Ostatnia aktualizacja · 2026-11-04

Rumos Privacy Notice (EU)

CU EUROPE Privacy Notice: the platform operator's privacy notice · Version 1.1 · Effective: 4 November 2026

This notice explains how CU EUROPE, digitalne storitve, d.o.o. ("CU EUROPE", "we", "us") processes personal data when you use the Rumos mobile apps, the Rumos website and our related services (together, the "Platform"). It applies to users and visitors in the European Union and the European Economic Area. It is our information under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

The regulated crypto-asset services you can reach through the Platform (custody, exchange, order execution and transfers, and the identity checks and anti-money-laundering controls that go with them) are provided by BitGo Europe GmbH, not by us. BitGo processes your personal data for those services as a separate controller under its own privacy notice. Section 5 explains where our responsibility ends and BitGo's begins.

1. Who we are and how to contact us

The controller of your personal data on the Platform is:

CU EUROPE, digitalne storitve, d.o.o. (short name CU EUROPE d.o.o.), trading as Rumos (formerly CryptoUnity) Slovenia (full postal address: see our Impressum at https://rumos.eu/legal/impressum) Company registration number (matična številka): 7591802000 Tax number (davčna številka): 69157022

• Privacy questions and requests to exercise your rights: info@rumos.eu
• Support and complaints: support@rumos.eu or in-app support
• By post: to that address, marked "Data protection"

We have not appointed a data protection officer, because the GDPR does not require one for our processing (see section 16). Please use the contacts above for all privacy matters.

CU EUROPE is a technology platform operator. It is not a licensed crypto-asset service provider and does not hold your crypto-assets or funds.

2. Change of platform operator

Until 22 October 2026, the Platform was operated by CU, trgovanje z virtualnimi valutami, d.o.o., Kotnikova ulica 5, 1000 Ljubljana, Slovenia, company registration number 8995958000 ("CU d.o.o."), which was the controller of your personal data. During the transition period CU EUROPE processed Platform data only as CU d.o.o.'s processor, on its instructions, with the data kept in the EU.

On 22 October 2026 (the "transfer day"), operation of the Platform passed from CU d.o.o. to CU EUROPE, and CU EUROPE became the controller. As we told you in our notice before the transfer, your user account, including your balance records and transaction history, passed to CU EUROPE on that day.

What passed to us. For each registered user: your profile and account data, account settings and communication preferences, the records of your account with BitGo as shown on the Platform (account identifiers, balance records and transaction history), the records of your acceptance of the Platform terms and of BitGo's agreements, and the identity-verification records held in the Platform's account with our former verification provider Sumsub (see section 4.4). Data of people who never registered on the Platform did not pass to us.

Legal basis. CU d.o.o. disclosed this data to us, and we received it, because it is necessary to keep providing the Platform you signed up for and to take over the contract with you (Article 6(1)(b) GDPR), and because CU d.o.o., CU EUROPE and our users have a legitimate interest in the Platform continuing without interruption, including your uninterrupted access to the assets that BitGo holds for you (Article 6(1)(f) GDPR).

What CU d.o.o. keeps. CU d.o.o. keeps, as a separate controller, the records it must retain under the law that applied to it, in particular a copy of the identity-verification records made up to the transfer day, and its earlier support history. For those records, please contact CU d.o.o. at the address above or by email at cut@cut-token.org.

If you do not want to continue with CU EUROPE, you can close your account at any time (see section 4.1). Closing your account does not affect your assets with BitGo; you can withdraw them under BitGo's terms.

3. This notice at a glance

Details follow in section 4.

