Privacy Policy

We take the protection of your personal data seriously. Qivalis B.V. (hereinafter referred to as “Qivalis”, “we”, “our”, “us” for the purpose of the EU General Data Protection Regulation (“GDPR”), and if not specified otherwise in this Privacy Policy, we are the “Data Controller”) is committed to data avoidance and data minimization. We treat your personal data as confidential and in accordance with the legal data protection regulations and this Privacy Policy. Please read this Privacy Policy carefully to better understand your rights in relation to your personal data, and how we collect and use it.

For the terms used (e.g. "personal data", "processing", "person responsible" and "processor") we refer to the definitions of the GDPR in Art. 4 GDPR.

I. Name and contact details of the Data Controller

II. Personal data we are processing, the purpose and legal basis for that processing and storage periods for the data
1. Website
2. Contact via email
3. Customer Onboarding Process
4. Redemption Process
5. Applications
6. Social Media

III. Recipients of your personal data and where it is stored
1. Data processors
2. Data storage location

IV. Rights of data subjects (your rights)

V. Disclaimer

VI. Changes and updates to this Privacy Policy

The person responsible for the processing of your personal data in the context of this website (Data Controller), if not specified otherwise, is: Qivalis B.V., Strawinskylaan 1457, 1077 XX Amsterdam, The Netherlands, Email: info@qivalis.eu

1. Website

When you visit our website (https://qivalis.eu/), the following data is processed:

Personal and additional data:
The provider of the pages collects and stores information in so-called server log-files, which your browser automatically transmits. The following data is temporarily stored by the web server when you visit the provider's website:
- Browser type/ browser version.
- Used operating system.
- IP address.
- Date and time of access.
- Referrer URL.
- Transferred amount of data.
- Message as to whether the call was successful.

Cookies:
Cookies are text files placed on your device to collect certain information. We are only using necessary cookies or “session cookies”. These cookies are used for activities that are strictly necessary to operate our website in a reliable manner, therefore, do not require you to consent.

Purposes of processing:
- Operating the website.
- Evaluating technical malfunctions.
- Website security measures.

Legal basis:
- Art. 6 para. 1 letter f GDPR (“legitimate interest”).

Storage period:
- Log-files are automatically deleted after the default settings of 52 days.

2. Contact via email

When you send us an email to info@qivalis.eu the following data is processed:

Personal data:
- Your name.
- Your email address.
- In regard to your message in your email you send us, please take the following into account:

-- We do not advise you to send us any data that is considered to be sensitive personal data in the meaning of Art. 9 GDPR (“special categories of personal data”), i.e. information on your racial or ethnic origin, sexual orientation, marital status, political affiliation, religion or any other beliefs, health, criminal records or a trade union membership.
-- If you disclose personal information about others in your message, you declare and warrant that you are authorized to do so and that you permit us to use such information in accordance with this Privacy Policy.

Purpose of processing:
- Answering your email.

Legal basis:
- Art. 6 para. 1 letter a GDPR (“consent”).
- Art. 6 para. 1 letter b GDPR (“performance of a contract”).
- Art. 6 para. 1 letter c GDPR (“legal obligation”).
- Art. 6 para. 1 letter f GDPR (“legitimate interest”).

Storage period:
After completion of the data processing, your data is generally deleted at the latest 3 years after the end of the year in which the data processing was completed. In exceptional cases, however, the data may be stored for longer. This depends on the individual case of your inquiry and the content of your message. The data will be deleted after 10 years at the latest. In the meantime, the data will be pseudonymized as far as possible.

3. Customer Onboarding Process

If you represent a company that wishes to become a customer of Qivalis, you will be asked to complete our know-your-business (“KYB”) onboarding process on a dedicated onboarding page to which you have received a link to. During the KYB onboarding process, you will be asked to accept this Privacy Policy. The onboarding will not be facilitated via this website therefore please refrain from sending us any KYB documents via e-mail.

Personal data:
- Email-address.
- Name and first name(s).
- Proof of identity.
- Proof of address of the company's directors.
- Ultimate beneficial owners (UBO) and authorized representatives.
- Further professional (e.g. company's registration, ownership and corporate structure) or private information (e.g. due to being a politically exposed person) depending on the company and situation. 

