Version 2 of 15 Oct 2026
1. Controller and processor
Controller: Diagenics Group SE, 7, Z.A.C. Kléngbusbierg, L-7795 Bissen, Luxembourg (the "Company"). The platform is operated on the Company's behalf by BIT BAJT as a processor under a data processing agreement. Contact for data protection matters: the address on the Company's website.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| E-mail address, chosen number of shares, payment method | Start your subscription and let you sign in without a password | Steps prior to a contract, Art. 6(1)(b) GDPR |
| Identity data (name, date of birth, nationality, address, document type and number), face and document images, proof of address, source-of-funds answers, screening results, tax residence, the capacity in which you subscribe (own account, trustee, custodian) and the name of the person for whom the shares are held | Identify you before you become a shareholder, check you against EU sanctions lists, lists of politically exposed persons and adverse media, and understand where the funds come from | Contract and steps prior to it, Art. 6(1)(b) GDPR; legal obligation under the directly applicable EU sanctions regulations, Art. 6(1)(c); the Company's legitimate interest in knowing its shareholders and preventing misuse, Art. 6(1)(f); for the face check, which uses biometric data, your explicit consent, Art. 9(2)(a) GDPR, given in the verification window. You can withdraw it; the identity check then cannot be completed. Screening results can reveal data on criminal offences (adverse media) and on political functions (politically exposed persons). The Company processes them only as far as Article 9(2) and Article 10 GDPR allow. |
| Subscriber declaration and self-certification (the three statements before the price), with the time, your browser identifier and a code derived from your IP address (not the address itself) | Evidence that the offer may be made to you without a prospectus | Contract and legal obligation, Art. 6(1)(b) and (c) GDPR |
| Subscription Application, signature evidence, payment reference, incoming payment data (payer name, IBAN, amount; for a crypto payment the sending wallet address, the transaction identifiers and the exchange rate) | Conclude the subscription, match your payment, register your shares | Contract, Art. 6(1)(b); accounting obligations, Art. 6(1)(c) |
| The wallet address you name for the DIA token before signing (a message signed with that wallet only where the platform asks for one), the acceptance of the DIA token terms, blockchain transaction identifiers | Record the DIA token in that wallet after the register entry and, on request, cancel it | Contract, Art. 6(1)(b) |
| Passkey public key, session and security log entries, IP address | Protect the platform, My page and your payment details from misuse, including the rate limit on requests for the offer figures from diagenics.com | Legitimate interest in security, Art. 6(1)(f) |
| Messages you send on My page, files you attach, and reports under "Something is wrong?" | Answer your questions and correct your data before you sign. Kept with your subscription records | Contract and steps prior to it, Art. 6(1)(b) GDPR |
| Phone number | The electronic signature (the signature provider sends you a one-time code) and questions about your subscription | Contract, Art. 6(1)(b) GDPR |
| Only if you have no valid identification for a qualified electronic signature yet: the data and images of your identity document and your mobile number; depending on the method, photographs or a video of you with a biometric comparison of your face | Identify you once before your first qualified electronic signature, as the law requires of the trust service provider that issues the signature certificate. An identification partner carries it out for that provider, which keeps the data on its servers in Switzerland; they never reach the platform. Depending on the method, the identification stays valid for your signatures for two to five years | Contract and steps prior to it, Art. 6(1)(b) GDPR. For the identification the trust service provider is a controller in its own right: it relies on its contract with you and on its legal duty to verify the identity of the person to whom it issues a qualified certificate (Art. 24(1) of Regulation (EU) No 910/2014), and its own privacy statement says how long it keeps the data |
3. Who receives data
The identity verification provider (document images and video stay there; we receive the result and the extracted data), the electronic signature provider, the trust service provider that issues the signature certificate and its identification partner (only for the one-time identification for the qualified signature; those data stay with them, in Switzerland), the Company's banks for payment reconciliation and, if the Company switches on an automated bank feed, the bank data service that reads its account statements, the provider that screens payer names against sanctions lists (where one is used), the wallet screening provider (only for a DIA token wallet), the Safe transaction service and the blockchain node provider (wallet address only), the hosting and e-mail providers of the platform operator, and the Company's share registrar. By name: Sumsub for the identity check (data stored in Germany), Skribble for the electronic signature (Skribble Deutschland GmbH, Germany) with Swisscom Trust Services as the trust service provider (Switzerland), Chainalysis for the wallet screening (United States), Safe Labs GmbH, Berlin, for the Safe transaction service, Infura (Consensys) and Alchemy for the Ethereum nodes (United States) and, for Bitcoin payments, mempool.space and blockstream.info, Hetzner Online GmbH for hosting (Germany) and Amazon Web Services for e-mail (Amazon SES, Frankfurt, Germany). The providers above are bound by contract. Two of them are also controllers in their own right: the trust service provider for the identification (section 2), and the identity verification provider for the purposes its own privacy notice names, among them developing and improving its services and detecting fraud across its clients, for which it keeps pseudonymised data to calibrate its models. The pages load no fonts or scripts from anyone else. Where a provider is located outside the EU, the transfer rests on an adequacy decision of the European Commission (for Switzerland, where the identification data for the qualified signature are kept, Decision 2000/518/EC; for certified companies in the United States, for example a wallet screening provider, the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses. Public blockchains are worldwide: the record of your DIA token contains your wallet address, the number of DIA tokens, an identity code that is the same for all your wallets and a subscription reference code, never your name.
4. Retention
Accounting records of your subscription (the signed Subscription Application, payment and account statement data, and the correspondence about them): ten years from the end of the financial year to which they relate (Luxembourg Code de commerce, art. 16). Identity and screening records: 5 years from the end of your subscription, to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR; for screening results that reveal special categories of data, Art. 9(2)(f) GDPR; screening results that reveal data on criminal offences, such as adverse media, are kept only where Union or Luxembourg law authorises it, Art. 10 GDPR). The tamper-proof audit log records every step of your subscription, including your declarations and the outcome of the identity check; its entries cannot be changed or deleted and are therefore kept without a time limit; they hold no IP addresses. Sign-in links and sessions: deleted when they expire. Sign-ups whose e-mail address is never confirmed are cancelled after seven days; the e-mail address and the declarations you made are kept as evidence for 6 months. Then the e-mail address is deleted; the record of your declarations stays in the tamper-proof audit log without it. The same applies to a subscription that ends before you sign the Subscription Application, with no payment and no identity check: its data are kept for 6 months, counted from its end, and then deleted. If the identity check had started, they are deleted when the period for identity and screening records above ends. Server logs with IP addresses, including requests for the offer figures from diagenics.com: 30 days. Blockchain records are permanent. The DIA token can be cancelled at your request at any time. Earlier records stay visible; cancelling the token is not an erasure of personal data under Art. 17 GDPR.
5. Your rights
Access, rectification, erasure (within the limits of the retention duties above), restriction, portability and objection, and a complaint with the Luxembourg data protection authority (CNPD). Write to the Company at the address above. The identity check can reject an application automatically. You can ask for a review by a person, state your view and contest the decision.
6. Cookies
The platform sets only technically necessary cookies: your session, your language (12 months), your confirmation on the start page that you may view the offer (30 days), a mark that you signed in on this device before (180 days, so that sign-in links others request for your address cannot block your own sign-in), if you have several subscriptions, which one My page shows (12 hours), a protection against requests from other websites (until you close the browser), a one-time notice after an action (one minute) and, while you wait to continue on another device, a waiting mark (as long as the sign-in link is valid, plus a few minutes). No analytics, no advertising, no third-party cookies. That is why there is no cookie banner.