Data Protection Policy

Information on the Processing of Personal Data

Tavex A/S (”Tavex”) is a Danish company licensed as a provider of currency exchange services pursuant to section 41 of the Danish Anti-Money Laundering Act (AML Act). Tavex is also registered as an agent for the money transfer companies MoneyGram International Limited and Tavexwise AS. Tavex is part of the Tavex Group, with its parent company, Tavid AS, based in Estonia, and has sister companies in 11 other European countries. Tavex’s services include currency exchange and money transfers, as well as buying and selling gold and silver, both as investment metals and scrap metals.

Tavex values your right to privacy and processes all personal data in accordance with applicable laws and regulations, including Regulation (EU) 2016/679 (the “GDPR”), the AML Act, and other relevant legal obligations, such as the Danish Bookkeeping Act.

Tavex is the data controller for the collection, processing, and use of all data related to our activities:

Tavex A/S
Vester Farimagsgade 1, st.,
1606 Copenhagen V
Email: tavex@tavex.dk
Telefon: +45 3311 1510
Cvr: 33166966

This privacy policy outlines how Tavex processes and stores your personal data when you use our services or contact us, what rights you have, and how you can exercise those rights under the GDPR, including any limitations.

Personal Data We Process and Why

According to Article 4 of the GDPR, “personal data” means any information relating to an identified or identifiable natural person… by reference to an identifier such as a name, ID number… or other characteristics specific to their physical, economic, or social identity.

“Processing” refers to any operation or set of operations – automated or not – such as collection, recording, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure or destruction.

For Tavex, the types of personal data we collect include, but are not limited to:

• Identity information: g. name, date of birth, personal ID number, customer number, nationality, citizenship, country of birth, job title
• Contact details:g. phone number, address, email address
• Financial information:g. completed and planned transactions, income, assets, card details
• Customer interactions and engagement:g. correspondence between you and Tavex
• Purpose of transactions:g. investment, travel, gift, savings
• Digital data: IP address, browser data

We process personal data for:

• Delivering our services and products, and managing agreements
• Customer relationship management and service
• Communication and targeted offers
• Compliance with legal regulatory obligation

Cookies and Online Tracking

Tavex uses cookies and similar technologies on our website for functional, statistical, and marketing purposes. For detailed information, see our Cookie Policy on www.tavex.dk/tavexs-cookie-politik/

Legal Basis for Processing Personal Data

We process personal data on the following legal bases:

• GDPR Art. 6(1)(a): Consent – e.g. for marketing purposes
• GDPR Art. 6(1)(a): Contract performance or pre-contractual actions
• GDPR Art. 6(1)(c): Legal obligations – e.g. AML, bookkeeping, tax
• GDPR Art. 6(1)(f): Legitimate interest – e.g. IT security, misuse prevention
• Danish Data Protection Act § 11(2): Processing of CPR number to verify identity

How We Collect Personal Data

Tavex collects personal data directly from you as the customer. We may also use public registers such as the Danish Business Register (CVR) and third-party sources, including international sanctions or PEP lists, as we are required to implement under the AML Act. Customers and prospective customers are regularly screened against lists from:

• The Danish FSA (Finanstilsynet)
• The EU
• The UN
• FATF
• UK HM Treasury
• US OFAC

Additionally, Tavex stores are under video surveillance to ensure the safety of customers and staff. The recordings are used to prevent, deter, and investigate criminal activity of suspected offenses.

If You Choose Not to Provide Personal Data

In some cases, we are legally required to collect certain personal data, especially under the AML Act. If you choose not to provide this information, we may be unable to offer you our services.

Disclosure and Recipients of Personal Data

We only share your data if we are legally required or entitled to do so, including to:

Authorities: Police, Danish AML Secretariat, Danish Tax Agency

• Data collected under the AML Act is processed solely for the purpose of preventing money laundering and terrorist financing. We do not share this data with third parties for other purposes.
• Information to the tax authority only applies to transactions where customers receive DKK 8,000 or more in cash for goods sold to Tavex, as required per the Danish Tax Assessment Act section 8 Y.

