IRTO DEFI ACADEMY LLC Last updated: June 2026 Section 1 – Controller The controller within the meaning of the General Data Protection Regulation (GDPR) is: IRTO DEFI ACADEMY LLC 530B Harkle Rd Ste 100 Santa Fe, NM 87505, USA Email: info@defi-power.com Section 2 – Applicability of the GDPR (1) Although the Provider is based in the USA, the GDPR applies pursuant to Art. 3 (2) GDPR, as the Provider offers services to persons located in the European Union (the so-called "marketplace principle"). The GDPR therefore applies to all processing of personal data of users habitually resident in the EU, regardless of where the processing actually takes place. (2) In addition to the GDPR, national data protection laws of the Member States may apply, in particular the German Federal Data Protection Act (BDSG) for users habitually resident in Germany. (3) For users residing or habitually resident in the USA, US data protection regulations may additionally apply, in particular at the state level. The Provider notes that the USA does not have a uniform federal data protection law comparable to European law. Section 3 – Principles of Data Processing (1) The Provider processes the user's personal data exclusively within the framework of applicable data protection regulations, in particular the GDPR and any additionally applicable national data protection laws. (2) The Provider collects, processes, and uses the user's personal data only to the extent necessary to establish, perform, and conclude the contractual relationship, or where the user has expressly consented. (3) Personal data is disclosed to third parties only to the extent necessary for the performance of the contract, where the user has expressly consented, or where a legal obligation exists. Section 4 – Categories of Data Collected and Purposes of Processing I. Performance of the Contract (1) In the course of concluding and performing the contract, the Provider processes the following categories of data: - Master data, in particular name, company, address, email address and, where available, telephone number, company name, position, and VAT identification number of the user; - Payment data, in particular bank details or other payment information, to the extent required for processing the agreed fees; - Communication data, in particular email correspondence and messages sent via the community platform or other agreed communication channels; - Usage data, in particular access data to the platform and participation data for communication formats. (2) The legal basis for processing this data is Art. 6 (1) (b) GDPR (performance of a contract). II. Payment Processing by External Service Providers (1) To process the contractually agreed fees, the Provider uses the payment service provider Odoo S.A., Avenue du Bois Soleil 4, 1420 Braine-l'Alleud, Belgium. Odoo processes the personal data of the user required for payment processing, in particular name, address, email address, and payment information, as a processor pursuant to Art. 28 GDPR on the basis of a data processing agreement. No transfer of this data to third countries outside the European Union takes place in the course of this processing. (2) The legal basis for disclosing the data to the aforementioned payment service providers is Art. 6 (1) (b) GDPR (performance of a contract). Insofar as data is transferred to the USA in this context, the provisions of Section 7 of this Privacy Policy apply additionally. III. Use of the Platform and Community (1) In the course of using the online platform and the community, the Provider processes usage data, in particular access times, content used, as well as posts and statements made within the community. (2) The legal basis for processing is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (f) GDPR. The Provider's legitimate interest lies in the proper operation and secure functioning of the platform and in protecting against misuse within the community. IV. Messenger Services and External Communication Platforms (1) For communication with the user and for operating the community, the Provider uses external messenger services and communication platforms, in particular Telegram (Telegram FZ-LLC, Dubai, UAE, with server infrastructure in various countries) and Heartbeat (Heartbeat Chat Inc., USA). When these services are used, connection data and the content of the messages exchanged are processed. (2) Telegram and Heartbeat act as independent controllers within the meaning of the GDPR. The Provider has no direct influence on the data processing carried out by these platforms. Users are advised to review the respective privacy policies of Telegram and Heartbeat independently. (3) These services are used on the basis of Art. 6 (1) (b) GDPR (performance of a contract), as the aforementioned platforms form part of the contractually owed services as agreed communication channels. Insofar as data is transferred to third countries in this context, the provisions of Section 7 of this Privacy Policy apply additionally. V. Communication Formats (Live Calls) (1) In the course of conducting synchronous online communication formats via two-way video conferencing, technical connection data is processed as well as, insofar as the user actively participates in the communication, real-time video and audio transmissions. The Provider uses Zoom Video Communications, Inc. (USA) or LiveWebinar (LiveWebinar RTCLab Sp. z o.o., Poland) to conduct video conferences. (2) Any recordings of live calls, workshop live calls, and Gold Club workshops are made exclusively as recordings of the Provider's presentation and contribution. Video and audio of participants are not recorded in these formats. Insofar as participants' audio is also recorded in these formats, this is done only after prior announcement at the beginning of the respective event. Participants are free to mute their microphone for the duration of the recording. In individual sessions, video and audio recordings are made only if the user has given their express consent in advance. Consent may be withdrawn at any time with effect for the future; the lawfulness of processing carried out on the basis of consent prior to its withdrawal remains unaffected. (3) The legal basis for processing this data is Art. 6 (1) (b) GDPR (performance of a contract). For the creation of recordings, Art. 6 (1) (a) GDPR (consent) applies. Insofar as data is transferred to Zoom Video Communications, Inc. in the USA in this context, the provisions of Section 7 of this Privacy Policy apply additionally. VI. Contact and Support (1) If the user contacts the Provider by email or other agreed communication channels, the Provider processes the personal data transmitted exclusively for the purpose of handling the inquiry and, where necessary, for performing the contract. (2) The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (f) GDPR. The Provider's legitimate interest lies in the proper handling of customer inquiries and in maintaining communication with the user. Section 5 – Retention Period (1) Personal data is stored only for as long as is necessary to fulfill the respective processing purpose or as required by statutory retention obligations. (2) Contract-related data, in particular master data, payment data, and invoicing