Rules

Last updated: 4 November 2025

Intro

IOOI Sp. z O.O (“PocketBank” or “we”) welcomes you. This Privacy Notice (“Privacy Notice”) applies to our Website https://pocketbank.net/ (the “Service”). The Privacy Notice describes which of your personal data PocketBank collects, how stores, processes, and uses it, and what happens when you use the Service.

About us

We are the controller of your personal data processed through the Service. This means that we determine the purposes and means of personal data processing. Pay attention that you can fall into several categories depending on your actions.

About you

When you visit the Service, you become our user (“User”). We divide the Users into categories so you can easily find details about the processing of your personal data.

Please note! We do not knowingly process the personal data of Users under the age of 18. If you are such a User or the legal representative of such a User, please contact us.

Personal data

Sources of data

We receive your data when you visit the Service and interact with it, depending on your actions on the Service. Additionally, we may receive your data when you contact us via Telegram or email.

You can change your personal data by exercising your right to rectification or by the Service functionality. Please note that the same lawful basis and storage terms apply to the changed data.

We may also (although we do not necessarily do so) receive data from third parties. It depends on your settings and the features you use.

Lawful bases for processing

To process your personal data, we rely on the following lawful bases:

• performance of the contract — for the processing of personal data necessary for the negotiating on, conclusion, and performance of a contract (mainly, the Terms of Service) with you;
• legitimate interest — for the processing necessary at the development of our services, taking into consideration your interests, rights, and expectations;
• legal obligation — for the processing as required by applicable laws (for example, to comply with tax or KYC/AML regulations) or if requested by a law enforcement agency, court, supervisory authority, or another state-authorised public body;
• consent — for additional specific purposes.

Visitors’ data

When you use the Website as the Visitor, we collect some data automatically. We need technical data to operate, support, and improve the Website’s functionality.

Data storage

Registration data

When you register an account and start to use our service, we collect or assign the data to enable you access and correct work of the Service.

Data storage

Data that is processed based on performance of the contract: Stored for 5 years from the last interaction.

General technical data

This section includes information collected for maintaining and optimising the technical aspects of the service, such as device information, browser details, and session logs. This data helps ensure the smooth functioning and security of the service.

Data storage

Data based on performance of the contract: Stored for 5 years from the last interaction.

Data based on legitimate interest: Stored for 5 years from the last interaction, if you do not object.

Account data

Account data consists of information related to user accounts, including registration details, authentication records, and account preferences. This data is essential for user access and customization of the service.

Data storage

Data based on legal obligation: Stored for 5 years from the collection.

Data based on performance of the contract: Stored for 5 years from the last interaction.

Usage data

Usage data encompasses information about how users interact with the service, including pages visited, actions performed, and duration of sessions. This data aids in understanding user behaviour and improving the service based on usage patterns.

Data storage

Data based on performance of a contract: Stored for 5 years from the end of service usage.

Сrypto exchange process

Data related to cryptocurrency exchange processes, including transaction history, exchange rates, and wallet information. This data is necessary for executing and monitoring cryptocurrency transactions securely.

Data storage

Data based on performance of a contract: Stored for 5 years from the end of service usage.

Notification and marketing data

Information gathered for managing communication with users, including email preferences, notification settings, and marketing analytics. This data helps in delivering relevant updates and promotions to users.

Data storage

Data based on legitimate interest: Stored for 5 years from the last interaction, if you do not object.

Data based on consent: Stored for 5 years from collection, if you do not withdraw consent.

Third-party providers

We use 3rd-party providers for our marketing activities. Here you can see the list and read how we involve them.

Report and customer support data

Data collected during customer support interactions, including issue reports, support tickets, and user feedback. This data is vital for resolving user queries and improving the overall service experience.

Data storage

Data based on performance of a contract: Stored for 5 years from the end of service usage.

Data received from third parties

We may receive some personal data from third parties. The amount of data collected, the purposes, and the lawful basis for processing is determined by the respective privacy documents of these third parties.

Data storage

Data sharing with third parties

We can share your personal data with third parties without any harm to you and in full compliance with applicable law. In addition, we have implemented organisational and technical measures to ensure the security of personal data during data transfer to third-party.

To get a detailed list of the third-party recipients of your personal data, contact us.

To share your data, we rely on the following lawful bases, depending on the case: consent, compliance with the law, and performance of a contract.

Data transfer outside the European Economic Area

The data is stored in Germany by default, but we may need to process your personal data in another country.

If there is no adequate decision by the European Commission regarding the country we transfer data to, we use the adopted Standard Contractual Clauses based on legislation assessments for data protection during transfer and storage.

If there is an adequate decision by the European Commission regarding the country we transfer data to, we can transfer personal data to that third country without any further safeguard being necessary.

You can read more detailed measures to protect your personal data here.

Data protection

We are regularly certified by ISO 27001 Standard. We apply a variety of security measures appropriate to the possible risks.

Organisational measures

• Staff training
• Internal policies and instructions
• Non-disclosure agreements (NDA)
• Transfer protection

Physical measures

• Video monitoring
• Signalling
• Limited access to premises
• Round the clock security

Technical measures

• Two-factor authentication
• Backups
• Firewalls
• Encryption technologies

Data subjects rights

You, as a data subject (individual), have the right to interact with your data directly or through a request to us. This section describes these rights and how you can exercise them depending on your residency.

European Economic Area residents

You, as a data subject, have the right to interact with its data directly or through a request to us. This section describes these rights and how you can exercise them:

To exercise your rights, contact us. If your request was not satisfied, you can submit a complaint to your local Data Protection Authority. You may find it here.

Cookies

We use cookies that are needed for the website’s operation. By using cookies, we receive automatically collected data. You can read more in the Cookie Policy.

If you want to turn off cookies, you can find instructions for managing your browser settings at these links:

• Internet Explorer
• Firefox
• Chrome
• Opera
• Microsoft Edge
• Vivaldi
• Safari
• Brave

Privacy Notice updates

This Privacy Notice is developed according to the General Data Protection Regulation, other applicable privacy laws, and best privacy practices.

Existing laws and requirements for the processing of personal data are subject to change. In this case, we will publish a new version of the Privacy Notice.

If there are material changes to the Privacy Notice or the Service that affect your data privacy rights, we will notify you by displaying information via the Service and, if necessary, ask for your consent.