Carnomaly Privacy Policy

Data protection is a particularly high priority for and the use of our Internet page (“Website”) is possible without any indication of personal data. However, if a data subject wants to use special services via our website, or any subdomains we maintain, processing of personal data could become necessary. 

By means of the Privacy Policy, we would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process, as well as that the processing of personal data by us will always be in line with all applicable statutory and regulatory guidelines. Furthermore, data subjects are informed, by means of this Privacy Policy, of the rights to which they are entitled. 

As a controller for the data collected via our Website, and as a processor for the data collected via any subdomains we maintain, has implemented numerous technical and organizational measures to ensure the most complete protection of the personal data processed. 


I. Definitions

To ensure that this Privacy Policy is legible and understandable for the general public, and particularly the data subjects, we would like to first explain the terminology used.

In this Privacy Policy, we use inter alia, the following terms:

  1. Personal data – any information relating to an identified or identifiable natural person;
  2. Data subject – any identified or identifiable natural person, whose personal data is processed by;
  3. Processing – any operation or set of operations which is performed on the personal data or on sets of personal data;
  4. Controller – a legal person, which alone determines the purposes and means of the processing of personal data. is a Controller, regarding the personal data collected by our website;
  5. Processor – a legal person, which processes Personal data of behalf of the Controller. is a Processor, regarding the Personal data collected via the subdomains we maintain. 

II. Identity and contact details

Registered Address:

101 E. Park Blvd., Ste. 1150
Plano, Texas 75074

Scott Heninger

Any data subject may, at any time, contact our Data Protection Officer directly with all questions and suggestions concerning data protection.


 III. Contact possibility via our Website:

Our website contains information that enables a quick electronic contact. If a Data subject contacts us via the contact form of our website, the personal data transmitted by the data subject, e.g., name and email address, are automatically stored and processed by Carnomaly in its capacity as a Controller of Personal data. 

Such personal data is transmitted on a voluntary basis by a data subject to the controller. It is stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties.


IV. Subdomains may maintain subdomains in addition to its main website and therefore may provide software and other services for that purpose. Therefore, if a data subject provides any data on such a subdomain, the personal data transmitted by the data subject is automatically stored and processed by in the capacity of a Processor of personal data for the subdomain, which subdomain would be the Controller of such personal data.

The personal data necessary for the registration of the data subject may vary but it mainly consists of:

Phase 1: Registration –




Phase 2: Verification/KYC – 




Date of birth;

ID front and back;

Proof of address


Hereinabove personal data is transmitted on a voluntary basis by a data subject via the relevant subdomain. Thus both the Controller and the Processor have access to and process those data.

The registration of the data subject, with the voluntary indication of personal data, is intended to enable the Controller to offer the data subject contents or services that may only be offered to registered users due to the nature of the matter in question.

After the Registration is completed a confirmation e-mail is sent to the data subject in the double opt-in procedure. This confirmation email is used to prove whether the owner of the e-mail address is authorized to make a registration or that the owner of the e-mail address is aware of a registration in their name and authorizes such registration.

Some of the subdomains we may maintain may also provide for social media registration. If a data subject makes a registration through a third-party social media site like Facebook, Twitter or LinkedIn, for example, we will only gain access to the name and email of the data subject.

The verification of the data subject, with the voluntary indication of personal data, is intended to meet any applicable Anti-Money Laundering (AML) requirements for prevention of the use of the subdomain for money laundering and terrorist financing, if any. All such data is used for the purpose of verification only.

Although, neither the Controller, nor the Processor are required to perform the AML measures, it is possible that in the future AML obliged entities might be broadened to include companies like ours, thus the good practices require the verification of buyer identity and residency and Controllers have may decide to perform Know Your Client (“KYC”) procedures. Regarding this, each Controller, at its own discretion, may decide to use an independent KYC Provider, which will be involved in the process and will be handling with the KYC forms and the data subject’s personal data. KYC providers are appointed only by the Controller at its own discretion, and the latter can only be held liable for the organizational and technical measure those KYC providers apply regarding the protection of Data Subjects’ personal data. Carnomaly has no contractual relations with any of its clients KYC providers and cannot be held liable for any of their actions.


V. Subscription to newsletters

Any subdomains which we may maintain that may offer the opportunity to subscribe to a newsletter by clicking the relevant box will also allow data subjects to revoke a given consent at any time and for this purpose a corresponding link will be found in each newsletter or email containing a newsletter.


VI. Possible consequences of failure to provide data

The non-provision of personal data would have the consequence that the service requested by the data subject could not be provided, i.e. the data subject would not be able to contact us via our website or would not be able to make a registration on the subdomains we maintain or get verified for other uses and/or purchases. 


VII. Period for which the personal data will be stored

Personal data is stored up until the termination of the user’s account. Upon termination, the corresponding data is deleted as it is no longer necessary to maintain and there is no other legal basis for processing the data.


VIII. Disclosure will not disclose any personal data to a third party. However, controllers of any subdomains or the controllers of any domains that may be linked through may disclose the personal data of the data subject to other processors, for example KYC providers, email providers, SMS providers.

