From b8320d53d141360ca46278c96d91f56c660346ad Mon Sep 17 00:00:00 2001 From: vdovhanych Date: Mon, 19 Oct 2026 15:49:29 +0200 Subject: [PATCH] chore: update privacy policy --- legal/privacy-policy.html | 149 +++++++++++++++++++++++++------------- 1 file changed, 98 insertions(+), 51 deletions(-) diff --git a/legal/privacy-policy.html b/legal/privacy-policy.html index 8aa2017..5e9c826 100644 --- a/legal/privacy-policy.html +++ b/legal/privacy-policy.html @@ -910,7 +910,7 @@

TREZOR

Privacy Policy

-

Last updated: 16 March 2026

+

Last updated: 15 October 2026

(“Privacy Policy”)

@@ -975,12 +975,14 @@

Personal data colle

Personal data collected when you subscribe to our newsletter (commercial communications)

-

On the Website, you may subscribe to our newsletter by entering your email and clicking - on the subscribe box or by clicking on the subscribe box during the order placement procedure in the Trezor Shop. - If you subscribe to our newsletter, we will regularly inform you about the latest news from Trezor, in particular - about our services and products.

-

As a data controller, we collect, store and process the email addresses and names (if - subscribed during the order placement procedure) of users who subscribe to our newsletter.

+

On the Website, you may subscribe to our newsletter by entering your email and + clicking on the subscribe box, by clicking on the subscribe box during the order placement procedure in the + Trezor Shop, or by redeeming a Promotional Code under our Free Device Program, where you give your consent to + receiving our newsletter. If you subscribe to our newsletter, we will regularly inform you about the latest + news from Trezor, in particular about our services and products.

+

As a data controller, we collect, store and process the email addresses and names + (if subscribed during the order placement procedure or by redeeming a Promotional Code) of users who + subscribe to our newsletter.

In case you change your mind and you do not want to receive the newsletter anymore, you can unsubscribe any time for free. We will always indicate within the newsletter how to unsubscribe.

Personal data collected when you order goods from the @@ -995,13 +997,16 @@

Personal data colle Físicas’ (CPF) number;
  • for users in the Republic of Korea, we also collect your Personal Customs Clearance Code (PCC) number;
    • +
  • if you redeem a Promotional Code, the code and information on + the partner or campaign through which you received it;
  • information about the status of your orders, requests under your warranty and refund rights and logs of your bitcoin payments.

    • Payment gateways

    -

    Our Website contains links to payment gateways provided by third parties which you may - use in order to make payments while using the Services. You will have to fill in your personal data related to the - payment when using the payment gateways.

    +

    Our Website and Trezor Shop contain links to and integrations with payment + gateways provided by third parties, such as Adyen, Confirmo, Apple Pay, Google Pay and PayPal, which you may + use in order to make payments while using the Services. You will have to fill in your personal data related + to the payment when using the payment gateways.

    These data are processed by the respective provider of the payment gateway as a data controller and the data processing is governed by terms and conditions and privacy policy of the payment gateway provider. We do not process these data and we do not have any access to such data unless @@ -1009,6 +1014,15 @@

    Payment gatewaysWe will always include the name of the payment gateway provider on the Website, so you may contact them to find all the information about how the payment gateway provider treats your personal data.

    +

    Personal data collected in connection with the + Refer-a-Friend Program (Trezor Suite)

    +

    If you participate in our Refer-a-Friend Program through Trezor Suite (henceforth + as “RAF Program”), we collect and process a persistent identifier associated with your Trezor Device, + together with a record of which version of the Refer-a-Friend Terms and Conditions you accepted and when. We + do not collect your name, email address or IP address for this purpose.

    +

    Our previous Legacy Refer-a-Friend Program (henceforth as “Legacy RAF”), supported + by Referral Candy, processed your name and email address; see "Who will have access to my personal data?" + below for its current status.

    Why do you process my personal data?

    Personal data collected in connection to the Website @@ -1027,9 +1041,9 @@

    Personal data colle relation to the requested issue.

    Personal data collected when you subscribe to our newsletter (commercial communications)

    -

    As we have stated above, we collect, store and process these personal data because you - subscribed to our newsletter. So we are processing your email and name (if subscribed during the order placement - procedure) in order to send you the newsletters.

