Open an account Icon Mobile Menu

Privacy policy

  • Icon Calendar NoteZaktualizowano: 9 March 2026

PRIVACY POLICY

In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter
referred to as „GDPR”) The Controller has appointed a Data Protection Officer, whom you can contact by
sending an email to: [email protected]

I. Definitions

Controller –
Finunion limited liability company with its registered office in Warsaw at ul. Wilcza 51/41,
Warsaw 00-679, entered in the Register of Entrepreneurs kept by the District Court for the Capital
City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under KRS number:
0000990847, NIP (Tax Identification Number): 5273018094, REGON (National Business Registry Number):
523048565;
Mobile Application –
software designed for installation on mobile devices (smartphones, tablets) running on iOS and
Android operating systems, enabling users to access financial services offered by Finunion. The
application provides functionalities related to account management, transactions, monitoring of
financial operations, and communication with customer service;
Personal Data –
personal data of Customers and Users within the meaning of the GDPR provided in connection with the
use of the Service;
Exchange Office –
a stationary point enabling the exchange of fiat currencies (e.g., PLN, EUR, USD) for
cryptocurrencies and vice versa. Transactions may be carried out in cash or by electronic payment,
in accordance with applicable law;
Customer –
natural or legal persons who have accepted the Terms and Conditions of the Service and have
concluded a contract with the Administrator for the provision of the Service;
Processing –
means any operation or set of operations performed on personal data or sets of personal data in an
automated or non-automated manner, such as collection, recording, organization, structuring,
storage, adapting or modifying, downloading, viewing, using, disclosing by transmission,
dissemination or otherwise making available, aligning or combining, restricting, erasing or
destroying;
Crypto Assets Regulation –
Regulation (EU) 2023/1113 of the European Parliament and of the Council of May 31, 2023, on
information accompanying transfers of funds and certain crypto assets and amending Directive (EU)
2015/849;
Website –
the website available at https://app.finunion.pl/ and its subdomains;
Services –
a service provided by Finunion, consisting in the exchange of digital currencies (cryptocurrencies)
into other cryptocurrencies or fiat currencies (e.g. PLN, EUR, USD) and vice versa, in accordance
with the applicable exchange rates using Exchange Offices and the Mobile Application;
AML Act –
Act of March 1, 2018, on counteracting money laundering and terrorist financing;
User –
a natural or legal person using the Administrator’s services. The provisions of this Policy relating
to the Customer shall, in principle, apply mutatis mutandis to the User;

The Administrator can be contacted via:

II. What are the purposes and basis for processing your personal data?

PURPOSE OF DATA PROCESSING LEGAL BASIS DATA RETENTION PERIOD SCOPE OF DATA PROCESSING
Provision of the Service by the Controller – Article 6(1)(b) of the GDPR; – Article 6(1)(c) of the GDPR; Until the end of cooperation, i.e. for the period
required by law (e.g. tax, accounting, AML Act) or until the expiry of claims.		 – Identification data (first and last name,
PESEL number); – Contact details (email address, telephone number); – Address
details (home address, residence address), Financial data (income
information, bank transaction data, bank account statements, tax returns, declarations of
residence); – Service-related data (cryptocurrency wallet data); – Biometric and
Technical data (biometric data, selfie identity verification (liveness check)); –
Image, IP address, data on devices used for verification).
Verification in accordance with the requirements
of the AML Act / sanction lists: – Customers; – Contractors; – Customer representatives
and agents		 Article 6(1)(c) of the GDPR in conjunction with Article 37(1) of
the AML Act		 For the period required by law, i.e. 5 years in
accordance with Article 49(1) of the AML Act		 – Identification data (concerning natural
persons, representatives of legal persons and beneficial owners): name and surname,
citizenship, PESEL number or date of birth and country of birth – if no PESEL number is
available, series and number of identity document; – Address details (if the
obligated institution has this information): address of residence, registered office or
place of business – in the case of legal persons and organizational units; – Business
entity data (concerning natural persons conducting business activity and legal
persons): name (company name), organizational form, tax identification number (NIP), and if
unavailable – country of registration, name of the relevant register, registration number
and date.
– Establishment and defense of own claims –
Internal accounting		 – Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of
the Accounting Act; – Article 6(1)(f) of the GDPR;		 For the period required by law, i.e. – 6 years for most
property claims; – 3 years for relations between entrepreneurs; – for 5 years from the end
of the calendar year in which the tax obligation arose.		 – Identification data (concerning natural
persons) first name and surname, PESEL number; – Address details (residential
address, registered office or business address); – Business entity data (for natural
persons conducting business activity and legal persons): name, NIP (tax identification
number), REGON (statistical number), KRS (National Court Register number).
Use of the Website Article 6(1)(f) of the GDPR For the duration of the storage of cookies on the website
visitor’s device or until objection to processing is expressed.		 – Information about visited pages (visited
pages and subpages, time spent on each of them); – Technical data (IP address, device
ID, browser and operating system data); – Location and search data (location, search
history).
– Contractor data – Contractor Representatives’
Data Aimed at establishing cooperation and during Cooperation		 – Article 6(1)(f) of the GDPR; – Article 6(1)(b) of the GDPR For the duration of the Cooperation and after its
termination until objection to processing is expressed.		 – Identification data (concerning natural
persons, representatives of legal persons) first name and surname, position held; –
Address details (registered office or business address); – Business entity
data (regarding natural persons conducting business activity and legal persons):
name, tax identification number (NIP), statistical identification number (REGON), National
Court Register number (KRS); – Contact details – email address, telephone number.
Conducting marketing activities, including
positioning, marketing, and online advertising		 Article 6(1)(f) of the GDPR Until objection is raised – Identification data – first and last name; –
Business entity data (regarding natural persons conducting business activity and
legal persons) – name, tax identification number, REGON number, KRS number; – Contact
details – email address, telephone number.
Sending newsletters and text messages Article 6(1)(a) of the GDPR Until consent is withdrawn. – Identification data – first and last name; –
Business entity data (concerning natural persons conducting business activity and
legal persons) – name, tax identification number, REGON number, KRS number; – Contact
details – email address, telephone number.
Transaction monitoring – Article 6(1)(c) of the GDPR; – Article 6(1)(f) of the GDPR Until the end of cooperation, i.e. for the period
required by law or until the expiry of the limitation period for claims.		 – Identification data of the parties to the
transaction (name and surname or name, address, account number or identifier, ID
card number – if required); – Transaction data (transaction value, currencies or
crypto assets being transferred).
Application of the Travel Rule Article 6(1)(c) of the GDPR Until the end of the cooperation, i.e. for the period
required by law or until the expiry of the limitation period for claims.		 – Identification data of the parties to the
transaction (name and surname or name, address, account number or identifier, ID
card number – if required); – Transaction data (value of the transaction, currencies
or crypto assets being transferred).
Recruitment – Article 6(1)(b) and (c) of the GDPR; – in the case of consent to
future recruitment – Article 6(1)(a) of the GDPR		 Until the end of the recruitment process, and in the case
of consent to future recruitment – until its withdrawal or in accordance with the retention
period resulting from legal provisions.		 – Candidate identification data (name and
surname, contact details, address, professional experience, education); – Other data
contained in the application documents (CV, cover letter, references, recruitment
test results – if required); – Information about the recruitment process (e.g.,
interview results, competency assessments); – If consent is given for future
recruitment, personal data will be stored until consent is withdrawn, but no longer
than for the period specified in the recruitment policy.

Taking into account the nature, scope, context and purposes of the processing and the risk of varying
likelihood and severity of the risk to the rights and freedoms of natural persons, the Controller
implements appropriate technical and organizational measures to ensure that the processing is performed
in accordance with the Regulation and to be able to demonstrate this. These measures are reviewed and
updated as necessary. The Administrator uses technical measures to prevent unauthorized persons from
obtaining and modifying personal data transmitted electronically.

III. Who does your data get shared with?

The administrator processes personal data solely for the purpose of fulfilling its obligations towards
users. The data is not disclosed to third parties unless the user consents to this or it is required by
law (e.g. at the request of law enforcement authorities). Personal data is not used for profiling or
automated decision-making.

