Your trust matters to us. This policy explains what personal data OPM collects, why we collect it, who we share it with and the rights you have.
1.Who we are
OPM is operated by GRID D EOOD (“GRID D”, “OPM”, “we”, “us”), UIC 208882057, with its registered office at ul. Mityo Stanov 15, entr. B, fl. 4, ap. 12, Radnevo (260), Sofia, Bulgaria.
We are the controller of the personal data described in this policy, which means we decide why and how it is processed. This policy applies to our website and to the OPM services once your account is open.
For any question about your personal data, or to exercise your rights, contact us through our contact page and choose “Privacy & my data”.
2.The personal data we collect
Depending on how you interact with us, we may collect:
- Identity data — your name, date of birth, nationality and identity document details, including photos taken during identity verification.
- Contact data — your email address, phone number and postal address.
- Financial data — account details, IBAN, card details, transactions and payment information.
- Business data — for business clients, company details and information about directors and beneficial owners.
- Technical data — your IP address, device and browser information, and how you use our website and app.
- Communications — messages you send us, for example through our contact form or in-app support, and our replies.
We collect most of this data directly from you. We may also receive data from identity verification providers, fraud-prevention databases, public registers and payment partners, where this is necessary to provide our services or meet our legal obligations.
3.Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Opening and running your account, cards and payments | Performance of a contract — Art. 6(1)(b) |
| Verifying your identity and preventing money laundering, fraud and financial crime | Legal obligation — Art. 6(1)(c) |
| Keeping records required by law | Legal obligation — Art. 6(1)(c) |
| Replying to your messages and handling complaints | Contract or legitimate interests — Art. 6(1)(b) and (f) |
| Keeping our website and services secure, and improving them | Legitimate interests — Art. 6(1)(f) |
| Sending you news about OPM products | Consent — Art. 6(1)(a), which you can withdraw at any time |
4.Forms on this website
When you use our contact form or join the list to open an account, we receive your name, email address and the details you enter. They are delivered to our team by email through our email service provider, Resend. We use them only to reply to you or to invite you to open your account, and we delete them when they are no longer needed for that purpose.
6.International transfers
Some of our service providers are located outside the European Economic Area. When your data is transferred there, we make sure it is protected by an adequacy decision of the European Commission or by appropriate safeguards such as the Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.
7.How long we keep it
- Account and transaction data — for the duration of our relationship and for 5 years after it ends, as required by anti-money laundering law.
- Messages from the contact form — for as long as needed to handle your request, and no longer than 2 years.
- Details left to join the list — until your account is opened or you ask us to delete them.
- Website technical logs — for a short period for security purposes.
8.Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased, where there is no legal reason for us to keep it;
- restrict or object to certain processing, including processing based on our legitimate interests;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing that took place before;
- not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review.
We reply to requests within one month. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or with the data protection authority in the EU country where you live.
9.Automated checks
To keep OPM safe we use automated tools to verify identity documents and to detect unusual or fraudulent activity. If an automated check affects your application or account, you can ask for the decision to be reviewed by a member of our team.
10.How we protect it
We use technical and organisational measures — including encryption, access controls, logging and staff training — to protect your data against loss, misuse and unauthorised access.
11.Children
OPM is for adults. We do not knowingly collect personal data from anyone under 18.
12.Changes to this policy
We may update this policy. The latest version is always on this page, and we will tell you about significant changes through the app or by email.