Controller
Elite Institute, Rosenthaler Straße 43-45, 10178 Berlin, Germany, contact@elitecontract.de. We have not appointed a data protection officer; on our assessment the conditions of Art. 37 GDPR do not apply. Data protection enquiries reach us at privacy@elitecontract.de.
What we collect, and why
When you send a case report
Your name, email address, and optionally telephone number and country; the type and approximate size of the loss, the period concerned, and your own description of what happened. Legal basis: steps taken at your request prior to a contract, Art. 6(1)(b) GDPR.
When you hold a client account
Your name, email address and a password. The password is never stored: only an Argon2id hash with a server-side secret is kept, from which the password cannot be recovered. Legal basis: performance of the mandate, Art. 6(1)(b) GDPR.
Optionally, a German phone number. We use it only to call you or to text you by SMS or WhatsApp about your case, for example about a booked call-back or a change in your case status. You can remove it at any time by contacting us. Legal basis: your consent, Art. 6(1)(a) GDPR, and performance of the mandate, Art. 6(1)(b) GDPR. Messages sent via WhatsApp are processed by WhatsApp Ireland Limited.
While your case runs
Case records and the investigator's notes, invoices, messages you exchange with us through the portal together with any files you attach, the wallet or bank details you give us for a payout, and ledger entries recording funds received and paid out. Legal basis: performance of the mandate, Art. 6(1)(b) GDPR, and statutory retention duties, Art. 6(1)(c) GDPR.
Automatically, for security
Rejected or failed requests — failed sign-ins, permission denials, malformed requests — are recorded with the source IP address, the browser's user-agent string, the time, and whether a session was present. Legal basis: our legitimate interest in protecting client data against unauthorised access, Art. 6(1)(f) GDPR. These records are deleted after 90 days.
How it is protected
Personal data is stored encrypted with AES-256-GCM. Email addresses are additionally stored as a keyed hash. Attachments are stored encrypted, and passwords use Argon2id with a server-side secret. Data is transmitted over TLS.
Access is restricted by role, and security-relevant access is logged.
Where your data is stored
The application and database run on a server in Switzerland. The European Commission has granted Switzerland an adequacy decision, most recently reconfirmed in January 2024: Swiss data protection is recognised as equivalent to the EU’s, so personal data may be transferred from the EU to Switzerland without additional safeguards.
Processing is therefore subject both to the EU General Data Protection Regulation (GDPR) and to the revised Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023). The server and database are under Swiss jurisdiction. Individual services that process data on our behalf — for example to send email — are listed below under “Who else processes your data”, and some may be based outside Switzerland.
Who else processes your data
- Server hosting
- The server on which the application and database run is operated by a hosting provider in Switzerland on our behalf, under a data processing agreement. We name the provider on request.
- Resend
- Delivers transactional email — verification links, password resets, invoices, notifications. Receives the recipient address and the content of that message.
- CoinGecko
- Supplies exchange rates for the indicative fiat value shown beside a balance. Receives only asset symbols and a currency code. No personal data is sent.
We do not use analytics, advertising, social media plug-ins or third-party fonts. Fonts are served from our own server, so no request is made to a third party when you open a page.
Cookies and local storage
See the cookie notice. We use one session cookie, a language preference and a text-size preference, kept in your browser. These are not used for tracking and do not require consent.
How long we keep it
- Case and billing records
- For the statutory retention period: six years for commercial correspondence and ten years for accounting records (§257 HGB, §147 AO), then deleted.
- Security events
- 90 days.
- Session records
- Removed when the session expires; staff sessions last at most 8 hours.
- Case reports that do not become a mandate
- six months after the last correspondence, then deleted.
Your rights
You may request access to your data (Art. 15), correction of it (Art. 16), its deletion (Art. 17), restriction of its processing (Art. 18), a copy in a portable format (Art. 20), and you may object to processing based on our legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.
To exercise any of these, write to privacy@elitecontract.de. You also have the right to complain to a supervisory authority; the one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
Is providing data required?
Providing the data described above is necessary for us to assess and pursue a recovery. You are not obliged to provide it, but without it we cannot take on the mandate.
Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Every assessment of a case is made by a person.
Changes
This notice was last updated on 25 September 2026. We will publish any change here.