Privacy Policy / Data Protection Policy

1. What is the GDPR?

The General Data Protection Regulation (GDPR, or RGPD in French) is a European regulation that has applied to all European residents since 25 May 2018. It governs the use of your personal data (surname, first name, contact details, telephone number, email address) and ensures that your data will be processed, used, disclosed and stored in a fully transparent manner. This regulation gives you more rights. For example, you can ask for the list of data that a company holds about you, and demand its rectification, its total erasure, the restriction of processing, the right to be forgotten…

To support you better, Finanbex therefore provides you below with clear information on the processing carried out with your data. A glossary of frequently used legal terms is provided below.

2. Practical information

2.1. Controller:

Finanbex SA, [registered office address to be completed] – Company no.: 980 682 290

2.2. Data protection officer:

Finanbex has a data protection officer, who is your point of contact for any request for information relating to the protection of your personal data.

You can send an email to the following address: [data protection officer’s email address to be completed] or a letter to:
Finanbex
For the attention of the data protection officer
[data protection officer’s postal address to be completed]

3. Purposes of processing, legal bases and source of the data

Personal data concerning you is processed by Finanbex depending on your situation. Click on the situation that applies to you to find out the purposes for which your data is used.

You are a Finanbex customer and have entered into a contract with us (credit facility with or without a card, instalment loan, 3XFinanbexPay).

The purposes below are necessary for the performance of the contract entered into with Finanbex or for the performance of pre-contractual measures taken at your request:

• Granting and management of credit, including the processing relating to the associated payment services (credit card)
• Distribution of life insurance products (outstanding balance) and non-life insurance products
• Customer management
• Where applicable, debt collection management

The processing carried out to achieve these purposes constitutes a legitimate interest of Finanbex in the context of the relationship we have with the consumer. This legitimate interest does not harm the interests, rights and freedoms of the consumer.

• Marketing: sending advertising content by post
• Fraud prevention
• Risk prevention and operational risk management

When you submit an online credit application, the country corresponding to your IP address is determined in order to pre-fill your country, your telephone dialling code and the format of your address, and to alert an adviser to any difference from the information entered (fraud prevention). Your IP address itself is not stored: only the country and a non-reversible hash of the address are recorded with the application. The country is sometimes determined by a geolocation provider, to which only the IP address is transmitted.

Processing necessary for compliance with the regulations relating to:

• consumer credit,
• payment services,
• the distribution of insurance products,
• combating money laundering and the financing of terrorism,
• the protection of personal data.

This processing complies with the legal obligations imposed on Finanbex.

The data processed in connection with your application is mainly data collected directly from you (or through one of our partners or brokers if you used one of these channels for the handling of your application) or resulting from the use of our products or services. However, some information may be collected from third parties:

• the individual credit register, which must be consulted for every credit application;
• the official anti-money laundering body, for the purpose of combating money laundering.

Unless you have objected, your data will be used for commercial promotion and prospecting purposes, in particular through profiling. Profiling is an evaluation process which, by combining data, makes it possible to analyse or predict certain elements such as your interests, your behaviour and your preferences (…). Profiling is used to target the offers likely to interest you and the means and methods of communication to be preferred. All the information collected during your applications and your exchanges with your adviser, during the contractual and pre-contractual relationship, as well as information about your browsing on our site if you have consented to it, will be used for profiling purposes.

You are not a Finanbex customer and your data was obtained from a company.

Finanbex may have obtained personal identification data (surname, first name, postal address) from files rented from external companies.

In this case, your personal data is processed for commercial purposes only. Your personal data is kept for no more than three months. If in the meantime you become a Finanbex customer, the personal data concerning you is processed as indicated in the section above (You are a Finanbex customer and have entered into a contract with us).

To send you advertising content by post, Finanbex relies, as the regulations allow, on its own legitimate interest in promoting its financial services and products. However, you may at any time object to receiving mail from us by sending an email to the following address: [data protection officer’s email address to be completed] or a letter to:
Finanbex
For the attention of the data protection officer
[data protection officer’s postal address to be completed]

Your credit or payment facility application was refused or was not completed.

If you applied to Finanbex for credit or a payment facility and your application was refused, we process and keep your data for the following purposes:

Processing necessary for compliance with the regulations relating to credit:

• consumer credit and payment services
• combating money laundering and the financing of terrorism
• the protection of personal data

The data processed in connection with your application is mainly data collected directly from you (or through one of our partners or brokers if you used one of these channels for the handling of your application) or resulting from the use of our products or services. However, some information may be collected from third parties:

• the individual credit register, which must be consulted for every credit application;
• the official anti-money laundering body, for the purpose of combating money laundering.

