Data protection notice in accordance with the EU General Data Protection Regulation (GDPR)

This Privacy Policy is effective as of August 2026.

The following information gives you an overview of how your personal data is processed in connection with Finoa GmbH and the services it delivers, and of your rights under data protection law.

Finoa GmbH is a technology infrastructure provider. Through its technical services offering, it provides technology that enables regulated virtual asset service providers (VASPs) and other institutions (“clients”) to protect and manage their own customers’ digital assets on a secure platform. Finoa GmbH is not an authorised Crypto-Asset Service Provider. It does not exercise control over client assets, does not provide custody, and does not execute orders; all regulated services are performed by the client’s own licensed entities.

1. Who is responsible for data processing and whom can I contact?

Responsible entity is:

Finoa GmbH

Voltastraße 1, 14482 Potsdam, Germany

E-Mail: contact@finoa.io

You can reach our Data Protection Officer (DPO) at:

Name: Martin Bastius

Company: heyData GmbH

Address: Schützenstraße 5, 10117 Berlin

Phone: +498941325320

E-Mail: datenschutz@heydata.eu

Please note: for job applications submitted via our careers page, the controller may instead be Finoa (LT) UAB (company register no. 307406608, Upės 23-1, Vilnius, Lithuania) where you apply for a role with that entity. See section 13 (Applications and recruitment) for details.

2. What sources and data do we use?

As controller, we process personal data that you provide to us or that arises when you interact with us — for example when you visit our website, contact us, subscribe to our newsletter, or act as a contact person or authorised representative of a business client or partner. We may also process data lawfully obtained from publicly accessible sources (e.g. commercial registers, press, internet) where permitted.

This includes, but is not limited to:

• Contact and identification data: name, business contact details (email, phone, address), job title/role, and, for our business clients, company and representative information.
• Website and usage data: IP address, device and browser information, pages visited, and interactions with our website (see the sections on analytics and cookies).
• Communication and marketing data: correspondence with us (inquiries, support), and — where you have subscribed — your newsletter email address and related preferences.

3. What do we process your data for (purpose of processing) and on what legal basis?

We process the aforementioned personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3.1 Main purposes (as controller)

As controller, we process personal data to operate and secure our website; to respond to your inquiries and provide support; to establish, manage and perform our business relationships and contracts with clients and partners (including communicating with their representatives); to send newsletters and information where you have subscribed; and to analyse and improve our website and services.

This includes, but is not limited to:

• Providing, operating and securing our website and online services.
• Establishing and managing client and partner relationships, contracts and the onboarding of business clients.
• Handling inquiries and providing support.
• Sending newsletters and service communications where you have subscribed or where otherwise permitted.

The processing is carried out to fulfil: contractual and pre-contractual obligations with our clients and partners (Art. 6(1)(b) GDPR); our legitimate interests in operating, securing and improving our website and business (Art. 6(1)(f) GDPR); your consent where required, e.g. for the newsletter and certain cookies (Art. 6(1)(a) GDPR); and compliance with legal obligations to which we are subject as a German company, in particular commercial and tax law (Art. 6(1)(c) GDPR).

General provisions:

3.2. Based on your consent (Article 6 para. 1 a GDPR)

If you have given us consent to process personal data for certain purposes, this processing is lawful on the basis of your consent. Consent given can be revoked at any time. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected. You can request a status overview of the consents you have granted from us at any time.

3.3. For the fulfillment of contractual obligations (Article 6 para. 1 b GDPR)

We process personal data to establish and perform our contracts with clients and partners, and to take pre-contractual steps at your request, on the basis of Art. 6(1)(b) GDPR.

3.4. Within the scope of the balancing of interests (Article 6 para. 1 f GDPR)

Where necessary, Finoa GmbH will process your data to protect the legitimate interests of Finoa GmbH or third parties (Art. 6(1)(f) GDPR). Examples:

• Assertion of legal claims and defense in legal disputes.
• Ensuring the IT security and the IT operation of Finoa GmbH.
• Analysing and improving our website and services
• Preventing fraud and misuse of our website and services

4. Who gets my data?

Within Finoa GmbH, access to personal data is granted to those units that need it for the purposes described. Service providers and processors engaged by us (e.g. hosting, IT, communications and support tools) may receive data for these purposes where they are bound by a data processing agreement and act on our written instructions (Art. 28 GDPR). Finoa group companies may receive data where necessary for administration and the purposes described.

