1. Controller
The controller for all processing described here is POOOL GmbH, Berlin — full contact details in the Imprint. Questions about your data: privacy@poool.example (Platzhalter — add DPO contact if one is appointed).
2. What data we process
Browsing: server logs (IP address, timestamp, requested page) to deliver the site securely. Account: name, email address and authentication data (password hash or passkey). Identity verification: ID document data and screening results, as required by anti-money-laundering law (see the AML / KYC Policy). Investing: orders, holdings, payouts and payment details. Communication: messages you send to our support.
3. Purposes and legal bases (Art. 6 GDPR)
We process your data to provide the platform and execute your investments (Art. 6(1)(b) — contract), to meet legal obligations such as KYC, sanctions screening and record-keeping (Art. 6(1)(c)), for platform security and fraud prevention (Art. 6(1)(f) — legitimate interest), and for marketing emails only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
4. Recipients
We share data only where necessary: identity-verification and payment providers, custodian and banking partners, IT hosting providers under data processing agreements, and authorities where the law requires it. We never sell your data. (Platzhalter — list actual processors.)
5. International transfers
Where processors are located outside the EU/EEA, we rely on adequacy decisions or EU standard contractual clauses with supplementary measures.
6. Retention
We keep your data only as long as needed for the purposes above. Statutory retention periods apply in particular to KYC records and transaction data (5–10 years under AML and commercial / tax law). After that, data is deleted or anonymised.
7. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can also lodge a complaint with a supervisory authority — for us, the Berlin Commissioner for Data Protection and Freedom of Information (Platzhalter — adjust to actual seat).
Questions about this document? privacy@poool.example
Earlier versions of this document are available on request.