Privacy Notice
Lunar Block A/S, Hack Kampmanns Plads 10, 8000 Aarhus C, Denmark, CVR: 38808117, ("Lunar", "we" and "us") is the data controller responsible for the processing of personal data related to your use of the crypto trading platform, as described below.
We also use AI tools to support our case handling. You can read more about this below.
Table of contents
Purpose of processing
About our use of AI tools (Claude Enterprise)
Categories of personal data
About data processed via AI tools
Legal basis for processing
Retention
Recipients of personal data
About Anthropic Ireland Limited as a data processor
Data subjects' rights
The right to be forgotten (erasure)
The right to restriction of processing
Right to human review (Article 22)
Complaints
Purpose of processing
Overall we are processing your personal data for four different purposes: 1. to know who you are, 2. to make the crypto trading platform available, including executing the transactions you request, 3. to provide you with the best possible platform, and 4. for sending you marketing material. The purposes are described further below.
- Before making the crypto trading platform available to you, we are legally required to collect certain information about you and to make an assessment of you as a customer, including collecting identification documentation. In order to do so, we will be collecting a lot of information about you, either, with your consent, from Lunar Bank A/S or directly from you. This information is also known as Know Your Customer (KYC) data.
- When you want to either purchase or sell crypto assets, we will be tracking your requests and the transactions performed in order for us to document all trades and trade orders. We will also continuously be providing you with an overview of your current holdings.
- In order to give you the best possible experience when using the crypto trading platform, we track how you use it. This gives us an idea of what works well and where we can improve your user experience.
- If you have given us your consent to receive marketing material, we will use your personal data to send you information about new products, features and offers.
About our use of AI tools (Claude Enterprise)
Lunar uses an AI tool (Claude Enterprise, provided by Anthropic) as a work aid for our employees in connection with case handling, customer service and compliance tasks.
The use of AI assistance does not change the legal basis for the processing of your personal data otherwise. The relevant processing purposes and legal bases are:
AI-assisted customer service and complaint handling
Our employees may use Claude to draft responses to your enquiries, summarise case history or analyse documentation in connection with your case – in order to handle your case more efficiently and accurately.
Claude does not replace our employees. All responses to enquiries, complaint outcomes etc. are reviewed and approved by a Lunar employee before being communicated to you.
Lunar will, upon request, inform you whether Claude has been involved in the handling of your case. You can also read about your rights in connection with AI-assisted processing under "Data subjects' rights" below.
The processing of personal data for the purpose of handling your enquiry takes place in accordance with Article 6(1)(b) of the GDPR, as also stated above.
AI-assisted anti-money laundering and KYC processing
In connection with anti-money laundering (AML), know-your-customer (KYC), sanctions screening and prevention of financial crime, our employees may use Claude to help process case information, structure analyses and prepare documentation.
The processing of personal data takes place in accordance with Article 6(1)(c) (legal obligation) under applicable AML legislation and EU anti-money laundering law.
Your national identification number is processed in accordance with applicable national data protection law in connection with identity verification requirements under AML legislation.
Where information about criminal offences is involved, processing is based on Article 10 of the GDPR in accordance with applicable national data protection law.
Administrative assistance and internal support
Our employees use Claude Enterprise for internal administrative tasks such as drafting emails, meeting summaries, translation and internal Q&A. This activity is primarily internally oriented and does not, as a starting point, concern your personal data. In cases where you are party to an internal communication (e.g. as a counterparty in an enquiry), information about you may however be included.
The processing of personal data takes place in accordance with Article 6(1)(f) (legitimate interests – our legitimate interest in internal efficiency).
Categories of personal data
All the personal data we collect about you is being processed for specific purposes as described above.