  1. Rights of the data subject
  2. Right to Access: As a data subject you have the right to obtain from us free information about your personal data processed at any time and a copy of this information. Furthermore, you will have access to the following information: the purposes of the processing; the categories of personal data collected; where possible, the anticipated period for which the personal data will be processed, or, if not possible, the criteria used to determine that period; the existence of the right to request from us rectification and erasure of personal data, or restriction of processing of personal data concerning you, or to object to such processing; the existence of the right to lodge a complaint with a supervisor authority; where the personal data are not collected directly from you, any available information as to their source; and the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and anticipated consequences of such processing for you.  
  3. Right to Rectification: You have the right to obtain from us, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes, you shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
  4. Right to be Forgotten: You have the right to obtain from us the erasure of personal data concerning you as soon as possible, and we shall have the obligation to erase personal data without undue delay where required by the law, including when:
    1. The personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
    2. There is no longer a legal ground for the processing;
    3. You object to the processing and there are no overriding legitimate grounds for the processing;
    4. The personal data has been unlawfully processed;
    5. The personal data must be erased for compliance with a legal obligation in accordance with the applicable law to which we are subject.
  5. Right to Restriction of Processing: You have the right to obtain from the Foundation restriction of processing where one of the following applies:
    • The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data;
    • The processing is unlawful and you oppose the erasure of the personal data and request instead the restriction of their use;
    • We no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims; and/or
    • You have objected to processing pursuant to applicable laws.
  6. Right to Object: You have the right to object, on grounds relating to your particular situation, at any time, to the processing personal data concerning you. We shall no longer process the personal data in the event of the objection, unless we can demonstrate reasonable grounds for the processing, which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. 
  7. Right to Withdraw Data Protection Consent: You have the right to withdraw your consent to processing of your personal data at any time.


IX. Security of the personal data

We have implemented technical and organizational measures to ensure that processing is carried out in accordance with all applicable statutory and/or regulatory requirements which may include but are not necessarily limited to:

  1. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
  2. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
  3. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.


X. Changes

We may periodically update this Policy and such updates will be published on our website. If the changes and updates in the Privacy Policy are important and substantially alter the rules on data protection, we will further notify the dad subjects through other means we find applicable, such as email or notice, before the changes come into effect.


XI. Questions

If you believe that any information about you is false or inaccurate, please let us know as soon as possible by contacting us at:

Who We Are

Our website address is:

Cookies Policy


Data protection is a particularly high priority for and we would like to inform the public that our internet page and any subdomains we maintain use cookies. 

This Cookie Policy is to inform the general public of the nature, scope, and purpose of the cookies we use, as well as the rights of data subject towards those uses.

1.What are cookies?

Cookies are text files that are stored in a computer system via an internet browser. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string through which internet pages and servers can be assigned to the specific internet browser in which the cookie was stored. This allows visited internet sites and servers to differentiate the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognized and identified using the unique cookie ID.

Through the use of cookies, can provide the users of the website or ICO subdomains of our clients with more user-friendly services that would not be possible without the cookie setting.

By means of a cookie, the information and offers on our website and any ICO subdomains of our clients can be optimized with the user in mind. Cookies allow us, as previously stated, to recognize users of our website and client subdomains. The purpose of this recognition is to make it easier for users to utilize the Website/Subdomains. The Website/Subdomain user that uses cookies, e.g. does not have to enter access data each time the Website/Subdomain is accessed, because this is taken over by the Website/Subdomain, and the cookie is thus stored on the user’s computer system.

2. Collection of general data and information

The Website/Subdomains collect a series of general data and information when a data subject or automated system calls them up. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches the Website/Subdomains (so-called referrers), (4) the sub-websites, (5) the date and time of access to the Website/Subdomains, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, (8) website usage information such as page views, button clicks, etc. and (9) any other similar data and information that may be used in the event of attacks on our information technology systems.

When using these general data and information, we do not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of the Website/Subdomains correctly, (2) optimize the content of the Website/Subdomains, and (3) ensure the long-term viability of our information technology systems and website technology. Therefore, we analyze anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise, and to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

3. Google Analytics (with anonymization function)

On the Website/Subdomains, we have integrated the component of Google Analytics (with the anonymizer function). The purpose of the Google Analytics component is to analyze the traffic on the Website/Subdomains. Google uses the collected data and information, inter alia, to evaluate the use of the Website/Subdomains and to provide online reports, which show the activities on the Website/Subdomains, and to provide other services concerning the use of the Website/Subdomains for us.

Further information and the applicable data protection provisions of Google may be retrieved under and under Google Analytics is further explained under the following link

4. Cookie choices and how to opt-out

The user may prevent the setting of cookies through the Website/Subdomains at any time by means of a corresponding adjustment of the web browser used and thus permanently deny the setting of cookies. Furthermore, already set cookies may be deleted at any time via an Internet browser or other software programs. This is possible in all popular Internet browsers. If the data subject deactivates the setting of cookies in the Internet browser used, not all functions of the Website/Subdomains may be entirely usable. Such an adjustment to the Internet browser used would also prevent Google Analytics from setting a cookie on the information technology system of the data subject. In addition, cookies already in use by Google Analytics may be deleted at any time via a web browser or other software programs.

5. Social plugins

We also use social plugins on some of the Subdomains. The social plugins used are hosted by social media networks such as Facebook, Twitter and LinkedIn. Your browser sends cookie data to a social media network when loading its related social plugin inside your browser. This data contains information on your use of the Subdomain. In case you are registered with the social media network, the data will be associated with your data already stored in the social media network.

Contact Us

For any queries in relation to this Cookie Policy, please contact us at