Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Thales MFI GmbH
Hauptstraße 55
24576 Hitzhusen
Germany

Commercial Register: HRB 28542 KI
VAT ID: DE 359912125
Email: contact@thales-mfi.de

2. Overview of Data Processing

Our website (https://thales.solutions) does not directly collect personal data via forms. Users are redirected via a Call-to-Action (CTA) to a Telegram Bot, where personal data may be collected.

We process personal data in compliance with:

• EU General Data Protection Regulation (GDPR)
• German Telecommunications-Digital Services Data Protection Act (TTDSG)

3. Data Collected via Telegram Bot

When users voluntarily interact with our Telegram Bot and explicitly consent to this Privacy Policy, we may collect:

• First and last name
• Country
• City
• Capital amount (investment capacity)

Purpose of Processing

• Assessment of eligibility for participation in our educational program
• Pre-contractual measures (Art. 6(1)(b) GDPR)
• Market analysis and program optimization
• Marketing communication and retargeting (based on consent)

Legal Basis

• Art. 6(1)(a) GDPR -- Consent
• Art. 6(1)(b) GDPR -- Pre-contractual measures
• Art. 6(1)(f) GDPR -- Legitimate interest (business analysis and security)

Participation in the educational program requires providing the requested information.

Users may withdraw consent at any time.

4. Data Retention

Personal data stored within our Cloudflare-based infrastructure (Workers, Durable Objects, D1 database) will be retained:

• Until the user requests deletion, or
• For a maximum period of three (3) years

After expiration, data will be securely deleted unless statutory retention obligations apply.

5. Server Log Files

When visiting our website, the following technical data may be automatically collected:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL

Purpose

• Ensuring technical security
• Preventing abuse
• System integrity

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in secure website operation)

6. Use of Google Analytics

We use Google Analytics (GA4) to analyze website traffic.

Google Analytics may set cookies and process usage data.

Analytics processing is based on user consent (Art. 6(1)(a) GDPR). Analytics cookies should only be activated after user consent via a cookie banner.

Users may withdraw consent at any time via browser settings or cookie management tools.

7. Use of Cloudflare

We use Cloudflare services (CDN, Workers, Durable Objects, D1 database) to operate and secure our infrastructure.

Cloudflare may process technical data such as IP addresses to ensure security and performance.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable infrastructure)

8. Telegram

Communication occurs via Telegram.

Please note that Telegram is a third-party service and may process data outside the European Union.

By interacting with our Telegram Bot, users acknowledge that data may be transferred to countries outside the EU.

Legal basis: Art. 6(1)(a) GDPR (consent)

9. Payment Processing (NowPayments)

Payments are processed via NowPayments.

We do not store payment details. Only technical payment identifiers (payment_id) may be stored for reconciliation purposes.

NowPayments may process data outside the EU.

10. International Data Transfers

Due to the use of:

• Google Analytics
• Telegram
• NowPayments
• Cloudflare

Personal data may be transferred to countries outside the European Union.

Such transfers are based on:

• EU Standard Contractual Clauses (SCCs), and/or
• EU-US Data Privacy Framework (where applicable)

11. Marketing and Retargeting

With user consent, collected data may be used for:

• Informational messages
• Retargeting
• Promotional communication

Users may withdraw consent at any time.

12. Rights of Data Subjects

Under GDPR, users have the right to:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7(3))

Requests may be sent to: contact@thales-mfi.de

Users may also request deletion via the Telegram Bot.

13. Supervisory Authority

Users have the right to lodge a complaint with the competent supervisory authority.

Responsible authority:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel
Germany

14. Minors

Our services are not directed at individuals under the age of 18.

We do not knowingly process data of minors.

15. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy when necessary to reflect legal, technical, or business developments.