Privacy Policy

1. Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

finvantage GmbH
Unter dem Schede 5
57392 Schmallenberg
Email: datenschutz@finvantage.de

2. Data we collect

We collect and process the following categories of personal data:

• Account data: name, email address, password (hashed)
• Profile data: address, date of birth, nationality, phone number
• Financial data: investment details, portfolio information, transaction data
• KYC documents: identity verification documents
• Usage data: log files, IP address, browser type, access times
• Communication data: messages sent via the contact form

3. Purpose and legal basis

We process your personal data for the following purposes:

• Contract performance (Art. 6(1)(b) GDPR): providing and maintaining your account and our services
• Legitimate interest (Art. 6(1)(f) GDPR): security measures, fraud prevention, service improvement
• Legal obligation (Art. 6(1)(c) GDPR): tax reporting, regulatory compliance
• Consent (Art. 6(1)(a) GDPR): marketing communications (only with explicit opt-in)

4. Data storage and hosting

Your portfolio data and documents are stored in German data centers (AWS Frankfurt, eu-central-1). Some processors we engage operate outside Germany; each is contracted under Art. 28 GDPR. We do not use external CDNs, tracking tools or third-party analytics services.

5. Data security

We implement the following technical and organizational measures:

• TLS 1.2 or higher between your browser and finvantage
• AES-256-GCM encryption for sensitive data at rest (TINs, bank details)
• Argon2id password hashing
• Append-only audit log for registration, sign-in, sign-out and password resets
• Uploaded documents stored with server-side encryption (AES-256)

6. Your rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): request a copy of all data we store about you
• Right to rectification (Art. 16 GDPR): correct inaccurate personal data
• Right to erasure (Art. 17 GDPR): request deletion of your data
• Right to data portability (Art. 20 GDPR): receive your data in a machine-readable format
• Right to object (Art. 21 GDPR): object to processing based on legitimate interest
• Right to withdraw consent: withdraw any consent given at any time

To exercise your rights, contact us at datenschutz@finvantage.de.

7. Cookies

We use only technically necessary cookies: the session cookie for authentication, a cookie that protects forms against cross-site request forgery and carries short-lived form state, and cookies that remember your language, your country, whether you dismissed the cookie notice, whether you have seen the welcome screen, and two display settings in the mailbox. We do not use tracking cookies, advertising cookies or third-party cookies. No consent is required for technically necessary cookies.

8. Data retention

We retain personal data for as long as your account is active or as needed to provide our services. Financial records are retained for the legally required period (typically 10 years under German commercial law).

9. Third-party services

We minimize the use of third-party services. All fonts, scripts and stylesheets are self-hosted. We engage a small number of processors under Art. 28 GDPR — for payments, bank-account access, e-mail delivery, sign-in with Google or Apple, commercial-register lookups and the password breach check. Beyond those, we pass your data on only where the law requires it or you have consented.

10. Supervisory authority

You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is:

The State Commissioner for Data Protection and Freedom of Information
of the respective federal state of our registered office.