Privacy policy

Privacy policy

Download PDF (116 kB)

Preliminary information

The privacy and security of your data are of top priority for us. For this reason, we make every effort to apply effective protection measures that guarantee the confidentiality, integrity and availability of the information processed. In addition, another element that is of importance to us is the transparency of our processes - you have the right, as a data subject, to know the purpose and way we process your personal information.

This document presents the types of personal data processing activities that can be carried out within the scope of our services and identifies the procedure. However, if you do not find all the answers to your questions, please do not hesitate to contact our Data Protection Officers (DPO):,,

Who is the controller of your personal data?

The controller of the services available at depends on which service is being used. The services and their controllers are listed below:

  • Currency exchange - Sp. z o.o. with its registered seat in Zielona Gora at ul. Sienkiewicza 9
  • Money transfers - Conotoxia Sp. z o.o. with its registered office in Zielona Gora at ul. Sienkiewicza 9
  • Online store - Marketing Sp. z o.o. Sp. k. with its registered office in Zielona Gora at u. Sienkiewicza 9
  • Forex trading - Conotoxia, Ltd. with its registered office in Chrysorroiatissi 11, 3032 Limassol, Cyprus
  • Currency loans – Currency Lending Sp. z o.o. with its registered office in Zielona Gora at ul. Sienkiewicza 9
  • Other services available at - another company offering services on the online platform

The Companies mentioned above cooperate with each other as entities offering complementary services. The cooperation within the group enables the use of the full potential of the individual Companies' resources and thereby offers Users a wide range of financial services. Therefore, as part of certain processing activities, the Companies share personal data (only with your consent) and entrust themselves with the processing of personal data or co-collecting the data as a Web Portal executive may also function as a Processor Entity, which on behalf of other Data Controllers, maintains the ICT infrastructure used for the implementation of individual Services.

How do we process your personal data?

Personal data are any information that can identify a person, such as his or her name, phone number, email address. In turn, the term processing relates to all the operations performed on the personal data, e.g. collecting or analyzing it for the purpose of providing services.

The Privacy Policy applies to the personal data and other information that we receive from you when you use our services and any payable services and any information provided by telephone, text message, email, letter or other correspondence and in person.

We are obligated to protect your personal data. We carefully select and apply the appropriate security measures adequate to the identified risks. Detailed information is available here.

Our group is obliged to use your personal data in accordance with the applicable data protection legislation - in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Act of 10 May 2018 on the protection of personal data and special provisions. At the same time, we guarantee that your data will be processed in accordance with the purpose for which it was transferred to us, and if its processing is based on voluntary consent, you will be able to withdraw it at any time, without affecting the lawfulness of the processing based on consent prior to its withdrawal.

The use of our services, including downloading a mobile app or using related services, is subject to review of this Privacy Policy, the Online Terms and Conditions and the applicable Payment Service Terms and Conditions available here. In the following section of this Privacy Policy you shall find the following information:

  • What information is collected and how is it processed?
  • How long is your personal data stored?
  • What is the legal basis for the processing of your personal data?
  • Is your personal data shared with others?
  • What are your rights with respect to the personal data you provide?

What information is collected and how is it processed?

Financial services

Providing personal data for the purposes of using our services is voluntary, with the exception of cases where the obligation to provide such data is subject to the applicable law. However, the submission of data is necessary in order to execute some of our services.Your personal data is collected directly from you - this is the information you provide in order to use our services.

In order to open an Account, you must provide (a) your User Name (email), (b) your password and (c) your country of residence. We need this information to allow you to use your Account. Your Account Password is encrypted and you are required to protect your Account login details from unauthorized access by third parties.

Using Payment Services involves providing additional personal data, which includes, your name, surname, identification numbers, address data, identity document number or bank account number. You may also be asked to provide a copy of your ID card or other identity documents to confirm your personal data. On some occasions it may be necessary to submit other documents or information in order to use our services for the purpose of applying the financial security measures required by counteracting money laundering and terrorist financing laws in order to use our services.