4. What we process, why, on what legal basis and for how long

4.1 Your account

• Purposes: creating your account; signing you in and authenticating you (including two-factor authentication); managing your settings and language; providing the Platform's features, such as portfolio views, the "Next Steps" guide, educational content and notifications; checking that you meet the Platform's eligibility rules; closing your account.
• Data: first name and last name, date of birth, citizenship, country of residence, email address, phone number, login credentials (passwords are stored only in hashed form), two-factor settings, account settings and preferences, the language you use, how you use the Platform's features (for example progress in educational content), and the device and app version you use. For legal entities, the same data about their representatives and beneficial owners.
• Legal basis: performance of our contract with you (Article 6(1)(b) GDPR); our legitimate interest in keeping accounts secure (Article 6(1)(f) GDPR).
• Retention: while your account is open. After you close your account, we keep the records of our business relationship with you (identification data, the agreements you accepted and the time of acceptance, your transaction history and formal communications) for 10 years after the relationship ends, because our agreement with BitGo and our AML/CFT policy require us to keep them and we may need them to establish or defend legal claims.

4.2 Access to BitGo's services: onboarding data we send to BitGo

• Purposes: collecting the information BitGo needs to open and maintain your BitGo account, and sending it to BitGo through its interface (API); showing you BitGo's agreements and risk disclosures in full and recording that you accepted them; sending your acceptance to BitGo.
• Data: name, date of birth, address, email and phone number, countries of birth, citizenship, residence and tax residence, tax identification number, industry, employment status, source of funds, your self-declaration on whether you are a politically exposed person, and the date and time you accepted BitGo's agreements. We send this information to BitGo as you gave it, marked as not verified by us. We do not edit or complete it for you.
• Legal basis: this is necessary to give you access to the BitGo services you ask for (Article 6(1)(b) GDPR). Keeping the records is in our legitimate interest in meeting our obligations to BitGo and being able to show that the onboarding was done correctly (Article 6(1)(f) GDPR). When you start onboarding, our Platform terms ask you to authorise this sharing; that authorisation is part of our contract with you and is required by BitGo. It is not consent in the GDPR sense, so the legal bases above apply.
• Retention: 10 years after the end of our business relationship with you.

4.3 Balances, transactions and your instructions

• Purposes: showing your balances, holdings, transaction history and account statements, which BitGo provides; passing your instructions (for example buy, sell or recurring purchases you set up) to BitGo through the API without changing them; passing BitGo's messages and account statements to you; keeping the Platform's record of your balances.
• Data: balances in crypto-assets and euro, transaction and order history and status, wallet addresses, BitGo account and enterprise identifiers, account statements, and the instructions you give.
• Legal basis: performance of our contract with you (Article 6(1)(b) GDPR); our legitimate interest in operating the Platform reliably (Article 6(1)(f) GDPR).
• Retention: while your account is open, then 10 years after the relationship ends. BitGo's records are the authoritative record of your holdings.

4.4 Identity-verification records from the earlier verification process

Before the current onboarding process with BitGo, identity verification for the Platform was carried out through Sumsub (Sum and Substance Ltd) on behalf of CU d.o.o. The Platform's Sumsub account, with the verification history, passed to us on the transfer day. Identity checks for new BitGo onboarding are now carried out by BitGo (see section 5). We no longer use our own Sumsub account for new identity checks: we keep it only to store those earlier records for as long as the law and our record-keeping obligations require. The identity checks in use today are run by BitGo in its own flow, with Sumsub acting for BitGo.

• Purposes: keeping the earlier verification records so that we can answer requests from you, from BitGo or from competent authorities, and establish, exercise or defend legal claims. We do not use them for any other purpose.
• Data: identification data, copies of identity documents, proof of address, results and reports of the checks, and, where a liveness check was done, facial images and data from that check, which can be biometric data.
• Legal basis: our legitimate interest in answering such requests and protecting our legal position (Article 6(1)(f) GDPR); for biometric data, Article 9(2)(f) GDPR (establishment, exercise or defence of legal claims).
• Retention: with access restricted to the managing director, for 10 years after the end of the business relationship with you, only to meet our legal record-keeping obligations.

4.5 Support and complaints

• Purposes: answering your questions; solving your requests; handling complaints under our Complaints Handling Procedure; forwarding to BitGo, within 2 business days, any message or complaint that concerns BitGo's services, and passing BitGo's reply back to you.
• Data: name, email address, the content of your messages and attachments, account data needed to solve the matter, and, for complaints, the entry in our complaints register (date, channel, category, summary, whether it concerns BitGo, actions, outcome, date closed).
• Legal basis: performance of our contract with you (Article 6(1)(b) GDPR); our legitimate interest in handling complaints properly, keeping a register and improving our service (Article 6(1)(f) GDPR).
• Retention: support correspondence for 3 years after the matter is closed; complaints and the complaints register for 10 years, under our AML/CFT policy, which our Complaints Handling Procedure follows.