records, is stored for the duration of the contractual relationship and for the duration of the statutory retention periods. The retention periods under commercial and tax law generally amount to six to ten years from the end of the respective financial year in which the data was created (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)). (3) Communication data, in particular email correspondence and messages via external platforms, is stored for the duration of the contractual relationship and for a reasonable follow-up period based on the statutory limitation periods for contractual claims, which is generally three years after the end of the contractual relationship. (4) Usage data and access data for the platform are stored for the duration of the contractual relationship and, insofar as necessary to prove the performance of the contract, for a reasonable period thereafter. (5) Data processed exclusively on the basis of consent is stored until consent is withdrawn, unless further statutory retention obligations apply. (6) Upon expiry of the respective retention period, personal data is routinely deleted or, where immediate deletion is not technically possible, blocked from further processing. Section 6 – Disclosure of Data to Third Parties and Data Processing on Behalf (1) The Provider discloses the user's personal data to third parties only to the extent necessary for the performance of the contract, in particular: - to payment service providers for processing fees, in particular Odoo S.A., Avenue du Bois Soleil 4, 1420 Braine-l'Alleud, Belgium; - to providers of technical infrastructure, insofar as they are engaged as processors within the meaning of Art. 28 GDPR; - to operators of communication platforms, in particular Telegram and Heartbeat, insofar as these form part of the contractually owed services as communication channels; - to Zoom Video Communications, Inc. or LiveWebinar RTCLab Sp. z o.o. in the course of conducting synchronous communication formats; - to public authorities or courts, insofar as there is a legal obligation to disclose. (2) Personal data is not disclosed to third parties for advertising purposes. (3) Insofar as the Provider engages service providers as processors, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR. The processors are contractually obligated to process personal data exclusively on the Provider's instructions and in compliance with data protection regulations. Section 7 – Transfer of Personal Data to the USA and Other Third Countries (1) The Provider is based in the United States of America (USA). Under data protection law, the USA is considered a third country for which the European Commission has not established a level of data protection equivalent to European law. The processing of personal data by the Provider therefore structurally takes place in a third country without an adequacy decision. (2) The transfer of personal data to the USA is carried out primarily on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular on the basis of the Standard Contractual Clauses (SCC) issued by the European Commission. Insofar as, in individual cases, no Standard Contractual Clauses or other appropriate safeguards pursuant to Art. 46 GDPR are exceptionally in place and a transfer is strictly necessary for the performance of the contract concluded with the user, the Provider bases the transfer alternatively on Art. 49 (1) (b) GDPR. This derogation is not used as a regular basis for structurally recurring transfers. (3) The user is expressly informed that in the USA, public authorities, in particular US intelligence agencies, may access personal data under certain legal conditions, and that the user may not have legal remedies available in the USA comparable to those under European law. This is particularly relevant under the Foreign Intelligence Surveillance Act (FISA) and the CLOUD Act. (4) Insofar as the Provider uses external communication platforms, in particular Telegram, Heartbeat, LiveWebinar, and Zoom Video Communications, the user's personal data may also be transferred to these providers in the USA or other third countries. The Provider notes that it has no direct influence on the data processing carried out by these platforms and that the user should review the respective privacy policies of these providers independently. (5) The user may at any time request from the Provider information about the appropriate safeguards used in the individual case as well as a copy of the Standard Contractual Clauses. Requests should be addressed to the contact address stated in Section 1. Section 8 – Rights of Data Subjects (1) With regard to the processing of their personal data, the user has the following rights vis-à-vis the Provider: - Right of access pursuant to Art. 15 GDPR; - Right to rectification pursuant to Art. 16 GDPR; - Right to erasure pursuant to Art. 17 GDPR; - Right to restriction of processing pursuant to Art. 18 GDPR; - Right to data portability pursuant to Art. 20 GDPR; - Right to object pursuant to Art. 21 GDPR to processing based on Art. 6 (1) (f) GDPR; - Right to withdraw consent pursuant to Art. 7 (3) GDPR with effect for the future; the lawfulness of processing carried out on the basis of consent prior to its withdrawal remains unaffected. (2) To exercise their rights, the user may contact the Provider at any time at the contact address stated in Section 1 (1) or the EU representative pursuant to Section 1 (2). The Provider responds to data subject requests within the statutory time limits, generally within one month of receipt of the request pursuant to Art. 12 (3) GDPR. (3) Without prejudice to any other administrative or judicial remedy, the user has the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR if they consider that the processing of their personal data infringes the GDPR. The competent supervisory authority is determined by the user's habitual residence, place of work, or the place of the alleged infringement. For users habitually resident in Germany, this is the competent state data protection authority or the Federal Commissioner for Data Protection and Freedom of Information (BfDI). Section 9 – Data Security (1) The Provider implements appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect the user's personal data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. (2) The security measures are continuously adapted and improved in line with technological developments. Section 10 – Changes to this Privacy Policy (1) The Provider reserves the right to amend this Privacy Policy as necessary, in particular to adapt it to changed legal requirements or changed technical circumstances. (2) The current version of the Privacy Policy is made available to the user in text form. Material changes will be communicated to the user separately. Translation Notice This Privacy Policy was originally written in German and has been translated into English for your convenience. In the event of any discrepancies, ambiguities, or errors in translation, the original German version shall prevail. We assume no liability or risk whatsoever for errors, omissions, or inaccuracies arising from the translation. You can find the original German version here: https://thorstenkoch‒defi.com/datenschutz