We may use certain personal data to profile you in order to quickly and effectively detect a specific crime and the person who committed it. As a result of such profiling, potentially non-compliant money laundering or terrorist financing conduct is identified. If suspicion of money laundering or terrorist financing is detected, the transaction is reported to the appropriate government authorities or execution of said transaction may be refused. As a result of such a statement, the execution of a contract with the User may also be rejected in the future.

The processing of your personal data is carried out in order to identify you as well as to identify beneficial owners within the meaning of the counteracting money laundering and terrorist financing laws, to monitor our business relationship on an ongoing basis and to investigate the origin of assets. In addition, on the basis of the information obtained from you, we determine the purpose and nature of your business relationship and perform any other activities required by anti-money laundering and anti-terrorist financing laws, in particular, we determine that the first payment to our bank account has been made through your bank account via a financial services provider, where the payer’s details are consistent with the information provided by you.

The counteracting of money laundering and terrorist financing laws allow us to supplement your personal data - we need to be sure of your identity whenever we provide our services to you. In addition, we ask you to provide us with the personal data concerning other parties. This applies, for example, when you are a co-owner of a bank account or when you define the bank account of a person to whom we make a transfer. We are committed to protecting the processing of third party data submitted to us in the course of providing the services to you as much as we are committed to protecting your data. Remember that the application of your personal data rights must not negatively affect the rights and freedom of others, including those who you have provided us with. We process your personal data when you contact us, e.g. through the User Service section. This includes information necessary for communicating with you, including answering any questions or concerns you may have. For this purpose, we use the data you have provided in your Account. The scope of data processing shall be limited solely to the information required to provide support, including the content of the message.

Your personal data are used to:

  • fulfil our obligations under agreements between us and you
  • provide specific services and their functionality
  • provide information regarding the status of the executed services
  • implement financial and other security measures resulting, among others, from the Act on Counteracting Money Laundering and Financing Terrorism
  • provide support during the term on which the services are provided by the Customer Care Department, as well as solve technical problems and other issues through the contact form
  • contact you, including providing information about changes in our Terms and Conditions and Policies
  • electronically send information about Exchange Rates
  • sell and support Currency Cards
  • consider complaints regarding the services
  • ensure the security of the offered services, including the execution of the Terms and Conditions and counteracting fraud and abuse
  • conduct court proceedings and other legal actions, in case of possible claims
  • settle accounts for the services

Lending services

In order to use the lending service Sp. z o.o. provides your data to Currency Lending Sp. z o.o., which will be the controller of your personal data. Provision of personal data for the Services is voluntary, except for cases where the obligation results from binding legal regulations. Nevertheless, providing data is necessary for the performance of the Services.

Your data are used for the following purposes:

  • to undertake, at your request, actions aimed at executing the contract, including any preparatory actions preceding the conclusion of the contract;
  • creditworthiness assessment and credit risk analysis based on information collected from data sets of credit and business information offices in connection with the Act of 12 May 2011 on Consumer Credit and the Act of 29 August 1997 on Banking Law;
  • automatic processing based on automated decision-making, including automatic creditworthiness assessment;
  • credit risk management and credit risk analysis, on termination of the contract, in accordance with Article 6(1)(a) of GDPR;
  • fulfil legal obligations in accordance with the legal provisions governing the conduct of business by lending institutions, and in order to comply with requirements imposed by decisions or laws issued by the authorised bodies, institutions or courts, as well as by instructions or recommendations issued by public agencies or institutions in accordance with Article 6(1)(c) of the GDPR;
  • providing the Service, including information about the status of the Service, communication with you, as well as information about changes to our Terms and Conditions and Policies, settlement of the Service;
  • performing legal obligations under the tax, accounting or anti-money laundering and anti-terrorist financing laws;
  • providing support during the provision of the Service by the Customer Care Department, as well as solving technical problems and other issues through the contact form;
  • conducting direct marketing based on your voluntary consent, pursuant to Article 172 of the Act of 16 July 2004 on Telecommunications Law and the Act of 18 July 2002 on the provision of services by electronic means;
  • consideration of complaints regarding the Services performed;
  • ensuring the security of the Services, including the enforcement of the Terms and Conditions and the prevention of any fraud or misuse;
  • conducting judicial and other proceedings in case of potential claims;
  • conducting management and statistical analyses, market trends research and reporting for internal needs of the organization.