4.6 Service messages and push notifications

• Purposes: sending you messages about your account and the Platform, such as security alerts, confirmations, changes to terms, and notices that BitGo or the law requires; push notifications about your account and activity.
• Data: email address, name, language, device token for push notifications, notification settings, and whether a message was delivered.
• Legal basis: performance of our contract with you (Article 6(1)(b) GDPR). You can turn off non-essential push notifications in the app or your device settings.
• Retention: while your account is open. Device tokens are deleted when you sign out, turn off notifications or uninstall the app, or when they expire.

4.7 Marketing and newsletters

• Purposes: sending you news about Rumos, our features, educational content, events and offers by email or push notification; measuring whether you open these messages.
• Data: email address, name, language, your subscription status and preferences, and whether you opened a message or clicked a link in it.
• Legal basis: your consent (Article 6(1)(a) GDPR). If you are a user and we send you news about our own similar services, we may rely on our legitimate interest (Article 6(1)(f) GDPR) under the Slovenian Electronic Communications Act (ZEKom-2); you can object at any time, including in every message.
• Retention: until you withdraw your consent or unsubscribe. We then keep only your email address on a suppression list, so that we do not contact you again.

You can unsubscribe through the link in every email or in your app settings. Withdrawing consent does not affect processing before the withdrawal.

4.8 Referral and reward programmes

• Purposes: running referral, loyalty and reward programmes; linking a referred user to the person who referred them; checking that rewards are earned fairly; paying rewards; preventing abuse.
• Data: your referral code, who referred you or whom you referred (the user's name or username as shown in the programme), the dates on which conditions were met, rewards earned and paid, and the information we need to detect abuse (for example linked accounts or devices).
• Legal basis: performance of the programme terms you accept (Article 6(1)(b) GDPR); our legitimate interest in preventing abuse (Article 6(1)(f) GDPR); for reward payment records, our legal obligation to keep accounting records (Article 6(1)(c) GDPR).
• Retention: while you take part in the programme and your account is open; records of rewards paid are kept for 10 years as accounting records.

4.9 Subscriptions and payments

• Purposes: providing paid subscriptions on the Platform; invoicing; handling refunds and disputes.
• Data: name, email address, the subscription you chose, its status and period, payment references and amounts. Card details are handled by the payment provider and are not stored by us.
• Legal basis: performance of our contract with you (Article 6(1)(b) GDPR); our legal obligation to keep invoices and accounting records (Article 6(1)(c) GDPR, the Slovenian Tax Procedure Act ZDavP-2, the Companies Act ZGD-1 and the accounting rules (Slovenian Accounting Standards)).
• Retention: invoices and accounting records for 10 years after the end of the year they relate to; other subscription data while your account is open.

If you subscribe through Apple's App Store or Google Play, Apple or Google processes your payment as a separate controller under its own terms. Stripe processes card payments made on the Platform (see section 7).

Paid subscriptions are sold and billed by CU Global, Inc., a corporation incorporated in the State of Delaware, USA, 1111B S Governors Ave STE 40602, Dover, DE 19904, USA. CU Global, Inc. is a separate controller of the data needed to sell, bill and manage your subscription (your account identifier, name, email address, the plan you chose, the subscription status and period, and payment references and amounts); card details are handled by Stripe. We pass it your account identifier, email address and the plan you chose, because this is necessary to provide the subscription you ask for (Article 6(1)(b) GDPR); CU Global, Inc. processes this data to perform your subscription contract (Article 6(1)(b) GDPR) and to keep the invoices and records that EU VAT rules require (Article 6(1)(c) GDPR). This is a transfer of personal data to the USA, which is necessary for the performance of the subscription contract you conclude with CU Global, Inc. (Article 49(1)(b) and (c) GDPR). You can exercise your rights regarding this data against CU Global, Inc. through info@rumos.eu.