We treat your data confidentially and only disclose it where this is required by law, where you have consented, where we are otherwise permitted, or to processors who are bound by a data processing agreement.

Under these conditions, recipients of personal data may be, for example:

• Public bodies and institutions (e.g. tax authorities, courts) where disclosure is required by law.
• Service providers and processors that support our operations, for example: hosting and IT infrastructure, software maintenance, communications and customer support, website management, analytics, marketing/newsletter tools, and professional advisers (e.g. auditors).
• Other data recipients may be those entities for which you have given your consent to the transfer of data or for which you have released us from confidentiality pursuant to an agreement or consent.

5. Is data transferred to a third country or to an international organization?

Data is transferred to countries outside the EU/EEA (so-called third countries) only where this is necessary for the stated purpose and/or required by law, where you have consented, or within the scope of data processing under Art. 46 et seq. GDPR. Any such transfer takes place on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or, in the absence of adequacy, appropriate safeguards such as Standard Contractual Clauses (Art. 46(2)(c) GDPR) accompanied by a data transfer impact assessment.

6. How long will my data be stored?

Personal data is retained only for as long as necessary for the purposes described and to satisfy the statutory retention periods to which Finoa GmbH is subject (in particular commercial and tax retention periods). Once the applicable periods expire, data is deleted or anonymised.

7. What data protection rights do I have?

You have the right of access to your information pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing according to Art. 18 GDPR, the right to data portability according to Art. 20 GDPR and the right to object pursuant to Art. 21 GDPR wherever we process your data on the basis of legitimate interests under Art. 6 para. 1 lit. f of GDPR. In addition, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you believe that the processing of your personal data is not lawful. Insofar as the processing of data is based on your consent, pursuant to Art. 7 GDPR you are entitled to revoke your consent to the use of your personal data at any time. Please note that the revocation is only effective for the future. Processing operations that took place before the revocation are not affected by this. Please also note that we may have to retain certain data for a certain period of time in order to comply with legal requirements.

8. Is there an obligation for me to provide data?

You are generally not legally obliged to provide personal data to us. However, to enter into and perform a contract or business relationship, or to respond to your inquiry, we need the relevant contact and contractual data; without it we may be unable to provide the requested service or information.

9. Is there any automated decision-making (including profiling)

In connection with the establishment and operation of your business relationship, we do not use automated decision-making within the meaning of Article 22 GDPR. Should we use such procedures in individual cases, we will inform you separately where this is required by law.

10. Communication for business initiation and customer service

10.1. Contact form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provide there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions.

The legal basis for the processing of your data, which is transmitted in the course of sending the message, is Art. 6 para. 1 p. 1 lit. b of the GDPR, insofar as your contact is aimed at the conclusion of a contract with us or the communication concerns an already existing contractual relationship.

If the contact is neither related to a contract nor aimed at the conclusion of a contract, the legal basis for the data processing is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a of the GDPR.

The data entered by you in the contact form will remain with us until you request us to solve the problem, revoke your consent for storage, or the purpose for which the data is stored no longer applies (e.g. after your inquiry has been processed). Mandatory legal provisions - in particular retention periods - remain unaffected.

10.2. Inquiry by email, telephone

If you contact us by email, telephone, your inquiry including all personal data (name, inquiry) will be stored and processed by us for the purpose of processing your request.

The legal basis for the processing of your data, which is transmitted in the course of sending the message, is Art. 6 para. 1 lit. b of the GDPR, insofar as your contact is aimed at the conclusion of a contract with us or the communication concerns an already existing contractual relationship.

If the contact is neither related to a contract nor aimed at the conclusion of a contract, the legal basis for the data processing is your consent pursuant to Art. 6 para. 1 lit. a of the GDPR.

The data sent to us by you via contact inquiries will remain with us until you request us to delete it, revoke your consent to its storage, or the purpose for storing it no longer applies (e.g. after your inquiry has been processed). Mandatory legal provisions - in particular legal retention periods - remain unaffected.