We are obliged to assess your creditworthiness on the receipt of your loan application. This assessment is made based on information provided by you, your personal data and information collected from third parties within the scope of the creditworthiness review policy adopted by the Company. We ensure that you act in good faith and evaluate your creditworthiness in an automated manner to determine eligibility to lend you money, amount and terms. The outcome of the processing may be an automatic refusal to contract, and you are entitled to express your opinion on the decision and question it.

As an institution obliged to apply the provisions of the Act on Counteracting Money Laundering and Terrorist Financing, we must submit reports to the relevant supervisory authorities, including the General Inspector of Financial Information. As a loan institution, we are required to assess your creditworthiness and may therefore share your data with credit and business offices, as well as with operators of information exchange systems or participants in systems for exchanging information about customers or potential customers of loan institutions, in order to obtain information and business data, verify your creditworthiness and analyze credit risk. We also provide your personal data to the payment institution Conotoxia Sp. z. o.o., which withdraws money on our behalf to your payment account and, in case of your voluntary consent, enables you to repay the loan to our payment account. Your data are also available to the banks executing the ordered transactions.

Recruitment process

If you are interested in working for our Companies, you can submit your application directly by email to or in paper form. The submission of personal data is voluntary, but necessary in order to consider your application.

Processing of your personal data in the recruitment process is based on taking action upon the request of the data subject (in this case the Candidate), before the conclusion of a contract (art. 6 sec.1b of GDPR). If the data provided by you go beyond the catalogue indicated in art. 221 of the Labour Code, we will process the data, if you voluntarily give us your consent by sending us an application, the application stands as a clear indication of your want to take part in a given recruitment process. We process your data until the end of the procedure. If you enrol for a specific position but would like to be taken into consideration in future recruitment procedures, you can agree to this by ticking the appropriate checkbox or including the appropriate clause in the application documents. In such a case, your data will remain in our database until your consent is revoked or for a maximum period of 5 years from the end of the year in which it was provided. The same applies if you are interested in working for us but at that given moment there are no positions suited to your competences. You can send us your application documents as part of the so-called spontaneous recruitment process. As a result, if we open a new recruitment process and believe that your qualifications meet our requirements, we will contact you and propose participation in the procedure. Remember that you can withdraw your consent at any time by sending us a request to

In order to verify the identity of the applicant, the message should be sent from the email address indicated in the application that was sent earlier.

The recruitment process for Conotoxia Holding is the responsibility of, therefore, it may also be carried out for the needs of other Group companies. Each time in the advertisement for a given position there is information about which company is being recruited. They may also have access to your personal data:

  • other Group companies that co-collect your data in the case of spontaneous recruitment or consent to participate in future recruitment procedures, because the database is shared (companies in the Group have a common purpose of processing, which is to optimise the human resources potential)
  • personnel consulting agencies cooperating with us
  • providers of IT solutions supporting the recruitment process

We may process personal data that you submit to us directly during the recruitment process by sending application documents, as well as analysing information about your professional achievements posted on portals to which you have provided your data. At the same time, we would like to inform you that if your application for a given position is selected on the basis of the Act of 12 April 2018 on the principles of obtaining information on the criminal record of persons applying for employment and persons employed in the financial sector, you will be asked to provide a certificate on the criminal record.

More details on the recruitment process are available at


If you have consented to receiving marketing information, we process your personal data in order to present offers concerning the Services provided within the platform. Offers will be sent to you until your consent is withdrawn, which you can do yourself by changing your Account settings or by contacting our Customer Care Department. We collect your data directly from you and in the framework of our partner relations with entities providing business information. These are entities to which you provide data on the basis of your own decision, we do not have control over the processing of personal data by the entities mentioned above.

