GDPR / workers

Controller: Benjamin Hofmann, WashedBlackDryTrading, Wilhelm-Backhaus-Str. 6a, 50931 Köln (Art. 4(7) GDPR). Supervisory authority: LDI NRW.

Legal basis: Art. 6(1)(b) to run the desk you hired; Art. 6(1)(c) to keep an EU AI Act log of automated decisions; Art. 6(1)(a) only if you tick worker-log consent so we may keep anonymous setup fingerprints (no name, no keys).

What a “worker” is, legally: software you instruct. It is not a human employee, not a MiCA CASP, and not MiFID investment advice. You set rails, logic, sides and leverage. You can pause, flatten and erase. Extra workers are extra configurations of the same tool, marked custom, billed as extra seats. The human remains in command.

Automated decisions: fills proposed or placed under your settings are logged. You may download that log. We do not show a live dump on the desk. Erasure wipes keys, workers and fills; the decision log is kept where the law requires a record (Art. 17(3)(b)).

Payments: card via Stripe when the processor is connected; crypto invoices when you open them. We invoice our fees only. Venue balances stay on the exchange. We do not custody crypto or cash.

Erasure path (engineering): keys, workers, fills, advice, reports and `apex_agent_memory` rows are wiped; `apex_gdpr.erasure_requested_at` is set; the EU AI Act / compliance decision log is kept where required. No calendar retention cron (e.g. delete inactive after N days) ships yet — policy text only.

Rights: access, rectification, erasure, restriction, portability (Art. 15–20), objection (Art. 21). Use Security → Your data on the desk, or write to the controller in Köln. This page is a product starting package, not counsel.