TREZOR
Privacy Policy
Last updated: 15 October 2026
(“Privacy Policy”)
We are committed to protecting your privacy. The following document outlines our policy concerning your personal data.
By accessing and using our websites and services, such as the Trezor Shop and Trezor Suite, you accept the practices described in this Privacy Policy.
Trezor is an ecosystem operated by our company mainly on the https://www.trezor.io/ website and its subdomains (the “Website”) on which we sell Trezor Devices and also operate several software interfaces that allow you, amongst other things, to access the Devices and manage, receive and send cryptocurrencies, purchase, sell and exchange cryptocurrencies, such as the Trezor Suite and the Trezor Suite Lite (the “Services”).
You may have heard about Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the ”Regulation”) more commonly known as GDPR.
Under the Article 13 and 14 of the Regulation, we must provide our customers and other data subjects with information on the collection, handling, protection and processing of their personal data.
Therefore, in this Privacy Policy you may learn more about these topics regarding the personal data that we collect when you access the Website and/or access and use the Services.
If you are located in Brazil, the processing of your personal data is also governed by the Lei Geral de Proteção de Dados Pessoais (LGPD, Law No. 13.709/2018). This Privacy Policy is intended to comply with LGPD, in addition to applicable EU and Czech laws.
We are a commercial company called Trezor Company s.r.o., incorporated and existing under the laws of the Czech Republic, Id. No. 024 40 032, with registered office at Kundratka 2359/17a, Libeň, 180 00 Prague 8, Czech Republic, registered in the commercial register kept by the Metropolitan Court in Prague under file No. C 219483.
When you access the Website and/or access to and use of the Services, we will, as a data controller, collect, store and process your personal data.
The collection of your personal data in connection to the use of the Website and access to and use of the Services is as limited as possible. We usually collect and process only the following personal data:
When you send us a message requesting customer support, or when you start a chat with Hal, our virtual support agent, we will try to answer your question or help you solve any problem related to the Website and/or the access to and use of the Services. In connection with provision of the above support, we collect and process also the following personal data:
On the Website, you may subscribe to our newsletter by entering your email and clicking on the subscribe box, by clicking on the subscribe box during the order placement procedure in the Trezor Shop, or by redeeming a Promotional Code under our Free Device Program, where you give your consent to receiving our newsletter. If you subscribe to our newsletter, we will regularly inform you about the latest news from Trezor, in particular about our services and products.
As a data controller, we collect, store and process the email addresses and names (if subscribed during the order placement procedure or by redeeming a Promotional Code) of users who subscribe to our newsletter.
In case you change your mind and you do not want to receive the newsletter anymore, you can unsubscribe any time for free. We will always indicate within the newsletter how to unsubscribe.
On the respective part of the Website, you may order products from the Trezor Shop. To ensure a smooth experience and fulfill our legal obligations, we collect and process the following personal data:
Our Website and Trezor Shop contain links to and integrations with payment gateways provided by third parties, such as Adyen, Confirmo, Apple Pay, Google Pay and PayPal, which you may use in order to make payments while using the Services. You will have to fill in your personal data related to the payment when using the payment gateways.
These data are processed by the respective provider of the payment gateway as a data controller and the data processing is governed by terms and conditions and privacy policy of the payment gateway provider. We do not process these data and we do not have any access to such data unless stated otherwise herein.
We will always include the name of the payment gateway provider on the Website, so you may contact them to find all the information about how the payment gateway provider treats your personal data.
If you participate in our Refer-a-Friend Program through Trezor Suite (henceforth as “RAF Program”), we collect and process a persistent identifier associated with your Trezor Device, together with a record of which version of the Refer-a-Friend Terms and Conditions you accepted and when. We do not collect your name, email address or IP address for this purpose.
Our previous Legacy Refer-a-Friend Program (henceforth as “Legacy RAF”), supported by Referral Candy, processed your name and email address; see "Who will have access to my personal data?" below for its current status.
It is quite simple. We collect, store and process the above mentioned personal data in order to allow you an use of the Website and/or the access to the Services, as well as to provide you with customer support.
To comply with legal requirements, we must mention that we collect, store and process such personal data pursuant to Article 6 (1) (b) of the Regulation. That means that processing of such personal data is necessary for the performance of a contract which we concluded - the contract established between you and our company when you access and use the Website and/or attempt to access the Services.
We may collect, store and process such personal data pursuant to Article 6 (1) (f) of the Regulation. That means that it is in our legitimate interest to collect, store and process such personal data (even when the contract is terminated), since we have to be able to protect ourselves during the period when you or any third party may contest that we have broken any of our obligations or have violated any applicable laws in relation to the requested issue.
As we have stated above, we collect, store and process these personal data because you subscribed to our newsletter. So we are processing your email and name (if subscribed during the order placement procedure or by redeeming a Promotional Code) in order to send you the newsletters.
To comply with legal requirements, we must mention that we collect, store and process such personal data pursuant to Article 6 (1) (a) of the Regulation. That means that you have given us consent to the processing of your personal data for the commercial communications purpose.
