Privacy policy

1. Controller

The controller for data processing is GFR Finance GmbH, Staatsstraße 5, 67468 Neidenfels, Germany, kontakt@gfr-gruppen.com.

2. Purposes of processing

We process your data to handle loan and insurance applications, to operate your client account, to communicate with you, to produce contracts and for security and fraud prevention.

3. Legal bases

Processing is based on Art. 6(1)(b) GDPR (contract and pre-contractual steps), (c) GDPR (legal obligations), (f) GDPR (legitimate interest in secure operation) and (a) GDPR where you have given consent.

4. Categories of data

Master data (name, address, date of birth), contact details, information about your financial situation, contract and payment data, uploaded documents and technical data such as IP address, browser identification and pages viewed.

5. Client portal

We use one technically necessary session cookie to operate the client portal. Signing in is not possible without this cookie.

6. Live chat and visit analysis

When you use our chat or view our pages we record the pages viewed, the time, the language and the IP address so that enquiries can be assigned and answered. This data is deleted after a short period.

7. Recipients

Data is passed on only where this is necessary to perform the contract or where there is a legal obligation. Our hosting is provided by a service provider within the European Union.

8. Retention period

We store data for the duration of the business relationship and beyond that for as long as statutory retention periods apply. It is then deleted or anonymised.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority.

10. Data security

Transmission is encrypted. Passwords are stored only as a hash. Access to client data is limited to authorised staff and is logged.

Cookies: Cookie information