If you want to be informed about our specific product or service that is being implemented, your data will be processed based on a voluntary consent given by providing your email address. We will delete your data immediately after sending you the requested information. If you change your mind, you have the right to withdraw your consent at any time by contacting our Customer Care Department.

We are committed to improving marketing activities, including tailoring content to your interests in the form of personalising offers or advertising services, but only on the basis of data that does not have the status of personal information. Please also be aware that we do not make automated decisions as part of our marketing processes that may affect your legal situation or could otherwise have a material impact on you. We process aggregated data that is not personal data to determine the volume or frequency of transactions, which allows us to continuously improve our offer.


Your personal data are also collected when you contact us via the available channels, including the contact form and the form used for reporting situations that you believe to be fraudulent, i.e. a financial crime. The data collected includes, among others, your name and email address. We process your data for purposes directly related to the operation, correct execution of our services and due to the applicable legal requirements that oblige us to prevent various violations of the law. By sending us a message, you consent to the processing of your personal data contained in the message. You can withdraw your consent at any time by contacting our Customer Care department. We store information about you for the time necessary to fulfil your request.


The processing of your personal data also takes place when you subscribe to our Newsletter. The legal basis of the processing of personal data, in this case, is your consent, expressed by subscribing to the Newsletter and providing us with your email address. Submission of personal data and consent is voluntary. At any time you can unsubscribe from the Newsletter and withdraw your consent to the processing of personal data through the deactivation link received in the content of the Newsletter. Removal from the list of subscribers will be carried out immediately.

Competitions and promotions

Occasionally, as part of our marketing activities, we hold competitions, raffles and promotions. If you want to take part in them, we will ask you to provide us with the data necessary to carry out a given action, current communication, as well as possible notification of a prize and financial settlement (in the case of a prize transfer). The basis for processing your personal data is voluntary consent and tax regulations in case of awarding the prize. We will process your data for the period necessary to execute the purpose of processing, subject to any obligations indicated in tax regulations.

If the action is carried out in cooperation with business partners to whom your personal data will be transferred, you will be informed about this fact in the applicable Terms and Conditions.

Cookies and activity tracking

When you use the services provided by us, we may also gather information such as technical data about the devices you use to access them, including your internet connection, IP address, or other technical details provided by your browser. In addition, we process specific information about your use of our services, such as measurement data about when and how you use the services, traffic data, your transaction history list and the type of transactions you make. We collect data using cookies or similar technology. For more information, please refer to our Cookies Policy, which is an integral part of this Privacy Policy. This data is collected by, which is responsible for managing the IT infrastructure of the Companies (also if you use the services of Conotoxia Ltd., Conotoxia Sp. z o.o. or another company offering services on the platform).

We are not responsible for the privacy policy of other websites, both those available through links placed on and those that place links to our website. Therefore, if you use external websites, we recommend that you review the relevant privacy policies posted on those websites.

Online store eStore offers a wide range of corporate gadgets such as mugs, t-shirts, powerbanks and many more. Therefore, we may process your personal data necessary to execute the order, its delivery, as well as to operate the account in the system for the period resulting from the applicable legal regulations, such as the statute of limitations for claims under the Civil Code, or, if a VAT invoice is issued, for the period resulting from the regulations on tax documentation.

To carry out the order, and in particular to deliver the ordered gadgets, your data will be made available to the entities carrying out the delivery (only to the extent necessary to carry out the delivery).

Details of the store's activity can be found in its Terms and Conditions.

How long do we store your personal data?

All personal data submitted to us is stored on our servers or on those of our affiliates. We use appropriate technical and organizational security measures to protect your personal data against unauthorized or unlawful processing, accidental loss, damage or destruction. The entities cooperating with us are also obliged to manage the data in accordance with the security and privacy requirements adopted by us.

