquiries, process feedback, and handle disputes. This may be necessary either to fulfil our contractual obligations (Article 6(1)(b)) or to pursue our legitimate interest in effective communication (Article 6(1)(f)).

4.6 To send you marketing communications, newsletters, promotional content, or surveys, subject to your explicit consent. This processing is carried out only with your prior consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

4.7 To analyse Services usage, improve our Platform, and personalise your experience. These processing activities are based on our legitimate interest in improving usability, functionality, and product relevance (Article 6(1)(f) GDPR).

4.8 To fulfil our obligations in legal proceedings or respond to competent authorities, including audits and investigations. This is carried out under our legitimate interest in legal defence and compliance (Article 6(1)(f) GDPR).

4.9 To ensure operational resilience, Services continuity, and disaster recovery, including through system backups and failover processes. These are justified by our legitimate interest in uninterrupted and secure Services provision (Article 6(1)(f) GDPR).

4.10 We do not process your Personal Data for any purpose that is incompatible with those listed above. Where consent is the legal basis, we ensure that it is freely given, specific, informed, and unambiguous, and we respect your right to withdraw it at any time.

5. Types of Personal Data

5.1 Directly collected Personal Data. This refers to the information, which Users directly provides us (e.g., by filling the Website forms). We usually collect and store information including in paper, physical and electronic form provided by our Users when communicating with us by telephone, email, web-based form, letter, facsimile or other means.

5.2 Indirectly collected Personal Data. This kind of information relates to the User, but he/she/it does not provide it directly (e.g., an IP address).

5.3 Automatically collected / generated Personal Data. Our system collects this type of information automatically. Though such information isn’t provided by a User, it relates to you and according to the Article 4 (1) of the GDPR is considered to be Personal Data. It has 2 subtypes:

5.3.1 Static. This information doesn’t usually change once it’s created. For instance, an internal user ID;
5.3.2 Dynamic. This subtype changes based on the activities performed by you.

5.4 We also collect information from your computer or mobile device automatically when you browse our Website. This information may include technical data, profile and User support data, usage data as detailed below.

5.5 The device you use to access our Website may collect information about you, including your location using longitude and latitude coordinates obtained through GPS, Wi-Fi or cell site triangulation. For information about your ability to restrict the collection and use of such information, please use the settings available on your device.

6. What Personal Data do we collect ?

6.1 Depending on whether and how you use our Services, Website, we will collect, use, store and transfer different kinds of your Personal Data, grouped in the following categories:

6.2 This information is not exhaustive, and is laid out to give you an idea about use of fundamental collected information. We will record all information collected and purposes for which we process that Personal Data.

6.3 Furthermore, we treat certain categories of Personal Data to be sensitive, and such sensitive data requires additional safeguards. We will only collect, use, store, and transfer your sensitive data if we can meet both the legal basis requirement and at least one of the required extra conditions.

6.4 The extra conditions include:

6.4.1 circumstances prescribed by regulations: Personal Data is processed in the conditions prescribed by regulations;
6.4.2 information made public by you: the sensitive data has become public as a result of your actions;
6.4.3 consent: you have provided your consent to the processing of your sensitive data.
6.4.4 judicial proceedings: the processing is required for the purpose of or in connection with any legal proceedings, for seeking legal advice, or for establishing, exercising, or defending legal rights;
6.4.5 public functions: the processing is necessary for the exercise of any functions conferred on any person by or under an enactment.

7. Lawfulness of Processing and Disclosure

7.1 We process your Personal Data in full compliance with the principles and legal bases established by the GDPR, in particular Articles 5 and 6. Your consent to this Privacy Policy constitutes a lawful basis for processing as per Article 6(1)(a) GDPR, where such consent is freely given, specific, informed, and unambiguous.

7.2 In accordance with GDPR principles:

7.2.1 Your Personal Data is processed lawfully, fairly, and transparently. We ensure that all Users are informed of how their data is collected, used, and disclosed, and for what purposes.
7.2.2 Personal Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
7.2.3 We collect only the Personal Data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
7.2.4 Reasonable steps are taken to ensure that Personal Data is accurate and, where necessary, kept up to date.
7.2.5 Personal Data is retained only for as long as necessary for the purposes for which it is processed, unless a longer retention period is required by law.

7.3 We apply appropriate technical and organisational measures to ensure the security of your Personal Data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include firewalls, data encryption, physical access restrictions to our facilities, and role-based access control mechanisms for our systems.

7.4 Access to Personal Data is strictly limited to those employees, contractors, auditors, and advisors who require such access to perform their job functions or contractual duties. All such personnel are bound by confidentiality obligations and are trained in GDPR-compliant data processing practices.

7.5 Additionally, we conduct regular assessments and audits of our data processing activities to verify compliance with this Privacy Policy and applicable data protection laws. These evaluations ensure that our safeguards, internal policies, and procedures remain robust and effective.