If you started a credit or payment facility application with Finanbex but it could not be completed, we will keep your contact data in order to make it easier to resume your application if you wish. We will use your contact data to send you communications, subject to your consent where communications are sent by electronic means.

In these cases, we keep your personal data for a maximum of three years from the time you started your credit or payment facility application.

You only hold an insurance product distributed by Finanbex.

As an intermediary and processor acting for the insurer, Finanbex is not the controller of your data. It is therefore for the insurer concerned to provide you with information on its policy for the processing of personal data.

4. The categories of personal data recipients

Personal data concerning you will be transmitted by Finanbex only to the following recipients:

• To the individual credit register: in the event of a credit application made by the consumer or an existing credit agreement between the consumer and Finanbex.
• Where applicable: to our credit insurer [credit insurer, address and company number to be completed] in accordance with the regulations applicable to consumer credit. Its data protection officer’s department is located at the same address and can be contacted by email sent to [email address of the credit insurer’s data protection officer to be completed]. The processing that this insurer would carry out is necessary for it in order to decide on possible credit insurance cover, and to carry out its regulated activity as a credit insurer (regulations applicable to insurance). Where applicable, this insurer will keep the personal data until the limitation periods have expired (10 years). It may keep your data beyond that period, but only for statistical purposes. Your rights can be exercised directly with this insurer.
• Where applicable: to a company that carries out amicable debt collection activity in respect of the consumer within the meaning of the regulations applicable to the amicable collection of consumer debts,
• Where applicable: to the persons authorised by the regulations applicable to consumer credit
• To the insurer named in your contract: where you take out an insurance product distributed by Finanbex in its capacity as insurance intermediary.
• To our service providers (processors). Processors carry out tasks on behalf of Finanbex under a contract between the processor concerned and Finanbex. As the regulations provide, Finanbex works only with processors that undertake to comply with the rules governing the processing of personal data.
• To duly authorised public authorities.
• To persons who demonstrate that they have obtained your consent.

5. Data retention period

Your personal data is kept:

• In general, for the period necessary for Finanbex to achieve its processing purposes.
• Where your personal data is processed by Finanbex and you are a customer: your data is then kept until the end of the limitation periods for all actions relating to the conclusion or performance of the contract. After these periods, your personal data will be deleted from our databases (subject to acts interrupting or suspending the limitation period, such as a payment, a formal notice or a summons).
• Where your personal data is processed by Finanbex but you have not entered into a contract: your data is then kept for a period of three years from the collection of your data.
• If you applied for credit from Finanbex but your application was refused: we keep your personal data for a period of three years from the date of the consultation of the individual credit register. Please note that Finanbex has a legal obligation to consult this register when assessing your creditworthiness and to keep these consultation notices for three years.

6. Your rights

As the regulations provide, and because Finanbex is firmly committed to respecting your data, we would like to make you aware of the rights you have:

• Right of access
• Right to rectification
• Right to erasure
• Restriction of processing
• Right to data portability
• Right to object
• Right to lodge a complaint with the supervisory authority

6.1. Right of access

In the course of our relationship, Finanbex has to process your data. You therefore have the right to obtain confirmation of the processing of your data.

You also have the right to access the personal data we hold and to obtain the following information:

• The purposes of the processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed;
• The envisaged period for which the personal data will be stored or, where that is not possible, the criteria used to determine that period;
• The existence of the right to request from Finanbex rectification or erasure of personal data, or restriction of processing of personal data concerning you or, finally, the right to object to the processing;
• The right to lodge a complaint with a supervisory authority;
• Where the personal data were collected from a company, any information as to their source;
• The existence of automated decision-making, including profiling, and, in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
• Where personal data are transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.

You can request a copy of the personal data processed by Finanbex. This copy will be provided to you free of charge as soon as possible. To do so, please refer to paragraph 6.8.

6.2. Right to rectification

You can ask Finanbex, as soon as possible, to rectify your personal data that may be inaccurate or incomplete. To do so, please refer to paragraph 6.8.

6.3. Right to erasure

In certain cases, you can ask Finanbex to delete your personal data.

The regulations provide that you can request this erasure in any of the following cases:

• Where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. Please note that Finanbex has a system in place for deleting personal data. When we consider that the data are no longer necessary to achieve the processing purposes, your data will be automatically deleted from the databases.
• Where you withdraw the consent on which the processing of your data is based and there is no other legal basis for that processing;
• Where you object to the automated processing of data and there are no overriding grounds, beyond those considered by Finanbex, for keeping your data;
• Where you object to the processing of your personal data for commercial purposes;
• Where the personal data have been unlawfully processed;
• Where the law requires it.

However, Finanbex has the right to refuse to erase your personal data:

• In order to comply with a legal obligation that requires the processing of your data;
• Where it is necessary for the establishment, exercise or defence of legal claims.