We only process your personal data for the period necessary to fulfill the objectives set out in this Privacy Policy. Please be informed that the specific nature of our services means that in most cases we are required by law to process your data even if you no longer use our services. This applies in particular to counteracting terrorist financing and money laundering provisions. Such obligations arise additionally from tax or accounting regulations. In most cases, even if you close your account, your personal data will still be processed by us. If you do not have an account but have contacted us, we will store this information for as long as it is necessary for legal or accounting issues.

We assure you that if we do not need your personal data in order to provide the services or for other reasons, such data will be immediately erased or anonymized.

What are the legal grounds for processing your personal data?

We process your personal information to allow you to use our services, which can be defined as a requirement to perform our service agreement. We process your data as it is necessary to comply with our legal obligations. In addition, we rely on legitimate interests, by which we refer to information about the services offered by the online platform as well as taking care of the safety of their provision, and the identification, investigation or protection of claims. In other cases, data processing is done on the grounds of your voluntary consent, which can be withdrawn at any time. This will not undermine the legality of processing based on the consent given before withdrawal. This applies, for example, to the transmission of commercial information or recruitment processes beyond the scope of the provisions of the labour law.

Do we disclose your personal data to others?

The Controller who manages your data has access to it. This is the entity providing the Services you use. Please be informed that we are constantly expanding our offer. Therefore, the list of processors to whom we share your personal data is expanding. However, each time you are asked whether you agree. Your personal data will only be transferred when you decide to use the service. We assure you that the data are only disclosed to the extent necessary to provide a particular service. Due to the disclosure of personal data to entities performing appropriate Services, they become independent data Controllers.

The receiver of your data may be entities with whom we cooperate in order to support our activity (Processors), as well as authorities entitled to receive the data under the provisions of law. We use the services of entities that provide us with tools that improve our work, in particular for internal communication and internal data sharing, as well as marketing tools and more efficient electronic communication management.

As an institution obliged to apply anti-money laundering and anti-terrorist financing regulations, we are obligated to submit reports to relevant supervisory authorities, including the Chief Inspector of Financial Information, who, as a government administration entity, controls compliance with the aforementioned regulations. Reports are generated and transmitted automatically by our software. We also cooperate with entities providing analytical services aimed at counteracting fraud and abuse in order to ensure the security of payment execution. Additionally, our company uses the professional services of legal, tax, accounting and auditing specialists. Moreover, your data is disclosed to banks, which provide execution of ordered transactions. We are also obliged to maintain security measures. Therefore, we may also disclose your personal data to the police or other authorities, especially if you are involved in a suspicious transaction or if your activity indicates a high risk of money laundering or other criminal activity. Please be informed that if you use the online forms available on this website, we will make a request via the reCAPTCHA plugin which will include sending you your IP address and any other data required by Google Inc.

Your rights regarding the personal data you submit to us

At any time, you have the right to object to the processing of your data where the data collected are processed by our legitimate interest. You can do this by sending an email to or or by contacting contacting our Customer Care Department. You also have the right to withdraw your consent (if the processing of your personal data was based on consent). You can do this by changing your settings in the Notification settings tab, by unsubscribing in messages you receive from us or by contacting our Customer Care Department. Other ways of withdrawing consent to the processing of personal data have been indicated in this document when describing particular processing activities. In any case, you may withdraw your consent at any time.

You have the right to access your data, rectify it, obtain a processing restriction and request for it to be forgotten. Moreover, you have the right to data portability and erasure of your data. You can claim these rights by contacting us directly via the User Panel or at or In addition, you can lodge a complaint with the Data Protection Authority.

Changes to the Privacy Policy and other relevant information

We reserve the right to make changes to the Privacy Policy regardless of any changes to the Terms of Use. Each time, you can find the current version of this document on our website. Please note that we are open to any suggestions and comments regarding confidentiality, protection or processing of your personal data. All of them can be sent to

Start chat