Privacy notice

This notice is a plain summary of how personal data is handled. Where it differs from the privacy policy you accept when you open an account, that policy applies.

Who is responsible

The controller is Bitpanda GmbH, Stella-Klein-Löw Weg 17, 1020 Vienna, Austria, entered in the commercial register of the Commercial Court Vienna under FN 569240 v (VAT ID ATU78580117). It provides the crypto-asset services for residents of the EU and EEA. The terms summary names the other Bitpanda companies and what each one provides.

Data protection officer: to be confirmed. For any question about your data you can also contact Bitpanda through the official channels.

What we collect and why

• Account data. Your name, contact details and login details, to open and run your account. Legal basis: the contract with you.
• Identity verification data. Your identity document and the result of the check, handled with verification partners. Legal basis: a legal obligation, because anti-money-laundering law requires the check.
• Transaction data. Orders, deposits, withdrawals and transfers, to carry them out and to keep the records the law requires.
• Support messages. What you tell us in chat, on a call or by e-mail, to answer you and to handle complaints.

Data is kept while your account is open and afterwards for as long as anti-money-laundering, tax and company law require.

Bitpanda states that it processes personal data only for purposes permitted by the GDPR and does not use personal data for automated decision-making, including profiling. The security page explains how accounts and data are protected.

This concept site

This concept site sets no cookies, loads no analytics or other third-party scripts and has no forms that collect data. Its only outside request is for two typefaces, Oswald and Inter, from Google Fonts: to deliver them, Google's servers at fonts.googleapis.com and fonts.gstatic.com receive your IP address. Links to regulators and other outside websites lead to pages with their own privacy rules.

Your rights and how to complain

Under the GDPR you can ask for access to your data, for correction, for erasure, for restriction of processing and for a portable copy. You can object to processing and withdraw a consent you gave. Some records must be kept even after an erasure request, for example those that anti-money-laundering law requires.

To use a right, write to us through the contact page. If the answer does not satisfy you, follow the complaints procedure. You can also complain to a data protection authority; in Austria that is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).