Contact us
finAPI GmbH
Adams-Lehmann-Str. 44
80797 München
Social Media
BaFin
Officially licensed and supervised by the German Federal Financial Supervisory Authority (BaFin).
TÜV certification
Data protection policy
Data protection matters to us. These notices explain in plain language which personal data we process when you use our website, why we do so, and what rights you have. Providing personal data is not required simply to visit our website – only if you contact us or make use of our services do we need certain data from you.
In brief
- We only process data where this is legally permitted, contractually necessary, or covered by your consent.
- You can withdraw any consent you have given at any time, with effect for the future.
- You have comprehensive rights to access, rectification, and erasure (see Section 2).
- For any questions, you can reach our data protection officer at any time at: datenschutz@finapi.io
Our Data protection policy
1. Who is responsible, and how can you reach us?
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is finAPI GmbH, Adams-Lehmann-Str. 44, 80797 Munich, Germany. You can reach our company data protection officer at the same address (Attn: Data Protection Department) or by e-mail at dataprotection@finapi.io.
2. Your rights at a glance
Provided the respective legal requirements are met, you have the following rights against finAPI:
- Access to the data we hold about you (Art. 15 GDPR)
- Rectification of inaccurate or incomplete data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of any consent given, with effect for the future
- Objection to processing based on our legitimate interest (Art. 21 GDPR) – for reasons arising from your particular situation
Please contact us in writing or by e-mail at dataprotection@finapi.io. You may also contact our competent supervisory authority at any time: the Bavarian State Office for Data Protection Supervision (BayLDA).
You may object to processing for advertising purposes at any time and without any particular form, without incurring any costs other than the transmission costs at basic rates. Once you object, the relevant contact address will be blocked from further processing for advertising purposes; for technical reasons (lead time of advertising campaigns), some further advertising material may still be sent briefly in exceptional cases.
3. When and what data do we process?
3.1 When you visit our website
When you access our website, the browser you use automatically sends certain information to our server, which we temporarily store in a so-called log file:
- IP address of the requesting device
- Date and time of access
- Name and URL of the file retrieved
- Referring website (referrer URL)
- Browser used, and where applicable the operating system and access provider
We use this data to ensure a smooth connection, to provide a comfortable user experience, and to evaluate system security. It is automatically deleted after 28 days. For more information on cookies and tracking tools, see Section 4.
3.2 When you contact us via our forms
When you use our contact forms for interested companies or get in touch with us as part of a marketing campaign, we process the data necessary to handle your request and, where relevant, transfer it to our CRM system.
Data categories processed: personal master data (title, first and last name, address, role within the company, company master data), communication data, usage data, and marketing data (e.g. consents given).
Legal basis: Art. 6(1)(b) GDPR (establishing contact and initiating a contract).
3.3 Media enquiries
If you contact us as a media representative, we process your data to provide the information you requested or to inform you about company news, for example by sending press releases. When contacting you, we are guided by the relevance of our message to your journalistic work.
Data categories processed: name, company data (medium, address), communication data (e-mail, telephone, department, position).
3.4 Applications
If you use our applicant form or apply at a career fair, we process your data to handle your application.
Your personal data will be processed solely for the purpose of deciding whether to establish an employment relationship with you.
For the purpose of conducting the recruitment process, it is necessary for your application documents to be shared within our company and, where applicable, for final approval at group level with our parent company, Fabrick S.p.A. (Piazza Gaudenzio Sella 1, 13900 Biella, Italy), and, where applicable, its parent company, Sella Group (Piazza Gaudenzio Sella 1, 13900 Biella, Italy), as part of the final decision-making process. We disclose your personal data only to those departments and individuals who require the data in order to fulfil contractual and legal obligations or to pursue our legitimate interests.
To optimise our recruitment management, we use the applicant management software provided by Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany. For the purposes of the recruitment process, we transfer the personal data required and permitted by law to Personio in accordance with Article 28 GDPR. Further information on Personio’s data protection practices can be found at www.personio.de/datenschutzerklaerung/.
Data categories processed: Personal identification data (surname, first name, date of birth, place of birth, address, marital status); contact details (email address, telephone number, department, position); and other application documents (e.g. CV, references, certificates and proof of enrolment).
3.5 Other online enquiries
For other online enquiries, we process the data required for this purpose, such as name, date and place of birth, address, communication data, and identification data.
4. Cookies and online tracking
4.1 What are cookies?
Cookies are small files automatically created by your browser and stored on your device (laptop, tablet, smartphone) when you visit our website. They do not damage your device and do not contain malware. We distinguish between cookies that may be set without consent because they are necessary for the website to function, and those for which we obtain your consent in advance.
Manage cookie settings
Which cookies are specifically used is detected automatically by our consent management tool, Cookiebot, and shown to you transparently in our cookie settings. There you can grant, adjust or withdraw your consent at any time.
4.2 Necessary cookies
Necessary cookies are required for you to use our online offering, or serve IT security purposes. They are used without your consent. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.
4.3 Preference, marketing, and statistics cookies
With your consent, we also use cookies that make using our website more convenient (e.g. recognising you on a repeat visit), statistically evaluate website usage, or display content tailored to you. These cookies are usually deleted when you close your browser; the exact storage period depends on the specific purpose.
Legal basis: your consent under Art. 6(1)(a) GDPR as well as Section 25(1) TDDDG.
Please note: Fully disabling cookies in your browser may mean you can no longer use all functions of our website. On shared devices, we recommend always logging out completely after use.