Purpose of processing:
- Verifying the identity of our corporate customers and its directors, UBOs and authorized representatives.
- Conducting anti-money laundering (AML), counter-terrorist financing (CTF), and sanctions and politically exposed person (PEP) screening.
- Complying with our obligations as a financial institution supervised by De Nederlandsche Bank (DNB).

Legal basis:
- Art. 6 para. 1 letter b GDPR (“performance of a contract”).
- Art. 6 para. 1 letter c GDPR (“legal obligation”).
- Art. 6 para. 1 letter f GDPR (“legitimate interest”).

Storage period:
We generally retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the duration of the business relationship and thereafter for as long as required by applicable statutory retention obligations, including applicable AML/CTF requirements. Where no statutory retention period applies, personal data will generally be deleted when it is no longer required for these purposes, subject to applicable limitation periods and any need to retain the data for the establishment, exercise or defence of legal claims.

4. Redemption Process 

If you hold our electronic money token (EMT), EURqi, but are not an onboarded customer (i.e. you have not completed our KYB onboarding process), you have the right to redeem your EURqi directly with us. To process the redemption in accordance with the procedure described on our website, we are legally required to carry out know-your-customer (KYC) and anti-money laundering (AML) checks. Accordingly, we need to process certain personal data to comply with these legal and regulatory obligations. 

Personal data:
- Proof of identity (including, where required, a notarised copy of a valid government-issued ID) and proof of address.
- Bank account details (IBAN).
- The blockchain wallet address from which the EURqi will be submitted for redemption.
- Where requested, documentation evidencing the source of funds or source of wealth.
- Any other information or documentation we reasonably require to complete identity verification and compliance checks.
- For legal entities additionally:

-- Company registration.
-- Ownership/beneficial-ownership documentation.
-- Evidence of authorisation to act on the entity's behalf.

Purpose of processing:
- Verifying the identity of the redeemer. 
- Conducting AML/CFT and sanctions and PEP screening on the redeemer and on the wallet address used.
- Processing and settling the redemption request.
- Complying with our obligations as a financial institution supervised by De Nederlandsche Bank (DNB).

Legal basis:
- Art. 6 para. 1 letter b GDPR (“performance of a contract”).
- Art. 6 para. 1 letter c GDPR (“legal obligation”).
- Art. 6 para. 1 letter f GDPR (“legitimate interest”). 

Storage period:
We generally retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the redemption process and thereafter for as long as required by applicable statutory retention obligations, including applicable AML/CTF requirements. Where no statutory retention period applies, personal data will generally be deleted when it is no longer required for these purposes, subject to applicable limitation periods and any need to retain the data for the establishment, exercise or defence of legal claims.

5. Applications

If you are applying for an open position you are sending us personal data. In principle, you yourself decide which data you want to send us with your application. However, we would like to point out that the lack of information about your training and your career path means that we cannot evaluate your application sufficiently with regard to an advertised position with us. Therefore, where some crucial information might be missing from your application, we would not be able to consider it.

Personal data:
- Email-address.
- Name and first name(s).
- Information provided in your CV. 
- In regard to your email you send us, please take the following into account: 

-- We do not advise you to send us any data that is considered to be sensitive personal data in the meaning of Art. 9 GDPR (“special categories of personal data”), i.e. information on your racial or ethnic origin, sexual orientation, marital status, political affiliation, religion or any other beliefs, health, criminal records or a trade union membership.

--If you disclose personal information about others in your message, you declare and warrant that you are authorized to do so and that you permit us to use such information in accordance with this Privacy Policy.

Purpose of processing:
- Answering your application and potentially initiation next steps in our hiring process.

Legal basis:
- Art. 6 para. 1 letter b GDPR (“performance of a contract”).
- Art. 6 para. 1 letter c GDPR (“legal obligation”).
- Art. 6 para. 1 letter f GDPR (“legitimate interest”).

Storage period:
In principle, we retain your application documents and any other personal data received from you during the application process for the duration of the application process. If your application is unsuccessful, we will retain your application documents and other relevant personal data for an additional period of six months in order to establish, exercise or defend against any potential legal claims. If the application process results in an employment relationship, your application documents will be transferred to your personnel file and retained for the duration of your employment and, insofar as necessary for the establishment, exercise or defence of legal claims, for an additional period of three years thereafter. Certain personal data, such as payroll-related information, may be subject to longer statutory retention periods. If you enter into an employment relationship with us, we will provide you with further information on the applicable data processing and retention periods as part of our employee privacy information.