11. Use and link to social media

11.1. Use of X

Functions of the X service are integrated into our services. These functions are offered by the:

X Internet Unlimited Company, One Cumberland Place, Fenian Street Dublin 2, D02 AX07 Ireland.

By using X and the "Repost" function, the websites you visit are linked to your X account and made known to other users. This also involves the transfer of data to X. We expressly point out that we, as the provider of the services, have no knowledge of the content of the transmitted data or its use by X. Further information on this can be found in the X privacy policy. You can change your data protection settings on X.

11.2. Use of LinkedIn

Our services use functions of the LinkedIn network. The provider is:

LinkedIn Ireland Unlimited Company,

Wilton Place, Dublin 2, Ireland.

When you visit our services and click the LinkedIn plugin ("Recommend button"), a connection to LinkedIn servers is established. LinkedIn will be notified that you have visited our services using your IP address. If you click on the LinkedIn "Recommend Button" and are logged into your LinkedIn account, LinkedIn may associate your visit to our services with your account. We expressly point out that we, as the provider of the pages, have no knowledge of the content of the data transmitted or of the use of such data by LinkedIn. You can find further information on LinkedIn’s data protection provisions.

The LinkedIn Insight Tag enables the collection of data regarding members’ visits to Finoa's website, including the URL, referrer, IP address, device and browser characteristics (User Agent), and timestamp. The IP addresses are truncated or (when used for reaching members across devices) hashed, and members’ direct identifiers are removed within seven days in order to make the data pseudonymous. This remaining pseudonymized data is then deleted within 180 days.

11.3. Use of Google Analytics

We have integrated the component Google Analytics (with an anonymization function) on this website. Google Analytics is a web analytics service. Web analysis is the gathering, collection, and analysis of data about the behavior of visitors to websites. Among other things, a web analysis service collects data on which website a data subject has come to a website from (so-called referrers), which subpages of the website were accessed, or how often and for which period of time a subpage was viewed. A web analysis is mainly used to optimize a website and for the cost-benefit analysis of Internet advertising.

The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Google Analytics uses cookies. The information generated by the cookie about your use of this website is usually transmitted to a Google server and stored there. Google might transfer the personal information collected via this technical procedure to third parties.

During your visit to the website the following data, among others, is recorded:

• The achievement of "website objectives" (e.g. contact requests and newsletter subscriptions)
• Your behavior on the pages (for example clicks, scrolling behavior, and dwell time)
• Your approximate location (country and city)
• Your IP address (in abbreviated form, so that no clear assignment is possible)
• Technical information such as browser, Internet provider, terminal device, and screen resolution
• Source of your visit (i.e. which website or advertising medium brought you to us)
• This data may be transferred to a Google server in the USA; such transfers are based on the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses.

Google Analytics stores cookies in your web browser for a period of two years since your last visit. These cookies contain a randomly generated user ID with which you can be recognized during future visits to the website. The recorded data is stored together with the randomly generated user ID, which enables the evaluation of pseudonymous user profiles. This user-related data is automatically deleted after 26 months. Other data remain stored in aggregated form for an unlimited period.

If you do not agree with the collection, you can prevent this by installing the browser add-on once to deactivate Google Analytics.

12. Information on your right of objection under Art. 21 of the General Data Protection Regulation (GDPR)

12.1. Right to object on a case-by-case basis

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) of the GDPR (data processing in the public interest) and Article 6(1)(f) of the GDPR (data processing on the basis of an assessment of interests). This also applies to profiling based on this provision within the meaning of Article 4 (4) GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that overrides your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.

12.2. Right to object to the processing of data for advertising purposes

In individual cases, we process your personal data for the purpose of direct advertising. You have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. This also applies to profiling, insofar as it is associated with such direct advertising. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes. The objection can be made form-free.

12.3. Recipient of an opposition

The objection can be made informally with the subject "Objection", stating your name, address, and date of birth, and should be addressed to:

Finoa GmbH

Voltastraße 1

14482 Potsdam, Germany

E-Mail: datenschutz@finoa.io

12.4. Additional information

If you would like information that this data protection notice cannot provide or if you would like further information on a specific point, please contact the Finoa GmbH data protection team at: datenschutz@finoa.io.