  • Accounting, auditing, and consulting service providers – based on personal data processing
    agreements.
  • Banks and payment institutions – to the extent necessary to execute financial transactions.
  • IT and hosting service providers – to ensure the proper functioning of IT systems and data security.
  • Public and supervisory authorities – when required by law, including tax, regulatory and law
    enforcement authorities.
  • Accounting and tax service providers – for the purpose of financial settlements.
  • Law firms – for the purpose of pursuing claims and providing legal services.
  • Courier and postal companies – for the purpose of sending documents.
  • Cryptocurrency exchange operators and payment service providers – to the extent necessary to process
    transactions.
  • Other entities within the capital group to which the Administrator belongs, and their authorized
    personnel.
  • Our authorized personnel and the authorized personnel of our subcontractors.

The Administrator may transfer personal data outside the European Economic Area, in particular when
using IT tool providers based outside the European Union.

The Administrator conducts ongoing risk analysis to ensure that personal data is processed by it in a
secure manner, ensuring in particular that access to the data is limited to authorized persons and only
to the extent necessary for the performance of their tasks. The controller ensures that all operations
on personal data are recorded and carried out only by authorized employees and associates.

IV. Is your data transferred outside the EEA?

Personal data may be transferred outside the European Economic Area (EEA), in particular to IT and
analytics service providers such as Google LLC and Meta Platforms, Inc. In such cases, the transfer of
data is carried out in accordance with the GDPR, on the basis of:

  • EU Standard Contract Clauses
  • European Commission decisions confirming an adequate level of protection
  • EU-US Data Privacy Framework – in the case of data transfers to the US

V. Social media

Meta Platforms (Facebook, Instagram) We use Meta Platforms plugins on our Website. Clicking on
the link will take you to our Facebook or Instagram profile. In this case, your data, such as
information about the web browser or app you are using, online identifiers (e.g., IP addresses, mobile
advertising identifiers of the operating system), and data about your interaction with ads, will be
transmitted to Facebook or Instagram.

With regard to this data, Meta Platforms Ireland Limited and the Administrator act as joint
controllers in accordance with Article 26 of the GDPR.

For detailed information on Facebook’s data processing and your rights, please refer to Facebook’s
privacy policy: https://www.facebook.com/about/privacy. For more information on joint
data control, please visit: https://www.facebook.com/legal/controller_addendum.

TikTok Our Website may contain links to our profile on the TikTok platform. When you click on the
link, TikTok Technology Limited may process your data, such as your IP address, device data, web
browser, and interactions with content and advertisements. TikTok processes data based on its own
privacy policy, which can be found at: https://www.tiktok.com/legal/privacy-policy.

Telegram Our Website may contain links to our Telegram profile. Clicking on the link establishes
a connection to the servers of Telegram Messenger Inc., which may process data such as your IP address,
browser type, and information about your interactions with our website. Detailed information on data
processing by Telegram is available in its privacy policy: https://telegram.org/privacy.

VI. What are your rights in relation to the processing of personal data by the
controller?

  • Right of access to data (Article 15 of the GDPR) – the possibility to obtain information
    about the data being processed and to receive a copy thereof.
  • Right to rectification (Article 16 of the GDPR) – the possibility to correct inaccurate or
    incomplete data.
  • Right to erasure („right to be forgotten,” Article 17 of the GDPR) – the possibility to
    request the erasure of data if it is no longer necessary for the purposes of processing, consent has
    been withdrawn, or the data is being processed unlawfully.
  • Right to restriction of processing (Article 18 of the GDPR) – the possibility to request
    temporary suspension of data processing in specific cases.
  • Right to data portability (Article 20 of the GDPR) – the possibility to receive your data in
    a structured format and transfer it to another controller (applies to processing based on consent or
    a contract).
  • Right to object to data processing (Article 21 of the GDPR) – the possibility to object to
    data processing based on the legitimate interest of the controller or the use of data for marketing
    purposes.
  • Right to withdraw consent (Article 7(3) of the GDPR) – in the case of data processing based
    on consent, the possibility to withdraw it at any time.
  • Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR) – if you
    believe that the processing of your data violates the law, you may lodge a complaint with the
    President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, [email protected].