4.10 Security, fraud prevention and financial-crime escalation

• Purposes: protecting accounts and systems; detecting unauthorised access, account takeover, fraud and misuse; investigating incidents; restricting access when BitGo asks us to; passing to BitGo what we notice in the ordinary course of business that may indicate fraud, scams, money laundering, terrorist financing, sanctions evasion or use from a prohibited country, so that BitGo can decide on reporting and account measures; reporting to the Slovenian Office for Money Laundering Prevention where Slovenian law requires us to.
• Data: IP address, device identifiers, browser and app data, sign-in and event logs, and the account, transaction and support data relevant to the case.
• Legal basis: our legitimate interest in keeping the Platform, our users and BitGo's services safe, and in meeting our obligations to BitGo (Article 6(1)(f) GDPR); where a law requires us to report, that legal obligation (Article 6(1)(c) GDPR).
• Retention: technical and access logs for up to 12 months, unless needed longer for an investigation or a legal procedure; case records for 10 years.

The law can stop us from telling you that a suspicion was raised or reported.

4.11 The website: cookies, consent and analytics

• Purposes: running the website; remembering your cookie choices, language, region and display theme; with your consent, measuring how visitors use the website through Google Analytics; measuring visits without cookies through our self-hosted audience-measurement tool (Umami); with your consent, recording pseudonymised session replays and heatmaps to see where pages are hard to use (all form inputs are masked, and nothing is stored on your device).
• Data: your cookie choices (stored in the cu-consent cookie and in your browser's local storage), language choice (cu-lang cookie), theme and region choices (local storage); for analytics, pages visited, referring site, campaign tags, approximate location derived from the IP address, device and browser type, and interactions on the page. Google Analytics is set to shorten IP addresses. Umami does not set cookies and does not store your IP address.
• Legal basis: strictly necessary storage (your consent choice, language and region): our legitimate interest in running the website (Article 6(1)(f) GDPR). Google Analytics and session recording: your consent (Article 6(1)(a) GDPR and Article 225 ZEKom-2). Cookieless audience measurement (Umami): our legitimate interest in knowing how the website is used and improving it (Article 6(1)(f) GDPR); you can object.
• Retention: the consent cookie for 12 months, the language cookie for 12 months; Google Analytics data for up to 14 months; Umami statistics for up to 14 months; session recordings for up to 30 days.

When the app opens website pages, such as these legal pages, no website analytics run.

Our Cookie Policy lists the cookies and similar technologies in detail and tells you how to change your choices.

4.12 The app: diagnostics and analytics

• Purposes: finding and fixing crashes and errors, to keep the app stable and secure; with your consent, understanding how the app's features are used so that we can improve them, and seeing which campaign or link an installation came from (install attribution).
• Data: crash reports (device model, operating system, app version, the state of the app when it crashed, a pseudonymous installation identifier); app usage events (screens viewed, features used) linked to a pseudonymous app-instance identifier and, after you log in, to a pseudonymised form of your user number; for install attribution, the Google Play install referrer with its click and install times (Android) or the result of exchanging Apple's AdServices token with Apple for Apple Search Ads attribution data (iOS), stored by us and not passed to Meta or Google.
• Legal basis: crash reporting: our legitimate interest in a working, secure app (Article 6(1)(f) GDPR); Firebase Crashlytics is used only as strictly necessary for the security and stability of the app (Article 225(2) ZEKom-2), only for crash and stability data and never for advertising. App analytics and install attribution: your consent (Article 6(1)(a) GDPR and Article 225 ZEKom-2), given through a separate opt-in that is not pre-ticked (shown when you accept the Terms or after you log in) and that you can withdraw at any time in the app settings; analytics stays off until you agree. This applies from app version 1.18. Versions before 1.18 do not have this opt-in and send usage statistics from the first launch and install-attribution data once per installation (see Section 5 of our Cookie Policy); we process that data on the basis of our legitimate interest in understanding the app's use (Article 6(1)(f) GDPR), and you can object to it and ask us to delete it at info@rumos.eu.
• Retention: crash reports up to 90 days; app analytics up to 14 months.