13. Applications and recruitment

If you apply for a position advertised on our careers page, we process the personal data you provide as part of your application. The controller for your application is the Finoa entity that has published the vacancy you apply for: Finoa GmbH, Voltastraße 1, 14482 Potsdam, Germany, for roles with Finoa GmbH, or Finoa (LT) UAB (company register no. 307406608), Upės 23-1, Vilnius, Lithuania, for roles with Finoa (LT) UAB. This section applies to both; where the applicable legal basis or the competent supervisory authority differs, this is indicated below.

13.1. What data we process and why

We process the information contained in your application, such as your name and contact details, CV, cover letter, qualifications, references and certificates, together with any notes and assessments we make during the selection process. Where legally required, we also process further documents and information necessary for the specific role — for example proof of your eligibility to work (such as a work and residence permit for non-EU/EEA nationals), evidence of professional qualifications or licences required for the position, and, where mandated by law for the role, a criminal record certificate or a health/aptitude certificate. We use this data to assess your suitability for the role and to carry out the recruitment process.

13.2. Legal basis

Where Finoa GmbH is the controller, the legal basis is Art. 6(1)(b) GDPR (processing for the decision on whether to establish an employment relationship and the related pre-contractual steps).

Where Finoa (LT) UAB is the controller, the corresponding legal basis is Art. 6(1)(b) GDPR together with applicable Lithuanian law (in particular the Labour Code of the Republic of Lithuania and the Law on Legal Protection of Personal Data).

In both cases, where you give us separate consent — for example to keep your details in our talent pool for future vacancies — the legal basis is Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future. We may also rely on our legitimate interests (Art. 6(1)(f) GDPR), in particular to defend against potential legal claims. Special categories of personal data (such as information on health or a severe disability) are processed only if you provide them voluntarily and in accordance with Art. 9(2) GDPR.

13.3. Recipients and applicant management system (Personio)

Within Finoa, access to your application data is limited to those employees on a need-to-know basis. To receive and manage applications we use the applicant management system provided by Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany, which acts as our processor on the basis of a data processing agreement (Art. 28 GDPR) and hosts the data within the EU. Applications are submitted via the Personio-operated recruitment website (finoa.jobs.personio.com): for the content of your application Finoa GmbH is the sole controller, while for the technical operation of that website (e.g. server logs and cookies) Personio provides its own privacy information as controller. Where a vacancy is coordinated within the Finoa group, your application may be shared between Finoa GmbH and Finoa (LT) UAB for the purposes of the recruitment process.

13.4. How long we keep applicant data

If your application is unsuccessful, we delete your application data no later than six months after completion of the selection process, unless a longer retention period is necessary (for example to defend against legal claims) or you have consented to storage in our talent pool. If we enter into an employment relationship with you, your data is transferred to your personnel file. The same applies where an offer is withdrawn before the employment relationship begins: your data is then treated as an unsuccessful application and deleted within the same period, unless a longer statutory retention period applies.

13.5. Voluntary provision, your rights and automated decisions

Providing your application data is voluntary; however, without the data required for the position we will not be able to consider your application. Your data-protection rights set out in section 7, including the right to lodge a complaint with a supervisory authority, apply. We do not use automated decision-making within the meaning of Art. 22 GDPR to evaluate applications. The competent supervisory authority is the Brandenburg data protection authority for applications to Finoa GmbH, and the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija) for applications to Finoa (LT) UAB.

Cookies Declaration

We use cookies and similar tracking technologies to enhance your experience on our website, analyze site traffic, and deliver personalized content. Cookies are small text files stored on your device that help us provide a functional and secure environment.

You have the right to decide whether to accept or reject non-essential cookies. You can update your preferences, change your selection, or withdraw your consent at any time by clicking the Cookie Settings Widget in the bottom left of any page of the website.

The lists below provide a comprehensive overview of the cookies used on our domain (www.finoa.io). These are categorized by their specific purpose, including their provider, type, and expiration period.