    +

    As we have stated above, we collect, store and process these personal data because + you subscribed to our newsletter. So we are processing your email and name (if subscribed during the order + placement procedure or by redeeming a Promotional Code) in order to send you the newsletters.

    To comply with legal requirements, we must mention that we collect, store and process such personal data pursuant to Article 6 (1) (a) of the Regulation. That means that you have given us consent to the processing of your personal data for the commercial communications purpose.

    @@ -1040,11 +1054,16 @@

    Personal data colle store and process such personal data.

    Personal data collected when you order goods from the Trezor Shop

    -

    We collect, store and process these personal data because you order products from the - Trezor Shop. In case you place your order using a discount code provided under our Refer-A-Friend program, we may - also process these personal data to ensure that the person who provided you with the discount code receives their - reward. When you leave a review and choose to display your name, we may also process your name, specifically, we - will display your name next to your review.

    +

    We collect, store and process these personal data because you order products from + the Trezor Shop. In case you place your order using a discount code provided under our Legacy RAF (being + discontinued, see below), we may also process these personal data to ensure that the person who provided you + with the discount code receives their reward. When you leave a review and choose to display your name, we may + also process your name, specifically, we will display your name next to your review.

    +

    When you redeem a Promotional Code, we also process the code and information on + the partner or campaign through which you received it, in order to validate the code and prevent its misuse. + We process this data pursuant to Article 6 (1) (b) of the Regulation. To the extent we use this data to + evaluate the effectiveness of our campaigns, we process it pursuant to Article 6 (1) (f) of the Regulation, + as it is in our legitimate interest to measure how our campaigns perform.

    To comply with legal requirements, we must mention that we collect, store and process such personal data pursuant to Article 6 (1) (b) of the Regulation. That means that processing of such personal data is necessary for the performance of a contract which we concluded - the contract established between you and @@ -1057,6 +1076,16 @@

    Personal data colle set forth by LGPD, which may include your consent, compliance with legal or regulatory obligations, the performance of contracts, the regular exercise of rights, the protection of credit, or our legitimate interests, provided such processing does not violate your fundamental rights and freedoms.

    +

    Personal data collected in connection with the RAF + Program (Trezor Suite)

    +

    We collect, store and process this personal data because you participate in our + RAF Program through Trezor Suite, in order to administer the RAF Program, including verifying referrals and + issuing rewards.

    +

    To comply with legal requirements, we must mention that we collect, store and + process such personal data pursuant to Article 6 (1) (b) of the Regulation. That means that processing of + such personal data is necessary for the performance of a contract which we concluded - the contract + established between you and our company when you accept the RAF Program Terms and Conditions and participate + in the RAF Program.

    For how long will you process my personal data?

    We process and store your personal data only for the time necessary to meet the @@ -1094,6 +1123,11 @@

    Personal data colle

    When you provide a product review and choose to display your name, we will process your name for an indefinite period of time and display it together with your review on the Website. You may at any point instruct us otherwise.

    +

    Personal data collected in connection with the + Refer-a-Friend Program (Trezor Suite)

    +

    We will process and store the persistent identifier and the record of your + Refer-a-Friend Terms and Conditions acceptance for the duration of your participation in the Program, plus 12 + months thereafter to verify referrals, resolve disputes and comply with our legal obligations.

    Who will have access to my personal data?

    We take care of your personal data security and so we choose the partners to whom we @@ -1123,18 +1157,32 @@

    Who will have access to -

    ShipBob

    +

    ShipMonk

    + + +

    Order of goods from the Trezor Shop.

    + + +

    Your name, address, email address, phone number and order + information.

    + + +

    We use this provider as our fulfillment (logistics) partner.

    + + + +

    Central Warehouse Solution (Skladon)

    -

    Order of goods from the Trezor Shop.

    +

    Order of goods from the Trezor Shop.

    -

    Your name, address, email address and phone number.

    +

    Your name, address, email address, phone number and order + information.

    -

    We use these providers as our logistics partners.

    +

    We use this provider as our logistics partner.

    @@ -1159,14 +1207,15 @@

    Who will have access to -

    Freshworks (Freshdesk)

    +

    Zendesk

    Sending us an email requesting customer support, or contacting us via our virtual support agent Hal.

