Privacy policy

Minna Invest GmbH takes the protection of your personal data very seriously. This policy explains what data we collect, why we use it, who we share it with, how long we keep it and how you can exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Data controller

The data controller is Minna Invest GmbH, whose registered office is at 370 Elbchaussee, 22609 Hamburg, Allemagne.

Data we collect

• Identity and contact details : title, last name, first name, date and place of birth, nationality, postal address, telephone number, e-mail address.
• Employment and financial situation : employment status, occupation, employer, length of service, income, outgoings, current loans, family and housing situation.
• Supporting documents : signed application form, proof of identity, proof of address, proof of income and, where applicable, bank statements.
• Application data : quotes, offers, contracts, electronic signatures and related evidence, payments, exchanges with our teams.
• Technical data : login and security logs, IP address, browser information.

Fields marked as required in our forms are necessary to assess your application. Without them, your application cannot be processed.

Purposes and legal bases

• Assessing your application and managing your file : from the simulation to the set-up of the financing, performance of pre-contractual measures taken at your request and then performance of the contract (Article 6(1)(b) GDPR).
• Creditworthiness assessment and prevention of fraud, money laundering and terrorist financing : compliance with our legal obligations, in particular the creditworthiness assessment required by section 505a of the German Civil Code (BGB) and the obligations under the German Anti-Money Laundering Act (GwG) (Article 6(1)(c) GDPR).
• Security of our services : prevention of fraudulent access and retention of evidence, based on our legitimate interest in protecting our services and our customers (Article 6(1)(f) GDPR).
• Sending marketing information : only with your consent, which you may withdraw at any time (Article 6(1)(a) GDPR).

Decisions on your application are made by our staff: we do not take any decision based solely on automated processing within the meaning of Article 22 GDPR.

Recipients

Your data is accessible only to authorised staff of Minna Invest GmbH, within the limits of their duties.

Where necessary to assess or set up your financing, it may be passed on to the lending institution, insurers, our technical service providers (hosting, e-mail sending, electronic signature) acting on our instructions, and to administrative and judicial authorities where required by law.

Your data is never sold or rented.

Should any data be transferred to a country outside the European Economic Area, this would only take place if the European Commission has recognised that country as providing an adequate level of protection or if appropriate safeguards, such as the European Commission's standard contractual clauses, have been put in place.

Retention periods

• Unfinished applications (drafts): 30 days at most.
• Security logs: for as long as necessary for the security of our services and as evidence of transactions.

Statutory retention periods, in particular under commercial and tax law (section 257 of the German Commercial Code, HGB, and section 147 of the German Fiscal Code, AO), remain unaffected. Once the applicable periods have expired, your data is irreversibly deleted or anonymised.

Security

We implement appropriate technical and organisational measures: encrypted communications, encryption of sensitive data, storage of documents outside public areas, access control, two-factor authentication for our teams and logging of access to files.

Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR).

Right to object (Article 21 GDPR) : where processing is based on our legitimate interest, you may object to it at any time on grounds relating to your particular situation. You may also object at any time, without giving reasons, to the use of your data for direct marketing.

You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular the authority of the German federal state (Land) where you live or the one responsible for our registered office.