Financial institutions: e.g. banks and payment service providers

• Shared only for verifying the origin of funds or identifying the beneficial owner of funds transferred to our accounts. These institutions are also subject to the AML Act and FSA oversight.

Other necessary parties: e.g. delivery services, data processing

• If you order goods for delivery, your contact information is shared with the courier.
• If you use multiple Tavex branches, your data may be shared between them for AML compliance.
• For identity verification of remove customers under the AML Act, we use third-party services:
  • MitID: – https://www.mitid.dk/en-gb/legal/privacy-notice/?language=en-gb
  • Veriff: – https://www.veriff.com/privacy-notice

Data retention

We retain your data only as long as necessary for the purpose and in compliance with applicable law:

• AML Act section 30(2): Data must be deleted 5 years after the end of a business relationship or a one-time transaction by occasional customers.
• Bookkeeping Act section 12: Accounting records must be kept for 5 years from the end of the financial year.
• Other: Stored until Tavex is no longer legally required to retain it or until consent is withdrawn.

Your Rights as a Data Subject

Below we have listed your rights under the data protection rules, but please note that conditions apply to some of them, and exceptions apply under, among others, the AML Act, the GDPR, and the Danish Data Protection Act.

If we are required to conduct investigations or notify authorities in accordance with Chapter 5 of AML Act, we are legally prohibited from informing individuals or disclosing information about such investigations or reports to the Danish Money Laundering Secretariat (cf. section 38 of the AML Act).

Right to Rectification

You have the right to request that we correct or supplement any inaccurate or incomplete personal data we hold about you.

Right to erasure (“Right to be forgotten”)

In certain cases, you have the right to have your personal data erased without undue delay. The right to erasure applies if:

• The data is no longer necessary for the purpose for which it was collected
• You withdraw your consent and there is no other legal basis for processing
• You object to processing based on legitimate interest, and no overriding legitimate grounds exist
• You object to processing for direct marketing purposes
• The data has been processed unlawfully

Please note that Tavex collects and processes several types of personal data. To the extent that it is necessary to continue processing your data, e.g., to comply with legal obligations under the AML Act, we are not obligated to delete it. Some of your data may therefore be retained until we are no longer legally required to process it.

Right to Restriction of Processing

You may, in certain circumstances, request that we restrict the processing of your personal data. This can apply if:

• You contest the accuracy of the data and want us to verify it
• The processing is unlawful, and you prefer restriction over deletion
• We no longer need the data, but you require it to establish, exercise, or defend legal claims
• You have objected to processing based on legitimate interest, and the matter is under review

When processing is restricted, we may only store your data and may not process it in any other way without your consent, unless required for legal claims, to protect individuals, or for important public interests.

Right to Data Portability

In certain situations, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transfer that data to another data controller. This right applies if:

• The transfer is technically feasible and can be done automatically
• The data is processed based on your consent or a contract

Right to Object

You have the right to object at any time to our processing of your personal data based on legitimate interest. If you object, we must demonstrate a compelling legitimate reason to continue processing – otherwise, we must cease the processing.

You may also object to profiling and other types of data processing related to your customer relationship.

You further have the right not to be subject to decisions made solely through automated processing, including profiling, if such decisions have legal or similarly significant effects on you. However, this right does not apply if the decision:

• Is necessary for entering into or performing a contract, or
• Is based on your explicit consent

Right to Withdraw Consent

If you have given us your consent to process your personal data (e.g., for newsletters), we record the time, method, and content of the consent. You have the right to withdraw your consent at any time by contacting us using the above contact details. Such withdrawal does not affect the lawfulness of processing prior to the withdrawal.

Complaints

You may file a complaint with the Danish Data Protection Agency if you believe your personal data has been handled incorrectly.

More information can be found on www.datatilsynet.dk

Questions

If you have any questions or wish to exercise your rights, please contact us on tavex@tavex.dk