The personal data we process can be these overall categories:
- Identity information, including basic information such as your name and citizenship, but also documentation of your identity and national identification number
- Contact information
- Information on whether you hold a prominent public function (PEP)
- Financial and economic information, including information about all transactions related to your account
- Communication records, both written correspondence between us and recordings of phone calls
- Information about the purpose and intended extent of your customer relationship with us
- Technical information about how you use the crypto trading platform provided in the Lunar app
- Sensitive or special categories of information. As a basis we don't process sensitive information about you unless you choose to disclose it to us
- Other information you may disclose to us
About data processed via AI tools
In cases where our employees use Claude Enterprise in connection with your case, relevant case information may be included in the information provided to the AI system. The specific data types depend on the purpose of use:
General case handling: Name, contact details, case number and case content.
AML/KYC and compliance cases: Identification information, including national identification number (processed under applicable national data protection law in connection with AML identification requirements), as well as PEP/sanctions status and AML case description. Full transaction histories are not part of AI prompts.
The following data types are not processed in the AI system:
- Payment data as defined in applicable payment services legislation; i.e. personally identifiable information about where you have used a payment service and what has been purchased.
- Special categories of personal data (health, religion, political opinion, trade union membership, etc.).
Legal basis for processing
The legal basis for Lunar processing this information is found in both the financial regulation and other places. These include:
- The Money Laundering Act
- The Bookkeeping Act
- The Payment Act
- The Marketing Act
- The Danish Data Protection Act
Depending on the purpose, we will also be processing your personal data under the rules of the General Data Protection Legislation (GDPR). This processing can be based on your consent, cf. art. 6.1 (a) e.g. when sending you marketing material, when necessary for the performance of a contract or prior to entering into a contract, cf. art. 6.1 (b) e.g. when providing you with technical support, when necessary for the compliance with legal obligations, cf. art. 6.1 (c) e.g. in relation to all the different laws mentioned above, or based on our legitimate interest, cf. art. 6.1 (f) e.g. as part of our efforts to develop new services or to strengthen our IT- and payment security.
Retention
All the personal information we process, as described above, is being processed to fulfill a specific purpose, and for each purpose we have assessed how long the information is necessary and set up retention rules to ensure that we don't keep anything longer than necessary. For example, according to the Money Laundering legislation, we have to keep transaction information, documents and registrations for at least five years after the completion of a transaction.
Recipients of personal data
We only share your personal data with third parties where it is absolutely necessary for us in order to provide you with our services. These third parties are either acting under our instructions as data processors or will be receiving your personal data as individual data controllers, who also need to process the information for their own purposes, e.g. to live up to legal requirements.
We do not sell your personal data.
Data processors
Our data processors will only be processing your personal data under the rules of the GDPR and in accordance with the data processing agreement we have in place, which include strict instructions on how the personal data may be processed and specific security requirements.
We use an external partner to help us with developing, maintaining and hosting the crypto trading platform. We have also chosen to outsource the ongoing Anti Money Laundering screening and direct, initial customer support to a third party.
About Anthropic Ireland Limited as a data processor
When one of our employees uses Claude Enterprise in connection with your case, relevant case information is transmitted to Anthropic Ireland Limited, 1 Windmill Lane, Dublin 2, Ireland, which operates the Claude Enterprise service for Lunar. Anthropic processes your personal data solely as a data processor – under our instructions and under a Data Processing Agreement in accordance with Article 28 of the GDPR.
Anthropic does not use your personal data to train AI models. Data processed via the Enterprise service is not used for model improvement.
Anthropic Ireland Limited uses sub-processors to provide the Claude service, primarily for cloud infrastructure. A current list of Anthropic's sub-processors is available at trust.anthropic.com/subprocessors. We receive advance notice of sub-processor changes and may raise objections to their use.
In connection with our use of the Claude Enterprise AI tool, information about you is transferred to the United States. Anthropic Ireland Limited uses infrastructure operated by Anthropic PBC in the United States, and your personal data may therefore be transferred there as part of AI-assisted case handling.
The transfer takes place on the basis of the EU Standard Contractual Clauses (SCC), Module 2 (controller to processor). We have implemented supplementary safeguards including encryption in transit and at rest, data segregation and a contractual obligation for Anthropic to challenge unauthorised governmental access requests.