In order to be able to prove that you have given us your consent to sending our newsletter (and processing your personal data for the commercial communications purposes), we may collect and store the information that you have given us this consent (e.g. the logs). We collect and store these data pursuant to Article 6 (1) (f) of the Regulation. That means that it is in our legitimate interest to collect, store and process such personal data.
We collect, store and process these personal data because you order products from the Trezor Shop. In case you place your order using a discount code provided under our Legacy RAF (being discontinued, see below), we may also process these personal data to ensure that the person who provided you with the discount code receives their reward. When you leave a review and choose to display your name, we may also process your name, specifically, we will display your name next to your review.
When you redeem a Promotional Code, we also process the code and information on the partner or campaign through which you received it, in order to validate the code and prevent its misuse. We process this data pursuant to Article 6 (1) (b) of the Regulation. To the extent we use this data to evaluate the effectiveness of our campaigns, we process it pursuant to Article 6 (1) (f) of the Regulation, as it is in our legitimate interest to measure how our campaigns perform.
To comply with legal requirements, we must mention that we collect, store and process such personal data pursuant to Article 6 (1) (b) of the Regulation. That means that processing of such personal data is necessary for the performance of a contract which we concluded - the contract established between you and our company when you order products from the Trezor Shop.
In order to fulfill our legal obligations such as those arising out of accounting laws, we may store certain parts of your personal data for various time periods as stated in those laws. We collect and store these data pursuant to Article 6 (1) (f) of the Regulation. That means that it is in our legitimate interest to collect, store and process such personal data.
For users in Brazil, we process your personal data in accordance with the legal bases set forth by LGPD, which may include your consent, compliance with legal or regulatory obligations, the performance of contracts, the regular exercise of rights, the protection of credit, or our legitimate interests, provided such processing does not violate your fundamental rights and freedoms.
We collect, store and process this personal data because you participate in our RAF Program through Trezor Suite, in order to administer the RAF Program, including verifying referrals and issuing rewards.
To comply with legal requirements, we must mention that we collect, store and process such personal data pursuant to Article 6 (1) (b) of the Regulation. That means that processing of such personal data is necessary for the performance of a contract which we concluded - the contract established between you and our company when you accept the RAF Program Terms and Conditions and participate in the RAF Program.
We process and store your personal data only for the time necessary to meet the purposes of its processing specified above, or for the time consented by you, or for the time that is either necessary to comply with our obligations under the applicable law or set forth by the applicable law or in accordance therewith. We comply with the mandatory rules for data archiving.
Once the purpose of the personal data processing disappears, we will destroy the personal data.
We will process and store such personal data for the duration of the contract established between you and our company when you use and access the Website and/or access the Services or until an issue requested by you is solved and also for the subsequent period thereafter that is either necessary to comply with our obligations under the applicable law or set forth by the applicable law or in accordance therewith, or during which you or any third party may contest that we have broken any of our obligations or have violated any applicable laws in relation to the requested issue.
We will process and store such personal data until you unsubscribe to our newsletter. You can unsubscribe any time for free. We will indicate how to unsubscribe within the newsletter.
We will process and store the information that you have given us the consent (e.g. the logs) to send you newsletter for the duration of the consent and also for the subsequent period thereafter that is either necessary to comply with our obligations under the applicable law or set forth by the applicable law or in accordance therewith, or during which you or any third party may contest that we have broken any of our obligations or have violated any applicable laws in relation to the commercial communications sent to you.
We will process such personal data only for such a period of time that allows us to deliver you the products and fulfill our other legal obligations connected to the sale of the products. We anonymize this data no later than 3 months after the sale of the product to the fullest possible extent and store them only in this anonymized form in case you contact us with an issue so we can verify that the data you provide us with, after anonymization, match the anonymized database inputs. After the expiry of the warranty period, we delete the data altogether.
When you provide a product review and choose to display your name, we will process your name for an indefinite period of time and display it together with your review on the Website. You may at any point instruct us otherwise.
We will process and store the persistent identifier and the record of your Refer-a-Friend Terms and Conditions acceptance for the duration of your participation in the Program, plus 12 months thereafter to verify referrals, resolve disputes and comply with our legal obligations.
We take care of your personal data security and so we choose the partners to whom we entrust your personal data very carefully.
All our partners must be able to provide sufficient security of your personal data to prevent unauthorized or accidental access thereto or other abuse thereof and all our partners must undertake a confidentiality obligation and must not use your personal data for any purpose other than the purpose for which the data were made available to them.
