Privacy Policy

0. Scope

This policy covers two services operated by the same controller: this website (www.finvantage.de) and the finvantage platform (cockpit.finvantage.de). Section 2a describes what happens when you merely visit this website. The remaining sections describe the platform, and apply once you create an account and use it.

1. Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

finvantage GmbH
Unter dem Schede 5
57392 Schmallenberg
Email: datenschutz@finvantage.de

2. Data we collect on the platform

Within the finvantage platform we collect and process the following categories of personal data:

• Account data: name, email address, password (hashed)
• Profile data: address, date of birth, nationality, phone number
• Financial data: investment details, portfolio information, transaction data
• KYC documents: identity verification documents
• Usage data: log files, IP address, browser type, access times
• Communication data: messages sent via the contact form

2a. This website

Visiting www.finvantage.de requires no account and sets no tracking. Concretely:

• Server log files: each request is logged by our web server with the IP address, the time, the requested address, the referrer and the browser identification. Legal basis is our legitimate interest in operating and securing the site (Art. 6(1)(f) GDPR). The logs are not merged with other data and are not used to profile visitors.
• Technically necessary cookie: sending one of our forms requires a session cookie that holds the security token and the captcha answer. It carries no identifier, expires when you close the browser and is set only when needed. No consent is required for it (§ 25(2) TDDDG).
• Contact and demo forms: the details you enter — name, email address, company, your role and your message — are sent to us by email so that we can answer you. Legal basis is your enquiry itself (Art. 6(1)(b) and (f) GDPR). We keep the correspondence for as long as answering it requires, and thereafter as long as commercial retention rules demand.
• Newsletter: we store the address you submit in order to send the newsletter, on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in every mail.
• Processor: form messages and newsletter delivery run through Mailjet (Mailjet SAS, Paris, France) as a processor under Art. 28 GDPR, on servers within the European Union.
• Not in use on this website: analytics, tracking pixels, advertising networks, social media plugins and external content delivery networks. All fonts, images, styles and scripts are served from our own servers, so visiting the site transmits your IP address to no third party.

3. Purpose and legal basis

We process your personal data for the following purposes:

• Contract performance (Art. 6(1)(b) GDPR): providing and maintaining your account and our services
• Legitimate interest (Art. 6(1)(f) GDPR): security measures, fraud prevention, service improvement
• Legal obligation (Art. 6(1)(c) GDPR): tax reporting, regulatory compliance
• Consent (Art. 6(1)(a) GDPR): marketing communications (only with explicit opt-in)

4. Data storage and hosting

Your portfolio data and documents are stored in German data centers (AWS Frankfurt, eu-central-1). Some processors we engage operate outside Germany; each is contracted under Art. 28 GDPR. We do not use external CDNs, tracking tools or third-party analytics services.

5. Data security

We implement the following technical and organizational measures:

• TLS 1.2 or higher between your browser and finvantage
• AES-256-GCM encryption for sensitive data at rest (TINs, bank details)
• Argon2id password hashing
• Append-only audit log for registration, sign-in, sign-out and password resets
• Uploaded documents stored with server-side encryption (AES-256)

6. Your rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): request a copy of all data we store about you
• Right to rectification (Art. 16 GDPR): correct inaccurate personal data
• Right to erasure (Art. 17 GDPR): request deletion of your data
• Right to data portability (Art. 20 GDPR): receive your data in a machine-readable format
• Right to object (Art. 21 GDPR): object to processing based on legitimate interest
• Right to withdraw consent: withdraw any consent given at any time

To exercise your rights, contact us at datenschutz@finvantage.de.

7. Cookies

The platform uses only technically necessary cookies: the session cookie that keeps you signed in, a cookie that protects forms against cross-site request forgery, and cookies that remember your language, your country, whether you dismissed the cookie notice, whether you have seen the welcome screen, and two display settings in the mailbox. This website itself sets only the one cookie described in section 2a. We do not use tracking cookies, advertising cookies or third-party cookies. No consent is required for technically necessary cookies.

8. Data retention

We retain personal data for as long as your account is active or as needed to provide our services. Financial records are retained for the legally required period (typically 10 years under German commercial law).

9. Third-party services

We minimize the use of third-party services. All fonts, scripts and stylesheets are self-hosted. We engage a small number of processors under Art. 28 GDPR — for payments, bank-account access, e-mail delivery, sign-in with Google or Apple, commercial-register lookups and the password breach check. Beyond those, we pass your data on only where the law requires it or you have consented.

10. Supervisory authority

You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is:

The State Commissioner for Data Protection and Freedom of Information
of the respective federal state of our registered office.