7.6 Any international data transfers (if applicable) are carried out in accordance with Chapter V of the GDPR, using appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions.

8. How we use Personal Data for communicating with you and direct marketing

8.1 We process your Personal Data for communication and direct marketing purposes in accordance with the General Data Protection Regulation (GDPR), particularly under Article 6(1)(a) (consent) and Article 6(1)(f) (legitimate interest), where applicable. Our intention is to inform you about services, products, features, or updates that may be relevant to your interests.

8.2 We may contact you using various communication channels, including:

8.2.1 Email;
8.2.2 Telephone calls;
8.2.3 SMS messages;
8.2.4 Push notifications.

8.3 These communications may include promotional offers, updates on services, newsletters, event invitations, and similar content that we believe may be of value to you.

8.4 We will only send direct marketing messages if:

8.4.1 You have provided clear, affirmative consent to receive such communications; or
8.4.1 We have a legitimate interest in informing you about similar products or services, and you have not opted out.

8.5 Consent for marketing can be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

8.6 You have the right to object at any time to the processing of your Personal Data for direct marketing purposes, including profiling, to the extent that it is related to such marketing.

8.7 We provide the following opt-out options:

8.7.1 Email: All direct marketing emails include an ‘unsubscribe’ link that allows you to easily opt out.
8.7.2 Push notifications: You can revoke your permission for push notifications in your mobile device settings. Please note, this may disable other important notifications as well.
8.7.3 Written or telephone requests: You may also contact us directly via phone or email to request removal from our marketing list. We aim to process such requests within five (5) business days.

8.8 Certain types of communication are mandatory and not subject to opt-out. These may include:

8.8.1 Notifications about security, privacy, or policy updates;
8.8.2 Service interruptions or changes to the operation of the Website;
8.8.3 Communications specifically requested by you (e.g., password reset emails).

8.9 You may, however, have control over the media or format of these communications through your account settings or device preferences.

8.10 Our direct marketing systems may involve servers or service providers located outside the European Economic Area (EEA). Where such international transfers occur, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or processing within jurisdictions covered by adequacy decisions of the European Commission.

8.11 We are committed to processing your Personal Data transparently, securely, and in full respect of your rights under the GDPR.

9. Third Parties

9.1 We have taken steps to ensure that Third Parties engaged by us in processing your Personal Data, have suitable technical and organisational measures in place to protect this Personal Data, and we will also ensure that they are GDPR-compliant. We have taken steps to ensure that Third Parties engaged by us, protect the confidentiality and security of Personal Data, and ensure that Personal Data is processed only for Service providing and in compliance with applicable law.

9.2 We may transfer your Personal Data to Third Parties, such as:

9.2.1 to our related entities, employees, officers, agents, contractors, other companies that provide services to us, sponsors, government agencies or other Third Parties to satisfy the purposes for which the information was collected or for another purpose if that other purpose is closely related to the primary purpose of collection and an individual would reasonably expect us to disclose the information for that secondary purpose;
9.2.2 to Third Parties who help us analyse the information we collect so that we can administer, support, improve or develop our business and the Services we provide to a User;
9.2.3 to merchants and the recipients of funds to identify you as the sender of the funds and to a party who sends you funds in connection with a transfer to you of funds;
9.2.4 legal and regulatory authorities to whom we are obligated to disclose your Personal Data under the law, AML and CFT requirements; agencies that deal with law enforcement; entities in cases of fraud or collusion prevention, identity verification, payment processing, credit reference; banks/financial institutions; courts;
9.2.5 identification and verification service providers engaged by us for Users, your verification, performance of AML and CFT requirements, as well as other software service providers who assist us to provide Services we provide to Users;
9.2.6 to our professional advisers such as consultants, bankers, professional indemnity insurers, brokers and auditors so that we can meet our regulatory obligations, and administer, support, improve or develop our business;
9.2.7 server hosts, which store our data, communication service providers, which help us stay in touch with you;
9.2.8 to Third Parties, including those in the blockchain and fintech industry, marketing and advertising sectors, to use your information in order to let you know about Services which may be of interest to you in accordance with GDPR;
9.2.9 banking, financial service providers, helping us in the Services to our Users;
9.2.10 to debt recovery agencies who assist us with the recovery of debts owed to us;
9.2.11 to any other person, with your consent (express or implied);
9.2.12 to facilitate the sale of all or a substantial part of our assets or business or to companies with which we propose to merge or who propose to acquire us and their advisers; and
9.2.13 other Third Parties which services, facilities we use, in order to provide our Services and deal with certain processes necessary for the operation of the Website, perform internal procedures and law requirements.

9.3 This list of the Third Parties is non-exhaustive and may change and be supplemented. The procedure for collecting, processing, storing and using Personal Data is determined by the privacy policy of the relevant Third Party.