6. Social Media

Our Website contains links to our social media profiles (e.g. LinkedIn and X).

You can recognize these links by the respective logos. When you click on a link, you will be redirected to the relevant social media platform.

In doing so, the provider may receive information such as your IP address and that you visited our Website. If you are logged into your social media account at that time, the provider may link your visit to your account.

The processing of personal data by these platforms is carried out solely by the respective providers. For more information, please refer to their privacy policies.

Insofar as we disclose data to other persons and companies (Data Processors) within the scope of our processing, transfer them to them or otherwise grant them access to the data, this only takes place on the following legal basis: consent Art. 6 para. 1 letter a GDPR, performance of a contract Art. 6 para. 1 letter b GDPR, a legal obligation Art. 6 para. 1 letter c GDPR, our legitimate interests Art. 6 para. 1 letter f GDPR.

1. Data processors

The following categories of third-party providers (Data Processors) are used to enable the work of our website and to communicate with you:

-  Email notification provider.
- CRM software provider.
- Cloud storage providers.
- KYB/AML screening and identity-verification provider.
- Identity-verification and AML/CFT screening provider(s).

2. Data storage location

The information that we collect from you is transferred, stored, and processed within the EEA and potentially in other countries where our Data Processors are located. We will take all reasonable steps to ensure that your personal data is treated securely, with a level of protection adequate to GDPR and in accordance with this Privacy Policy. We have provided further details below regarding the steps taken to ensure adequate processing of your personal data.

Model clauses

If we transfer data to a third party located outside of the EEA which is not in a White Listed Country, as data exporters, we enter into the European Commission’s model contracts (“SCCs”) for the transfer of personal data to third countries (i.e., the standard contractual clauses pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021) with the relevant data importer. Prior to entering into SCCs we assess, on a case-by-case basis, as outlined in the CJEU decision in Case C‑311/18 [also known as Schrems II] on 16.07.2020, whether an adequate level of data protection, comparably to the level of data protection within the EU is given in the country where the data will be transferred to. If the appropriate level of protection is not given, additional protection provisions and measures will be contractually agreed and/or implemented by us to ensure the protection of personal data.

You have the following rights under the statutory provisions: 

- Right to withdraw consent (Art. 7 (3) GDPR).
- Right of access to information (Art. 15 GDPR).
- Right to have incorrect personal data concerning you corrected (“Right to rectification”)  (Art. 16 GDPR).
- Right to erasure ("Right to be forgotten") (Art. 17 GDPR).
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability (Art. 20 GDPR).
- Right to object against the processing of personal data concerning yourself (Art. 21 GDPR).
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent supervisory authority for Qivalis B.V. is the Autoriteit Persoonsgegevens (AP), Bezuidenhoutseweg 30, 2594 AW Den Haag, The Netherlands (www.autoriteitpersoonsgegevens.nl).

To exercise any of your rights, please email dataprotection@qivalis.eu. We will respond to your request within one month of receipt. In complex or high-volume cases, this period may be extended by a further two months; we will notify you of any extension within the initial one-month period (Art. 12(3) GDPR).

Please note that for each of the rights above, we may have valid legal reasons to refuse your request, in such instances we will let you know if that is the case. In particular, the right to erasure under Art. 17 GDPR does not apply to the extent we are subject to a statutory retention obligation under applicable anti-money laundering legislation (Art. 17(3)(b) GDPR), including in relation to the KYB onboarding and EMT redemption data described in Sections II.3 and II.4 above.

This Privacy Policy contains links to other websites. Please note that by clicking on a link you will be redirected to another website or document. These websites can be beyond Qivalis's sphere of influence. Liability is excluded. The operators of the linked websites are solely responsible for their content. We refer you to their privacy policy. 

This Privacy Policy is reviewed and revised from time to time. Further developments of our website and the implementation of new technologies to improve user experience may also require changes to this Privacy Policy. We, therefore, recommend that you re-read this Privacy Policy from time to time.

Last update of this Privacy Policy: 2026-09-18