4.13 Legal obligations, legal claims and business changes

• Purposes: keeping records required by law and by our agreements; answering lawful requests from courts and authorities; cooperating with BitGo's audits and regulatory requests under our agreement with BitGo; establishing, exercising or defending legal claims; in a merger, sale or reorganisation of our business, giving the buyer or successor what it needs to continue the Platform.
• Data: the data described above, limited to what the purpose needs.
• Legal basis: legal obligation (Article 6(1)(c) GDPR); our legitimate interest (Article 6(1)(f) GDPR).
• Retention: as stated for each activity above, or as long as a proceeding or request lasts.

5. BitGo Europe GmbH and identity verification

BitGo is a separate controller. The regulated crypto-asset services on the Platform are provided by BitGo Europe GmbH, Mainzer Landstraße 10, 60325 Frankfurt am Main, Germany, a crypto-asset service provider authorised by the German Federal Financial Supervisory Authority (BaFin). You have a direct contract with BitGo under BitGo's own agreements. BitGo decides how it processes your personal data for those services, including identity verification ("KYC"), anti-money-laundering checks, sanctions screening, transaction monitoring, custody and order execution, and its own legal and tax reporting duties. For that processing, BitGo is an independent controller, and BitGo's Privacy Notice applies: BitGo Privacy Notice and www.bitgo.com/privacy. BitGo's privacy contact is privacy@bitgo.com. We are not BitGo's processor, and BitGo is not ours.

Identity verification. When you onboard to BitGo's services, the app sends you to BitGo's own identity-verification flow (a document and liveness check, or a video identification), which BitGo runs with its identity-verification provider (currently Sumsub, acting for BitGo). The documents, images and biometric data collected in that flow are collected by and for BitGo. We do not receive them. BitGo decides whether to approve you; you cannot use BitGo's services on the Platform until BitGo has approved you.

What we send to BitGo through its API: - the onboarding data listed in section 4.2 and your acceptance of BitGo's agreements; - your instructions (for example buy, sell or recurring purchases), unchanged; - messages and complaints that concern BitGo's services, and the information needed to handle them; - information about possible fraud or financial crime, as described in section 4.10; - information BitGo asks for to meet its legal or regulatory obligations, or in an audit.

What we receive from BitGo through its API: - the status of your onboarding and verification (for example pending, approved or rejected), but not the documents or biometric data behind it; - your BitGo account and enterprise identifiers and wallet addresses; - your balances, transaction and order history and status, and prices; - account statements and notices that BitGo requires us to pass to you; - requests to restrict or disable your access to BitGo's services.

Requests about the data BitGo holds should go to BitGo. If you send them to us, we will forward them to BitGo.

6. Where your data comes from

Most of the data we process comes from you, when you register, use the Platform or contact us. We also receive data from:

• CU d.o.o., the previous operator, on the transfer day (section 2);
• BitGo, through its API (section 5);
• Apple, Google and Stripe, about the status of subscriptions and payments (section 4.9);
• other users, when they refer you (section 4.8);
• your device and browser, through the technologies described in sections 4.11 and 4.12.

7. Who we share your data with

Service providers (our processors). They process data only on our instructions and under data-processing terms with us:

Independent controllers. They decide themselves how they use the data, under their own privacy notices: - BitGo Europe GmbH, for its regulated services (section 5); - Stripe, for card payments; - CU Global, Inc. (Delaware, USA), the seller of paid subscriptions (section 4.9); - Apple (App Store) and Google (Google Play), for in-app purchases and app distribution; - CU d.o.o., for the records it keeps (section 2).

Others, where needed: courts, supervisory and law-enforcement authorities (including the Slovenian Office for Money Laundering Prevention and tax authorities) when the law requires it; our lawyers, accountants and auditors; and a buyer or successor of our business (section 4.13).

We do not sell your personal data, and we do not share it with third parties for their own advertising.

