Privacy Notice
Lunar Block A/S, Hack Kampmanns Plads 10, 8000 Aarhus C, Denmark, CVR: 38808117, (“Lunar”, “we” and “us”) is the data controller responsible for the processing of personal data related to your use of the crypto trading platform, as described below.
Purpose of processing
Overall we are processing your personal data for four different purposes: 1. to know who you are, 2. to make the crypto trading platform available, including executing the transactions you request, 3. to provide you with the best possible platform, and 4. for sending you marketing material. The purposes are described further below.
- Before making the crypto trading platform available to you, we are legally required to collect certain information about you and to make an assessment of you as a customer, including collecting identification documentation. In order to do so, we will be collecting a lot of information about you, either, with your consent, from Lunar Bank A/S or directly from you. This information is also known as Know Your Customer (KYC) data.
- When you want to either purchase or sell crypto assets, we will be tracking your requests and the transactions performed in order for us to document all trades and trade orders. We will also continuously be providing you with an overview of your current holdings.
- In order to give you the best possible experience when using the crypto trading platform, we track how you use it. This gives us an idea of what works well and where we can improve your user experience.
- If you have given us your consent to receive marketing material, we will use your personal data to send you information about new products, features and offers.
Categories of personal data
All the personal data we collect about you is being processed for specific purposes as described above.
The personal data we process can be these overall categories:
- Identity information, including basic information such as your name and citizenship, but also documentation of your identity and national identification number
- Contact information
- Information on whether you hold a prominent public function (PEP)
- Financial and economic information, including information about all transactions related to your account
- Communication records, both written correspondence between us and recordings of phone calls
- Information about the purpose and intended extend of your customer relationship with us
- Technical information about how you use the crypto trading platform provided in the Lunar app
- Sensitive or special categories of information. As a basis we don’t process sensitive information about you unless you choose to disclose it to us
- Other information you may disclose to us
Legal basis for processing
The legal basis for Lunar processing this information is found in both the financial regulation and other places. These include:
- The Money Laundering Act
- The Bookkeeping Act
- The Payment Act
- The Marketing Act
- The Danish Data Protection Act
Depending on the purpose, we will also be processing your personal data under the rules of the General Data Protection Legislation (GDPR). This processing can be based on your consent, cf. art. 6.1 (a) e.g. when sending you marketing material, when necessary for the performance of a contract or prior to entering into a contract, cf. art. 6.1 (b) e.g. when providing you with technical support, when necessary for the compliance with legal obligations, cf. art. 6.1 (c) e.g. in relation to all the different laws mentioned above, or based on our legitimate interest, cf. art. 6.1 (f) e.g. as part of our efforts to develop new services or to strengthen our IT- and payment security.
Retention
All the personal information we process, as described above, is being processed to fulfill a specific purpose, and for each purpose we have assessed how long the information is necessary and set up retention rules to ensure that we don’t keep anything longer than necessary. For example, according to the Money Laundering legislation, we have to keep transaction information, documents and registrations for at least five years after the completion of a transaction.
Recipients of personal data
We only share your personal data with third parties where it is absolutely necessary for us in order to provide you with our services. These third parties are either acting under our instructions as data processors or will be receiving your personal data as individual data controllers, who also need to process the information for their own purposes, e.g. to live up to legal requirements.
We do not sell your personal data.
Data processors
Our data processors will only be processing your personal data under the rules of the GDPR and in accordance with the data processing agreement we have in place, which include strict instructions on how the personal data may be processed and specific security requirements.
We use an external partner to help us with developing, maintaining and hosting the crypto trading platform. We have also chosen to outsource the ongoing Anti Money Laundering screening and direct, initial customer support to a third party.
Data Controllers
The last step of finalizing a purchase order is to confirm the payment. That will happen via a third party payment application embedded in the crypto trading platform. The check out solution is provided by Lunar Bank A/S, who, as part of the transaction, will receive information about the transaction between you and us and act accordingly. As a payment solution provider, they will keep information about the transaction in order to comply with their own documentation obligations. You can find more information about how they process your personal data on www.lunar.app.
Data subjects’ rights
As a data subject, you have a number of rights that allow you to stay in control of how your personal data is being used. These rights are described a little further in this section. You can also find more information about these rights on your local data protection authority’s website. A list of links to the local data protection authority is found below.
If you want to exercise one of these rights, please contact us as described below.
The right to access
You have the right to obtain information about whether or not personal data is being processed about you and, where that is the case, information about the types of personal data being processed, the purpose for processing the personal data and, where possible, the expected period the personal data will be stored.
The right to rectification
If any of the information we have about you somehow is incorrect, incomplete or irrelevant, you have the right to have it corrected.
The right to be forgotten (erasure)
In certain situations you have the right to have your information deleted from our databases and thereby be forgotten. There are, however, some limitations to this right, e.g. when we need the information to comply with documentation requirements or to defend Lunar against legal claims.
The right to restriction of processing
In some situations, typically related to the fulfillment of other requests to exercise your rights, you have the right to restrict the processing of your personal data. That will, in nature, limit Lunar’s ability to process your personal data without your consent for other purposes than storage and the establishment, exercise or defence of legal claims.
The right to data portability
You have the right to receive the personal data, which you have provided to Lunar, in a structured, commonly used and machine-readable format and to have the personal data transmitted from Lunar to a new data controller. This basically means that in the unthinkable situation that you want to move to another bank, Lunar shall, at your request and where technically feasible, transmit the master data to that new bank.
The right to object against direct marketing
You have the right to object against certain processing activities, such as the processing performed in relation to direct marketing, including profiling.
Complaints
In the unfortunate event that you feel that we just aren’t good enough at explaining what we do and why we do it, or if you think that we are doing things that we shouldn’t, of course we hope that you will tell us directly so we get a chance to make things right, but you also have the right to raise a complaint with the local Data Protection Authority.
The Lunar Group has appointed a Data Protection Officer (DPO) who can be reached either:
- by email: dpo@lunar.app
- by mail: Hack Kampmanns Plads 10, 8000 Aarhus C, att. “DPO”
You can find contact information for the local authorities and a guide to how to raise a complaint on their websites:
Denmark: www.datatilsynet.dk
Norway: www.datatilsynet.no
Sweden: www.imy.se