Once your request for erasure of your personal data has been accepted by Finanbex, your data will be erased as soon as possible. You will be informed by post.

6.4. Restriction of processing

As the regulations provide, you can request the restriction of processing of your data in any of the following cases:

• Where you contest the accuracy of your personal data, the processing is restricted for a period enabling Finanbex to verify the accuracy of those data;
• Where processing is unlawful and you oppose the erasure of the personal data concerned by that processing;
• Where Finanbex no longer needs the personal data but you still need them for the establishment, exercise or defence of legal claims;
• Where you have objected to the processing (including profiling), pending verification by Finanbex of whether its grounds for processing override your interests.

Where processing is restricted, your personal data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Where you have obtained the restriction of processing, you will be informed by Finanbex before the restriction of processing is lifted.

To exercise your right to restriction of processing, please refer to paragraph 6.8.

6.5. Right to data portability

You can ask to receive the personal data concerning you that you have provided to us. You will receive these data in a readable format (for example: an Excel format) that can be accessed using standard office software.

You also have the right, if you wish, to transmit these data to another personal data controller.

You can also ask Finanbex to transmit the personal data that you have provided to us directly to another controller. However, the legislation on consumer credit does not allow Finanbex to disclose personal data to third parties other than those exhaustively listed in that regulation.

Please note that the right to portability of your personal data applies only where the processing of personal data is automated and based on your consent or on a contract.

6.6. Right to object

• You have the right to object, at any time, to processing of your personal data that is based on the legitimate interest of Finanbex, including profiling.
  Finanbex will then carefully examine your request and determine, as provided by law, whether there are grounds for processing that override your interests, rights and freedoms, or that are needed for the establishment, exercise or defence of legal claims. For example, if the processing is necessary for the management of the contract entered into with Finanbex, your request to object to the processing cannot be granted. The same applies if the processing is necessary for compliance with a legal obligation.
• You can object at any time to the processing of your personal data for commercial purposes, including profiling. If you object to this type of processing, no advertising will be sent to you.
  To exercise your right to object, please refer to paragraph 6.8.

6.7. Automated individual decision-making.

Finanbex may take decisions based on automated processing of data following credit applications made through our website. These may produce legal effects. In practice, these are the preliminary decisions given to the customer in respect of consumer credit, the granting of credit to finance purchases on the websites of our e-commerce partners, including payment facilities under the 3XFinanbexPay solution, and also refusal decisions.

This processing is necessary to provide you with a quick response and to reduce the risk of error linked to human intervention.

You can request a new review of your application by one of Finanbex’s advisers. You can also express your point of view and contest the decision taken by Finanbex.

To exercise your right to object, please refer to the paragraph below.

6.8. In practice, how do you exercise one of these rights?

Simply send us an email at the following address: [data protection officer’s email address to be completed]

You can also contact us by post at the following address:
Finanbex
For the attention of the data protection officer
[data protection officer’s postal address to be completed]

6.9. Right to lodge a complaint with the supervisory authority

If you consider that any of the processing of your personal data constitutes an infringement of the regulations, you can lodge a complaint with the data protection authority of your country of residence. The list of European authorities is available on the website of the European Data Protection Board (edpb.europa.eu).

7. Document to download in PDF format

Download the content of this page in PDF format.

8. Glossary

• Advertising content: the direct or indirect promotion of a financial product distributed by Finanbex (consumer credit and insurance products)
• Consent: consent is your agreement that we may carry out the envisaged processing. In some cases, we must obtain your agreement in order to process your personal data. This is the case, for example, when we wish to send you advertising by electronic means. This agreement can be withdrawn at any time.
• Data recipients: a person, authority or body to whom your personal data may be disclosed, within the limits set by law. For example, your personal data is disclosed to the individual credit register.
• Purpose: the objective assigned to the processing of your personal data. For example, we process your data for the granting of consumer credit and the management of that credit.
• Legitimate interest: the interest of Finanbex SA in processing your personal data in order to achieve a specific purpose. This interest cannot go against your interests, freedoms or fundamental rights. Example: sending advertising content by post to our customers constitutes a legitimate interest for Finanbex.
• Restriction of processing: where you contest the accuracy of your personal data or exercise a right to object, we restrict the processing of your personal data to the storage of the data in our possession, while we examine your request.
• Profiling: profiling is automated processing of your personal data consisting of using that data to evaluate certain personal aspects relating to you, or to analyse or predict certain behaviours.
• Controller: this is Finanbex SA. We process your data to achieve the processing purposes (objectives) that we have set and that are set out in this document.
• Processing: this is what we do, in practical terms, with your personal data (for example collection, consultation, storage).

9. Useful link

For more information on the GDPR, visit the website of the European Commission.