Privacy Policy

Information for persons concerned

Olky Group Privacy Policy

The Olky Group (hereinafter the "Olky Group" or "we") historically created the first payment institution specialized in SEPA Direct Debit operations. It is still at the forefront of technology and market expectations with its OlkyPass, OlkyPay and OlkyWallet offers. The purpose of this privacy policy is to explain our use of your personal data and the rights you have under the (EU) General Data Protection Regulation of April 27, 2016 (hereinafter "GDPR").

Table of contents

  1. Which entities are in charge of processing your personal data?
  2. What data do we process?
  3. With whom may we share your data?
  4. How do we ensure the confidentiality and security of your data?
  5. What cookies and other tracking devices do we use?
  6. What rights do you have?
  7. How can you exercise your rights?
  8. When do we update our privacy policy?

I. Which entities are responsible for processing your personal data?

Your data may be processed by several Olky Group entities. Nun-Tech is the data controller within the meaning of the GDPR for the processing of personal data (hereinafter "processing(s)") implemented as part of the OlkyPass offering. Nun-Tech is also a subcontractor of OlkyPay and OlkyWallet for processing data relating to the OlkyPass KYC passports In addition, OlkyPay acts as a data controller in connection with its activities as a payment establishment and the provision of the OlkyPay offer. Similarly, OlkyWallet acts as a data controller for its activities as a crypto-asset service provider (CASP) and for the provision of the OlkyWallet offer (currently in the process of obtaining approval under MiCA EU regulation).

If you provide us with the personal data of third parties, you may qualify as a data controller. As such, you are obliged to inform these third parties of the processing of their data by the Olky Group and of the existence of this data protection policy.

II. What data do we process?

Personal data (hereinafter referred to as "Data") is information that can be used to identify a person :

  • directly, such as name or postal address, or
  • indirectly, such as a customer number or IP address.

We collect Data in the following cases:

  • You subscribe to one of our OlkyPass, OlkyPay or OlkyWallet offerings;
  • You request information about our products and services;
  • You visit our website or use our mobile application;
  • You are applying for a position within the Olky Group;
  • You contact us via a form for a purpose other than subscribing to our products and services or exercising your rights to your personal data (customer support, complaint, etc.).

As part of our obligations to combat money laundering and the financing of terrorism (AML/CFT) and our regulated activities, we process Data that is not collected directly from the persons concerned. For example, if you are a legal representative, beneficial owner or customer of a company receiving regulated services from Olky Group entities, we may need to process certain Data.


Type of data collected in connection with our OlkyPass, OlkyPay and OlkyWallet offers Use of data Legal basis for processing Retention period
  • Identification data (surname, first name, address, telephone number, etc.)
  • Personal data (date and place of birth, nationality, etc.)
  • Electronic identification and authentication data (e-mail address, IP addresses, cookies, password, PIN code, etc.)
  • Data relating to your company or profession, employment, academic background
  • Data relating to business links with the Olky Group's internal or external partners
  • Image and sound recording, for KYC verification purposes only (as part of account opening)
  • Identifier assigned by public authority / public body
  • Financial data (including income and assets) and transactional data (including data relating to natural or legal person counterparties
  • And any other information related to the provision of OlkyPass, OlkyPay and/or OlkyWallet services.
  • User space management
  • Activity as a payment service provider
  • Activity as a crypto-asset service provider
  • Contract performance and execution
  • Account holder data, including contracts and copies of exchanges, are kept for 10 years after account closure.
  • Data obtained in the course of an unsuccessful business relationship is deleted after two years.
  • Management of commands and communication rights from public authorities
  • Compliance with a legal obligation
  • Know You Customer management (verification of customer identity, application of AML/CFT regulations,
  • Compliance with other legal and regulatory obligations, etc.).
  • Compliance with a legal obligation
  • 5 years in France / 10 years in Luxembourg: after termination of the contractual relationship or after completion of the last transaction
  • Know Your Transaction management (traceability of identification, fight against financial crime, compliance with legal and regulatory obligations, etc.).
  • Compliance with a legal obligation
  • Data processing with Olky Group entities offering services subject to AML/CFT regulations
  • Sharing of information on the basis of law provisions on AML/CFT requirements at Group level
  • Compliance with a legal obligation
  • Identity, contact data, exchanges
  • Receipt of newsletters
  • Request for contact and information
  • Commercial prospection and promotion of new products.
  • Consent or legitimate interest
  • Three years from the date of the request, except in the case of customers or in the case of opposition.
  • Digital path: IP address, operating system, browser, devices used, date and time of visit, flow of clicks on URLs entering and leaving our website, sections consulted, download errors, duration of visits to certain pages, interaction between pages, use of our mobile application.
  • Visits to our website and use of our mobile application
  • Consent or refusal to store cookies on your device: legitimate interest
  • 12 months
  • Bug fixes, statistics, fraud prevention, personalization of your experience : legitimate interest
  • Audience measurement, display of advertisements on third-party websites or on our site: Consent
  • 12 months
  • Name, e-mail and postal addresses, telephone number, content of exchanges, identification or other details (if verification is required)
  • Request for assistance (customer support, claim)
  • Exercise of rights held under the GDPR
  • Legitimate interest
  • Lifetime of account management or 2 years for requests to exercise GDPR rights


Generally speaking, Data is kept for as long as is necessary for our Group to fulfill its legal and regulatory obligations, and to exercise the prerogatives granted to it by law and jurisprudence.