Exercising your rights: Requests to exercise the above rights can be sent to the following email
address: [email protected].
The controller will consider the request within one month, with the possibility of extending this period
to two months in special cases.

VII. Do we use cookies?

The Website uses cookies (small text files, so-called cookies) or technologies with similar
functionality to cookies, which are stored by your browser on your device (e.g. laptop, smartphone).

We use two types of cookies: session cookies and persistent cookies. Session cookies are
temporary files that are stored on your device until you log out or leave the Website. Persistent
cookies are stored on your end device for the time specified in the cookie parameters or until they are
deleted.

The following types of cookies may be used on the Website:

  • Essential cookies – you cannot disable these cookies because they are necessary for the
    Website to function. We use them to ensure the proper functioning of the website and its safe use –
    without them, it would be impossible to use the Website.
  • Functional cookies – require your consent. They help analyze how the Website is used. Thanks
    to them, it is possible, for example, to determine the number of people visiting the website, as
    well as to detect and remove irregularities in its functioning.
  • Analytical cookies – require your consent. They help to ensure an efficient and user-friendly
    Website, tailored to your preferences. They allow, among other things, to check how you use the
    Website or the Mobile Application.
  • Marketing cookies – require your consent. These cookies are used to tailor marketing content
    to your needs and interests, and may also be used to tailor the content and advertisements presented
    by third parties.

Detailed information on the cookies used on the Website is available in the table below:

Cookie Domain Description Type
pll_language finunion.pl The pll_language cookie is used by Polylang to remember the
language selected by the user when returning to the website, as well as to obtain
information about the language when it is not available in any other way.		 functional
burst_uid finunion.pl None other
_gcl_au finunion.pl Google Tag Manager sets this cookie to experiment with the
effectiveness of ads on websites using their services.		 analytical
_ga_* finunion.pl Google Analytics sets this cookie to store and count page views. analytical
_ga finunion.pl The _ga cookie, installed by Google Analytics, calculates visitor,
session, and campaign data and tracks website usage for the website’s analytics report. The
cookie stores information anonymously and assigns a randomly generated number to identify
unique visitors.		 analytical
_ga_* finunion.pl Google Analytics sets this cookie to store and count page views. analytical
_fbp finunion.pl Facebook sets this cookie to store and track interactions. analytical
lastExternalReferrerTime finunion.pl None other
lastExternalReferrer finunion.pl None other
wpEmojiSettingsSupports finunion.pl WordPress sets this cookie when a user interacts with emojis on a
WordPress website. It helps determine whether the user’s browser can correctly display
emojis.		 essential
_ga_* finunion.pl Google Analytics sets this cookie to store and count page views. analytical
_ga finunion.pl The _ga cookie, installed by Google Analytics, calculates visitor,
session, and campaign data and tracks website usage for the website’s analytics report. The
cookie stores information anonymously and assigns a randomly generated number to identify
unique visitors.		 analytical

Obtaining and storing information using cookies, except when necessary to ensure the proper functioning
of the Website and your use of its functionality, is only possible with your consent.

You can withdraw your consent to the use of cookies via your browser settings. Detailed information on
this can be found at the following links:

You can verify your current privacy settings in your browser at any time using the tool available at https://optout.aboutads.info/?c=2&lang=EN

Withdrawing your consent will not affect the lawfulness of any processing activities carried out based
on your consent before its withdrawal. Restricting the use of cookies may affect some of the features
available on the Website, prevent or significantly hinder the proper use of the Website.

pl en

Start managing your
finance with the FinUnion mobile app!

Modal image
Finunion in App Store
Finunion in App Store

Start in browser

pl en
cookie

This website uses cookies and services to collect technical data from visitors (IP address, location, etc.) in order to ensure correct operation and improve the quality of the service. By continuing to use our site, you automatically consent to the use of these technologies.

Cookie policy Terms and conditions