You may request a copy of the Standard Contractual Clauses by contacting dpo@lunar.app.
Data controllers
The last step of finalizing a purchase order is to confirm the payment. That will happen via a third party payment application embedded in the crypto trading platform. The check out solution is provided by Lunar Bank A/S, who, as part of the transaction, will receive information about the transaction between you and us and act accordingly. As a payment solution provider, they will keep information about the transaction in order to comply with their own documentation obligations. You can find more information about how they process your personal data on www.lunar.app.
Data subjects' rights
As a data subject, you have a number of rights that allow you to stay in control of how your personal data is being used. These rights are described a little further in this section. You can also find more information about these rights on your local data protection authority's website. A list of links to the local data protection authority is found below.
If you want to exercise one of these rights, please contact us as described below.
The right to access
You have the right to obtain information about whether or not personal data is being processed about you and, where that is the case, information about the types of personal data being processed, the purpose for processing the personal data and, where possible, the expected period the personal data will be stored.
The right to rectification
If any of the information we have about you somehow is incorrect, incomplete or irrelevant, you have the right to have it corrected.
The right to be forgotten (erasure)
In certain situations you have the right to have your information deleted from our databases and thereby be forgotten. There are, however, some limitations to this right, e.g. when we need the information to comply with documentation requirements or to defend Lunar against legal claims.
The right to restriction of processing
In some situations, typically related to the fulfillment of other requests to exercise your rights, you have the right to restrict the processing of your personal data. That will, in nature, limit Lunar's ability to process your personal data without your consent for other purposes than storage and the establishment, exercise or defence of legal claims.
The right to data portability
You have the right to receive the personal data, which you have provided to Lunar, in a structured, commonly used and machine-readable format and to have the personal data transmitted from Lunar to a new data controller. This basically means that in the unthinkable situation that you want to move to another bank, Lunar shall, at your request and where technically feasible, transmit the master data to that new bank.
Right to object
Where we process personal data about you on the basis of legitimate interests (Article 6(1)(f)) – including in connection with AI-assisted customer service and complaint handling etc. – you have the right to object to the processing on grounds relating to your particular situation. Contact dpo@lunar.app. You can always object to direct marketing.
Right to human review (Article 22)
Where decisions are based on automated processing, you have the right to:
- Human review: you may request that the decision be reviewed by a qualified Lunar employee.
- To submit your view: you may provide additional context or information relevant to the decision.
- To challenge the decision: you may challenge an outcome that you consider incorrect or unfair.
Please contact our customer service via the Lunar app or our DPO at dpo@lunar.app to exercise these rights.
Claude Enterprise is used as a work aid for our employees – not as an autonomous decision-making system. A Lunar employee reviews and approves any decision or communication that has legal effects or other significant implications for you. Claude does not have authority to make binding decisions about you.
Complaints
In the unfortunate event that you feel that we just aren't good enough at explaining what we do and why we do it, or if you think that we are doing things that we shouldn't, of course we hope that you will tell us directly so we get a chance to make things right, but you also have the right to raise a complaint with the local Data Protection Authority.
The Lunar Group has appointed a Data Protection Officer (DPO) who can be reached either:
By email: dpo@lunar.app
By mail: Hack Kampmanns Plads 10, 8000 Aarhus C, att. "DPO"
If you wish to complain about the processing of your personal data, you can contact the supervisory authority in your country of residence:
Denmark:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Telefon: 33 19 32 00
E-mail: dt@datatilsynet.dk
www.datatilsynet.dk
Norway:
Datatilsynet
Postboks 458 Sentrum
0105 Oslo
Telefon: 22 39 69 00
E-post: postkasse@datatilsynet.no
www.datatilsynet.no
Sweden:
Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm
Telefon: 08-657 61 00
E-post: imy@imy.se
www.imy.se
The information was updated with effect from 16 April 2026.