Refusal to provide Data required by our services is entirely at your discretion. However, such refusal may prevent you from subscribing to some of our services and continuing our contractual relationship.

If you apply for a position with the Olky Group and we have not acted on your application within 2 months of receiving it, please assume that your application has been unsuccessful and that your Data has been deleted. If you have been granted an interview but your application has not been accepted, we will delete the Data 1 month after our last exchange.

III. With whom may we share your Data?

Access to Data is strictly limited to employees of the Olky Group who are duly authorized by virtue of their functions and bound by an obligation of confidentiality.

We share your Data with:

  • Our technical service providers who help us provide our services (for example, in the fight against money laundering and terrorism);
  • Our subsidiaries;
  • Our external Partners who use your Data to provide you with personalized advertising or an enhanced experience on our website or within our mobile application. To see the list of these third-party service providers, please consult our Cookie Policy;
  • Entities to which we may sell or transfer all or part of our business.

We may communicate Data to public authorities (tax, judicial, police, control authorities and regulators) and, where applicable, to lawyers, notaries, liquidators or other persons authorized and legally entitled to receive such Data.

Data related to OlkyPass, OlkyPay and OlkyWallet services are stored within the European Union.

We may transfer Data to countries outside the European Economic Area (for example to external Partners as part of a recruitment process or to external Partners using cookies).

We only transfer Data to external Partners:
  • who are established in a country offering an adequate level of protection according to the European Commission; or
  • with whom we have signed the standard contractual clauses adopted by the European Commission ; or
  • who undertake to apply a code of conduct or a certification mechanism validated by the competent European authorities.

IV. How we ensure the confidentiality and security of your data?

The Olky Group is committed to paying particular attention to the security of your personal data.

To this end, the Olky Group takes appropriate physical, technical and organizational measures to prevent, as far as possible, any alteration or loss of Data or any unauthorized access thereto.

V. Cookies and tracers

For information on the use of cookies and other tracking devices on our website and mobile application, please consult our cookie policy, available at www.olky.eu/en/universe/cookies.

VI. Your rights

When we process your Data, you have certain rights. These rights are as follows: and in particular :

  • A right of access - you have the right to obtain from us confirmation as to whether or not your Data is being processed and information about how it is being processed. You also have the right to obtain a copy of your Data. We may refuse to provide you with information where this is a matter of business confidentiality or where it relates to another person.
  • A right of rectification - you can ask us to take steps to correct your Data if it is inaccurate or incomplete (for example, in the case of a wrong name or address).
  • A right to erasure - you may request that we erase or delete your Data. However, this is not a general right to erasure, and there are some exceptions (for example, where we need to retain information to comply with a legal obligation).
  • A right to restrict processing - you have the right to "block" or prevent further use of your Data when we are assessing a request for rectification or as an alternative to erasure. Where processing is restricted, we may still retain your Data, but we may not continue to use it, unless otherwise required by law.
  • A right to data portability - where the processing of Data is based on your consent or on the performance of a contract and the processing is carried out using automated processes, you may request to obtain from us the Data concerning you in a structured, commonly used and machine-readable format, for the purposes in particular of transmission to a third party. Where technically possible, you also have the right to have your Data transmitted directly to this third party.
  • A right to object - you have the right to object to certain types of processing, insofar as such processing takes place for the purposes of legitimate interests pursued by the Olky Group (for example, in the case of marketing and prospecting). We will be permitted to continue processing Data if we can demonstrate that the processing is justified on compelling legitimate grounds that override your interests, rights and freedoms or if we need it for the establishment, exercise or defense of legal claims.
  • A right to withdraw your consent - where the Olky Group processes your Data on the basis of your consent, you have the right to withdraw your consent at any time. However, such withdrawal does not affect the lawfulness of the processing that took place prior to such withdrawal.

French legislation on the protection of personal Data, and more specifically article 85 of law no. 78-17 of January 6, 1978 relating to information technology, files and freedoms (known as the "Loi Informatique et Libertés"), allows data subjects and, where applicable, their heirs, to provide data controllers with instructions on how to manage their Data after their death. Luxembourg legislation does not currently contain an equivalent provision. Nevertheless, if we receive such a request, the company will do its utmost to process it, subject to any legal or regulatory obligations to the contrary.

VII. Exercising your rights

If you wish to exercise your rights, you can contact us using the "Exercise your rights to your personal data" form or by post at OLKY, 1 Op de Leemen, L-5846 Fentange Luxembourg.
Our departments are obliged to respond to your requests within a maximum of one month from receipt of the request. However, this one-month period may be extended by a further two months due to the complexity of your request. In this case, you will be informed within a maximum of one month of receipt of your initial request.
In the event of difficulty in connection with the management of your Data, you may lodge a complaint with:

  • CNPD - Commission Nationale pour la Protection des Données (more information at www.cnpd.public.lu) for data relating to human resources and OlkyPass, OlkyPay and OlkyWallet activities;

VIII. Update of this privacy policy

We update this privacy policy on a regular basis and in line with regulatory developments or as our range of services expands. Your continued use of our services constitutes your acceptance of any such changes.

9 July 2025