9.4 The privacy policies of the Third Parties are available for review at the following links:

9.5 In addition to the above recipients, we will disclose your Personal Data if we are required to do so under law or if the disclosure is made in connection with either the normal operation of our business in a way that you might reasonably expect, for example, if such disclosure is incidental to IT services being provided to our business or for the resolution of any dispute that arises between you and us. This disclosure may involve your Personal Data being transmitted overseas.

9.6 In the event of a proposed restructure or sale of our business (or part of our business) or where a company proposes to acquire or merge with us, we may disclose Personal Data to the buyer and their advisers without your consent subject to compliance with GDPR. If we sell the business and the sale is structured as a share sale, you acknowledge that this transaction will not constitute the ‘transfer’ of Personal Data.

9.7 Personal Data shall not be processed (or cause to be processed) in a country that has not been designated by the European Commission as providing an adequate level of data protection unless it has put in place such measures as are necessary to ensure such transfer is in compliance with Personal Data protection laws, except where otherwise required by applicable law.

9.8 We are obliged to disclose your Personal Data in following cases:

9.8.1 in response to lawful requests by public authorities, including to meet legitimate national security or law enforcement requirements;
9.8.2 to protect, establish, or exercise our legal rights or defend against legal claims, including to collect a debt; to comply with a subpoena, court order, legal process, or other legal requirement;
9.8.3 when we believe in good faith that such disclosure is required to comply with the law, prevent imminent physical harm or financial loss, or investigate, prevent, or take action regarding illegal activities, suspected fraud, threats to our property, or violations of Terms & Conditions;
9.8.4 to Third Parties in case of: merger, restructuring, joint venture, assignment, sale of part of the business or the whole business.

9.9 If we are acquired or merged with a Third Party entity, we reserve the right to transfer or assign the data we have collected from our Users as part of such merger, acquisition, sale, or other change of control. If we become involved in a merger, acquisition, or any form of sale of some or all our assets, we will notify Users, you before Personal Data is transferred and become subject to a different privacy policy. We may not be able to control how your Personal Data is treated, transferred, or used in the unlikely event of our bankruptcy, insolvency, reorganisation, receivership, or assignment for the benefit of creditors, or the application of laws or equitable principles affecting creditors’ rights in general.

10. Where do we store Personal Data?

10.1 Please note that we use our own and Third Party servers including our Website hosts, data backups and payment gateway(s), which may be located overseas, and your Personal Data will likely be stored and transmitted overseas as part of the normal operation of our business. To ensure the security and privacy of your Personal Data, we take measures designed to protect that information from loss, misuse, unauthorised access, disclosure, alteration, or destruction.

11. How long do we store Personal Data?

11.1 We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including for the provision of services, compliance with legal obligations, dispute resolution, enforcement of agreements, and protection of legitimate interests.

11.2 Your Personal Data will be stored for the duration of the service relationship between you and us, as well as any Third Party acting on our behalf. Following the termination of service provision, we will continue to retain your Personal Data for a period of up to eight (8) years, unless:

11.2.1 A longer retention period is required by applicable national or international law (e.g., tax, accounting, anti-money laundering regulations);
11.2.2 Retention is necessary for the establishment, exercise, or defence of legal claims;
11.2.3 You have provided explicit consent for a longer retention period.

11.3 Once the retention period has expired or the data is no longer required for the stated purpose, your Personal Data will be:

11.3.1 Securely deleted or destroyed;
11.3.2 Anonymised in a way that it can no longer be associated with you, for research or statistical purposes.

11.4 We conduct periodic reviews of the data we hold and update or securely erase records that are no longer needed in accordance with our data retention policies.

12. Security of Personal Data

12.1 When you provide your Personal Data over our Website or Platform, it is securely sent across the Internet using industry standard encryption. Your Personal Data will be held encrypted on secure servers.

12.2 We will endeavour to take all reasonable steps to keep secure and protect any Personal Data which we hold about you, including:

12.2.1 securing our physical premises and digital storage media;
12.2.2using computer safeguards such as Secure Socket Layer (SSL) technology to ensure that your information is encrypted and sent across the Internet securely;
12.2.3placing password protection and access control over our information technology systems and databases to limit access and protect electronic information from unauthorised interference, access, modification and disclosure; and
12.2.4taking regular back-ups of our electronic systems.

13. Breaches Notifications

13.1 In case of a Personal Data breach, we shall notify the supervisory competent authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the Personal Data breach is unlikely to result in a risk to the rights and freedoms of individuals.

13.2 If we become aware of a security breach, we may seek to notify you electronically so that you can take appropriate preventive measures. If a security breach occurs, we may make a notice on the Website.

13.3 When Personal Data breach is anticipated to result in a high risk to Users’, your rights and freedoms, we will inform you.

