Privacy Policy

This Policy uses the terms defined in the GDPR. In particular:

• Personal Data: any information relating to an identified or identifiable natural person.
• Data Subject: an individual whose personal data is processed.
• Processing: any operation performed on personal data (e.g., collection, storage, use, disclosure).
• Controller: the entity that determines the purposes and means of processing.
• Processor: an entity that processes personal data on behalf of the controller.
• Sub-processor: a processor engaged by Us to process personal data on Our behalf.
• Consent: a freely given, specific, informed, and unambiguous indication of your wishes.

The controller responsible for the processing described in this Policy is:

Fintalo GmbH, Bahnhofstraße 44, 82284 Grafrath, Germany. Phone: +49 89 37448797. Email: info@fintalo.com. Website: www.fintalo.com.

We have appointed an external Data Protection Officer. You can contact our Data Protection Officer directly with any questions about the processing of your personal data:

Kertos GmbH (external Data Protection Officer), Brienner Str. 41, 80333 München, Germany. Data Protection Officer: Dr. Kilian Schmidt. Email: dsb@kertos.io. Phone: +49 151 525 797 93.

Depending on how you use our website and the Platform, We process the following categories of personal data:

• Account and registration data: first and last name, business email address, password (stored only in hashed form), profile picture, and role assigned on the Platform.
• Contact data: information you provide when you contact us by email or through a contact form.
• Technical and log data: IP address, browser type, operating system, referring website, and date and time of access, collected when you visit our website or use the Platform, for security and operation.
• Platform usage and account-activity data: email-verification status; online/session status; the number and type of actions you take on the Platform (e.g., logins, document views, form submissions); and, in relation to a specific M&A project, metadata such as the number of documents uploaded, whether required agreements (e.g., an NDA) have been signed, and which security and team settings have been configured.

We receive most personal data directly from you (for example when you register or use the Platform). Some data — in particular your name and business email address — may be provided to us by the M&A Project Owner who invites you to a project, rather than collected directly from you.

We process personal data for the following purposes and on the following legal bases:

• Providing and administering the Platform, including registration and account management — Art. 6(1)(b) GDPR (performance of a contract).
• Customer support and customer success, including reviewing account status and usage/activity data to assist you and the organisation you represent — Art. 6(1)(b) and Art. 6(1)(f) GDPR.
• Security, integrity, and prevention of misuse of the Platform — Art. 6(1)(f) GDPR, and Art. 6(1)(c) GDPR where required to comply with a legal obligation.
• Responding to enquiries you send us — Art. 6(1)(b) or Art. 6(1)(f) GDPR.

We do not use identifiable usage or account-activity data to train artificial-intelligence or machine-learning models. Where We use such data to train or improve Our AI features, or to carry out analytics for general product improvement across customers (for example, based on page views or feature usage), We do so only on irreversibly anonymised and aggregated data that cannot be linked back to you.

Where We rely on Art. 6(1)(f) GDPR, our legitimate interests are providing and supporting our users, maintaining the security and integrity of the Platform, preventing misuse, and improving our services in a way that benefits our users and stakeholders. We balance these interests against your rights and freedoms and do not process personal data where your interests override ours.

Our website and the Platform use cookies. Some cookies are strictly necessary for core functionality, such as keeping you logged in, and do not require your consent. We also use analytics cookies to understand how the Platform is used in aggregate; these are only set with your consent, which you can give or withdraw at any time via the cookie banner shown on our website. You can control or delete cookies through your browser settings; disabling cookies may affect the functionality of the Platform.

We share personal data only where necessary. We use carefully selected service providers (processors and sub-processors), for example for hosting and analytics infrastructure, who process personal data on our documented instructions under a data processing agreement. We do not publish our list of sub-processors generally; a copy of the list and of our data processing agreement is available to customers on written request to info@fintalo.com.

For most personal data handled within a specific M&A project, We act as a processor on behalf of the relevant M&A Project Owner, who is the controller. That processing is governed by a data processing agreement concluded with the Project Owner (Art. 28 GDPR), and requests concerning such data should be directed to the relevant controller. In practice, this means that the M&A Project Owner who invited you to a project (or its designated administrator) can see which company you belong to and your platform activity within that project, such as your registration/sign-up status, logins, and actions you take (for example, document views).

Personal data relating to our users and customers, including all data processed in connection with a specific M&A project, is processed and stored on servers located within the European Union (EU) / European Economic Area (EEA).

Some of the processors and sub-processors We engage for the Platform may be headquartered outside the EU/EEA, including in the United States; in those cases, the processing of your data itself still takes place on EU/EEA infrastructure, and We ensure appropriate safeguards are in place, such as Standard Contractual Clauses under Art. 46 GDPR or, where applicable, the provider's certification under the EU-U.S. Data Privacy Framework.

For our website (as opposed to the Platform), We use analytics and similar tools that may process data outside the EU/EEA; such transfers are likewise based on appropriate safeguards, including Standard Contractual Clauses under Art. 46 GDPR or the provider's certification under the EU-U.S. Data Privacy Framework.

Should any processing exceptionally require a transfer to a third country beyond these arrangements, We would carry it out only subject to the safeguards required by Art. 44 et seq. GDPR and, for customer or project data, in accordance with the applicable Platform Agreement.

We have implemented appropriate technical and organisational measures to protect personal data. Please note that data transmitted over the internet can never be fully secured against access by third parties; you are welcome to communicate sensitive information to us by alternative means, such as by telephone.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, and delete or anonymise it once that purpose no longer applies. Usage and account-activity data is retained for the duration of your use of the Platform and deleted or anonymised thereafter, unless a longer retention period is required by applicable law (for example statutory accounting and tax retention obligations).

Providing certain personal data may be required by law or by contract, or may be necessary to enter into a contract with us. In particular, the account data needed to register for and use the Platform is required to provide the Services; if you do not provide it, We may be unable to grant you access to the Platform.

Subject to the conditions set out in the GDPR, you have the right to:

• request confirmation of, and access to, the personal data We hold about you (Art. 15);
• request rectification of inaccurate or incomplete data (Art. 16);
• request erasure of your data (Art. 17);
• request restriction of processing (Art. 18);
• receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability, Art. 20);
• object to processing based on legitimate interests or for direct marketing (Art. 21); and
• withdraw any consent you have given, with effect for the future (Art. 7(3)).

To exercise any of these rights, please contact us at info@fintalo.com or our Data Protection Officer at dsb@kertos.io. You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for Fintalo is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA).

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing, including profiling. The usage and account-activity data described above is reviewed by our support and customer-success staff to assist you; it is not used for automated decision-making without human involvement.

We may update this Privacy Policy to reflect changes to the Platform or to legal requirements. The current version is available on our website, and We will indicate the date of the latest update.