    -

    Your name, email address and physical address in case of refunds.

    +

    Your name, email address and physical address and order information in case + of refunds.

    We use this service as a ticketing portal for customer communications.

    @@ -1196,8 +1245,8 @@

    Who will have access to

    Subscribing to our newsletter.

    -

    Your name (if you subscribe during the order placement procedure in the Trezor - Shop) and email address.

    +

    Your name (if you subscribe during the order placement procedure in the + Trezor Shop or by redeeming a Promotional Code) and email address.

    We use this service for sending marketing emails to those who have @@ -1315,8 +1364,9 @@

    Who will have access to

    Referral Candy

    -

    Order of goods from the Trezor Shop using a discount code provided under our Refer-A-Friend program.

    +

    Order of goods from the Trezor Shop using a discount code provided under our + legacy Refer-A-Friend program (being discontinued; full closure targeted for 4 January + 2027).

    Your email address and your name.

    @@ -1328,26 +1378,32 @@

    Who will have access to
    +

    From 4 November 2026, new participants join our Refer-a-Friend Program directly + through Trezor Suite, which we operate ourselves without a third-party processor.

    +

    In addition to the above, if you choose to pay using Apple Pay, Google Pay or + PayPal at checkout, your payment is processed directly by Apple Inc., Google LLC or PayPal respectively, each + acting as an independent data controller for that payment data, governed by their own terms and privacy + policy. We do not act as their processor and do not have access to your underlying payment card or account + data.

    Another recipients that may have access to your personal data are our providers of technological, security, accounting, legal and administrative services.

    -

    Also, in connection with the cryptocurrency buy, sell and exchange services, the - possible recipient of your personal data is a member company of the SatoshiLabs Group group of companies, the - commercial company Invity.io s.r.o., Id. No. 083 88 032, with its registered office at Kundratka 2359/17a, - Libeň, 180 00 Prague 8, the Czech Republic, registered by the Municipal Court in Prague, Section C, Insert - 318166.

    +

    If you redeem a Promotional Code distributed by our partner, we may inform that + partner that the code has been redeemed. We do not share your name, contact details or delivery address with + the partner.

    Our aim is and always will be to ensure your personal data are as anonymous as possible and unavailable to all third parties. However, under certain specifically defined conditions we will be under some circumstances required, in accordance with the applicable law, to transfer certain personal data to public authorities.

    -

    When collecting, storing and processing personal data we sometimes may use personal - data processors, which under some circumstances transmit your personal data to third countries. In such an event - we always make sure such transmission is compliant with the Regulation. In particular, we specify that the - personal data may be transmitted to the United States of America and in such event the transmission is compliant - with the “Privacy Shield” program.

    -

    For Brazilian users, if we transfer your personal data outside Brazil, we will take - steps to ensure that such transfer complies with the LGPD and that adequate protection is provided for your - data.

    +

    When collecting, storing and processing personal data we sometimes may use + personal data processors, which under some circumstances transmit your personal data to third countries. In + such an event we always make sure such transmission is compliant with the Regulation. In particular, we + specify that the personal data may be transmitted to the United States of America, and where the recipient + participates in the EU-U.S. Data Privacy Framework, such transmission is based on the European Commission's + adequacy decision for that framework, Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EUR-Lex). Where a recipient does not + participate in the EU-U.S. Data Privacy Framework, we rely on Standard Contractual Clauses or another + transfer mechanism recognised under the Regulation.

    How is my personal data protected?

    All your personal data is secured by standard procedures and technologies using the @@ -1402,15 +1458,6 @@

    What are my rights in re a request for remedial measures in case of any violation of the obligations set forth in the Regulation at the following address: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, phone number +420 234 665 111 (central telephone exchange).

    -

    If you are located in Brazil, you also have the following rights under the LGPD: -

    -
      -
    • a right to confirm the existence of processing;
      • -
    • a right to obtain information about public and private entities with - which we share your data;
      • -
    • a right to obtain information about the possibility of not providing - consent and the consequences of such refusal.
      • -

    You may exercise these rights by contacting us at info@trezor.io. We will respond to requests in accordance with applicable law.