The services listed below are used to help us keep the Website and Services running by storing or processing your personal data on our behalf:
Fulfillment:
|
Service provider |
User action |
Data collected |
Purpose |
|
ShipMonk |
Order of goods from the Trezor Shop. |
Your name, address, email address, phone number and order information. |
We use this provider as our fulfillment (logistics) partner. |
|
Central Warehouse Solution (Skladon) |
Order of goods from the Trezor Shop. |
Your name, address, email address, phone number and order information. |
We use this provider as our logistics partner. |
Communications:
|
Service provider |
User action |
Data collected |
Purpose |
|
Zendesk |
Sending us an email requesting customer support, or contacting us via our virtual support agent Hal. |
Your name, email address and physical address and order information in case of refunds. |
We use this service as a ticketing portal for customer communications. |
|
Ada Support |
Starting a chat with our virtual support agent Hal. |
Your name, email address and order ID in case of asking about order details.
|
We use this service for customer service automation. |
|
Sendinblue (Brevo) |
Subscribing to our newsletter. |
Your name (if you subscribe during the order placement procedure in the Trezor Shop or by redeeming a Promotional Code) and email address. |
We use this service for sending marketing emails to those who have opted-in. |
Payment gateways:
|
Service provider |
User action |
Data collected |
Purpose |
|
Confirmo |
Making a bitcoin payment in the Trezor Shop. |
Your crypto address, email address and order ID in case of refunds. |
This service handles bitcoin payments for us. |
|
Adyen |
Making a fiat payment in the Trezor Shop. |
Your payment card data, name, address, email address and phone number. |
This service handles fiat payments for us. |
Infrastructure:
|
Service provider |
Data collected |
Purpose |
|
Amazon Web Services (AWS) |
Data you generate by using the Website and/or Services. |
We use AWS to store data securely in the cloud. |
|
Google Cloud |
Emails that you send to us. |
Emails sent to us pass through Google. |
Referral Program:
|
Service provider |
User action |
Data collected |
Purpose |
|
Referral Candy |
Order of goods from the Trezor Shop using a discount code provided under our legacy Refer-A-Friend program (being discontinued; full closure targeted for 4 January 2027). |
Your email address and your name. |
Referral Candy provides us with our Refer-A-Friend program, the data is used to distribute the rewards. |
From 4 November 2026, new participants join our Refer-a-Friend Program directly through Trezor Suite, which we operate ourselves without a third-party processor.
In addition to the above, if you choose to pay using Apple Pay, Google Pay or PayPal at checkout, your payment is processed directly by Apple Inc., Google LLC or PayPal respectively, each acting as an independent data controller for that payment data, governed by their own terms and privacy policy. We do not act as their processor and do not have access to your underlying payment card or account data.
Another recipients that may have access to your personal data are our providers of technological, security, accounting, legal and administrative services.
If you redeem a Promotional Code distributed by our partner, we may inform that partner that the code has been redeemed. We do not share your name, contact details or delivery address with the partner.
Our aim is and always will be to ensure your personal data are as anonymous as possible and unavailable to all third parties. However, under certain specifically defined conditions we will be under some circumstances required, in accordance with the applicable law, to transfer certain personal data to public authorities.
When collecting, storing and processing personal data we sometimes may use personal data processors, which under some circumstances transmit your personal data to third countries. In such an event we always make sure such transmission is compliant with the Regulation. In particular, we specify that the personal data may be transmitted to the United States of America, and where the recipient participates in the EU-U.S. Data Privacy Framework, such transmission is based on the European Commission's adequacy decision for that framework, Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EUR-Lex). Where a recipient does not participate in the EU-U.S. Data Privacy Framework, we rely on Standard Contractual Clauses or another transfer mechanism recognised under the Regulation.
All your personal data is secured by standard procedures and technologies using the industry best practice approach. We provide data protection against unauthorized or accidental access, alteration, destruction, loss, unauthorized transmission or any other unauthorized processing, as well as against any other abuse of records containing the personal data.
We are not able to guarantee the security of your personal data without your help and responsible behavior. Therefore, we ask you to help us ensure the security of your data by keeping it secret.
On our Website we use cookies to analyze traffic and to personalize content and ads. We also use cookies for other purposes, such as to provide mechanisms for online shopping and to enable traffic monitoring under our Affiliate Program. We will, as a data controller, collect, store and process any personal data collected by such cookies (the personal data may include your IP address, information about your activity on our Website, information about your advertisement preferences etc.).
It is in our legitimate interest to collect, store and process such personal data for marketing purposes and for website traffic analysis, since (i) it allows us to improve our products and services and to provide you with personalized content and advertisement, (ii) we do not attempt to identify you using such personal data, (iii) there is little to no restriction of your interests, rights and freedoms, and (iv) you may at any time delete stored cookies permanently and change your cookie settings to disable or limit storage of any new cookies.
Please, read our Cookie Policy available on our Website to learn more about the cookies that we use.
In relation to the personal data you shall have in particular the following rights:
You have a right to object, on grounds relating to your particular situation, at any time to processing your personal data which is based on Article 6 (1) (f) of Regulation (it means that we have legitimate interest to process such personal data). You have also a right to object to processing your personal data for direct marketing purposes.
Additionally, you have a right to contact the Office for Personal Data Protection with a request for remedial measures in case of any violation of the obligations set forth in the Regulation at the following address: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, phone number +420 234 665 111 (central telephone exchange).
You may exercise these rights by contacting us at info@trezor.io. We will respond to requests in accordance with applicable law.
If you have any questions regarding this Privacy Policy, please do not hesitate to contact us using the contact details below:
Contact address: Kundratka 2359/17a, Libeň, 180 00 Prague 8, Czech Republic
Email address: info@trezor.io