4.4 Consent management with Cookiebot
To obtain and document your cookie consents in compliance with data protection law, we use the technology of Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (cookiebot.com, hereinafter “Cookiebot”). When you visit our website, a connection is established to Cookiebot’s servers and a cookie is set to record your consent or its withdrawal. This data is stored until you request its deletion, delete the Cookiebot cookie yourself, or the purpose for storage no longer applies.
Legal basis: our legitimate interest under Art. 6(1)(f) GDPR as well as Section 25(2) No. 2 TDDDG.
4.5 Web analytics with Matomo
With your consent, we use the web analytics tool Matomo to statistically evaluate the use of our website. The cookies used for this purpose collect information that is transmitted exclusively to our own servers and aggregated into pseudonymous usage profiles – it is not passed on to third parties. Your IP address is anonymised (IP masking), so that it cannot be linked to an individual person.
Legal basis: your consent under Art. 6(1)(a) GDPR as well as Section 25(1) TDDDG.
4.6 Google Ads, conversion tracking, remarketing and enhanced conversions
With your consent, we use Google Ads, an advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to promote our offerings and measure the effectiveness of our campaigns. We use the following features:
- Conversion tracking: we can determine whether users carry out a desired action on our website after clicking an ad, such as submitting a form or visiting a particular page.
- Remarketing: previous visitors to our website can be shown relevant ads again.
- Enhanced conversions: where technically possible, we additionally transmit data you provide during a conversion action (e.g. e-mail address, name, phone number) to Google in encrypted form (SHA-256 hashing). Google cannot reconstruct your original data from the hash value alone; however, if you are signed in to a Google account with the same e-mail address, Google can match the hash value to that account.
The relevant tags are implemented via the Matomo Tag Manager; Matomo remains our sole web analytics tool. Which cookies are specifically set is shown to you automatically via Cookiebot in our cookie settings.
Legal basis for all of the above features: your separate consent under Art. 6(1)(a) GDPR as well as Section 25(1) TDDDG.
In connection with the use of Google Ads, personal data may also be processed by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; we cannot rule out a transfer to the USA. Google states that it has implemented appropriate safeguards for any such transfer, including participation in the EU-US Data Privacy Framework and the conclusion of EU standard contractual clauses under Art. 46 GDPR. Further information can be found in Google’s privacy policy (policies.google.com/privacy).
You can withdraw your consent to Google Ads, conversion tracking, remarketing and enhanced conversions at any time, with effect for the future, via your cookie settings. View cookies and manage settings.
5. Newsletter and e-mail communication
You can subscribe to our newsletter on our website or register for e-mail automation lists, for example for communication relating to test accounts or orders. We use the double opt-in procedure for this: after you register, we send you an e-mail to the address provided, asking you to confirm your registration. This allows us to prove your registration and clarify any possible misuse of your data.
You may withdraw your consent and unsubscribe at any time by using the unsubscribe link included in every newsletter, by emailing kontakt@finapi.io, or by contacting us using the contact details provided in the legal notice (Imprint).
We use the service provider Brevo GmbH, Köpenicker Str. 126, 10179 Berlin (“Brevo”), to send these e-mails; Brevo processes our data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The data is stored on Brevo’s servers in German data centres and is subject to the data protection laws applicable there. Brevo uses the data solely to send and evaluate our messages on our behalf and to improve its own services, but does not contact recipients itself or pass the data on to third parties. Further information: brevo.com/legal/privacypolicy.
6. Advertising and market and opinion research
6.1 Advertising communications
If you have entered into a contract with us, or we treat you as a prospective customer, we process your address data and advertising selection criteria on the basis of Art. 6(1)(a) and (f) GDPR in order to send you information and offers from us and selected partner companies. Sending may be carried out via a mailing service provider. You can object to the use of your data for advertising purposes at any time (see Section 2).
6.2 Market and opinion research
We also use your data for market and opinion research – exclusively in anonymized form, for statistical purposes, and only within finAPI. We do not store survey responses together with your e-mail address or other personal data, and we do not pass them on to third parties or publish them. You can object to this use at any time, in whole or for specific measures, free of charge other than transmission costs at basic rates – informally, by message to our contact details, or via the unsubscribe link in every survey e-mail.
7. How long do we store your data?
We generally only store your data for as long as necessary for the respective processing purpose or to comply with statutory retention periods:
- Contract data: until the expiry of statutory or contractual warranty rights; afterwards for the periods required under commercial and tax law (generally ten years from conclusion of the contract), during which the data is only processed again in the event of a tax audit.
- Advertising data: generally 4 years after the end of the contract or the end of the marketing activity; objections to advertising are not deleted.
- Application data: up to 6 months after completion of the application process.
In particularly justified cases, we may also store data for longer periods, for example where a public authority requires this or where the data is needed for legal reasons, such as evidence in court proceedings.
8. Data transfers outside the EU
Where we use service providers outside the EU or the European Economic Area (EEA), we implement appropriate safeguards under Art. 44 et seq. GDPR – for example by concluding EU standard contractual clauses and implementing additional technical and organizational measures such as encryption or anonymization. Despite careful selection of our service providers, they may be subject, due to their place of business, to a different legal regime that does not offer a level of data protection comparable to the GDPR.
9. Who do we share your data with?
All information you provide to us via our website is stored on servers within the European Union and is forwarded only to the relevant internal departments to process your request. In addition, service providers we engage may receive data from us to fulfil the relevant purposes, for example in the categories of IT services, printing services, marketing, sales or telecommunications.
10. Data security
All data you transmit to us personally is encrypted using the secure SSL/TLS (Secure Socket Layer) standard – the same standard used, for example, in online banking. You can recognize a secure connection by the “https://” prefix in your browser’s address bar and the padlock symbol.
This data protection policy applies to our website. For further questions, please contact us at any time at dataprotection@finapi.io.