14. Your Rights

14.1 Obtain confirmation. You have the right to request confirmation that Personal Data pertaining to you is being processed.

14.2 Access Personal Data. You have the right to access such data, or ask us to provide a copy of your Personal Data processed by us.

14.3 Request of information. You have the right to request the following additional information concerning your Personal Data:

14.3.1 the purposes of the processing;
14.3.2 the categories of Personal Data concerned;
14.3.3 the recipient(s) or category(ies) of recipient to whom/which Personal Data have been or will be disclosed;
14.3.4 the criteria determining the period for which Personal Data will be stored, etc.

14.4 Request rectification. You have the right to rectify Personal Data in case the data is incorrect or incomplete.

14.5 Right to Withdraw Consent for Data Processing. You are entitled to withdraw the consent granted for the processing of Personal Data at any time. Withdrawal does not affect the lawfulness of the processing conducted before the withdrawal. If you withdraw your consent, we may not be able to provide certain Services to you, but we will advise you if this is the case at the time you withdraw your consent;

14.6 Right to erasure. Sometimes called Right-to-be-forgotten. You have the right to revoke previously provided consent and have the Personal Data erased from our system. In this case, Third Parties will no longer have access to your Personal Data. However, it does not mean that your data will be erased immediately; it will still be stored at our facility in order to comply with numerous statutory obligations, specifically a provision of the GDPR regulations, AML and CFT requirements, under which we are required to store any collected information for a minimum period of 10 (ten) years from relations termination, for the purposes of the prevention, detection, analysis, and investigation of money laundering or funding of terrorism activities. Your Personal Data will be erased from our records after this period has elapsed.

14.7 Restrict processing. You have the right to ask us to restrict the processing of the Personal Data in case the data is incorrect or incomplete, or in case Personal Data is processed unlawfully. Nevertheless, the AML/CFT Regulations require us to store your Personal Data for at least 8 years after the end of the relationship between us and a User. Biometrics are processed and stored so long as the other Personal Data as set forth in this Privacy Policy. This period may be further extended in certain cases if so provided by and in accordance with the applicable legislation. Upon amendment or removal of your Personal Data, it is archived and safekept separately from processed Personal Data.

14.8 Receive Personal Data. You have the right to receive the Personal Data concerning you provided to us, in a structured, commonly used and machine-readable format. We are obliged and have provided all the information which you have right to receive. This Privacy Policy concludes all the information and is available to you on our Website at any point of time.

14.9 Have Personal Data transmitted. You have the right to have the Personal Data transmitted directly from one Controller to another, where technically feasible. You may request the transfer of the Personal Data to you or to a Third Party, and we will provide to you, or a Third Party you have chosen (where technically feasible), your Personal Data; note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

14.10 Right to Object. You have the right to object, on grounds relating to your particular situation, where there is a reason to believe that we have no lawful grounds for processing Personal Data, at any time to processing of Personal Data. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

14.11 Requests and Complaints. If you have any queries in relation to this policy, you wish to access or correct the Personal Data we hold about you, or make a complaint in accordance with our Complaints Procedure.

14.12 In order to disclose information to you in response to a request for access, we may require you to provide us with certain information to verify your identity. GDPR may prescribe exceptions which may affect your right to access your Personal Data.

14.13 In the event that you believe that there has been a breach of GDPR, we invite you to contact us as soon as possible.

14.14 If you are not satisfied with our handling of a complaint or the outcome of a complaint, you have the right to lodge a complaint with an appropriate authority:

The Office for Personal Data Protection of the Czech Republic:
Address: Pplk. Sochora 27, 170 00 Praha 7
Phones: +420 234 665 800 / +420 234 665 111
E-mail [email protected]
Website: https://uoou.gov.cz/en

14.15 Should we lawfully receive your Personal Data from a Third Party, you will have the same rights regarding the information in question as related to information you provided to us directly, or we have collected during cooperation with you.

15. Use of Cookies

15.1 When you visit our Website or the website of our Third Party, we and our Third Parties may use the Cookies to recognise you and customise your online experience. For more information, please refer to the Cookies Policy.

16. Miscellaneous

16.1 Please acknowledge, by implementing some rights given by GDPR (erasure, stop processing), you will be deprived of some features of the Website and/or Platform, and in some cases, where applicable, we may be forced to close your access to our Website/Platform. Despite the rights exercised by you, we anyway could proceed with your Personal Data processing, if required by law.

16.2 We are committed to protecting the privacy of Personal Data and make every effort to disclose the processing details clear and simple to understand.

16.3 Should you have any questions concerning the information above, please, don’t hesitate to contact us as set forth above.

16.4 This Privacy Policy may from time to time be updated or amended. We will post any such updates on the Website and an alert notification will be sent to you. Such updated Privacy Policy as posted will take effect immediately, unless otherwise indicated.