Privacy
Last updated: August 2026
This notice covers the website atlas.corey-management.com and the COREY ATLAS app on iPhone and in the browser.
Controller
The controller for the processing of your personal data is COREY Management GmbH, Uhlandstraße 175, 10719 Berlin, desk@corey-management.com, +49 30 439738262. Full details are in the imprint. We have not appointed a data protection officer; please address enquiries to the contact given.
When this website is called up
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States. When the pages are called up, the provider processes on our behalf the technically necessary access data: IP address, time of the request, address requested, volume transferred, browser type, and operating system. This serves to deliver the page and to defend against attacks and is based on Art. 6 (1) (f) GDPR. The data is deleted after 90 days. Delivery runs through a worldwide network of servers, which may involve a transfer to the United States. We have a data processing agreement with the provider under Art. 28 GDPR that includes the European Commission's standard contractual clauses.
No cookies, no measurement, no banner
This site sets no cookies, embeds no third-party fonts, maps, or scripts, and measures no usage behaviour. A consent request is therefore not required. If you switch between light and dark mode, that choice is stored in your browser's local storage so it still applies on your next visit. It never leaves your device and serves only the presentation you asked for (§ 25 (2) no. 2 TDDDG).
What data the app processes
Master data (name, address, date of birth, company name, and register details), contact details, identification and compliance records, details of the participation agreement, custody and account data including holdings, executions, bookings, result and fees, documents and reports, messages and requests to your contact, as well as technical access data such as device identifier, app version, sign-in times, and active sessions.
Where the data comes from
Part of the data comes from you, for instance from onboarding and from your messages. Holdings, executions, and account movements are retrieved from the custodian on working days, bookings from the business account. Reports, documents, and commentary come from COREY Trading and are made available in ATLAS through COREY Management GmbH. Prices and comparison series come from a market data provider and contain no personal data.
Purposes and legal bases
To perform the participation agreement and to provide the app: Art. 6 (1) (b) GDPR. To comply with legal obligations, in particular under the German Money Laundering Act and under commercial and tax retention rules: Art. 6 (1) (c) GDPR. To protect legitimate interests in secure and undisturbed operation: Art. 6 (1) (f) GDPR. For push notifications, where you allow them: Art. 6 (1) (a) GDPR.
Recipients and processors
No data is transmitted to third parties from the app; the only exception is the export you trigger yourself. For operation we use service providers who process on our behalf and are bound by contract under Art. 28 GDPR: a provider for database, file storage, and sign-in, and Vercel Inc. for hosting this website. Parties to the participation agreement may have access to parts of the data; details are in the information sheet for your strategy.
Processing within the European Union
Database, file storage, and sign-in run in a data centre within the European Union. There are two exceptions: push notifications are delivered through the operating system vendor's service, and this website is delivered through the hosting provider's worldwide network of servers. Either may involve a transfer to the United States. The basis in both cases is the European Commission's standard contractual clauses.
Push notifications
If you allow notifications, a device identifier is stored and passed, together with the text of the message, to the operating system vendor's service. The operating system issues this identifier per installation; it applies to ATLAS on this device alone and changes, for instance after a reinstall. You can switch delivery off at any time in the app or in your device settings; the device identifier is then deleted.
Face ID and app lock
The app can be locked with Face ID, Touch ID, or the device passcode. The check takes place exclusively on your device. Biometric data is transmitted neither to us nor to third parties and is not accessible to us; the app only learns whether the check succeeded.
Sign-in and passkeys
Sign-in works through a one-time link sent to your registered email address, or through a passkey. No password is issued or stored. With a passkey the private key stays on your device and is not accessible to us. What we store is the public key, a label for the device, and the time it was set up. For every session we record the time, the device, and the IP address so that you can spot and end sessions that are not yours.
Export
The export creates a file with your data and offers it to you for download. What happens to the file afterwards is up to you. The files created are deleted after download.
No advertising, no profiling
We do not use your data for advertising, do not combine it with data from other sources, and do not evaluate it into profiles. Automated decision-making including profiling under Art. 22 GDPR does not take place.
Retention
Contract and evidence records are stored in line with commercial and tax retention periods of up to ten years. Technical access data is deleted after 90 days. Your app account is deleted on request; how that works and what remains is set out in the section on deleting your account.
Your rights
You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). Any consent given can be withdrawn at any time with effect for the future. Exercise your rights with COREY Management GmbH, Uhlandstraße 175, 10719 Berlin, desk@corey-management.com.
Complaint to a supervisory authority
You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
Whether providing data is required
The details from onboarding and identification are required for the participation agreement and to comply with legal obligations. Without them we cannot set up access to the app. Push notifications and the app lock are optional.
Changes to this notice
We adjust this notice when the processing changes. The version published here applies; the date is given above.