LEGAL
Privacy policy
Last updated: 30.07.2026
The English version is provided for convenience. The German version is legally binding.
1. Controller
The controller responsible for data processing on this website is Ilker Yavuzsoy, Burgauerstraße 7, 86156 Augsburg, Germany. Contact details can be found in the imprint.
2. General information on processing
We only process personal data of our users to the extent necessary to provide a functional website along with our content and services, or where consent has been given. Processing is based on Art. 6(1)(a) GDPR (consent), (b) GDPR (contract performance) and (f) GDPR (legitimate interest), depending on which legal basis applies in the individual case.
3. Contact and inquiry form
When you contact us via our form or by email, the data you provide, your email address and, where applicable, further contact details are stored to process your request. Processing takes place to fulfil a contract or pre contractual measures (Art. 6(1)(b) GDPR). The data is deleted once it is no longer required for processing, unless statutory retention periods prevent this.
4. Hosting and server log files
Our website is hosted by Vercel Inc., using servers within the European Union where regionally available. When you access the website, Vercel automatically collects technical access data in so called server log files, such as IP address, date and time of the request, page accessed, amount of data transferred, browser type and referrer URL. This data serves technical delivery and the detection of attacks based on our legitimate interest (Art. 6(1)(f) GDPR) and is deleted after 30 days at the latest, unless security relevant incidents require a longer retention.
5. Account, sign in and database
For registration, account management and storing Academy content we use Supabase, with servers located in Frankfurt am Main (eu-central-1). A data processing agreement under Art. 28 GDPR is in place with Supabase. We store first name, last name, email address, country, optionally a phone number and community handle, your approval status and technical metadata such as sign up time and last activity. The legal basis is contract performance (Art. 6(1)(b) GDPR).
6. Broker verification through name matching
For Academy access, we match the names registered with our partner broker against the names on file with Aurex. You do not need to upload a file or submit separate proof for this. The match is based on the first and last name you provide when registering with Aurex. The legal basis is contract performance (Art. 6(1)(b) GDPR).
7. Community groups
If you join our community or signal groups (currently via WhatsApp), the respective provider's own privacy terms additionally apply. We only receive the information the platform itself makes available to us, such as your username.
8. Cookies and consent
We use cookies to operate the website technically and, if you consent, to embed statistics and marketing services. On your first visit we ask for your consent through a cookie banner, which you can withdraw or adjust at any time via the "Cookie settings" link in the footer. We store your choice for 12 months in the aurex_consent cookie, as well as, together with a hashed and non reversible value of your IP address, in our consent log. Details on individual cookies are available in the cookie banner itself.
9. Recipients and transfers to third countries
Some of our service providers, for example for security checks (Cloudflare Turnstile), error monitoring (Sentry) or sending transactional emails (Resend), may process data outside the European Union. In these cases we rely on the EU Standard Contractual Clauses under Art. 46 GDPR as an appropriate safeguard. A list of all service providers used is available on request.
10. Retention period
We store personal data only for as long as required for the respective purpose or as required by statutory retention obligations. Account data is anonymised after account deletion, to the extent that commercial or tax law retention obligations prevent complete deletion.
11. Your rights
Under Art. 15 to 21 GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Consent already given can be withdrawn at any time with effect for the future. To exercise your rights, an informal message to the contact address stated in the imprint is sufficient, or, while logged in, the data export in your account settings. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bavarian State Office for Data Protection Supervision.