8. Transfers outside the EEA

We keep the Platform's data in the EU. Some of our service providers, or their sub-processors, are based in or can access data from the USA: Mailgun, Google and, for support purposes, Amazon Web Services. For these transfers we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR). The transfer to CU Global, Inc. for subscriptions is described in section 4.9. Sumsub is based in the United Kingdom, for which the European Commission has adopted an adequacy decision. You can ask us for more information about these safeguards at the contact in section 1.

9. Cookies and similar technologies

We use cookies, local storage and SDKs as described in sections 4.11 and 4.12 and in our Cookie Policy. In the EU, we place non-essential cookies and run analytics only after you consent. You can change your choices at any time through the cookie settings on the website or in the app.

10. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, with one exception: before your onboarding data is sent to BitGo, the app checks automatically that you are at least 18 years old and resident in a country where BitGo's services are offered, using the data you entered. If you do not meet these rules, your application is not sent. This check is necessary to enter into the contract for access to BitGo's services (Article 22(2)(a) GDPR). If you think the check was wrong, contact us and a person will review it.

We may tailor what the app shows you (for example the "Next Steps" guide or educational content) based on how you use it. This does not have legal or similarly significant effects.

BitGo, and its identity-verification provider on BitGo's behalf, may use automated processing in identity verification and anti-money-laundering checks. That processing is BitGo's, under BitGo's Privacy Notice.

11. Do you have to give us your data?

You need to give us the account data in section 4.1 to open an account, and the onboarding data in section 4.2 if you want to use BitGo's services; BitGo requires it, partly to meet its legal obligations. Without it we cannot open the account or give you access to those services. Everything else, such as marketing preferences or analytics consent, is optional.

12. How we delete data

When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you. Data in backups is overwritten in the normal backup cycle, within 12 months (hourly backups are kept for 7 days, daily backups for 60 days and weekly backups for 365 days). Where we must keep data longer for a legal procedure or a lawful request, we keep only what is needed, with access restricted.

13. How we protect your data

We use encryption in transit (TLS) and at rest, access limited to authorised persons with two-factor authentication, hashed passwords, secure storage of API keys, backups, and a procedure for personal data breaches, including notification of the Information Commissioner within 72 hours and of affected users where the risk is high. The Platform never holds the private keys to your crypto-assets.

14. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy (Article 15);
• rectification of inaccurate or incomplete data (Article 16); you can change much of your profile in the app;
• erasure (Article 17), unless we must keep the data, for example for the retention periods in section 4;
• restriction of processing (Article 18);
• data portability for data you gave us that we process on the basis of contract or consent (Article 20);
• object to processing based on our legitimate interests (Article 21(1)); and to object at any time to direct marketing (Article 21(2)), after which we stop;
• withdraw your consent at any time, without affecting earlier processing (Article 7(3));
• not to be subject to a solely automated decision as described in Article 22, and to obtain human review (section 10).

To exercise a right, write to info@rumos.eu or use in-app support. We may ask you to confirm your identity, for example by writing from the email address registered to your account. We answer within one month; for complex requests we may extend this by up to two further months and will tell you why. Exercising your rights is free, unless a request is manifestly unfounded or excessive. Rights over the data BitGo processes as controller are exercised with BitGo (section 5); if you send such a request to us, we will forward it.

Complaint to the supervisory authority. You can lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec Republike Slovenije), Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip@ip-rs.si, www.ip-rs.si, or with the supervisory authority in the EU or EEA country where you live or work, or where an infringement took place. We would appreciate the chance to resolve your concern first, but you do not have to contact us before complaining.

15. Children

The Platform is only for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

16. Data protection officer

We have not appointed a data protection officer. Our processing does not involve large-scale regular and systematic monitoring of individuals or large-scale processing of special categories of data, so Article 37 GDPR does not require one. Our managing director is responsible for data protection and can be reached at info@rumos.eu.

17. Changes to this notice

We may update this notice when our processing or the law changes. The current version and its effective date are always shown on our website and in the app. We will tell you about material changes in advance by email or in the app.

Version 1.1 · Effective: 4 November 2026 · CU EUROPE, digitalne storitve, d.o.o., Slovenia